@onkernel/sdk 0.139.0 → 0.141.0

package/src/resources/vaults/items.ts

@@ -424,7 +424,8 @@ export type CardVaultItemSpec =
   | CardVaultItemSpec.LinkCardVaultItemSpec
   | CardVaultItemSpec.AgentCardCardVaultItemSpec
   | KernelCardVaultItemSpec
-  | ShopPayCardVaultItemSpec;
+  | ShopPayCardVaultItemSpec
+  | VgsCardVaultItemSpec;
 
 export namespace CardVaultItemSpec {
   /**
@@ -608,7 +609,8 @@ export type CardVaultItemState =
   | CardVaultItemState.LinkCardState
   | CardVaultItemState.AgentCardCardState
   | KernelCardState
-  | ShopPayCardState;
+  | ShopPayCardState
+  | VgsCardState;
 
 export namespace CardVaultItemState {
   /**
@@ -863,6 +865,7 @@ export namespace CredentialAccountVaultItem {
       | '1pw_fill'
       | '1pw_recover'
       | '1pw_update_access_token'
+      | 'update_access_token'
       | 'webmcp_invoke'
       | 'add_payment_method'
       | 'remove_payment_method';
@@ -1243,6 +1246,7 @@ export namespace CredentialVaultItem {
       | '1pw_fill'
       | '1pw_recover'
       | '1pw_update_access_token'
+      | 'update_access_token'
       | 'webmcp_invoke'
       | 'add_payment_method'
       | 'remove_payment_method';
@@ -1471,17 +1475,26 @@ export interface FillVaultItemOperationResult {
 }
 
 /**
- * A ready Kernel card supports authorize, fill, then submit checkout. Card details
- * are delivered for a few minutes after fill; submit promptly. Repeated fill is
- * safe and never submits checkout. Visa purchases require a spend_approval action
- * before details are issued; Mastercard purchases need no hosted approval.
- * masks.last4 is the enrolled card's last four digits; masks.token_last4, when
- * present, is the token's last four digits shown to the merchant. Kernel does not
- * observe whether the merchant charged the card.
+ * A ready Kernel card funded by a payment method supports authorize, fill, then
+ * submit checkout. A single-use card (source single_use_card) is ready on
+ * creation, supports only fill, and is expired from expires_at; Kernel deletes its
+ * stored details shortly after expires_at. It has no payment_method_id or
+ * funding_status. Card details are delivered for a few minutes after fill; submit
+ * promptly. Repeated fill is safe and never submits checkout. Visa purchases
+ * require a spend_approval action before details are issued; Mastercard purchases
+ * need no hosted approval. masks.last4 is the enrolled card's last four digits;
+ * masks.token_last4, when present, is the token's last four digits shown to the
+ * merchant. Kernel does not observe whether the merchant charged the card.
  */
 export interface KernelCardState {
   provider: 'kernel';
 
+  /**
+   * payment_method for a purchase funded by a wallet payment method; single_use_card
+   * for a card whose details were supplied with single_use_card.
+   */
+  source: 'payment_method' | 'single_use_card';
+
   /**
    * pending_authorization waits for cardholder approval on Visa purchases or fresh
    * security-code collection on alias-mode purchases through the spend_approval
@@ -1511,7 +1524,9 @@ export interface KernelCardState {
     | 'recovery_required';
 
   /**
-   * Informational registrable domain. Fill is locked to merchant_url's exact origin.
+   * Informational registrable domain. Fill is locked to merchant_url's exact origin,
+   * except that a single-use card fills on any https page of this registrable
+   * domain.
    */
   domains?: Array<string>;
 
@@ -1568,7 +1583,18 @@ export namespace KernelCardState {
  * after collection. An expired card requires a new purchase. Fill types those
  * details on merchant_url's origin. The amount, merchant_url and merchant_country
  * are recorded but do not restrict payment requests sent by the browser. Card
- * updates are not supported; delete and create a new item instead.
+ * updates are not supported; delete and create a new item instead. With
+ * single_use_card the item is instead a single-use card whose details the caller
+ * supplies, such as a virtual card from its issuer. It is not funded by a payment
+ * method, is ready on creation, and supports only fill: Kernel stores the details
+ * encrypted, never returns them, and fills them on any https page whose
+ * registrable domain (state.domains) is merchant_url's, including its subdomains.
+ * Fill does not consume it. From expires_at it is expired and can no longer be
+ * filled; Kernel deletes its stored details shortly after expires_at. Deleting the
+ * card, its wallet or its vault deletes them immediately. amount, currency and the
+ * merchant fields are recorded but not enforced. Repeating the identical request
+ * returns the existing card; any other request with the same key returns 409, as
+ * does repeating it once the expired card's details have been deleted.
  */
 export interface KernelCardVaultItemSpec {
   /**
@@ -1597,6 +1623,16 @@ export interface KernelCardVaultItemSpec {
    */
   wallet: string;
 
+  /**
+   * Single-use cards only. From this time the card is expired and can no longer be
+   * filled; Kernel deletes its stored details shortly after. Deleting the card, its
+   * wallet or its vault deletes them immediately. Defaults to 2 hours after
+   * creation, capped at the end of the card's expiry month; a requested time must be
+   * in the future, at most 24 hours after creation, and not after the end of the
+   * card's expiry month. Returned in UTC.
+   */
+  expires_at?: string;
+
   /**
    * Actual merchant category when known. Omit rather than invent a category.
    */
@@ -1619,9 +1655,20 @@ export interface KernelCardVaultItemSpec {
    * Omission selects the wallet's default card, ID card, for compatibility with
    * existing requests; it never falls back to another method, and a wallet without a
    * default card requires the ID. The purchase is bound to the method's enrolled
-   * card and network token, so later operations cannot switch funding.
+   * card and network token, so later operations cannot switch funding. Not allowed
+   * with single_use_card.
    */
   payment_method_id?: string;
+
+  /**
+   * Details of a card the caller supplies, such as a single-use virtual card from
+   * its issuer. Mutually exclusive with payment_method_id. The card details are
+   * stored encrypted for fill and never returned; reads return only reference.
+   * Kernel deletes them shortly after the card's expires_at; deleting the card, its
+   * wallet or its vault deletes them immediately. A card whose expiry month has
+   * ended is rejected.
+   */
+  single_use_card?: KernelSingleUseCard;
 }
 
 export interface KernelCredentialVaultItemSpec {
@@ -1738,6 +1785,22 @@ export interface KernelPaymentRequestVaultItemSpec {
   merchant_country?: string;
 }
 
+/**
+ * Details of a card the caller supplies, such as a single-use virtual card from
+ * its issuer. Mutually exclusive with payment_method_id. The card details are
+ * stored encrypted for fill and never returned; reads return only reference.
+ * Kernel deletes them shortly after the card's expires_at; deleting the card, its
+ * wallet or its vault deletes them immediately. A card whose expiry month has
+ * ended is rejected.
+ */
+export interface KernelSingleUseCard {
+  /**
+   * The caller's identifier for the card, such as the issuer's card ID. Returned
+   * unchanged on reads.
+   */
+  reference?: string;
+}
+
 export interface KernelWalletState {
   provider: 'kernel';
 
@@ -2427,10 +2490,12 @@ export namespace OnePasswordCredentialVaultItemState {
 
 /**
  * Fill and submit an approved 1Password login in the selected browser page. The
- * page must share the selected entry's login origin. Supply entry_id when more
- * than one approved entry matches the page origin, and target_id when more than
- * one open page has page_url. The extension selects fields; callers cannot supply
- * selectors or secret values. Submission does not confirm website authentication.
+ * 1Password extension decides whether the approved login matches the page and
+ * refuses pages that don't. Supply entry_id when several entries are approved and
+ * the page origin does not identify exactly one of them, and target_id when more
+ * than one open page has page_url. The extension selects fields; callers cannot
+ * supply selectors or secret values. Submission does not confirm website
+ * authentication.
  */
 export interface OnePasswordFillVaultItemOperationRequest {
   /**
@@ -2447,8 +2512,8 @@ export interface OnePasswordFillVaultItemOperationRequest {
   type: '1pw_fill';
 
   /**
-   * ID of an approved request entry. Required when several approved entries have the
-   * page's origin.
+   * ID of an approved request entry. Required when several entries are approved and
+   * the page's origin does not match exactly one of them.
    */
   entry_id?: string;
 
@@ -2616,6 +2681,7 @@ export namespace PaymentRequestVaultItem {
       | '1pw_fill'
       | '1pw_recover'
       | '1pw_update_access_token'
+      | 'update_access_token'
       | 'webmcp_invoke'
       | 'add_payment_method'
       | 'remove_payment_method';
@@ -3073,6 +3139,26 @@ export namespace ShopPayWalletVaultItemSpec {
   }
 }
 
+/**
+ * Billing address filled with the billing\_\* fill fields. Never returned.
+ */
+export interface SingleUseCardBillingAddress {
+  city?: string;
+
+  /**
+   * ISO 3166-1 alpha-2 code.
+   */
+  country?: string;
+
+  line1?: string;
+
+  line2?: string;
+
+  postal_code?: string;
+
+  state?: string;
+}
+
 export interface VaultCardAliases {
   cvc: string;
 
@@ -3321,6 +3407,7 @@ export namespace VaultItem {
         | '1pw_fill'
         | '1pw_recover'
         | '1pw_update_access_token'
+        | 'update_access_token'
         | 'webmcp_invoke'
         | 'add_payment_method'
         | 'remove_payment_method';
@@ -3420,6 +3507,7 @@ export namespace VaultItem {
         | '1pw_fill'
         | '1pw_recover'
         | '1pw_update_access_token'
+        | 'update_access_token'
         | 'webmcp_invoke'
         | 'add_payment_method'
         | 'remove_payment_method';
@@ -3611,6 +3699,7 @@ export namespace VaultItemOperationResponse {
         | '1pw_fill'
         | '1pw_recover'
         | '1pw_update_access_token'
+        | 'update_access_token'
         | 'webmcp_invoke'
         | 'add_payment_method'
         | 'remove_payment_method';
@@ -3710,6 +3799,7 @@ export namespace VaultItemOperationResponse {
         | '1pw_fill'
         | '1pw_recover'
         | '1pw_update_access_token'
+        | 'update_access_token'
         | 'webmcp_invoke'
         | 'add_payment_method'
         | 'remove_payment_method';
@@ -3827,6 +3917,166 @@ export interface VaultWebmcpBinding {
   format?: string;
 }
 
+/**
+ * The card's aliases in the customer's VGS vault, its expiry and last four digits.
+ * Write-only: stored encrypted and never returned in the item, its events or logs.
+ * A repeated PUT with the same key must send the same card.
+ */
+export interface VgsCardInput {
+  /**
+   * A volatile alias of a freshly collected security code in the customer's vault.
+   * It must still exist when authorize runs.
+   */
+  cvc_alias: string;
+
+  exp_month: number;
+
+  exp_year: number;
+
+  /**
+   * The card number's last four digits, checked against the revealed alias.
+   */
+  last4: string;
+
+  /**
+   * A persistent alias of the card number in the customer's vault.
+   */
+  pan_alias: string;
+}
+
+/**
+ * A ready VGS card supports fill, then submit checkout, until expires_at. Kernel
+ * does not observe whether the merchant charged the card. masks.last4 is the
+ * card's last four digits.
+ */
+export interface VgsCardState {
+  provider: 'vgs';
+
+  /**
+   * requested until authorize reveals the aliases; if the reveal fails before
+   * anything is stored, authorize returns 503 provider_unavailable and the card
+   * stays requested. declined means authorize was refused: invalid_card for aliases
+   * that do not match the card or a card that has expired (fix the input and create
+   * a new card), alias_not_found when the customer's vault has no such alias,
+   * usually an expired CVC alias (collect the CVC again and create a new card), or
+   * provider_credentials_rejected when VGS refused the configuration's service
+   * account (update the provider configuration and create a new card). ready lasts
+   * until the CVC alias expires, then expired.
+   */
+  status: 'requested' | 'pending_authorization' | 'ready' | 'expired' | 'declined' | 'recovery_required';
+
+  /**
+   * Informational registrable domain. Fill is locked to merchant_url's exact origin.
+   */
+  domains?: Array<string>;
+
+  masks?: VgsCardState.Masks;
+
+  status_reason?: string;
+}
+
+export namespace VgsCardState {
+  export interface Masks {
+    brand?: string;
+
+    last4?: string;
+
+    /**
+     * Last four digits of the network token presented to the merchant.
+     */
+    token_last4?: string;
+
+    [k: string]: string | undefined;
+  }
+}
+
+/**
+ * One live purchase with a card in the customer's VGS vault. authorize reveals
+ * card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which
+ * replaces both with aliases in Kernel's vault before they reach Kernel; Kernel
+ * never receives the card number or security code. The card is then ready with no
+ * further approval, until expires_at, by default five minutes after authorize.
+ * fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy
+ * replaces them with the card's details when the browser submits checkout. An
+ * expired card requires a new purchase with a freshly collected CVC alias. The
+ * amount and merchant are recorded but do not restrict payment requests sent by
+ * the browser. Card updates are not supported; delete and create a new item
+ * instead.
+ */
+export interface VgsCardVaultItemSpec {
+  /**
+   * Integer amount in minor currency units (at most 1000000).
+   */
+  amount: number;
+
+  /**
+   * ISO 4217 code. Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy,
+   * krw, mxn, nok, nzd, pln, sek, sgd, usd, zar.
+   */
+  currency: string;
+
+  merchant_name: string;
+
+  /**
+   * Merchant checkout URL. Fill is allowed only on this URL's origin.
+   */
+  merchant_url: string;
+
+  provider: 'vgs';
+
+  /**
+   * Key of the VGS wallet item whose configuration reads the aliases.
+   */
+  wallet: string;
+
+  /**
+   * Required when creating the card. Never returned.
+   */
+  card?: VgsCardInput;
+}
+
+export interface VgsWalletState {
+  provider: 'vgs';
+
+  /**
+   * A VGS wallet is connected on creation. pending_authorization or degraded means
+   * its creation did not finish; reading the wallet retries it, and a wallet that
+   * stays degraded can be deleted and created again. Whether its configuration's
+   * credentials still work is checked when a card is authorized.
+   */
+  status: 'pending_authorization' | 'connected' | 'degraded';
+
+  status_reason?: string;
+}
+
+/**
+ * Cards kept in the customer's own VGS vault. The wallet binds a VGS provider
+ * configuration and is connected on creation; it holds no cards and has no payment
+ * methods. Each purchase is a card item that carries the card's aliases from the
+ * customer's vault. The configuration binding cannot be changed after creation.
+ */
+export interface VgsWalletVaultItemSpec {
+  provider: 'vgs';
+
+  /**
+   * Select a VGS configuration. Required, because there are no Kernel-managed VGS
+   * credentials for this provider.
+   */
+  provider_config: VgsWalletVaultItemSpec.ProviderConfig;
+}
+
+export namespace VgsWalletVaultItemSpec {
+  /**
+   * Select a VGS configuration. Required, because there are no Kernel-managed VGS
+   * credentials for this provider.
+   */
+  export interface ProviderConfig {
+    id?: string;
+
+    name?: string;
+  }
+}
+
 /**
  * AgentCard wallet. Omit provider_config to use Kernel-managed credentials, or
  * select a customer-owned configuration. Mode (sandbox vs live) is determined by
@@ -3847,7 +4097,8 @@ export type WalletVaultItemSpec =
   | WalletVaultItemSpec.LinkWalletVaultItemSpec
   | WalletVaultItemSpec.AgentCardWalletVaultItemSpec
   | KernelWalletVaultItemSpec
-  | ShopPayWalletVaultItemSpec;
+  | ShopPayWalletVaultItemSpec
+  | VgsWalletVaultItemSpec;
 
 export namespace WalletVaultItemSpec {
   export interface LinkWalletVaultItemSpec {
@@ -3861,6 +4112,14 @@ export namespace WalletVaultItemSpec {
       client: Authorization.KernelManagedOAuthClient | Authorization.CustomerManagedOAuthClient;
 
       method: 'oauth';
+
+      /**
+       * Who refreshes an imported Link grant. kernel (default) means Kernel holds and
+       * rotates the refresh token. customer means your backend keeps the refresh token
+       * and replaces the access token with update_access_token; Kernel never refreshes
+       * or revokes the grant. Fixed at wallet creation.
+       */
+      token_refresh?: 'kernel' | 'customer';
     }
 
     export namespace Authorization {
@@ -3939,7 +4198,8 @@ export type WalletVaultItemState =
   | WalletVaultItemState.LinkWalletState
   | WalletVaultItemState.AgentCardWalletState
   | KernelWalletState
-  | ShopPayWalletState;
+  | ShopPayWalletState
+  | VgsWalletState;
 
 export namespace WalletVaultItemState {
   export interface LinkWalletState {
@@ -4187,6 +4447,7 @@ export type ItemPerformOperationParams =
   | ItemPerformOperationParams.OnePasswordFillVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordRecoverVaultItemOperationRequest
   | ItemPerformOperationParams.OnePasswordUpdateAccessTokenVaultItemOperationRequest
+  | ItemPerformOperationParams.UpdateAccessTokenVaultItemOperationRequest
   | ItemPerformOperationParams.WebmcpInvokeVaultItemOperationRequest
   | ItemPerformOperationParams.AddPaymentMethodVaultItemOperationRequest
   | ItemPerformOperationParams.RemovePaymentMethodVaultItemOperationRequest;
@@ -4507,8 +4768,8 @@ export declare namespace ItemPerformOperationParams {
     type: '1pw_fill';
 
     /**
-     * Body param: ID of an approved request entry. Required when several approved
-     * entries have the page's origin.
+     * Body param: ID of an approved request entry. Required when several entries are
+     * approved and the page's origin does not match exactly one of them.
      */
     entry_id?: string;
 
@@ -4560,6 +4821,23 @@ export declare namespace ItemPerformOperationParams {
     access_token_expires_at?: string;
   }
 
+  export interface UpdateAccessTokenVaultItemOperationRequest {
+    /**
+     * Path param
+     */
+    id_or_name: string;
+
+    /**
+     * Body param
+     */
+    access_token: string;
+
+    /**
+     * Body param
+     */
+    type: 'update_access_token';
+  }
+
   export interface WebmcpInvokeVaultItemOperationRequest {
     /**
      * Path param
@@ -4670,7 +4948,8 @@ export declare namespace ItemUpsertParams {
       | WalletVaultItemRequest.LinkWalletVaultItemRequestSpec
       | WalletVaultItemRequest.AgentCardWalletVaultItemSpec
       | KernelWalletVaultItemSpec
-      | ShopPayWalletVaultItemSpec;
+      | ShopPayWalletVaultItemSpec
+      | VgsWalletVaultItemSpec;
 
     /**
      * Body param
@@ -4713,7 +4992,16 @@ export declare namespace ItemUpsertParams {
        * wallet with state.status=connected. An expired, invalid, revoked, or
        * insufficiently scoped access token returns 400 and no wallet is created. Refresh
        * expired tokens in your backend before importing them. A failed import does not
-       * modify existing wallets. After successful import, Kernel owns subsequent
+       * modify existing wallets. By default (token_refresh=kernel), Kernel owns
+       * subsequent refresh-token rotation after a successful import; the customer must
+       * stop refreshing this grant. With token_refresh=customer, send only the access
+       * token: your backend keeps the refresh token and rotates the grant, and Kernel
+       * never refreshes or revokes it. When Link rejects the stored access token, any
+       * operation that reaches Link, such as creating, authorizing or filling a card,
+       * returns 409 with code access_token_rejected without contacting Link again. Push
+       * a fresh access token with the wallet's update_access_token operation, then retry
+       * the operation. The remainder of this description applies to
+       * token_refresh=kernel. With token_refresh=kernel, Kernel owns subsequent
        * refresh-token rotation; the customer must stop refreshing this grant. Import
        * does not verify the refresh token: if it or the configured client credentials
        * are rejected during a later refresh, the imported wallet becomes degraded. An
@@ -4740,13 +5028,22 @@ export declare namespace ItemUpsertParams {
         method: 'oauth';
 
         /**
-         * Send the token pair from your backend. Both tokens must be from the same Link
-         * grant under the referenced client. Supply a currently valid access token. Kernel
-         * refreshes when needed after import and uses the expiry returned by Link for
-         * subsequent tokens. Tokens are never returned in wallet responses, events, or
+         * Send the tokens from your backend. Supply a currently valid access token. With
+         * token_refresh=kernel, also send the refresh token from the same Link grant under
+         * the referenced client; Kernel refreshes when needed after import and uses the
+         * expiry returned by Link for subsequent tokens. With token_refresh=customer, omit
+         * the refresh token. Tokens are never returned in wallet responses, events, or
          * logs.
          */
         tokens: ImportedLinkAuthorizationInput.Tokens;
+
+        /**
+         * Who refreshes an imported Link grant. kernel (default) means Kernel holds and
+         * rotates the refresh token. customer means your backend keeps the refresh token
+         * and replaces the access token with update_access_token; Kernel never refreshes
+         * or revokes the grant. Fixed at wallet creation.
+         */
+        token_refresh?: 'kernel' | 'customer';
       }
 
       export namespace ImportedLinkAuthorizationInput {
@@ -4775,16 +5072,20 @@ export declare namespace ItemUpsertParams {
         }
 
         /**
-         * Send the token pair from your backend. Both tokens must be from the same Link
-         * grant under the referenced client. Supply a currently valid access token. Kernel
-         * refreshes when needed after import and uses the expiry returned by Link for
-         * subsequent tokens. Tokens are never returned in wallet responses, events, or
+         * Send the tokens from your backend. Supply a currently valid access token. With
+         * token_refresh=kernel, also send the refresh token from the same Link grant under
+         * the referenced client; Kernel refreshes when needed after import and uses the
+         * expiry returned by Link for subsequent tokens. With token_refresh=customer, omit
+         * the refresh token. Tokens are never returned in wallet responses, events, or
          * logs.
          */
         export interface Tokens {
           access_token: string;
 
-          refresh_token: string;
+          /**
+           * Required with token_refresh=kernel; rejected with token_refresh=customer.
+           */
+          refresh_token?: string;
         }
       }
     }
@@ -4951,6 +5252,7 @@ export declare namespace Items {
     type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput,
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
     type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec,
+    type KernelSingleUseCard as KernelSingleUseCard,
     type KernelWalletState as KernelWalletState,
     type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
     type LinkShippingAddress as LinkShippingAddress,
@@ -4982,6 +5284,7 @@ export declare namespace Items {
     type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec,
     type ShopPayWalletState as ShopPayWalletState,
     type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec,
+    type SingleUseCardBillingAddress as SingleUseCardBillingAddress,
     type VaultCardAliases as VaultCardAliases,
     type VaultCardFillField as VaultCardFillField,
     type VaultCheckoutContext as VaultCheckoutContext,
@@ -4993,6 +5296,11 @@ export declare namespace Items {
     type VaultItemOperationResponse as VaultItemOperationResponse,
     type VaultPaymentMethod as VaultPaymentMethod,
     type VaultWebmcpBinding as VaultWebmcpBinding,
+    type VgsCardInput as VgsCardInput,
+    type VgsCardState as VgsCardState,
+    type VgsCardVaultItemSpec as VgsCardVaultItemSpec,
+    type VgsWalletState as VgsWalletState,
+    type VgsWalletVaultItemSpec as VgsWalletVaultItemSpec,
     type WalletVaultItemSpec as WalletVaultItemSpec,
     type WalletVaultItemState as WalletVaultItemState,
     type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest,

package/src/resources/vaults/vaults.ts

@@ -48,6 +48,7 @@ import {
   KernelCredentialVaultItemSpecInput,
   KernelCredentialVaultItemState,
   KernelPaymentRequestVaultItemSpec,
+  KernelSingleUseCard,
   KernelWalletState,
   KernelWalletVaultItemSpec,
   LinkShippingAddress,
@@ -79,6 +80,7 @@ import {
   ShopPayCardVaultItemSpec,
   ShopPayWalletState,
   ShopPayWalletVaultItemSpec,
+  SingleUseCardBillingAddress,
   VaultCardAliases,
   VaultCardFillField,
   VaultCheckoutContext,
@@ -90,6 +92,11 @@ import {
   VaultItemOperationResponse,
   VaultPaymentMethod,
   VaultWebmcpBinding,
+  VgsCardInput,
+  VgsCardState,
+  VgsCardVaultItemSpec,
+  VgsWalletState,
+  VgsWalletVaultItemSpec,
   WalletVaultItemSpec,
   WalletVaultItemState,
   WebmcpInvokeVaultItemOperationRequest,
@@ -320,6 +327,7 @@ export declare namespace Vaults {
     type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput,
     type KernelCredentialVaultItemState as KernelCredentialVaultItemState,
     type KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec,
+    type KernelSingleUseCard as KernelSingleUseCard,
     type KernelWalletState as KernelWalletState,
     type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec,
     type LinkShippingAddress as LinkShippingAddress,
@@ -351,6 +359,7 @@ export declare namespace Vaults {
     type ShopPayCardVaultItemSpec as ShopPayCardVaultItemSpec,
     type ShopPayWalletState as ShopPayWalletState,
     type ShopPayWalletVaultItemSpec as ShopPayWalletVaultItemSpec,
+    type SingleUseCardBillingAddress as SingleUseCardBillingAddress,
     type VaultCardAliases as VaultCardAliases,
     type VaultCardFillField as VaultCardFillField,
     type VaultCheckoutContext as VaultCheckoutContext,
@@ -362,6 +371,11 @@ export declare namespace Vaults {
     type VaultItemOperationResponse as VaultItemOperationResponse,
     type VaultPaymentMethod as VaultPaymentMethod,
     type VaultWebmcpBinding as VaultWebmcpBinding,
+    type VgsCardInput as VgsCardInput,
+    type VgsCardState as VgsCardState,
+    type VgsCardVaultItemSpec as VgsCardVaultItemSpec,
+    type VgsWalletState as VgsWalletState,
+    type VgsWalletVaultItemSpec as VgsWalletVaultItemSpec,
     type WalletVaultItemSpec as WalletVaultItemSpec,
     type WalletVaultItemState as WalletVaultItemState,
     type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest,

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.139.0'; // x-release-please-version
+export const VERSION = '0.141.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.139.0";
+export declare const VERSION = "0.141.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.139.0";
+export declare const VERSION = "0.141.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.139.0'; // x-release-please-version
+exports.VERSION = '0.141.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map