From 668cdfcd969a6fde9484524e29f07dbd88c138a7 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 16:07:11 +0000
Subject: [PATCH 1/4] codegen metadata

---
 .stats.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index f8ffb2dd..639bc208 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-f0486d0b8e34ddf8ba34e36ff97856cf973e0797e021ff621e04e4840970966e.yml
-openapi_spec_hash: 12a71ce5ac80fc65f6a8779f0ca29223
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-8af2d28c8540273b1b413f49b8f9bcaa5df25fa2332d187d2693ec01502a2ac2.yml
+openapi_spec_hash: ee71b9231754b4682377a514d1a2c249
 config_hash: 06186eb40e0058a2a87ac251fc07415d

From c6d6b651a377d4283af20ab631f2adf25354954f Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 16:52:24 +0000
Subject: [PATCH 2/4] feat: Layer telemetry request config onto the default set

---
 .stats.yml                                    |  4 ++--
 src/kernel/types/browser_create_params.py     | 24 +++++++++++++------
 src/kernel/types/browser_update_params.py     | 24 +++++++++++++------
 .../browser_telemetry_categories_config.py    |  4 ++--
 ...owser_telemetry_categories_config_param.py |  4 ++--
 .../browser_telemetry_category_config.py      |  4 +++-
 ...browser_telemetry_category_config_param.py |  4 +++-
 7 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index 639bc208..adc4cc21 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-8af2d28c8540273b1b413f49b8f9bcaa5df25fa2332d187d2693ec01502a2ac2.yml
-openapi_spec_hash: ee71b9231754b4682377a514d1a2c249
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-61dab8d0d01c2838febaf4319114ae35aa169a813a102e93af6598ca0d445da2.yml
+openapi_spec_hash: c9fbe809670384dc5141dccb60e45672
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/types/browser_create_params.py b/src/kernel/types/browser_create_params.py
index f76cc23f..01ac2598 100644
--- a/src/kernel/types/browser_create_params.py
+++ b/src/kernel/types/browser_create_params.py
@@ -134,16 +134,26 @@ class Telemetry(TypedDict, total=False):
     browser: BrowserTelemetryCategoriesConfigParam
     """Per-category capture flags.
 
-    Selection is opt-in: only the categories set to enabled=true are captured;
-    anything omitted is off. If enabled is true and browser is omitted or empty, the
-    default category set is used. A browser config that enables nothing stops
-    capture on update and starts no capture on create.
+    The operational categories (control, connection, system, captcha) are captured
+    whenever telemetry is enabled; set one to enabled=false to opt out. The CDP
+    categories (console, network, page, interaction) and screenshot are off by
+    default; set enabled=true to opt in. On create, provided categories layer onto
+    the default set. On update, provided categories merge onto the session's current
+    config; when no telemetry is active this falls back to the default set (matching
+    create). If browser is omitted or empty, the default set is used. A browser
+    config that disables every category stops capture on update and starts no
+    capture on create.
     """
 
     enabled: bool
     """Request shortcut for browser telemetry capture.
 
-    True enables capture using the default category set unless browser category
-    settings are provided. False stops capture on update and starts no capture on
-    create. enabled=false cannot be combined with browser category settings.
+    True enables capture; with no browser category settings it captures the default
+    set (control, connection, system, captcha), and any browser category settings
+    are layered onto that default set. On update, enabled=true resolves the config
+    fresh from the default set plus any provided categories, replacing the session's
+    current selection rather than merging onto it; omit enabled to merge categories
+    onto the current selection instead. False stops capture on update and starts no
+    capture on create. enabled=false cannot be combined with browser category
+    settings.
     """
diff --git a/src/kernel/types/browser_update_params.py b/src/kernel/types/browser_update_params.py
index 7488be4f..3c3140ee 100644
--- a/src/kernel/types/browser_update_params.py
+++ b/src/kernel/types/browser_update_params.py
@@ -70,18 +70,28 @@ class Telemetry(TypedDict, total=False):
     browser: BrowserTelemetryCategoriesConfigParam
     """Per-category capture flags.
 
-    Selection is opt-in: only the categories set to enabled=true are captured;
-    anything omitted is off. If enabled is true and browser is omitted or empty, the
-    default category set is used. A browser config that enables nothing stops
-    capture on update and starts no capture on create.
+    The operational categories (control, connection, system, captcha) are captured
+    whenever telemetry is enabled; set one to enabled=false to opt out. The CDP
+    categories (console, network, page, interaction) and screenshot are off by
+    default; set enabled=true to opt in. On create, provided categories layer onto
+    the default set. On update, provided categories merge onto the session's current
+    config; when no telemetry is active this falls back to the default set (matching
+    create). If browser is omitted or empty, the default set is used. A browser
+    config that disables every category stops capture on update and starts no
+    capture on create.
     """
 
     enabled: bool
     """Request shortcut for browser telemetry capture.
 
-    True enables capture using the default category set unless browser category
-    settings are provided. False stops capture on update and starts no capture on
-    create. enabled=false cannot be combined with browser category settings.
+    True enables capture; with no browser category settings it captures the default
+    set (control, connection, system, captcha), and any browser category settings
+    are layered onto that default set. On update, enabled=true resolves the config
+    fresh from the default set plus any provided categories, replacing the session's
+    current selection rather than merging onto it; omit enabled to merge categories
+    onto the current selection instead. False stops capture on update and starts no
+    capture on create. enabled=false cannot be combined with browser category
+    settings.
     """
 
 
diff --git a/src/kernel/types/browsers/browser_telemetry_categories_config.py b/src/kernel/types/browsers/browser_telemetry_categories_config.py
index 0013fee3..b89ff17b 100644
--- a/src/kernel/types/browsers/browser_telemetry_categories_config.py
+++ b/src/kernel/types/browsers/browser_telemetry_categories_config.py
@@ -9,9 +9,9 @@
 
 
 class BrowserTelemetryCategoriesConfig(BaseModel):
-    """Per-category telemetry capture settings.
+    """Per-category telemetry capture settings layered onto the default set.
 
-    Selection is opt-in: set a category to enabled=true to capture it; anything omitted is off. The default set (used by enabled=true with no per-category settings) is the lightweight operational signals: control, connection, system, captcha. The CDP categories (console, network, page, interaction) and screenshot are off by default and must be opted into.
+    The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction) and screenshot are off by default and are opt-in: set enabled=true to capture them.
     """
 
     captcha: Optional[BrowserTelemetryCategoryConfig] = None
diff --git a/src/kernel/types/browsers/browser_telemetry_categories_config_param.py b/src/kernel/types/browsers/browser_telemetry_categories_config_param.py
index a1520d7c..add32385 100644
--- a/src/kernel/types/browsers/browser_telemetry_categories_config_param.py
+++ b/src/kernel/types/browsers/browser_telemetry_categories_config_param.py
@@ -10,9 +10,9 @@
 
 
 class BrowserTelemetryCategoriesConfigParam(TypedDict, total=False):
-    """Per-category telemetry capture settings.
+    """Per-category telemetry capture settings layered onto the default set.
 
-    Selection is opt-in: set a category to enabled=true to capture it; anything omitted is off. The default set (used by enabled=true with no per-category settings) is the lightweight operational signals: control, connection, system, captcha. The CDP categories (console, network, page, interaction) and screenshot are off by default and must be opted into.
+    The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction) and screenshot are off by default and are opt-in: set enabled=true to capture them.
     """
 
     captcha: BrowserTelemetryCategoryConfigParam
diff --git a/src/kernel/types/browsers/browser_telemetry_category_config.py b/src/kernel/types/browsers/browser_telemetry_category_config.py
index f75616c9..f63c02f4 100644
--- a/src/kernel/types/browsers/browser_telemetry_category_config.py
+++ b/src/kernel/types/browsers/browser_telemetry_category_config.py
@@ -13,5 +13,7 @@ class BrowserTelemetryCategoryConfig(BaseModel):
     enabled: Optional[bool] = None
     """Whether this category is captured.
 
-    Selection is opt-in, so an omitted category is not captured.
+    Operational categories (control, connection, system, captcha) default to true;
+    set false to opt out. CDP categories (console, network, page, interaction) and
+    screenshot default to false; set true to opt in.
     """
diff --git a/src/kernel/types/browsers/browser_telemetry_category_config_param.py b/src/kernel/types/browsers/browser_telemetry_category_config_param.py
index 3958f7d8..09dbe418 100644
--- a/src/kernel/types/browsers/browser_telemetry_category_config_param.py
+++ b/src/kernel/types/browsers/browser_telemetry_category_config_param.py
@@ -13,5 +13,7 @@ class BrowserTelemetryCategoryConfigParam(TypedDict, total=False):
     enabled: bool
     """Whether this category is captured.
 
-    Selection is opt-in, so an omitted category is not captured.
+    Operational categories (control, connection, system, captcha) default to true;
+    set false to opt out. CDP categories (console, network, page, interaction) and
+    screenshot default to false; set true to opt in.
     """

From 1c4af8ea100bd288182b38792ad87abab4136543 Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:32:36 +0000
Subject: [PATCH 3/4] feat: Return credential value keys and support removing
 values on update

---
 .stats.yml                                   |  4 ++--
 src/kernel/resources/credentials.py          | 12 +++++++++++-
 src/kernel/types/credential.py               |  9 ++++++++-
 src/kernel/types/credential_update_params.py |  9 +++++++++
 tests/api_resources/test_credentials.py      |  2 ++
 5 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/.stats.yml b/.stats.yml
index adc4cc21..3f7dec3b 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 125
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-61dab8d0d01c2838febaf4319114ae35aa169a813a102e93af6598ca0d445da2.yml
-openapi_spec_hash: c9fbe809670384dc5141dccb60e45672
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/kernel/kernel-ba32039d3975da7aa6d28e5184f0a44c9fbfe36ab7dbc71985d14e2ecc0867b9.yml
+openapi_spec_hash: a9f32fc90c2add2ae85af828c298e35b
 config_hash: 06186eb40e0058a2a87ac251fc07415d
diff --git a/src/kernel/resources/credentials.py b/src/kernel/resources/credentials.py
index 3919ecff..fd073957 100644
--- a/src/kernel/resources/credentials.py
+++ b/src/kernel/resources/credentials.py
@@ -7,7 +7,7 @@
 import httpx
 
 from ..types import credential_list_params, credential_create_params, credential_update_params
-from .._types import Body, Omit, Query, Headers, NoneType, NotGiven, omit, not_given
+from .._types import Body, Omit, Query, Headers, NoneType, NotGiven, SequenceNotStr, omit, not_given
 from .._utils import path_template, maybe_transform, async_maybe_transform
 from .._compat import cached_property
 from .._resource import SyncAPIResource, AsyncAPIResource
@@ -145,6 +145,7 @@ def update(
         id_or_name: str,
         *,
         name: str | Omit = omit,
+        remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
@@ -163,6 +164,9 @@ def update(
         Args:
           name: New name for the credential
 
+          remove_value_keys: Field names to remove from the credential's stored values. Removals are applied
+              before `values` are merged, so a key present in both is kept with its new value.
+
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
@@ -187,6 +191,7 @@ def update(
             body=maybe_transform(
                 {
                     "name": name,
+                    "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
                     "totp_secret": totp_secret,
                     "values": values,
@@ -445,6 +450,7 @@ async def update(
         id_or_name: str,
         *,
         name: str | Omit = omit,
+        remove_value_keys: SequenceNotStr[str] | Omit = omit,
         sso_provider: Optional[str] | Omit = omit,
         totp_secret: str | Omit = omit,
         values: Dict[str, str] | Omit = omit,
@@ -463,6 +469,9 @@ async def update(
         Args:
           name: New name for the credential
 
+          remove_value_keys: Field names to remove from the credential's stored values. Removals are applied
+              before `values` are merged, so a key present in both is kept with its new value.
+
           sso_provider: If set, indicates this credential should be used with the specified SSO
               provider. Set to empty string or null to remove.
 
@@ -487,6 +496,7 @@ async def update(
             body=await async_maybe_transform(
                 {
                     "name": name,
+                    "remove_value_keys": remove_value_keys,
                     "sso_provider": sso_provider,
                     "totp_secret": totp_secret,
                     "values": values,
diff --git a/src/kernel/types/credential.py b/src/kernel/types/credential.py
index 323617c5..fb2ff6e1 100644
--- a/src/kernel/types/credential.py
+++ b/src/kernel/types/credential.py
@@ -1,6 +1,6 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
-from typing import Optional
+from typing import List, Optional
 from datetime import datetime
 
 from .._models import BaseModel
@@ -48,3 +48,10 @@ class Credential(BaseModel):
 
     totp_code_expires_at: Optional[datetime] = None
     """When the totp_code expires. Only included when totp_code is present."""
+
+    value_keys: Optional[List[str]] = None
+    """The field names stored in this credential's values (e.g., username, password).
+
+    Values themselves are never returned. Included on single-credential responses
+    (create, get by id or name, update); omitted from list responses.
+    """
diff --git a/src/kernel/types/credential_update_params.py b/src/kernel/types/credential_update_params.py
index c42209e4..9da3f09c 100644
--- a/src/kernel/types/credential_update_params.py
+++ b/src/kernel/types/credential_update_params.py
@@ -5,6 +5,8 @@
 from typing import Dict, Optional
 from typing_extensions import TypedDict
 
+from .._types import SequenceNotStr
+
 __all__ = ["CredentialUpdateParams"]
 
 
@@ -12,6 +14,13 @@ class CredentialUpdateParams(TypedDict, total=False):
     name: str
     """New name for the credential"""
 
+    remove_value_keys: SequenceNotStr[str]
+    """Field names to remove from the credential's stored values.
+
+    Removals are applied before `values` are merged, so a key present in both is
+    kept with its new value.
+    """
+
     sso_provider: Optional[str]
     """If set, indicates this credential should be used with the specified SSO
     provider.
diff --git a/tests/api_resources/test_credentials.py b/tests/api_resources/test_credentials.py
index 31704230..9fddf1c0 100644
--- a/tests/api_resources/test_credentials.py
+++ b/tests/api_resources/test_credentials.py
@@ -141,6 +141,7 @@ def test_method_update_with_all_params(self, client: Kernel) -> None:
         credential = client.credentials.update(
             id_or_name="id_or_name",
             name="my-updated-login",
+            remove_value_keys=["old_field"],
             sso_provider="google",
             totp_secret="JBSWY3DPEHPK3PXP",
             values={
@@ -433,6 +434,7 @@ async def test_method_update_with_all_params(self, async_client: AsyncKernel) ->
         credential = await async_client.credentials.update(
             id_or_name="id_or_name",
             name="my-updated-login",
+            remove_value_keys=["old_field"],
             sso_provider="google",
             totp_secret="JBSWY3DPEHPK3PXP",
             values={

From 712856b78f0d3fc9cf3d7b3120f1f0717dc60bec Mon Sep 17 00:00:00 2001
From: "stainless-app[bot]"
 <142633134+stainless-app[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:33:08 +0000
Subject: [PATCH 4/4] release: 0.76.0

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 9 +++++++++
 pyproject.toml                | 2 +-
 src/kernel/_version.py        | 2 +-
 4 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 1cfe7eb3..aa39267a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.75.0"
+  ".": "0.76.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77fec02e..e0c979f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.76.0 (2026-07-09)
+
+Full Changelog: [v0.75.0...v0.76.0](https://github.com/kernel/kernel-python-sdk/compare/v0.75.0...v0.76.0)
+
+### Features
+
+* Layer telemetry request config onto the default set ([c6d6b65](https://github.com/kernel/kernel-python-sdk/commit/c6d6b651a377d4283af20ab631f2adf25354954f))
+* Return credential value keys and support removing values on update ([1c4af8e](https://github.com/kernel/kernel-python-sdk/commit/1c4af8ea100bd288182b38792ad87abab4136543))
+
 ## 0.75.0 (2026-07-08)
 
 Full Changelog: [v0.74.0...v0.75.0](https://github.com/kernel/kernel-python-sdk/compare/v0.74.0...v0.75.0)
diff --git a/pyproject.toml b/pyproject.toml
index 1c215e5a..205c9767 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.75.0"
+version = "0.76.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"
diff --git a/src/kernel/_version.py b/src/kernel/_version.py
index 98f14c72..443b322f 100644
--- a/src/kernel/_version.py
+++ b/src/kernel/_version.py
@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.75.0"  # x-release-please-version
+__version__ = "0.76.0"  # x-release-please-version