kernel 0.116.0__tar.gz → 0.117.0__tar.gz

kernel-0.117.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.117.0"
+}

{kernel-0.116.0 → kernel-0.117.0}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.117.0](https://github.com/kernel/kernel-python-sdk/compare/v0.116.0...v0.117.0) (2026-10-02)
+
+
+### Features
+
+* Invoke WebMCP tools with vault item fields ([a75eb77](https://github.com/kernel/kernel-python-sdk/commit/a75eb77bb3722e82b45836e1b9f5f6fc43dfa4ff))
+
 ## [0.116.0](https://github.com/kernel/kernel-python-sdk/compare/v0.115.0...v0.116.0) (2026-10-01)
 
 

{kernel-0.116.0 → kernel-0.117.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.116.0
+Version: 0.117.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.116.0 → kernel-0.117.0}/api.md

@@ -596,8 +596,11 @@ from kernel.types.vaults import (
     VaultItemEvent,
     VaultItemOperationResponse,
     VaultPaymentMethod,
+    VaultWebmcpBinding,
     WalletVaultItemSpec,
     WalletVaultItemState,
+    WebmcpInvokeVaultItemOperationRequest,
+    WebmcpInvokeVaultItemOperationResult,
     ItemListResponse,
     ItemEventsResponse,
 )

{kernel-0.116.0 → kernel-0.117.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.116.0"
+version = "0.117.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.116.0"  # x-release-please-version
+__version__ = "0.117.0"  # x-release-please-version

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/resources/vaults/items.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Any, List, Union, Iterable, cast
+from typing import Any, Dict, List, Union, Iterable, cast
 from datetime import datetime
 from typing_extensions import Literal, overload
 
@@ -31,6 +31,7 @@ from ...types.vaults.item_list_response import ItemListResponse
 from ...types.vaults.item_events_response import ItemEventsResponse
 from ...types.vaults.vault_fill_field_param import VaultFillFieldParam
 from ...types.vaults.card_vault_item_spec_param import CardVaultItemSpecParam
+from ...types.vaults.vault_webmcp_binding_param import VaultWebmcpBindingParam
 from ...types.vaults.vault_checkout_context_param import VaultCheckoutContextParam
 from ...types.vaults.vault_item_operation_response import VaultItemOperationResponse
 from ...types.vaults.credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
@@ -857,6 +858,73 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -864,6 +932,7 @@ class ItemsResource(SyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     def perform_operation(
         self,
@@ -878,7 +947,8 @@ class ItemsResource(SyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -891,6 +961,10 @@ class ItemsResource(SyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -921,6 +995,10 @@ class ItemsResource(SyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),
@@ -1954,6 +2032,73 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -1961,6 +2106,7 @@ class AsyncItemsResource(AsyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     async def perform_operation(
         self,
@@ -1975,7 +2121,8 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -1988,6 +2135,10 @@ class AsyncItemsResource(AsyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -2018,6 +2169,10 @@ class AsyncItemsResource(AsyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/__init__.py

@@ -23,6 +23,7 @@ from .wallet_vault_item_state import WalletVaultItemState as WalletVaultItemStat
 from .one_password_oauth_action import OnePasswordOAuthAction as OnePasswordOAuthAction
 from .card_vault_item_spec_param import CardVaultItemSpecParam as CardVaultItemSpecParam
 from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVaultItemSpec
+from .vault_webmcp_binding_param import VaultWebmcpBindingParam as VaultWebmcpBindingParam
 from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
 from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
 from .agentcard_prepared_processor import AgentcardPreparedProcessor as AgentcardPreparedProcessor
@@ -60,6 +61,9 @@ from .one_password_credential_vault_item_spec import (
 from .one_password_credential_vault_item_state import (
     OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState,
 )
+from .webmcp_invoke_vault_item_operation_result import (
+    WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult,
+)
 from .collect_vault_item_operation_request_param import (
     CollectVaultItemOperationRequestParam as CollectVaultItemOperationRequestParam,
 )
@@ -81,6 +85,9 @@ from .kernel_credential_vault_item_spec_input_param import (
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .webmcp_invoke_vault_item_operation_request_param import (
+    WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
+)
 from .one_password_credential_vault_item_spec_input_param import (
     OnePasswordCredentialVaultItemSpecInputParam as OnePasswordCredentialVaultItemSpecInputParam,
 )

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/credential_account_vault_item.py

@@ -40,6 +40,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -47,6 +47,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/item_perform_operation_params.py

@@ -2,13 +2,14 @@
 
 from __future__ import annotations
 
-from typing import Union, Iterable
+from typing import Dict, Union, Iterable
 from datetime import datetime
 from typing_extensions import Literal, Required, Annotated, TypeAlias, TypedDict
 
 from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
 from .vault_fill_field_param import VaultFillFieldParam
+from .vault_webmcp_binding_param import VaultWebmcpBindingParam
 from .vault_checkout_context_param import VaultCheckoutContextParam
 
 __all__ = [
@@ -22,6 +23,7 @@ __all__ = [
     "OnePasswordFillVaultItemOperationRequest",
     "OnePasswordRecoverVaultItemOperationRequest",
     "OnePasswordUpdateAccessTokenVaultItemOperationRequest",
+    "WebmcpInvokeVaultItemOperationRequest",
 ]
 
 
@@ -141,6 +143,39 @@ class OnePasswordUpdateAccessTokenVaultItemOperationRequest(TypedDict, total=Fal
     """Optional supplied expiry. Omit to clear the old expiry."""
 
 
+class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    bindings: Required[Iterable[VaultWebmcpBindingParam]]
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    input: Required[Dict[str, object]]
+    """Public tool arguments with an existing null slot at each binding path.
+
+    At most 64 KiB after JSON serialization, including substituted values. Never
+    include vault values here.
+    """
+
+    page_url: Required[str]
+    """Exact top-level URL from the discovered tool source (fragment omitted).
+
+    This pins the target page; it does not authorize a destination.
+    """
+
+    tool_ref: Required[str]
+    """Opaque reference to the exact live WebMCP registration."""
+
+    type: Required[Literal["webmcp_invoke"]]
+
+    timeout_sec: int
+    """
+    Tool invocation timeout in seconds; preflight and response handling have an
+    additional bounded allowance. An indeterminate outcome is not retried.
+    """
+
+
 ItemPerformOperationParams: TypeAlias = Union[
     AuthorizeVaultItemOperationRequest,
     CollectVaultItemOperationRequest,
@@ -151,4 +186,5 @@ ItemPerformOperationParams: TypeAlias = Union[
     OnePasswordFillVaultItemOperationRequest,
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordUpdateAccessTokenVaultItemOperationRequest,
+    WebmcpInvokeVaultItemOperationRequest,
 ]

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/vault_item.py

@@ -55,6 +55,7 @@ class WalletVaultItemAvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 
@@ -129,6 +130,7 @@ class CardVaultItemAvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

{kernel-0.116.0 → kernel-0.117.0}/src/kernel/types/vaults/vault_item_operation_response.py

@@ -14,6 +14,7 @@ from .wallet_vault_item_spec import WalletVaultItemSpec
 from .wallet_vault_item_state import WalletVaultItemState
 from .credential_account_vault_item import CredentialAccountVaultItem
 from .fill_vault_item_operation_result import FillVaultItemOperationResult
+from .webmcp_invoke_vault_item_operation_result import WebmcpInvokeVaultItemOperationResult
 from .one_password_fill_vault_item_operation_result import OnePasswordFillVaultItemOperationResult
 
 __all__ = [
@@ -56,6 +57,7 @@ class WalletVaultItemAvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 
@@ -130,6 +132,7 @@ class CardVaultItemAvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 
@@ -170,4 +173,5 @@ VaultItemOperationResponse: TypeAlias = Union[
     CredentialVaultItem,
     FillVaultItemOperationResult,
     OnePasswordFillVaultItemOperationResult,
+    WebmcpInvokeVaultItemOperationResult,
 ]

kernel-0.117.0/src/kernel/types/vaults/vault_webmcp_binding_param.py

@@ -0,0 +1,28 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+__all__ = ["VaultWebmcpBindingParam"]
+
+
+class VaultWebmcpBindingParam(TypedDict, total=False):
+    field: Required[str]
+    """A declared, populated credential field or supported card field.
+
+    A TOTP field supplies a fresh code, never its seed.
+    """
+
+    input_path: Required[str]
+    """RFC 6901 JSON Pointer to an existing null value in input.
+
+    Object keys are exact; array indices must be canonical and in range. No root or
+    array-append paths. Each path and each field may occur only once.
+    """
+
+    format: str
+    """Required for card expiration (MM/YY or MM/YYYY), forbidden for other fields.
+
+    Invalid formats are rejected before invocation.
+    """

kernel-0.117.0/src/kernel/types/vaults/webmcp_invoke_vault_item_operation_request_param.py

@@ -0,0 +1,53 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Dict, Iterable
+from typing_extensions import Literal, Required, TypedDict
+
+from .vault_webmcp_binding_param import VaultWebmcpBindingParam
+
+__all__ = ["WebmcpInvokeVaultItemOperationRequestParam"]
+
+
+class WebmcpInvokeVaultItemOperationRequestParam(TypedDict, total=False):
+    """Invoke a WebMCP tool using values from a vaulted item.
+
+    The browser must be
+    attached to the item's vault. Discover the tool_ref, inputSchema, and source
+    with GET /browsers/{id_or_name}/webmcp/tools or webmcp.listTools() in the
+    Browser REPL (POST /browsers/{id_or_name}/repl) before invoking it.
+    Input paths replace existing null slots in input. Tool output is returned
+    without redaction and may include the supplied values. The tool may submit
+    or perform other side effects. Any item destination
+    restrictions apply to the tool's top-level page and registering frame (if any).
+    """
+
+    bindings: Required[Iterable[VaultWebmcpBindingParam]]
+
+    browser_id: Required[str]
+    """Browser session ID, not a reusable browser name."""
+
+    input: Required[Dict[str, object]]
+    """Public tool arguments with an existing null slot at each binding path.
+
+    At most 64 KiB after JSON serialization, including substituted values. Never
+    include vault values here.
+    """
+
+    page_url: Required[str]
+    """Exact top-level URL from the discovered tool source (fragment omitted).
+
+    This pins the target page; it does not authorize a destination.
+    """
+
+    tool_ref: Required[str]
+    """Opaque reference to the exact live WebMCP registration."""
+
+    type: Required[Literal["webmcp_invoke"]]
+
+    timeout_sec: int
+    """
+    Tool invocation timeout in seconds; preflight and response handling have an
+    additional bounded allowance. An indeterminate outcome is not retried.
+    """

kernel-0.117.0/src/kernel/types/vaults/webmcp_invoke_vault_item_operation_result.py

@@ -0,0 +1,37 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+
+__all__ = ["WebmcpInvokeVaultItemOperationResult"]
+
+
+class WebmcpInvokeVaultItemOperationResult(BaseModel):
+    """
+    Returns the same tool result fields as the browser WebMCP invoke API, plus the vault operation discriminator. Output and error text are untrusted page-provided data, returned without redaction; tools may include supplied vault values. Inspect the browser page to determine whether the intended site action succeeded.
+    """
+
+    status: Literal["completed", "canceled", "error", "awaiting_submission", "unknown"]
+    """Unknown means invocation may have run; do not retry automatically.
+
+    No status confirms that the website accepted the action.
+    """
+
+    type: Literal["webmcp_invoke"]
+
+    error_text: Optional[str] = None
+    """Untrusted page-provided error text, returned without redaction.
+
+    May contain supplied vault values.
+    """
+
+    invocation_id: Optional[str] = None
+    """Present when the browser reported one."""
+
+    output: Optional[object] = None
+    """Untrusted page-provided output, returned without redaction.
+
+    May contain supplied vault values.
+    """