@onkernel/sdk 0.127.0 → 0.129.0

package/src/resources/vaults/items.ts

@@ -368,9 +368,7 @@ export namespace CardVaultItemSpec {
    */
   export interface LinkCardVaultItemSpec {
     /**
-     * Integer amount in minor currency units. Link Pay Token execution permits at most
-     * 500000; virtual-card execution permits at most 50000. Authorization rejects a
-     * larger amount when the checkout requires a virtual card.
+     * Integer amount in minor currency units, at most 50000.
      */
     amount: number;
 
@@ -2215,8 +2213,16 @@ export namespace VaultItem {
      * select a customer-owned configuration. Mode (sandbox vs live) is determined by
      * the selected credential; there is no per-item test flag. Without user_id,
      * creation returns a hosted enrollment action and Kernel polls until the user
-     * connects. user_id may only reference a user already enrolled by a wallet in this
-     * organization under the same configuration.
+     * connects. With a customer-owned provider_config, user_id imports an existing
+     * connection after verifying access with the selected credentials in their sandbox
+     * or live mode; no hosted enrollment is needed, even if the connected user has no
+     * stored cards. With Kernel-managed credentials, user_id may only reference a user
+     * already enrolled by a wallet in this organization under the same configuration.
+     * The user and configuration bindings cannot be changed after creation. Import
+     * validation is read-only and runs before creation: a failed validation leaves no
+     * wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+     * imports of the same key may both validate, but create at most one wallet and
+     * connected event.
      */
     spec: ItemsAPI.WalletVaultItemSpec;
 
@@ -2399,6 +2405,13 @@ export namespace VaultItemAction {
     name: 'card_enrollment';
 
     url: string;
+
+    /**
+     * Secret bearer capability for embedded card capture with @onkernel/vault-react.
+     * Present only for Kernel wallets; never for AgentCard. Treat it like the
+     * enrollment URL and do not log or persist it in browser storage.
+     */
+    capture_token?: string;
   }
 }
 
@@ -2451,8 +2464,16 @@ export namespace VaultItemOperationResponse {
      * select a customer-owned configuration. Mode (sandbox vs live) is determined by
      * the selected credential; there is no per-item test flag. Without user_id,
      * creation returns a hosted enrollment action and Kernel polls until the user
-     * connects. user_id may only reference a user already enrolled by a wallet in this
-     * organization under the same configuration.
+     * connects. With a customer-owned provider_config, user_id imports an existing
+     * connection after verifying access with the selected credentials in their sandbox
+     * or live mode; no hosted enrollment is needed, even if the connected user has no
+     * stored cards. With Kernel-managed credentials, user_id may only reference a user
+     * already enrolled by a wallet in this organization under the same configuration.
+     * The user and configuration bindings cannot be changed after creation. Import
+     * validation is read-only and runs before creation: a failed validation leaves no
+     * wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+     * imports of the same key may both validate, but create at most one wallet and
+     * connected event.
      */
     spec: ItemsAPI.WalletVaultItemSpec;
 
@@ -2668,8 +2689,16 @@ export interface VaultWebmcpBinding {
  * select a customer-owned configuration. Mode (sandbox vs live) is determined by
  * the selected credential; there is no per-item test flag. Without user_id,
  * creation returns a hosted enrollment action and Kernel polls until the user
- * connects. user_id may only reference a user already enrolled by a wallet in this
- * organization under the same configuration.
+ * connects. With a customer-owned provider_config, user_id imports an existing
+ * connection after verifying access with the selected credentials in their sandbox
+ * or live mode; no hosted enrollment is needed, even if the connected user has no
+ * stored cards. With Kernel-managed credentials, user_id may only reference a user
+ * already enrolled by a wallet in this organization under the same configuration.
+ * The user and configuration bindings cannot be changed after creation. Import
+ * validation is read-only and runs before creation: a failed validation leaves no
+ * wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+ * imports of the same key may both validate, but create at most one wallet and
+ * connected event.
  */
 export type WalletVaultItemSpec =
   | WalletVaultItemSpec.LinkWalletVaultItemSpec
@@ -2726,8 +2755,16 @@ export namespace WalletVaultItemSpec {
    * select a customer-owned configuration. Mode (sandbox vs live) is determined by
    * the selected credential; there is no per-item test flag. Without user_id,
    * creation returns a hosted enrollment action and Kernel polls until the user
-   * connects. user_id may only reference a user already enrolled by a wallet in this
-   * organization under the same configuration.
+   * connects. With a customer-owned provider_config, user_id imports an existing
+   * connection after verifying access with the selected credentials in their sandbox
+   * or live mode; no hosted enrollment is needed, even if the connected user has no
+   * stored cards. With Kernel-managed credentials, user_id may only reference a user
+   * already enrolled by a wallet in this organization under the same configuration.
+   * The user and configuration bindings cannot be changed after creation. Import
+   * validation is read-only and runs before creation: a failed validation leaves no
+   * wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+   * imports of the same key may both validate, but create at most one wallet and
+   * connected event.
    */
   export interface AgentCardWalletVaultItemSpec {
     provider: 'agentcard';
@@ -3317,8 +3354,16 @@ export declare namespace ItemUpsertParams {
      * credentials, or select a customer-owned configuration. Mode (sandbox vs live) is
      * determined by the selected credential; there is no per-item test flag. Without
      * user_id, creation returns a hosted enrollment action and Kernel polls until the
-     * user connects. user_id may only reference a user already enrolled by a wallet in
-     * this organization under the same configuration.
+     * user connects. With a customer-owned provider_config, user_id imports an
+     * existing connection after verifying access with the selected credentials in
+     * their sandbox or live mode; no hosted enrollment is needed, even if the
+     * connected user has no stored cards. With Kernel-managed credentials, user_id may
+     * only reference a user already enrolled by a wallet in this organization under
+     * the same configuration. The user and configuration bindings cannot be changed
+     * after creation. Import validation is read-only and runs before creation: a
+     * failed validation leaves no wallet or reserved key, so the user_id can be
+     * corrected and retried. Concurrent imports of the same key may both validate, but
+     * create at most one wallet and connected event.
      */
     spec:
       | WalletVaultItemRequest.LinkWalletVaultItemRequestSpec
@@ -3447,8 +3492,16 @@ export declare namespace ItemUpsertParams {
      * select a customer-owned configuration. Mode (sandbox vs live) is determined by
      * the selected credential; there is no per-item test flag. Without user_id,
      * creation returns a hosted enrollment action and Kernel polls until the user
-     * connects. user_id may only reference a user already enrolled by a wallet in this
-     * organization under the same configuration.
+     * connects. With a customer-owned provider_config, user_id imports an existing
+     * connection after verifying access with the selected credentials in their sandbox
+     * or live mode; no hosted enrollment is needed, even if the connected user has no
+     * stored cards. With Kernel-managed credentials, user_id may only reference a user
+     * already enrolled by a wallet in this organization under the same configuration.
+     * The user and configuration bindings cannot be changed after creation. Import
+     * validation is read-only and runs before creation: a failed validation leaves no
+     * wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+     * imports of the same key may both validate, but create at most one wallet and
+     * connected event.
      */
     export interface AgentCardWalletVaultItemSpec {
       provider: 'agentcard';

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.127.0'; // x-release-please-version
+export const VERSION = '0.129.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.127.0";
+export declare const VERSION = "0.129.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.127.0";
+export declare const VERSION = "0.129.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.127.0'; // x-release-please-version
+exports.VERSION = '0.129.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.127.0'; // x-release-please-version
+export const VERSION = '0.129.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map