@onkernel/sdk 0.139.0 → 0.141.0

package/resources/vaults/items.d.ts

@@ -329,7 +329,7 @@ export interface AuthorizeVaultItemOperationRequest {
  * virtual card otherwise. Callers never receive or choose how the credential is
  * delivered.
  */
-export type CardVaultItemSpec = CardVaultItemSpec.LinkCardVaultItemSpec | CardVaultItemSpec.AgentCardCardVaultItemSpec | KernelCardVaultItemSpec | ShopPayCardVaultItemSpec;
+export type CardVaultItemSpec = CardVaultItemSpec.LinkCardVaultItemSpec | CardVaultItemSpec.AgentCardCardVaultItemSpec | KernelCardVaultItemSpec | ShopPayCardVaultItemSpec | VgsCardVaultItemSpec;
 export declare namespace CardVaultItemSpec {
     /**
      * Live Link card request. Test-mode card creation is not supported. The spec can
@@ -474,7 +474,7 @@ export declare namespace CardVaultItemSpec {
  * Issued Link cards retain encrypted card material for the fill operation. Link
  * cards do not expose aliases or support egress substitution.
  */
-export type CardVaultItemState = CardVaultItemState.LinkCardState | CardVaultItemState.AgentCardCardState | KernelCardState | ShopPayCardState;
+export type CardVaultItemState = CardVaultItemState.LinkCardState | CardVaultItemState.AgentCardCardState | KernelCardState | ShopPayCardState | VgsCardState;
 export declare namespace CardVaultItemState {
     /**
      * Issued Link cards retain encrypted card material for the fill operation. Link
@@ -644,7 +644,7 @@ export declare namespace CredentialAccountVaultItem {
      */
     interface AvailableOperation {
         description: string;
-        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
     }
 }
 export interface CredentialAccountVaultItemRequest {
@@ -965,7 +965,7 @@ export declare namespace CredentialVaultItem {
      */
     interface AvailableOperation {
         description: string;
-        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
     }
     interface OnePasswordAccessApprovalAction {
         /**
@@ -1156,16 +1156,24 @@ export interface FillVaultItemOperationResult {
     type: 'fill';
 }
 /**
- * A ready Kernel card supports authorize, fill, then submit checkout. Card details
- * are delivered for a few minutes after fill; submit promptly. Repeated fill is
- * safe and never submits checkout. Visa purchases require a spend_approval action
- * before details are issued; Mastercard purchases need no hosted approval.
- * masks.last4 is the enrolled card's last four digits; masks.token_last4, when
- * present, is the token's last four digits shown to the merchant. Kernel does not
- * observe whether the merchant charged the card.
+ * A ready Kernel card funded by a payment method supports authorize, fill, then
+ * submit checkout. A single-use card (source single_use_card) is ready on
+ * creation, supports only fill, and is expired from expires_at; Kernel deletes its
+ * stored details shortly after expires_at. It has no payment_method_id or
+ * funding_status. Card details are delivered for a few minutes after fill; submit
+ * promptly. Repeated fill is safe and never submits checkout. Visa purchases
+ * require a spend_approval action before details are issued; Mastercard purchases
+ * need no hosted approval. masks.last4 is the enrolled card's last four digits;
+ * masks.token_last4, when present, is the token's last four digits shown to the
+ * merchant. Kernel does not observe whether the merchant charged the card.
  */
 export interface KernelCardState {
     provider: 'kernel';
+    /**
+     * payment_method for a purchase funded by a wallet payment method; single_use_card
+     * for a card whose details were supplied with single_use_card.
+     */
+    source: 'payment_method' | 'single_use_card';
     /**
      * pending_authorization waits for cardholder approval on Visa purchases or fresh
      * security-code collection on alias-mode purchases through the spend_approval
@@ -1187,7 +1195,9 @@ export interface KernelCardState {
      */
     status: 'requested' | 'pending_authorization' | 'ready' | 'consumed' | 'expired' | 'declined' | 'recovery_required';
     /**
-     * Informational registrable domain. Fill is locked to merchant_url's exact origin.
+     * Informational registrable domain. Fill is locked to merchant_url's exact origin,
+     * except that a single-use card fills on any https page of this registrable
+     * domain.
      */
     domains?: Array<string>;
     /**
@@ -1235,7 +1245,18 @@ export declare namespace KernelCardState {
  * after collection. An expired card requires a new purchase. Fill types those
  * details on merchant_url's origin. The amount, merchant_url and merchant_country
  * are recorded but do not restrict payment requests sent by the browser. Card
- * updates are not supported; delete and create a new item instead.
+ * updates are not supported; delete and create a new item instead. With
+ * single_use_card the item is instead a single-use card whose details the caller
+ * supplies, such as a virtual card from its issuer. It is not funded by a payment
+ * method, is ready on creation, and supports only fill: Kernel stores the details
+ * encrypted, never returns them, and fills them on any https page whose
+ * registrable domain (state.domains) is merchant_url's, including its subdomains.
+ * Fill does not consume it. From expires_at it is expired and can no longer be
+ * filled; Kernel deletes its stored details shortly after expires_at. Deleting the
+ * card, its wallet or its vault deletes them immediately. amount, currency and the
+ * merchant fields are recorded but not enforced. Repeating the identical request
+ * returns the existing card; any other request with the same key returns 409, as
+ * does repeating it once the expired card's details have been deleted.
  */
 export interface KernelCardVaultItemSpec {
     /**
@@ -1258,6 +1279,15 @@ export interface KernelCardVaultItemSpec {
      * Key of the Kernel wallet item whose enrolled card pays.
      */
     wallet: string;
+    /**
+     * Single-use cards only. From this time the card is expired and can no longer be
+     * filled; Kernel deletes its stored details shortly after. Deleting the card, its
+     * wallet or its vault deletes them immediately. Defaults to 2 hours after
+     * creation, capped at the end of the card's expiry month; a requested time must be
+     * in the future, at most 24 hours after creation, and not after the end of the
+     * card's expiry month. Returned in UTC.
+     */
+    expires_at?: string;
     /**
      * Actual merchant category when known. Omit rather than invent a category.
      */
@@ -1277,9 +1307,19 @@ export interface KernelCardVaultItemSpec {
      * Omission selects the wallet's default card, ID card, for compatibility with
      * existing requests; it never falls back to another method, and a wallet without a
      * default card requires the ID. The purchase is bound to the method's enrolled
-     * card and network token, so later operations cannot switch funding.
+     * card and network token, so later operations cannot switch funding. Not allowed
+     * with single_use_card.
      */
     payment_method_id?: string;
+    /**
+     * Details of a card the caller supplies, such as a single-use virtual card from
+     * its issuer. Mutually exclusive with payment_method_id. The card details are
+     * stored encrypted for fill and never returned; reads return only reference.
+     * Kernel deletes them shortly after the card's expires_at; deleting the card, its
+     * wallet or its vault deletes them immediately. A card whose expiry month has
+     * ended is rejected.
+     */
+    single_use_card?: KernelSingleUseCard;
 }
 export interface KernelCredentialVaultItemSpec {
     /**
@@ -1378,6 +1418,21 @@ export interface KernelPaymentRequestVaultItemSpec {
      */
     merchant_country?: string;
 }
+/**
+ * Details of a card the caller supplies, such as a single-use virtual card from
+ * its issuer. Mutually exclusive with payment_method_id. The card details are
+ * stored encrypted for fill and never returned; reads return only reference.
+ * Kernel deletes them shortly after the card's expires_at; deleting the card, its
+ * wallet or its vault deletes them immediately. A card whose expiry month has
+ * ended is rejected.
+ */
+export interface KernelSingleUseCard {
+    /**
+     * The caller's identifier for the card, such as the issuer's card ID. Returned
+     * unchanged on reads.
+     */
+    reference?: string;
+}
 export interface KernelWalletState {
     provider: 'kernel';
     /**
@@ -1938,10 +1993,12 @@ export declare namespace OnePasswordCredentialVaultItemState {
 }
 /**
  * Fill and submit an approved 1Password login in the selected browser page. The
- * page must share the selected entry's login origin. Supply entry_id when more
- * than one approved entry matches the page origin, and target_id when more than
- * one open page has page_url. The extension selects fields; callers cannot supply
- * selectors or secret values. Submission does not confirm website authentication.
+ * 1Password extension decides whether the approved login matches the page and
+ * refuses pages that don't. Supply entry_id when several entries are approved and
+ * the page origin does not identify exactly one of them, and target_id when more
+ * than one open page has page_url. The extension selects fields; callers cannot
+ * supply selectors or secret values. Submission does not confirm website
+ * authentication.
  */
 export interface OnePasswordFillVaultItemOperationRequest {
     /**
@@ -1955,8 +2012,8 @@ export interface OnePasswordFillVaultItemOperationRequest {
     page_url: string;
     type: '1pw_fill';
     /**
-     * ID of an approved request entry. Required when several approved entries have the
-     * page's origin.
+     * ID of an approved request entry. Required when several entries are approved and
+     * the page's origin does not match exactly one of them.
      */
     entry_id?: string;
     /**
@@ -2079,7 +2136,7 @@ export declare namespace PaymentRequestVaultItem {
      */
     interface AvailableOperation {
         description: string;
-        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+        type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
     }
 }
 /**
@@ -2435,6 +2492,20 @@ export declare namespace ShopPayWalletVaultItemSpec {
         }
     }
 }
+/**
+ * Billing address filled with the billing\_\* fill fields. Never returned.
+ */
+export interface SingleUseCardBillingAddress {
+    city?: string;
+    /**
+     * ISO 3166-1 alpha-2 code.
+     */
+    country?: string;
+    line1?: string;
+    line2?: string;
+    postal_code?: string;
+    state?: string;
+}
 export interface VaultCardAliases {
     cvc: string;
     exp_month: string;
@@ -2604,7 +2675,7 @@ export declare namespace VaultItem {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
         }
         /**
          * Live, non-persisted data requested through the item GET expand parameter.
@@ -2668,7 +2739,7 @@ export declare namespace VaultItem {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
         }
     }
 }
@@ -2787,7 +2858,7 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
         }
         /**
          * Live, non-persisted data requested through the item GET expand parameter.
@@ -2851,7 +2922,7 @@ export declare namespace VaultItemOperationResponse {
          */
         interface AvailableOperation {
             description: string;
-            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
+            type: 'authorize' | 'restart_verification' | 'confirm_transaction' | 'collect' | 'prepare_checkout' | 'fill' | 'arm_passkey' | 'register_passkey' | 'disarm_passkey' | '1pw_create_access_request' | '1pw_access_request_status' | '1pw_fill' | '1pw_recover' | '1pw_update_access_token' | 'update_access_token' | 'webmcp_invoke' | 'add_payment_method' | 'remove_payment_method';
         }
     }
 }
@@ -2943,6 +3014,138 @@ export interface VaultWebmcpBinding {
      */
     format?: string;
 }
+/**
+ * The card's aliases in the customer's VGS vault, its expiry and last four digits.
+ * Write-only: stored encrypted and never returned in the item, its events or logs.
+ * A repeated PUT with the same key must send the same card.
+ */
+export interface VgsCardInput {
+    /**
+     * A volatile alias of a freshly collected security code in the customer's vault.
+     * It must still exist when authorize runs.
+     */
+    cvc_alias: string;
+    exp_month: number;
+    exp_year: number;
+    /**
+     * The card number's last four digits, checked against the revealed alias.
+     */
+    last4: string;
+    /**
+     * A persistent alias of the card number in the customer's vault.
+     */
+    pan_alias: string;
+}
+/**
+ * A ready VGS card supports fill, then submit checkout, until expires_at. Kernel
+ * does not observe whether the merchant charged the card. masks.last4 is the
+ * card's last four digits.
+ */
+export interface VgsCardState {
+    provider: 'vgs';
+    /**
+     * requested until authorize reveals the aliases; if the reveal fails before
+     * anything is stored, authorize returns 503 provider_unavailable and the card
+     * stays requested. declined means authorize was refused: invalid_card for aliases
+     * that do not match the card or a card that has expired (fix the input and create
+     * a new card), alias_not_found when the customer's vault has no such alias,
+     * usually an expired CVC alias (collect the CVC again and create a new card), or
+     * provider_credentials_rejected when VGS refused the configuration's service
+     * account (update the provider configuration and create a new card). ready lasts
+     * until the CVC alias expires, then expired.
+     */
+    status: 'requested' | 'pending_authorization' | 'ready' | 'expired' | 'declined' | 'recovery_required';
+    /**
+     * Informational registrable domain. Fill is locked to merchant_url's exact origin.
+     */
+    domains?: Array<string>;
+    masks?: VgsCardState.Masks;
+    status_reason?: string;
+}
+export declare namespace VgsCardState {
+    interface Masks {
+        brand?: string;
+        last4?: string;
+        /**
+         * Last four digits of the network token presented to the merchant.
+         */
+        token_last4?: string;
+        [k: string]: string | undefined;
+    }
+}
+/**
+ * One live purchase with a card in the customer's VGS vault. authorize reveals
+ * card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which
+ * replaces both with aliases in Kernel's vault before they reach Kernel; Kernel
+ * never receives the card number or security code. The card is then ready with no
+ * further approval, until expires_at, by default five minutes after authorize.
+ * fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy
+ * replaces them with the card's details when the browser submits checkout. An
+ * expired card requires a new purchase with a freshly collected CVC alias. The
+ * amount and merchant are recorded but do not restrict payment requests sent by
+ * the browser. Card updates are not supported; delete and create a new item
+ * instead.
+ */
+export interface VgsCardVaultItemSpec {
+    /**
+     * Integer amount in minor currency units (at most 1000000).
+     */
+    amount: number;
+    /**
+     * ISO 4217 code. Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy,
+     * krw, mxn, nok, nzd, pln, sek, sgd, usd, zar.
+     */
+    currency: string;
+    merchant_name: string;
+    /**
+     * Merchant checkout URL. Fill is allowed only on this URL's origin.
+     */
+    merchant_url: string;
+    provider: 'vgs';
+    /**
+     * Key of the VGS wallet item whose configuration reads the aliases.
+     */
+    wallet: string;
+    /**
+     * Required when creating the card. Never returned.
+     */
+    card?: VgsCardInput;
+}
+export interface VgsWalletState {
+    provider: 'vgs';
+    /**
+     * A VGS wallet is connected on creation. pending_authorization or degraded means
+     * its creation did not finish; reading the wallet retries it, and a wallet that
+     * stays degraded can be deleted and created again. Whether its configuration's
+     * credentials still work is checked when a card is authorized.
+     */
+    status: 'pending_authorization' | 'connected' | 'degraded';
+    status_reason?: string;
+}
+/**
+ * Cards kept in the customer's own VGS vault. The wallet binds a VGS provider
+ * configuration and is connected on creation; it holds no cards and has no payment
+ * methods. Each purchase is a card item that carries the card's aliases from the
+ * customer's vault. The configuration binding cannot be changed after creation.
+ */
+export interface VgsWalletVaultItemSpec {
+    provider: 'vgs';
+    /**
+     * Select a VGS configuration. Required, because there are no Kernel-managed VGS
+     * credentials for this provider.
+     */
+    provider_config: VgsWalletVaultItemSpec.ProviderConfig;
+}
+export declare namespace VgsWalletVaultItemSpec {
+    /**
+     * Select a VGS configuration. Required, because there are no Kernel-managed VGS
+     * credentials for this provider.
+     */
+    interface ProviderConfig {
+        id?: string;
+        name?: string;
+    }
+}
 /**
  * AgentCard wallet. Omit provider_config to use Kernel-managed credentials, or
  * select a customer-owned configuration. Mode (sandbox vs live) is determined by
@@ -2959,7 +3162,7 @@ export interface VaultWebmcpBinding {
  * imports of the same key may both validate, but create at most one wallet and
  * connected event.
  */
-export type WalletVaultItemSpec = WalletVaultItemSpec.LinkWalletVaultItemSpec | WalletVaultItemSpec.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec | ShopPayWalletVaultItemSpec;
+export type WalletVaultItemSpec = WalletVaultItemSpec.LinkWalletVaultItemSpec | WalletVaultItemSpec.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec | ShopPayWalletVaultItemSpec | VgsWalletVaultItemSpec;
 export declare namespace WalletVaultItemSpec {
     interface LinkWalletVaultItemSpec {
         authorization: LinkWalletVaultItemSpec.Authorization;
@@ -2969,6 +3172,13 @@ export declare namespace WalletVaultItemSpec {
         interface Authorization {
             client: Authorization.KernelManagedOAuthClient | Authorization.CustomerManagedOAuthClient;
             method: 'oauth';
+            /**
+             * Who refreshes an imported Link grant. kernel (default) means Kernel holds and
+             * rotates the refresh token. customer means your backend keeps the refresh token
+             * and replaces the access token with update_access_token; Kernel never refreshes
+             * or revokes the grant. Fixed at wallet creation.
+             */
+            token_refresh?: 'kernel' | 'customer';
         }
         namespace Authorization {
             interface KernelManagedOAuthClient {
@@ -3032,7 +3242,7 @@ export declare namespace WalletVaultItemSpec {
         }
     }
 }
-export type WalletVaultItemState = WalletVaultItemState.LinkWalletState | WalletVaultItemState.AgentCardWalletState | KernelWalletState | ShopPayWalletState;
+export type WalletVaultItemState = WalletVaultItemState.LinkWalletState | WalletVaultItemState.AgentCardWalletState | KernelWalletState | ShopPayWalletState | VgsWalletState;
 export declare namespace WalletVaultItemState {
     interface LinkWalletState {
         provider: 'link';
@@ -3223,7 +3433,7 @@ export interface ItemEventsParams {
      */
     wait?: number;
 }
-export type ItemPerformOperationParams = ItemPerformOperationParams.AuthorizeVaultItemOperationRequest | ItemPerformOperationParams.RestartVerificationVaultItemOperationRequest | ItemPerformOperationParams.ConfirmTransactionVaultItemOperationRequest | ItemPerformOperationParams.CollectVaultItemOperationRequest | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest | ItemPerformOperationParams.FillVaultItemOperationRequest | ItemPerformOperationParams.ArmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.RegisterPasskeyVaultItemOperationRequest | ItemPerformOperationParams.DisarmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest | ItemPerformOperationParams.AddPaymentMethodVaultItemOperationRequest | ItemPerformOperationParams.RemovePaymentMethodVaultItemOperationRequest;
+export type ItemPerformOperationParams = ItemPerformOperationParams.AuthorizeVaultItemOperationRequest | ItemPerformOperationParams.RestartVerificationVaultItemOperationRequest | ItemPerformOperationParams.ConfirmTransactionVaultItemOperationRequest | ItemPerformOperationParams.CollectVaultItemOperationRequest | ItemPerformOperationParams.PrepareCheckoutVaultItemOperationRequest | ItemPerformOperationParams.FillVaultItemOperationRequest | ItemPerformOperationParams.ArmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.RegisterPasskeyVaultItemOperationRequest | ItemPerformOperationParams.DisarmPasskeyVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRequestAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordPollAccessVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest | ItemPerformOperationParams.UpdateAccessTokenVaultItemOperationRequest | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest | ItemPerformOperationParams.AddPaymentMethodVaultItemOperationRequest | ItemPerformOperationParams.RemovePaymentMethodVaultItemOperationRequest;
 export declare namespace ItemPerformOperationParams {
     interface AuthorizeVaultItemOperationRequest {
         /**
@@ -3481,8 +3691,8 @@ export declare namespace ItemPerformOperationParams {
          */
         type: '1pw_fill';
         /**
-         * Body param: ID of an approved request entry. Required when several approved
-         * entries have the page's origin.
+         * Body param: ID of an approved request entry. Required when several entries are
+         * approved and the page's origin does not match exactly one of them.
          */
         entry_id?: string;
         /**
@@ -3525,6 +3735,20 @@ export declare namespace ItemPerformOperationParams {
          */
         access_token_expires_at?: string;
     }
+    interface UpdateAccessTokenVaultItemOperationRequest {
+        /**
+         * Path param
+         */
+        id_or_name: string;
+        /**
+         * Body param
+         */
+        access_token: string;
+        /**
+         * Body param
+         */
+        type: 'update_access_token';
+    }
     interface WebmcpInvokeVaultItemOperationRequest {
         /**
          * Path param
@@ -3613,7 +3837,7 @@ export declare namespace ItemUpsertParams {
          * corrected and retried. Concurrent imports of the same key may both validate, but
          * create at most one wallet and connected event.
          */
-        spec: WalletVaultItemRequest.LinkWalletVaultItemRequestSpec | WalletVaultItemRequest.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec | ShopPayWalletVaultItemSpec;
+        spec: WalletVaultItemRequest.LinkWalletVaultItemRequestSpec | WalletVaultItemRequest.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec | ShopPayWalletVaultItemSpec | VgsWalletVaultItemSpec;
         /**
          * Body param
          */
@@ -3647,7 +3871,16 @@ export declare namespace ItemUpsertParams {
              * wallet with state.status=connected. An expired, invalid, revoked, or
              * insufficiently scoped access token returns 400 and no wallet is created. Refresh
              * expired tokens in your backend before importing them. A failed import does not
-             * modify existing wallets. After successful import, Kernel owns subsequent
+             * modify existing wallets. By default (token_refresh=kernel), Kernel owns
+             * subsequent refresh-token rotation after a successful import; the customer must
+             * stop refreshing this grant. With token_refresh=customer, send only the access
+             * token: your backend keeps the refresh token and rotates the grant, and Kernel
+             * never refreshes or revokes it. When Link rejects the stored access token, any
+             * operation that reaches Link, such as creating, authorizing or filling a card,
+             * returns 409 with code access_token_rejected without contacting Link again. Push
+             * a fresh access token with the wallet's update_access_token operation, then retry
+             * the operation. The remainder of this description applies to
+             * token_refresh=kernel. With token_refresh=kernel, Kernel owns subsequent
              * refresh-token rotation; the customer must stop refreshing this grant. Import
              * does not verify the refresh token: if it or the configured client credentials
              * are rejected during a later refresh, the imported wallet becomes degraded. An
@@ -3672,13 +3905,21 @@ export declare namespace ItemUpsertParams {
                 client: ImportedLinkAuthorizationInput.Client;
                 method: 'oauth';
                 /**
-                 * Send the token pair from your backend. Both tokens must be from the same Link
-                 * grant under the referenced client. Supply a currently valid access token. Kernel
-                 * refreshes when needed after import and uses the expiry returned by Link for
-                 * subsequent tokens. Tokens are never returned in wallet responses, events, or
+                 * Send the tokens from your backend. Supply a currently valid access token. With
+                 * token_refresh=kernel, also send the refresh token from the same Link grant under
+                 * the referenced client; Kernel refreshes when needed after import and uses the
+                 * expiry returned by Link for subsequent tokens. With token_refresh=customer, omit
+                 * the refresh token. Tokens are never returned in wallet responses, events, or
                  * logs.
                  */
                 tokens: ImportedLinkAuthorizationInput.Tokens;
+                /**
+                 * Who refreshes an imported Link grant. kernel (default) means Kernel holds and
+                 * rotates the refresh token. customer means your backend keeps the refresh token
+                 * and replaces the access token with update_access_token; Kernel never refreshes
+                 * or revokes the grant. Fixed at wallet creation.
+                 */
+                token_refresh?: 'kernel' | 'customer';
             }
             namespace ImportedLinkAuthorizationInput {
                 interface Client {
@@ -3702,15 +3943,19 @@ export declare namespace ItemUpsertParams {
                     }
                 }
                 /**
-                 * Send the token pair from your backend. Both tokens must be from the same Link
-                 * grant under the referenced client. Supply a currently valid access token. Kernel
-                 * refreshes when needed after import and uses the expiry returned by Link for
-                 * subsequent tokens. Tokens are never returned in wallet responses, events, or
+                 * Send the tokens from your backend. Supply a currently valid access token. With
+                 * token_refresh=kernel, also send the refresh token from the same Link grant under
+                 * the referenced client; Kernel refreshes when needed after import and uses the
+                 * expiry returned by Link for subsequent tokens. With token_refresh=customer, omit
+                 * the refresh token. Tokens are never returned in wallet responses, events, or
                  * logs.
                  */
                 interface Tokens {
                     access_token: string;
-                    refresh_token: string;
+                    /**
+                     * Required with token_refresh=kernel; rejected with token_refresh=customer.
+                     */
+                    refresh_token?: string;
                 }
             }
         }
@@ -3822,6 +4067,6 @@ export declare namespace ItemUpsertParams {
     }
 }
 export declare namespace Items {
-    export { type AddPaymentMethodVaultItemOperationRequest as AddPaymentMethodVaultItemOperationRequest, type AddPaymentMethodVaultItemOperationResult as AddPaymentMethodVaultItemOperationResult, type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, type CollectVaultItemOperationRequest as CollectVaultItemOperationRequest, type ConfirmTransactionVaultItemOperationRequest as ConfirmTransactionVaultItemOperationRequest, type CredentialAccountVaultItem as CredentialAccountVaultItem, type CredentialAccountVaultItemRequest as CredentialAccountVaultItemRequest, type CredentialCollectionAction as CredentialCollectionAction, type CredentialVaultFieldDefinition as CredentialVaultFieldDefinition, type CredentialVaultFieldDefinitionInput as CredentialVaultFieldDefinitionInput, type CredentialVaultFieldInput as CredentialVaultFieldInput, type CredentialVaultFieldState as CredentialVaultFieldState, type CredentialVaultFieldType as CredentialVaultFieldType, type CredentialVaultFieldUpdate as CredentialVaultFieldUpdate, type CredentialVaultItem as CredentialVaultItem, type CredentialVaultItemRequest as CredentialVaultItemRequest, type CredentialVaultItemSpec as CredentialVaultItemSpec, type CredentialVaultItemSpecInput as CredentialVaultItemSpecInput, type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, type KernelCardVaultItemSpec as KernelCardVaultItemSpec, type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec, type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type LinkShippingAddress as LinkShippingAddress, type LinkUserInfo as LinkUserInfo, type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField, type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec, type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput, type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState, type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec, type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState, type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec, type OnePasswordCredentialVaultItemSpecInput as OnePasswordCredentialVaultItemSpecInput, type OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState, type OnePasswordFillVaultItemOperationRequest as OnePasswordFillVaultItemOperationRequest, type OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult, type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult, type PaymentRequestVaultItem as PaymentRequestVaultItem, type PaymentRequestVaultItemSpec as PaymentRequestVaultItemSpec, type PaymentRequestVaultItemState as PaymentRequestVaultItemState, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest, type RemovePaymentMethodVaultItemOperationRequest as RemovePaymentMethodVaultItemOperationRequest, type RemovePaymentMethodVaultItemOperationResult as RemovePaymentMethodVaultItemOperationResult, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type ShopPayCardState as ShopPayCardState, type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec, type ShopPayWalletState as ShopPayWalletState, type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, type VaultFillField as VaultFillField, type VaultFillFieldResult as VaultFillFieldResult, type VaultItem as VaultItem, type VaultItemAction as VaultItemAction, type VaultItemEvent as VaultItemEvent, type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult, type ItemListResponse as ItemListResponse, type ItemEventsResponse as ItemEventsResponse, type ItemRetrieveParams as ItemRetrieveParams, type ItemUpdateParams as ItemUpdateParams, type ItemDeleteParams as ItemDeleteParams, type ItemEventsParams as ItemEventsParams, type ItemPerformOperationParams as ItemPerformOperationParams, type ItemUpsertParams as ItemUpsertParams, };
+    export { type AddPaymentMethodVaultItemOperationRequest as AddPaymentMethodVaultItemOperationRequest, type AddPaymentMethodVaultItemOperationResult as AddPaymentMethodVaultItemOperationResult, type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, type ArmPasskeyVaultItemOperationRequest as ArmPasskeyVaultItemOperationRequest, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, type CollectVaultItemOperationRequest as CollectVaultItemOperationRequest, type ConfirmTransactionVaultItemOperationRequest as ConfirmTransactionVaultItemOperationRequest, type CredentialAccountVaultItem as CredentialAccountVaultItem, type CredentialAccountVaultItemRequest as CredentialAccountVaultItemRequest, type CredentialCollectionAction as CredentialCollectionAction, type CredentialVaultFieldDefinition as CredentialVaultFieldDefinition, type CredentialVaultFieldDefinitionInput as CredentialVaultFieldDefinitionInput, type CredentialVaultFieldInput as CredentialVaultFieldInput, type CredentialVaultFieldState as CredentialVaultFieldState, type CredentialVaultFieldType as CredentialVaultFieldType, type CredentialVaultFieldUpdate as CredentialVaultFieldUpdate, type CredentialVaultItem as CredentialVaultItem, type CredentialVaultItemRequest as CredentialVaultItemRequest, type CredentialVaultItemSpec as CredentialVaultItemSpec, type CredentialVaultItemSpecInput as CredentialVaultItemSpecInput, type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, type DisarmPasskeyVaultItemOperationRequest as DisarmPasskeyVaultItemOperationRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, type KernelCardVaultItemSpec as KernelCardVaultItemSpec, type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec, type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec, type KernelSingleUseCard as KernelSingleUseCard, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type LinkShippingAddress as LinkShippingAddress, type LinkUserInfo as LinkUserInfo, type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField, type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec, type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput, type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState, type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec, type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState, type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec, type OnePasswordCredentialVaultItemSpecInput as OnePasswordCredentialVaultItemSpecInput, type OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState, type OnePasswordFillVaultItemOperationRequest as OnePasswordFillVaultItemOperationRequest, type OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult, type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, type PasskeyVaultItemOperationResult as PasskeyVaultItemOperationResult, type PaymentRequestVaultItem as PaymentRequestVaultItem, type PaymentRequestVaultItemSpec as PaymentRequestVaultItemSpec, type PaymentRequestVaultItemState as PaymentRequestVaultItemState, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, type RegisterPasskeyVaultItemOperationRequest as RegisterPasskeyVaultItemOperationRequest, type RemovePaymentMethodVaultItemOperationRequest as RemovePaymentMethodVaultItemOperationRequest, type RemovePaymentMethodVaultItemOperationResult as RemovePaymentMethodVaultItemOperationResult, type RestartVerificationVaultItemOperationRequest as RestartVerificationVaultItemOperationRequest, type ShopPayCardState as ShopPayCardState, type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec, type ShopPayWalletState as ShopPayWalletState, type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec, type SingleUseCardBillingAddress as SingleUseCardBillingAddress, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, type VaultFillField as VaultFillField, type VaultFillFieldResult as VaultFillFieldResult, type VaultItem as VaultItem, type VaultItemAction as VaultItemAction, type VaultItemEvent as VaultItemEvent, type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, type VgsCardInput as VgsCardInput, type VgsCardState as VgsCardState, type VgsCardVaultItemSpec as VgsCardVaultItemSpec, type VgsWalletState as VgsWalletState, type VgsWalletVaultItemSpec as VgsWalletVaultItemSpec, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult, type ItemListResponse as ItemListResponse, type ItemEventsResponse as ItemEventsResponse, type ItemRetrieveParams as ItemRetrieveParams, type ItemUpdateParams as ItemUpdateParams, type ItemDeleteParams as ItemDeleteParams, type ItemEventsParams as ItemEventsParams, type ItemPerformOperationParams as ItemPerformOperationParams, type ItemUpsertParams as ItemUpsertParams, };
 }
 //# sourceMappingURL=items.d.ts.map