kernel 0.116.0__tar.gz → 0.118.0__tar.gz

kernel-0.118.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.118.0"
+}

{kernel-0.116.0 → kernel-0.118.0}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.118.0](https://github.com/kernel/kernel-python-sdk/compare/v0.117.0...v0.118.0) (2026-10-02)
+
+
+### Features
+
+* Add a query filter to the vault list endpoint ([eaa17a1](https://github.com/kernel/kernel-python-sdk/commit/eaa17a1e7068bb70abe9f07f4bba1c818ddeeba1))
+* Add Kernel wallets backed by VGS agentic network tokens, with hosted card capture ([04d839e](https://github.com/kernel/kernel-python-sdk/commit/04d839e6bb948049d3683380efeaae5a3732c959))
+
+## [0.117.0](https://github.com/kernel/kernel-python-sdk/compare/v0.116.0...v0.117.0) (2026-10-02)
+
+
+### Features
+
+* Invoke WebMCP tools with vault item fields ([a75eb77](https://github.com/kernel/kernel-python-sdk/commit/a75eb77bb3722e82b45836e1b9f5f6fc43dfa4ff))
+
 ## [0.116.0](https://github.com/kernel/kernel-python-sdk/compare/v0.115.0...v0.116.0) (2026-10-01)
 
 

{kernel-0.116.0 → kernel-0.118.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.116.0
+Version: 0.118.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.116.0 → kernel-0.118.0}/api.md

@@ -572,9 +572,13 @@ from kernel.types.vaults import (
     CredentialVaultItemUpdateRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
+    KernelCardState,
+    KernelCardVaultItemSpec,
     KernelCredentialVaultItemSpec,
     KernelCredentialVaultItemSpecInput,
     KernelCredentialVaultItemState,
+    KernelWalletState,
+    KernelWalletVaultItemSpec,
     OnePasswordCredentialAccountSpec,
     OnePasswordCredentialAccountState,
     OnePasswordCredentialVaultItemSpec,
@@ -596,8 +600,11 @@ from kernel.types.vaults import (
     VaultItemEvent,
     VaultItemOperationResponse,
     VaultPaymentMethod,
+    VaultWebmcpBinding,
     WalletVaultItemSpec,
     WalletVaultItemState,
+    WebmcpInvokeVaultItemOperationRequest,
+    WebmcpInvokeVaultItemOperationResult,
     ItemListResponse,
     ItemEventsResponse,
 )

{kernel-0.116.0 → kernel-0.118.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.116.0"
+version = "0.118.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.116.0"  # x-release-please-version
+__version__ = "0.118.0"  # x-release-please-version

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/resources/vaults/items.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Any, List, Union, Iterable, cast
+from typing import Any, Dict, List, Union, Iterable, cast
 from datetime import datetime
 from typing_extensions import Literal, overload
 
@@ -31,6 +31,7 @@ from ...types.vaults.item_list_response import ItemListResponse
 from ...types.vaults.item_events_response import ItemEventsResponse
 from ...types.vaults.vault_fill_field_param import VaultFillFieldParam
 from ...types.vaults.card_vault_item_spec_param import CardVaultItemSpecParam
+from ...types.vaults.vault_webmcp_binding_param import VaultWebmcpBindingParam
 from ...types.vaults.vault_checkout_context_param import VaultCheckoutContextParam
 from ...types.vaults.vault_item_operation_response import VaultItemOperationResponse
 from ...types.vaults.credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
@@ -308,10 +309,13 @@ class ItemsResource(SyncAPIResource):
     ) -> None:
         """
         Unresolved payment operations normally block deletion, including operations on
-        child cards of a wallet. An AgentCard card in recovery_required whose checkout
-        create response returned no authorization ID may be explicitly abandoned by
-        deleting that card directly; deleting its wallet or vault remains blocked.
-        Deleting or recreating an item is not proof that a payment did not occur.
+        child cards of a wallet. Deleting a connected Kernel wallet first blocks new
+        payments on it, then removes its enrolled card. If that fails, the wallet is
+        kept and keeps refusing payments; retry the deletion. An AgentCard card in
+        recovery_required whose checkout create response returned no authorization ID
+        may be explicitly abandoned by deleting that card directly; deleting its wallet
+        or vault remains blocked. Deleting or recreating an item is not proof that a
+        payment did not occur.
 
         Args:
           extra_headers: Send extra headers
@@ -857,6 +861,73 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -864,6 +935,7 @@ class ItemsResource(SyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     def perform_operation(
         self,
@@ -878,7 +950,8 @@ class ItemsResource(SyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -891,6 +964,10 @@ class ItemsResource(SyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -921,6 +998,10 @@ class ItemsResource(SyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),
@@ -1405,10 +1486,13 @@ class AsyncItemsResource(AsyncAPIResource):
     ) -> None:
         """
         Unresolved payment operations normally block deletion, including operations on
-        child cards of a wallet. An AgentCard card in recovery_required whose checkout
-        create response returned no authorization ID may be explicitly abandoned by
-        deleting that card directly; deleting its wallet or vault remains blocked.
-        Deleting or recreating an item is not proof that a payment did not occur.
+        child cards of a wallet. Deleting a connected Kernel wallet first blocks new
+        payments on it, then removes its enrolled card. If that fails, the wallet is
+        kept and keeps refusing payments; retry the deletion. An AgentCard card in
+        recovery_required whose checkout create response returned no authorization ID
+        may be explicitly abandoned by deleting that card directly; deleting its wallet
+        or vault remains blocked. Deleting or recreating an item is not proof that a
+        payment did not occur.
 
         Args:
           extra_headers: Send extra headers
@@ -1954,6 +2038,73 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
@@ -1961,6 +2112,7 @@ class AsyncItemsResource(AsyncAPIResource):
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     async def perform_operation(
         self,
@@ -1975,7 +2127,8 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -1988,6 +2141,10 @@ class AsyncItemsResource(AsyncAPIResource):
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -2018,6 +2175,10 @@ class AsyncItemsResource(AsyncAPIResource):
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/resources/vaults/vaults.py

@@ -92,6 +92,7 @@ class VaultsResource(SyncAPIResource):
         *,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
+        query: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -103,6 +104,8 @@ class VaultsResource(SyncAPIResource):
         List vaults in the current project
 
         Args:
+          query: Case-insensitive substring match against vault name. IDs match by exact value.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -123,6 +126,7 @@ class VaultsResource(SyncAPIResource):
                     {
                         "limit": limit,
                         "offset": offset,
+                        "query": query,
                     },
                     vault_list_params.VaultListParams,
                 ),
@@ -143,9 +147,11 @@ class VaultsResource(SyncAPIResource):
     ) -> None:
         """Unresolved payment operations block deletion.
 
-        Reconcile the original attempt
-        with the provider or support first; deleting or recreating an item is not proof
-        that a payment did not occur.
+        Deleting a connected Kernel wallet
+        first blocks new payments on it, then removes its enrolled card. If that fails,
+        the wallet is kept and keeps refusing payments; retry the deletion. Reconcile
+        the original attempt with the provider or support first; deleting or recreating
+        an item is not proof that a payment did not occur.
 
         Args:
           extra_headers: Send extra headers
@@ -266,6 +272,7 @@ class AsyncVaultsResource(AsyncAPIResource):
         *,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
+        query: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -277,6 +284,8 @@ class AsyncVaultsResource(AsyncAPIResource):
         List vaults in the current project
 
         Args:
+          query: Case-insensitive substring match against vault name. IDs match by exact value.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -297,6 +306,7 @@ class AsyncVaultsResource(AsyncAPIResource):
                     {
                         "limit": limit,
                         "offset": offset,
+                        "query": query,
                     },
                     vault_list_params.VaultListParams,
                 ),
@@ -317,9 +327,11 @@ class AsyncVaultsResource(AsyncAPIResource):
     ) -> None:
         """Unresolved payment operations block deletion.
 
-        Reconcile the original attempt
-        with the provider or support first; deleting or recreating an item is not proof
-        that a payment did not occur.
+        Deleting a connected Kernel wallet
+        first blocks new payments on it, then removes its enrolled card. If that fails,
+        the wallet is kept and keeps refusing payments; retry the deletion. Reconcile
+        the original attempt with the provider or support first; deleting or recreating
+        an item is not proof that a payment did not occur.
 
         Args:
           extra_headers: Send extra headers

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vault_list_params.py

@@ -11,3 +11,6 @@ class VaultListParams(TypedDict, total=False):
     limit: int
 
     offset: int
+
+    query: str
+    """Case-insensitive substring match against vault name. IDs match by exact value."""

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/__init__.py

@@ -4,12 +4,14 @@ from __future__ import annotations
 
 from .vault_item import VaultItem as VaultItem
 from .vault_item_event import VaultItemEvent as VaultItemEvent
+from .kernel_card_state import KernelCardState as KernelCardState
 from .vault_item_action import VaultItemAction as VaultItemAction
 from .item_events_params import ItemEventsParams as ItemEventsParams
 from .item_list_response import ItemListResponse as ItemListResponse
 from .item_update_params import ItemUpdateParams as ItemUpdateParams
 from .item_upsert_params import ItemUpsertParams as ItemUpsertParams
 from .vault_card_aliases import VaultCardAliases as VaultCardAliases
+from .kernel_wallet_state import KernelWalletState as KernelWalletState
 from .card_vault_item_spec import CardVaultItemSpec as CardVaultItemSpec
 from .item_events_response import ItemEventsResponse as ItemEventsResponse
 from .item_retrieve_params import ItemRetrieveParams as ItemRetrieveParams
@@ -23,24 +25,29 @@ from .wallet_vault_item_state import WalletVaultItemState as WalletVaultItemStat
 from .one_password_oauth_action import OnePasswordOAuthAction as OnePasswordOAuthAction
 from .card_vault_item_spec_param import CardVaultItemSpecParam as CardVaultItemSpecParam
 from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVaultItemSpec
+from .vault_webmcp_binding_param import VaultWebmcpBindingParam as VaultWebmcpBindingParam
 from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
 from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
+from .kernel_card_vault_item_spec import KernelCardVaultItemSpec as KernelCardVaultItemSpec
 from .agentcard_prepared_processor import AgentcardPreparedProcessor as AgentcardPreparedProcessor
 from .credential_collection_action import CredentialCollectionAction as CredentialCollectionAction
 from .credential_vault_field_state import CredentialVaultFieldState as CredentialVaultFieldState
 from .vault_checkout_context_param import VaultCheckoutContextParam as VaultCheckoutContextParam
 from .credential_account_vault_item import CredentialAccountVaultItem as CredentialAccountVaultItem
 from .item_perform_operation_params import ItemPerformOperationParams as ItemPerformOperationParams
+from .kernel_wallet_vault_item_spec import KernelWalletVaultItemSpec as KernelWalletVaultItemSpec
 from .vault_item_operation_response import VaultItemOperationResponse as VaultItemOperationResponse
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation as AgentcardCheckoutPreparation
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization
 from .fill_vault_item_operation_result import FillVaultItemOperationResult as FillVaultItemOperationResult
 from .credential_vault_field_definition import CredentialVaultFieldDefinition as CredentialVaultFieldDefinition
+from .kernel_card_vault_item_spec_param import KernelCardVaultItemSpecParam as KernelCardVaultItemSpecParam
 from .kernel_credential_vault_item_spec import KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec
 from .credential_vault_field_input_param import CredentialVaultFieldInputParam as CredentialVaultFieldInputParam
 from .kernel_credential_vault_item_state import KernelCredentialVaultItemState as KernelCredentialVaultItemState
 from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam as CredentialVaultFieldUpdateParam
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
+from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -60,6 +67,9 @@ from .one_password_credential_vault_item_spec import (
 from .one_password_credential_vault_item_state import (
     OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState,
 )
+from .webmcp_invoke_vault_item_operation_result import (
+    WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult,
+)
 from .collect_vault_item_operation_request_param import (
     CollectVaultItemOperationRequestParam as CollectVaultItemOperationRequestParam,
 )
@@ -81,6 +91,9 @@ from .kernel_credential_vault_item_spec_input_param import (
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .webmcp_invoke_vault_item_operation_request_param import (
+    WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
+)
 from .one_password_credential_vault_item_spec_input_param import (
     OnePasswordCredentialVaultItemSpecInputParam as OnePasswordCredentialVaultItemSpecInputParam,
 )

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/authorize_vault_item_operation_request_param.py

@@ -8,7 +8,7 @@ __all__ = ["AuthorizeVaultItemOperationRequestParam"]
 
 
 class AuthorizeVaultItemOperationRequestParam(TypedDict, total=False):
-    """Authorize a Link card using its existing purchase specification.
+    """Authorize a Link or Kernel card using its existing purchase specification.
 
     Use only after explicit user approval and when the item advertises authorize. Do not automatically retry provider failures or indeterminate outcomes. Checkout context is not accepted.
     """

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/card_vault_item_spec.py

@@ -5,6 +5,7 @@ from typing_extensions import Literal, Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from ..._models import BaseModel
+from .kernel_card_vault_item_spec import KernelCardVaultItemSpec
 
 __all__ = [
     "CardVaultItemSpec",
@@ -133,5 +134,6 @@ class AgentCardCardVaultItemSpec(BaseModel):
 
 
 CardVaultItemSpec: TypeAlias = Annotated[
-    Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec], PropertyInfo(discriminator="provider")
+    Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec, KernelCardVaultItemSpec],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/card_vault_item_spec_param.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 from typing import Dict, Union, Iterable
 from typing_extensions import Literal, Required, TypeAlias, TypedDict
 
+from .kernel_card_vault_item_spec_param import KernelCardVaultItemSpecParam
+
 __all__ = [
     "CardVaultItemSpecParam",
     "LinkCardVaultItemSpec",
@@ -131,4 +133,6 @@ class AgentCardCardVaultItemSpec(TypedDict, total=False):
     """
 
 
-CardVaultItemSpecParam: TypeAlias = Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec]
+CardVaultItemSpecParam: TypeAlias = Union[
+    LinkCardVaultItemSpec, AgentCardCardVaultItemSpec, KernelCardVaultItemSpecParam
+]

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/card_vault_item_state.py

@@ -7,6 +7,7 @@ from pydantic import Field as FieldInfo
 
 from ..._utils import PropertyInfo
 from ..._models import BaseModel
+from .kernel_card_state import KernelCardState
 from .vault_card_aliases import VaultCardAliases
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization
@@ -19,6 +20,9 @@ class LinkCardStateMasks(BaseModel):
 
     last4: Optional[str] = None
 
+    token_last4: Optional[str] = None
+    """Last four digits of the network token presented to the merchant."""
+
     if TYPE_CHECKING:
         # Some versions of Pydantic <2.8.0 have a bug and don’t allow assigning a
         # value to this field, so for compatibility we avoid doing it at runtime.
@@ -64,6 +68,9 @@ class AgentCardCardStateMasks(BaseModel):
 
     last4: Optional[str] = None
 
+    token_last4: Optional[str] = None
+    """Last four digits of the network token presented to the merchant."""
+
     if TYPE_CHECKING:
         # Some versions of Pydantic <2.8.0 have a bug and don’t allow assigning a
         # value to this field, so for compatibility we avoid doing it at runtime.
@@ -127,5 +134,5 @@ class AgentCardCardState(BaseModel):
 
 
 CardVaultItemState: TypeAlias = Annotated[
-    Union[LinkCardState, AgentCardCardState], PropertyInfo(discriminator="provider")
+    Union[LinkCardState, AgentCardCardState, KernelCardState], PropertyInfo(discriminator="provider")
 ]

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/credential_account_vault_item.py

@@ -40,6 +40,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -47,6 +47,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

{kernel-0.116.0 → kernel-0.118.0}/src/kernel/types/vaults/fill_vault_item_operation_request_param.py

@@ -12,8 +12,8 @@ __all__ = ["FillVaultItemOperationRequestParam"]
 
 class FillVaultItemOperationRequestParam(TypedDict, total=False):
     """
-    Fill selected fields from one ready credential or ready, unexpired Link card
-    into a browser linked to its vault.
+    Fill selected fields from one ready credential or ready, unexpired Link or
+    Kernel card into a browser linked to its vault.
     Only invoke when the item advertises `fill`. Browser and vault must belong
     to the same project. Kernel checks access and allowed destinations before
     filling; providing a page URL does not authorize a destination.
@@ -34,7 +34,7 @@ class FillVaultItemOperationRequestParam(TypedDict, total=False):
     Fill in request order and stop on the first failure. This operation is
     not atomic: previously filled fields are not rolled back. Never submit
     the form or click buttons, though input/change events may trigger site
-    behavior. Link cards use fill for browser checkout and do not expose
+    behavior. Link and Kernel cards use fill for browser checkout and do not expose
     aliases or support egress substitution. Do not automatically retry a
     failed or indeterminate operation.