From 4faf1fa159cc4fa0f506abe8f8e5b7be5b06c1ae Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Sun, 25 Oct 2026 19:25:13 +0000 Subject: [PATCH 1/5] Wait for npm and rebase the MCP coverage branch on main --- .github/workflows/update-mcp-coverage.yml | 39 +++++++++++++++-------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/.github/workflows/update-mcp-coverage.yml b/.github/workflows/update-mcp-coverage.yml index 3bdea613..bab066cc 100644 --- a/.github/workflows/update-mcp-coverage.yml +++ b/.github/workflows/update-mcp-coverage.yml @@ -38,6 +38,17 @@ jobs: echo "Skipping non-stable SDK version: $version" exit 0 fi + # A just-published version can take a few minutes to become installable. + for attempt in $(seq 1 30); do + if [[ "$(npm view "@onkernel/sdk@$version" version 2>/dev/null)" == "$version" ]]; then + break + fi + if [[ "$attempt" == 30 ]]; then + echo "::error::@onkernel/sdk@$version is not available on npm after 15 minutes." + exit 1 + fi + sleep 30 + done echo "version=$version" >> "$GITHUB_OUTPUT" echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" @@ -104,14 +115,21 @@ jobs: if git show-ref --verify --quiet "refs/remotes/origin/$UPDATE_BRANCH"; then echo "update_sha=$(git rev-parse "origin/$UPDATE_BRANCH")" >> "$GITHUB_OUTPUT" git switch --track "origin/$UPDATE_BRANCH" - if ! git merge origin/main --no-edit; then - echo "::error::$UPDATE_BRANCH conflicts with main. Resolve the conflicts on that branch, or delete it to start fresh, then rerun this workflow." - exit 1 + if ! git rebase origin/main; then + git rebase --abort + # The agent covers everything since main's SDK version, so a bot-only + # branch can be regenerated from main. Human commits must be kept. + if git log --no-merges --format=%ae "origin/main..origin/$UPDATE_BRANCH" \ + | grep -qvxF '260533166+kernel-internal[bot]@users.noreply.github.com'; then + echo "::error::$UPDATE_BRANCH has human commits that conflict with main. Resolve the conflicts on that branch, then rerun this workflow." + exit 1 + fi + echo "::warning::$UPDATE_BRANCH conflicts with main; regenerating it from main." + git switch -C "$UPDATE_BRANCH" origin/main fi else git switch -c "$UPDATE_BRANCH" origin/main fi - echo "agent_base=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" old_version=$(jq -er '.dependencies["@onkernel/sdk"]' package.json) if [[ "$old_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] && @@ -203,9 +221,9 @@ jobs: id: snapshot working-directory: mcp env: - AGENT_BASE: ${{ steps.prepare.outputs.agent_base }} + MAIN_SHA: ${{ steps.prepare.outputs.main_sha }} run: | - git reset -q --soft "$AGENT_BASE" + git reset -q --soft "$MAIN_SHA" git add -A git diff --cached --name-only --no-renames -z \ | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/excluded-paths" @@ -284,12 +302,7 @@ jobs: run: | git config user.name 'kernel-internal[bot]' git config user.email '260533166+kernel-internal[bot]@users.noreply.github.com' - if [[ -n "$UPDATE_SHA" ]]; then - git switch -c "$UPDATE_BRANCH" "$UPDATE_SHA" - git merge --no-edit "$MAIN_SHA" - else - git switch -c "$UPDATE_BRANCH" "$MAIN_SHA" - fi + git switch -c "$UPDATE_BRANCH" "$MAIN_SHA" git apply --index "$RUNNER_TEMP/mcp-coverage-update/changes.patch" git diff --cached --name-only --no-renames -z \ | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/disallowed-paths" @@ -325,7 +338,7 @@ jobs: exit 0 fi gh auth setup-git - git push origin "$UPDATE_BRANCH" + git push --force-with-lease="$UPDATE_BRANCH:$UPDATE_SHA" origin "$UPDATE_BRANCH" body="$RUNNER_TEMP/mcp-coverage-pr.md" { From cc762e6fcbc348ae23728e8be4ae6d563677834d Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Sun, 25 Oct 2026 19:27:13 +0000 Subject: [PATCH 2/5] Pin rebase, regenerate and lease behavior in the updater security test --- .github/tests/update-coverage-security.test.mjs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/tests/update-coverage-security.test.mjs b/.github/tests/update-coverage-security.test.mjs index 3d827776..11d7bac1 100644 --- a/.github/tests/update-coverage-security.test.mjs +++ b/.github/tests/update-coverage-security.test.mjs @@ -61,9 +61,12 @@ test('changes are restricted to the allowlist before validation', () => { assert.ok(jobs.generate.indexOf(snapshot) < jobs.generate.indexOf(verify)); assert.match(snapshot, /mcp-update-disallowed-paths\.sh/); assert.match(snapshot, /git reset -q --hard\n\s+git clean -fdq/); - assert.match(snapshot, /AGENT_BASE: \$\{\{ steps\.prepare\.outputs\.agent_base \}\}/); - assert.match(snapshot, /git reset -q --soft "\$AGENT_BASE"\n\s+git add -A/); - assert.match(step('generate', 'Prepare update branch and SDK diff'), /agent_base=\$\(git rev-parse HEAD\)/); + assert.match(snapshot, /MAIN_SHA: \$\{\{ steps\.prepare\.outputs\.main_sha \}\}/); + assert.match(snapshot, /git reset -q --soft "\$MAIN_SHA"\n\s+git add -A/); + const prepare = step('generate', 'Prepare update branch and SDK diff'); + assert.match(prepare, /main_sha=\$\(git rev-parse origin\/main\)/); + // Only a branch without human commits may be regenerated from main. + assert.match(prepare, /git rebase --abort\n[\s\S]*grep -qvxF '260533166\+kernel-internal\[bot\]@users\.noreply\.github\.com'[\s\S]*exit 1\n[\s\S]*git switch -C /); const scriptCalls = workflow.match(/^.*disallowed-paths\.sh.*$/gm); assert.equal(scriptCalls.length, 2); for (const line of scriptCalls) assert.match(line, /\| bash /); @@ -106,7 +109,7 @@ test('publishing runs in a separate job that never executes repository code', () assert.doesNotMatch(jobs.publish.slice(0, mint).join(''), /GH_TOKEN:/); const publish = step('publish', 'Open or update MCP coverage PR'); assert.match(publish, /GH_TOKEN: \$\{\{ steps\.app-token\.outputs\.token \}\}/); - assert.match(publish, /gh auth setup-git\n\s+git push/); + assert.match(publish, /gh auth setup-git\n\s+git push --force-with-lease="\$UPDATE_BRANCH:\$UPDATE_SHA"/); for (const entry of jobs.publish) { assert.doesNotMatch(entry, /continue-on-error: true|always\(\)/); } From 70a42c05ce0bae96ba6bd4cabe2c4a0ecd07ecb1 Mon Sep 17 00:00:00 2001 From: rgarcia <72655+rgarcia@users.noreply.github.com> Date: Sun, 25 Oct 2026 19:36:14 +0000 Subject: [PATCH 3/5] Format the updater security test --- .github/tests/update-coverage-security.test.mjs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/tests/update-coverage-security.test.mjs b/.github/tests/update-coverage-security.test.mjs index 11d7bac1..5c43c6fa 100644 --- a/.github/tests/update-coverage-security.test.mjs +++ b/.github/tests/update-coverage-security.test.mjs @@ -66,7 +66,10 @@ test('changes are restricted to the allowlist before validation', () => { const prepare = step('generate', 'Prepare update branch and SDK diff'); assert.match(prepare, /main_sha=\$\(git rev-parse origin\/main\)/); // Only a branch without human commits may be regenerated from main. - assert.match(prepare, /git rebase --abort\n[\s\S]*grep -qvxF '260533166\+kernel-internal\[bot\]@users\.noreply\.github\.com'[\s\S]*exit 1\n[\s\S]*git switch -C /); + assert.match( + prepare, + /git rebase --abort\n[\s\S]*grep -qvxF '260533166\+kernel-internal\[bot\]@users\.noreply\.github\.com'[\s\S]*exit 1\n[\s\S]*git switch -C /, + ); const scriptCalls = workflow.match(/^.*disallowed-paths\.sh.*$/gm); assert.equal(scriptCalls.length, 2); for (const line of scriptCalls) assert.match(line, /\| bash /); From 14233922402fca4668216fc64bf222ab9947ad60 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 14:56:33 +0000 Subject: [PATCH 4/5] feat: Arm vault passkeys in browsers and sign WebAuthn requests in metro-api Stainless-Generated-From: fd60ea2fdb3b68786994e1d53a4e0672eb9fb53d --- api.md | 4 + src/resources/vaults/index.ts | 4 + src/resources/vaults/items.ts | 209 +++++++++++++++++++++++++++++++-- src/resources/vaults/vaults.ts | 8 ++ 4 files changed, 217 insertions(+), 8 deletions(-) diff --git a/api.md b/api.md index 3ed75618..eb8d1a1e 100644 --- a/api.md +++ b/api.md @@ -515,6 +515,7 @@ Types: - AgentcardCheckoutAuthorization - AgentcardCheckoutPreparation - AgentcardPreparedProcessor +- ArmPasskeyVaultItemOperationRequest - AuthorizeVaultItemOperationRequest - CardVaultItemSpec - CardVaultItemState @@ -536,6 +537,7 @@ Types: - CredentialVaultItemSpecUpdate - CredentialVaultItemState - CredentialVaultItemUpdateRequest +- DisarmPasskeyVaultItemOperationRequest - FillVaultItemOperationRequest - FillVaultItemOperationResult - KernelCardState @@ -561,7 +563,9 @@ Types: - OnePasswordOAuthAction - OnePasswordRecoverVaultItemOperationRequest - OnePasswordRequestAccessVaultItemOperationRequest +- PasskeyVaultItemOperationResult - PrepareCheckoutVaultItemOperationRequest +- RegisterPasskeyVaultItemOperationRequest - RestartVerificationVaultItemOperationRequest - VaultCardAliases - VaultCardFillField diff --git a/src/resources/vaults/index.ts b/src/resources/vaults/index.ts index 3b3ab789..df2d91f0 100644 --- a/src/resources/vaults/index.ts +++ b/src/resources/vaults/index.ts @@ -5,6 +5,7 @@ export { type AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation, type AgentcardPreparedProcessor, + type ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest, type CardVaultItemSpec, type CardVaultItemState, @@ -26,6 +27,7 @@ export { type CredentialVaultItemSpecUpdate, type CredentialVaultItemState, type CredentialVaultItemUpdateRequest, + type DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest, type FillVaultItemOperationResult, type KernelCardState, @@ -51,7 +53,9 @@ export { type OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest, + type PasskeyVaultItemOperationResult, type PrepareCheckoutVaultItemOperationRequest, + type RegisterPasskeyVaultItemOperationRequest, type RestartVerificationVaultItemOperationRequest, type VaultCardAliases, type VaultCardFillField, diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index 8cf6107e..3b84df6e 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -316,6 +316,39 @@ export type AgentcardPreparedProcessor = | 'mercado_pago' | 'adyen'; +/** + * Let a browser attached to the item's vault sign in with a stored passkey. Only + * invoke when the item advertises `arm_passkey`. Returns immediately; there is no + * time limit. While armed, when a page in that browser whose origin matches the + * passkey's relying party asks for a passkey (`navigator.credentials.get`, + * including autofill requests made at page load), Kernel answers with this + * passkey. The private key never enters the browser: Kernel signs on its servers, + * using the origin Chrome reports for the requesting frame. Arming a passkey for a + * relying party replaces any passkey armed earlier in the browser for the same + * relying party. The arm lasts until `disarm_passkey`, the browser ends, the vault + * is detached, or the item or field is deleted. Drive the sign-in with your own + * browser tools and inspect the page to confirm it. A page opened in a new tab or + * window can run its first scripts before Kernel's handler attaches; if such a + * page asks for a passkey as soon as it loads, reload it. While armed, any script + * running on the relying party's pages can obtain a sign-in without user + * interaction, as with a password manager that fills automatically; disarm when + * the task is done. Passkeys report a signature counter of 0 and backup flags, as + * synced passkeys do. + */ +export interface ArmPasskeyVaultItemOperationRequest { + /** + * Browser session ID, not a reusable browser name. + */ + browser_id: string; + + type: 'arm_passkey'; + + /** + * Passkey field to arm. Required when more than one passkey field holds a passkey. + */ + field?: string; +} + /** * Authorize a Link or Kernel card using its existing purchase specification. Use * only after explicit user approval and when the item advertises authorize; follow @@ -764,6 +797,9 @@ export namespace CredentialAccountVaultItem { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -853,7 +889,7 @@ export interface CredentialVaultFieldDefinition { * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256 * private key), a lowercase `rpId` domain, and optional `username` and * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into - * pages. + * pages; use arm_passkey to sign in with one and register_passkey to create one. */ type: CredentialVaultFieldType; @@ -889,7 +925,7 @@ export interface CredentialVaultFieldDefinitionInput { * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256 * private key), a lowercase `rpId` domain, and optional `username` and * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into - * pages. + * pages; use arm_passkey to sign in with one and register_passkey to create one. */ type: CredentialVaultFieldType; @@ -932,7 +968,7 @@ export interface CredentialVaultFieldInput { * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256 * private key), a lowercase `rpId` domain, and optional `username` and * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into - * pages. + * pages; use arm_passkey to sign in with one and register_passkey to create one. */ type: CredentialVaultFieldType; @@ -1005,7 +1041,7 @@ export interface CredentialVaultFieldState { * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256 * private key), a lowercase `rpId` domain, and optional `username` and * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into - * pages. + * pages; use arm_passkey to sign in with one and register_passkey to create one. */ export type CredentialVaultFieldType = 'text' | 'email' | 'password' | 'totp' | 'passkey'; @@ -1139,6 +1175,9 @@ export namespace CredentialVaultItem { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -1277,6 +1316,26 @@ export interface CredentialVaultItemUpdateRequest { expected_item_id?: string; } +/** + * Stop a browser from using this item's passkeys: removes its armed passkeys and + * its pending registration into this item. Pages that already loaded keep Kernel's + * WebAuthn handler but get the browser's own behavior. + */ +export interface DisarmPasskeyVaultItemOperationRequest { + /** + * Browser session ID, not a reusable browser name. + */ + browser_id: string; + + type: 'disarm_passkey'; + + /** + * Limit disarming to one passkey field. Omit to disarm every passkey field of the + * item. + */ + field?: string; +} + /** * Use a vault item in a browser session, for example to fill a login or payment * form. Only invoke when the item advertises `fill`; the advertised operation @@ -1770,7 +1829,7 @@ export interface ManagedAuthCredentialVaultField { * `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256 * private key), a lowercase `rpId` domain, and optional `username` and * `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into - * pages. + * pages; use arm_passkey to sign in with one and register_passkey to create one. */ type: CredentialVaultFieldType; } @@ -2235,6 +2294,22 @@ export interface OnePasswordRequestAccessVaultItemOperationRequest { reason?: string; } +export interface PasskeyVaultItemOperationResult { + /** + * armed means the browser will answer matching passkey requests; it does not mean + * a page has asked yet. disarmed means the browser no longer uses this item's + * passkeys. + */ + status: 'armed' | 'disarmed'; + + type: 'arm_passkey' | 'register_passkey' | 'disarm_passkey'; + + /** + * Relying party the armed passkey answers for. Returned by arm_passkey. + */ + rp_id?: string; +} + /** * Prepare an unused AgentCard card for a supported checkout. Deliver the returned * approval URL and keep the approval page open. Poll the item until @@ -2256,6 +2331,35 @@ export interface PrepareCheckoutVaultItemOperationRequest { type: 'prepare_checkout'; } +/** + * Let a browser attached to the item's vault create a passkey on a website and + * store it in an empty passkey field. Only invoke when the item advertises + * `register_passkey`; declare the field first, for example by adding an optional + * passkey field with a credential update. Returns immediately; there is no time + * limit. The next passkey a page in that browser creates + * (`navigator.credentials.create`) is generated by Kernel, stored in the field, + * and only then returned to the page, so the website never receives a passkey + * Kernel failed to store. Each browser has one pending registration; a later + * `register_passkey` replaces it. Drive the website's "add a passkey" flow with + * your own browser tools, then confirm by reading the item (the field reports + * `has_value`) or its `credential_passkey_registered` event, and by signing in + * with `arm_passkey`. Only ES256 passkeys are created. + */ +export interface RegisterPasskeyVaultItemOperationRequest { + /** + * Browser session ID, not a reusable browser name. + */ + browser_id: string; + + type: 'register_passkey'; + + /** + * Empty passkey field to store the new passkey in. Required when more than one + * passkey field is empty. + */ + field?: string; +} + /** * Explicitly prepare a fresh local verification session for the same Kernel Visa * purchase and connected wallet, only when restart_verification is advertised. @@ -2501,6 +2605,9 @@ export namespace VaultItem { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -2595,6 +2702,9 @@ export namespace VaultItem { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -2674,9 +2784,9 @@ export interface VaultItemEvent { } /** - * Authorization and preparation return the existing item shape. Fill returns a - * value-free result; WebMCP invocation returns the tool's output. Neither persists - * transient outcomes on the item. + * Authorization and preparation return the existing item shape. Fill and passkey + * operations return value-free results; WebMCP invocation returns the tool's + * output. None persist transient outcomes on the item. */ export type VaultItemOperationResponse = | VaultItemOperationResponse.WalletVaultItem @@ -2684,6 +2794,7 @@ export type VaultItemOperationResponse = | CredentialAccountVaultItem | CredentialVaultItem | FillVaultItemOperationResult + | PasskeyVaultItemOperationResult | OnePasswordFillVaultItemOperationResult | WebmcpInvokeVaultItemOperationResult; @@ -2766,6 +2877,9 @@ export namespace VaultItemOperationResponse { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -2860,6 +2974,9 @@ export namespace VaultItemOperationResponse { | 'collect' | 'prepare_checkout' | 'fill' + | 'arm_passkey' + | 'register_passkey' + | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' @@ -3268,6 +3385,9 @@ export type ItemPerformOperationParams = | ItemPerformOperationParams.CollectVaultItemOperationRequest | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest | ItemPerformOperationParams.FillVaultItemOperationRequest + | ItemPerformOperationParams.ArmPasskeyVaultItemOperationRequest + | ItemPerformOperationParams.RegisterPasskeyVaultItemOperationRequest + | ItemPerformOperationParams.DisarmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest @@ -3435,6 +3555,75 @@ export declare namespace ItemPerformOperationParams { timeout_ms?: number; } + export interface ArmPasskeyVaultItemOperationRequest { + /** + * Path param + */ + id_or_name: string; + + /** + * Body param: Browser session ID, not a reusable browser name. + */ + browser_id: string; + + /** + * Body param + */ + type: 'arm_passkey'; + + /** + * Body param: Passkey field to arm. Required when more than one passkey field + * holds a passkey. + */ + field?: string; + } + + export interface RegisterPasskeyVaultItemOperationRequest { + /** + * Path param + */ + id_or_name: string; + + /** + * Body param: Browser session ID, not a reusable browser name. + */ + browser_id: string; + + /** + * Body param + */ + type: 'register_passkey'; + + /** + * Body param: Empty passkey field to store the new passkey in. Required when more + * than one passkey field is empty. + */ + field?: string; + } + + export interface DisarmPasskeyVaultItemOperationRequest { + /** + * Path param + */ + id_or_name: string; + + /** + * Body param: Browser session ID, not a reusable browser name. + */ + browser_id: string; + + /** + * Body param + */ + type: 'disarm_passkey'; + + /** + * Body param: Limit disarming to one passkey field. Omit to disarm every passkey + * field of the item. + */ + field?: string; + } + export interface OnePasswordRequestAccessVaultItemOperationRequest { /** * Path param @@ -3852,6 +4041,7 @@ export declare namespace Items { type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, + type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, @@ -3873,6 +4063,7 @@ export declare namespace Items { type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, + type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, @@ -3898,7 +4089,9 @@ export declare namespace Items { type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, + type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, + type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, diff --git a/src/resources/vaults/vaults.ts b/src/resources/vaults/vaults.ts index f51a3e63..189c6487 100644 --- a/src/resources/vaults/vaults.ts +++ b/src/resources/vaults/vaults.ts @@ -6,6 +6,7 @@ import { AgentcardCheckoutAuthorization, AgentcardCheckoutPreparation, AgentcardPreparedProcessor, + ArmPasskeyVaultItemOperationRequest, AuthorizeVaultItemOperationRequest, CardVaultItemSpec, CardVaultItemState, @@ -27,6 +28,7 @@ import { CredentialVaultItemSpecUpdate, CredentialVaultItemState, CredentialVaultItemUpdateRequest, + DisarmPasskeyVaultItemOperationRequest, FillVaultItemOperationRequest, FillVaultItemOperationResult, ItemDeleteParams, @@ -61,7 +63,9 @@ import { OnePasswordOAuthAction, OnePasswordRecoverVaultItemOperationRequest, OnePasswordRequestAccessVaultItemOperationRequest, + PasskeyVaultItemOperationResult, PrepareCheckoutVaultItemOperationRequest, + RegisterPasskeyVaultItemOperationRequest, RestartVerificationVaultItemOperationRequest, VaultCardAliases, VaultCardFillField, @@ -271,6 +275,7 @@ export declare namespace Vaults { type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, + type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, @@ -292,6 +297,7 @@ export declare namespace Vaults { type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, + type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, @@ -317,7 +323,9 @@ export declare namespace Vaults { type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, + type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, + type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, From 215b21e1d67b748336ea7b1b82b7f63d23fc4e74 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 15:26:52 +0000 Subject: [PATCH 5/5] release: 0.131.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 7 +++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 90ea33ab..e074c76b 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.130.0" + ".": "0.131.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 74e9fd9b..134bbdfb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [0.131.0](https://github.com/kernel/kernel-node-sdk/compare/v0.130.0...v0.131.0) (2026-10-26) + + +### Features + +* Arm vault passkeys in browsers and sign WebAuthn requests in metro-api ([1423392](https://github.com/kernel/kernel-node-sdk/commit/14233922402fca4668216fc64bf222ab9947ad60)) + ## [0.130.0](https://github.com/kernel/kernel-node-sdk/compare/v0.129.0...v0.130.0) (2026-10-24) diff --git a/package.json b/package.json index 18ae683a..fcc01f69 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.130.0", + "version": "0.131.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index bfde34bc..63a530b5 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.130.0'; // x-release-please-version +export const VERSION = '0.131.0'; // x-release-please-version