Merge pull request #201 from kernel/release-please--branches--main--changes--next

release: 0.131.0

Author: rgarcia

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.130.0"
+  ".": "0.131.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.131.0](https://github.com/kernel/kernel-python-sdk/compare/v0.130.0...v0.131.0) (2026-10-26)
+
+
+### Features
+
+* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([b740930](https://github.com/kernel/kernel-python-sdk/commit/b7409304f4ed37a03004683db63b079052f387bb))
+
 ## [0.130.0](https://github.com/kernel/kernel-python-sdk/compare/v0.129.0...v0.130.0) (2026-10-24)
 
 

api.md

@@ -572,6 +572,7 @@ from kernel.types.vaults import (
     AgentcardCheckoutAuthorization,
     AgentcardCheckoutPreparation,
     AgentcardPreparedProcessor,
+    ArmPasskeyVaultItemOperationRequest,
     AuthorizeVaultItemOperationRequest,
     CardVaultItemSpec,
     CardVaultItemState,
@@ -593,6 +594,7 @@ from kernel.types.vaults import (
     CredentialVaultItemSpecUpdate,
     CredentialVaultItemState,
     CredentialVaultItemUpdateRequest,
+    DisarmPasskeyVaultItemOperationRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
     KernelCardState,
@@ -618,7 +620,9 @@ from kernel.types.vaults import (
     OnePasswordOAuthAction,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
+    PasskeyVaultItemOperationResult,
     PrepareCheckoutVaultItemOperationRequest,
+    RegisterPasskeyVaultItemOperationRequest,
     RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.130.0"
+version = "0.131.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.130.0"  # x-release-please-version
+__version__ = "0.131.0"  # x-release-please-version

src/kernel/resources/vaults/items.py

@@ -51,6 +51,7 @@
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
 from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
+from .passkey_vault_item_operation_result import PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -103,9 +104,15 @@
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .arm_passkey_vault_item_operation_request_param import (
+    ArmPasskeyVaultItemOperationRequestParam as ArmPasskeyVaultItemOperationRequestParam,
+)
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .disarm_passkey_vault_item_operation_request_param import (
+    DisarmPasskeyVaultItemOperationRequestParam as DisarmPasskeyVaultItemOperationRequestParam,
+)
 from .managed_auth_credential_vault_item_spec_input_param import (
     ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
 )
@@ -115,6 +122,9 @@
 from .prepare_checkout_vault_item_operation_request_param import (
     PrepareCheckoutVaultItemOperationRequestParam as PrepareCheckoutVaultItemOperationRequestParam,
 )
+from .register_passkey_vault_item_operation_request_param import (
+    RegisterPasskeyVaultItemOperationRequestParam as RegisterPasskeyVaultItemOperationRequestParam,
+)
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )

src/kernel/types/vaults/__init__.py

@@ -0,0 +1,41 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["ArmPasskeyVaultItemOperationRequestParam"]
+
+
+class ArmPasskeyVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Let a browser attached to the item's vault sign in with a stored passkey.
+    Only invoke when the item advertises `arm_passkey`. Returns immediately;
+    there is no time limit. While armed, when a page in that browser whose
+    origin matches the passkey's relying party asks for a passkey
+    (`navigator.credentials.get`, including autofill requests made at page
+    load), Kernel answers with this passkey. The private key never enters the
+    browser: Kernel signs on its servers, using the origin Chrome reports for
+    the requesting frame. Arming a passkey for a relying party replaces any
+    passkey armed earlier in the browser for the same relying party. The arm
+    lasts until `disarm_passkey`, the browser ends, the vault is detached, or
+    the item or field is deleted. Drive the sign-in with your own browser
+    tools and inspect the page to confirm it. A page opened in a new tab
+    or window can run its first scripts before Kernel's handler attaches;
+    if such a page asks for a passkey as soon as it loads, reload it. While
+    armed, any script running on the relying party's pages can obtain a
+    sign-in without user interaction, as with a password manager that
+    fills automatically; disarm when the task is done. Passkeys report a
+    signature counter of 0 and backup flags, as synced passkeys do.
+    """
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    type: Required[Literal["arm_passkey"]]
+
+    field: str
+    """Passkey field to arm.
+
+    Required when more than one passkey field holds a passkey.
+    """

src/kernel/types/vaults/arm_passkey_vault_item_operation_request_param.py

@@ -37,6 +37,9 @@ class AvailableOperation(BaseModel):
         "collect",
         "prepare_checkout",
         "fill",
+        "arm_passkey",
+        "register_passkey",
+        "disarm_passkey",
         "1pw_create_access_request",
         "1pw_access_request_status",
         "1pw_fill",

src/kernel/types/vaults/credential_account_vault_item.py

@@ -37,7 +37,7 @@ class CredentialVaultFieldDefinition(BaseModel):
     `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
     private key), a lowercase `rpId` domain, and optional `username` and
     `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
-    pages.
+    pages; use arm_passkey to sign in with one and register_passkey to create one.
     """
 
     label: Optional[str] = None