kernel 0.117.0__tar.gz → 0.119.0__tar.gz

kernel-0.119.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.119.0"
+}

{kernel-0.117.0 → kernel-0.119.0}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.119.0](https://github.com/kernel/kernel-python-sdk/compare/v0.118.0...v0.119.0) (2026-10-02)
+
+
+### Features
+
+* Add managed auth provider to vault credential items ([795d824](https://github.com/kernel/kernel-python-sdk/commit/795d8241dfd22dc7667d7fd74c70182cc7467928))
+
+## [0.118.0](https://github.com/kernel/kernel-python-sdk/compare/v0.117.0...v0.118.0) (2026-10-02)
+
+
+### Features
+
+* Add a query filter to the vault list endpoint ([eaa17a1](https://github.com/kernel/kernel-python-sdk/commit/eaa17a1e7068bb70abe9f07f4bba1c818ddeeba1))
+* Add Kernel wallets backed by VGS agentic network tokens, with hosted card capture ([04d839e](https://github.com/kernel/kernel-python-sdk/commit/04d839e6bb948049d3683380efeaae5a3732c959))
+
 ## [0.117.0](https://github.com/kernel/kernel-python-sdk/compare/v0.116.0...v0.117.0) (2026-10-02)
 
 

{kernel-0.117.0 → kernel-0.119.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.117.0
+Version: 0.119.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.117.0 → kernel-0.119.0}/api.md

@@ -572,9 +572,17 @@ from kernel.types.vaults import (
     CredentialVaultItemUpdateRequest,
     FillVaultItemOperationRequest,
     FillVaultItemOperationResult,
+    KernelCardState,
+    KernelCardVaultItemSpec,
     KernelCredentialVaultItemSpec,
     KernelCredentialVaultItemSpecInput,
     KernelCredentialVaultItemState,
+    KernelWalletState,
+    KernelWalletVaultItemSpec,
+    ManagedAuthCredentialVaultField,
+    ManagedAuthCredentialVaultItemSpec,
+    ManagedAuthCredentialVaultItemSpecInput,
+    ManagedAuthCredentialVaultItemState,
     OnePasswordCredentialAccountSpec,
     OnePasswordCredentialAccountState,
     OnePasswordCredentialVaultItemSpec,

{kernel-0.117.0 → kernel-0.119.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.117.0"
+version = "0.119.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.117.0"  # x-release-please-version
+__version__ = "0.119.0"  # x-release-please-version

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/resources/vaults/items.py

@@ -93,6 +93,7 @@ class ItemsResource(SyncAPIResource):
               approval, or credential collection. Return the current item when ready or when
               the wait elapses. This does not wait for edits to an already-ready credential;
               poll GET without wait and compare version to observe changes after collect.
+              Managed auth credentials are created ready, so wait returns immediately.
 
           extra_headers: Send extra headers
 
@@ -309,10 +310,14 @@ class ItemsResource(SyncAPIResource):
     ) -> None:
         """
         Unresolved payment operations normally block deletion, including operations on
-        child cards of a wallet. An AgentCard card in recovery_required whose checkout
-        create response returned no authorization ID may be explicitly abandoned by
-        deleting that card directly; deleting its wallet or vault remains blocked.
-        Deleting or recreating an item is not proof that a payment did not occur.
+        child cards of a wallet. Deleting a connected Kernel wallet first blocks new
+        payments on it, then removes its enrolled card. If that fails, the wallet is
+        kept and keeps refusing payments; retry the deletion. An AgentCard card in
+        recovery_required whose checkout create response returned no authorization ID
+        may be explicitly abandoned by deleting that card directly; deleting its wallet
+        or vault remains blocked. Deleting or recreating an item is not proof that a
+        payment did not occur. Deleting a managed auth credential item leaves the
+        connection and its saved credential unchanged.
 
         Args:
           extra_headers: Send extra headers
@@ -1267,6 +1272,7 @@ class AsyncItemsResource(AsyncAPIResource):
               approval, or credential collection. Return the current item when ready or when
               the wait elapses. This does not wait for edits to an already-ready credential;
               poll GET without wait and compare version to observe changes after collect.
+              Managed auth credentials are created ready, so wait returns immediately.
 
           extra_headers: Send extra headers
 
@@ -1483,10 +1489,14 @@ class AsyncItemsResource(AsyncAPIResource):
     ) -> None:
         """
         Unresolved payment operations normally block deletion, including operations on
-        child cards of a wallet. An AgentCard card in recovery_required whose checkout
-        create response returned no authorization ID may be explicitly abandoned by
-        deleting that card directly; deleting its wallet or vault remains blocked.
-        Deleting or recreating an item is not proof that a payment did not occur.
+        child cards of a wallet. Deleting a connected Kernel wallet first blocks new
+        payments on it, then removes its enrolled card. If that fails, the wallet is
+        kept and keeps refusing payments; retry the deletion. An AgentCard card in
+        recovery_required whose checkout create response returned no authorization ID
+        may be explicitly abandoned by deleting that card directly; deleting its wallet
+        or vault remains blocked. Deleting or recreating an item is not proof that a
+        payment did not occur. Deleting a managed auth credential item leaves the
+        connection and its saved credential unchanged.
 
         Args:
           extra_headers: Send extra headers

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/resources/vaults/vaults.py

@@ -92,6 +92,7 @@ class VaultsResource(SyncAPIResource):
         *,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
+        query: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -103,6 +104,8 @@ class VaultsResource(SyncAPIResource):
         List vaults in the current project
 
         Args:
+          query: Case-insensitive substring match against vault name. IDs match by exact value.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -123,6 +126,7 @@ class VaultsResource(SyncAPIResource):
                     {
                         "limit": limit,
                         "offset": offset,
+                        "query": query,
                     },
                     vault_list_params.VaultListParams,
                 ),
@@ -143,9 +147,11 @@ class VaultsResource(SyncAPIResource):
     ) -> None:
         """Unresolved payment operations block deletion.
 
-        Reconcile the original attempt
-        with the provider or support first; deleting or recreating an item is not proof
-        that a payment did not occur.
+        Deleting a connected Kernel wallet
+        first blocks new payments on it, then removes its enrolled card. If that fails,
+        the wallet is kept and keeps refusing payments; retry the deletion. Reconcile
+        the original attempt with the provider or support first; deleting or recreating
+        an item is not proof that a payment did not occur.
 
         Args:
           extra_headers: Send extra headers
@@ -266,6 +272,7 @@ class AsyncVaultsResource(AsyncAPIResource):
         *,
         limit: int | Omit = omit,
         offset: int | Omit = omit,
+        query: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -277,6 +284,8 @@ class AsyncVaultsResource(AsyncAPIResource):
         List vaults in the current project
 
         Args:
+          query: Case-insensitive substring match against vault name. IDs match by exact value.
+
           extra_headers: Send extra headers
 
           extra_query: Add additional query parameters to the request
@@ -297,6 +306,7 @@ class AsyncVaultsResource(AsyncAPIResource):
                     {
                         "limit": limit,
                         "offset": offset,
+                        "query": query,
                     },
                     vault_list_params.VaultListParams,
                 ),
@@ -317,9 +327,11 @@ class AsyncVaultsResource(AsyncAPIResource):
     ) -> None:
         """Unresolved payment operations block deletion.
 
-        Reconcile the original attempt
-        with the provider or support first; deleting or recreating an item is not proof
-        that a payment did not occur.
+        Deleting a connected Kernel wallet
+        first blocks new payments on it, then removes its enrolled card. If that fails,
+        the wallet is kept and keeps refusing payments; retry the deletion. Reconcile
+        the original attempt with the provider or support first; deleting or recreating
+        an item is not proof that a payment did not occur.
 
         Args:
           extra_headers: Send extra headers

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vault_list_params.py

@@ -11,3 +11,6 @@ class VaultListParams(TypedDict, total=False):
     limit: int
 
     offset: int
+
+    query: str
+    """Case-insensitive substring match against vault name. IDs match by exact value."""

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/__init__.py

@@ -4,12 +4,14 @@ from __future__ import annotations
 
 from .vault_item import VaultItem as VaultItem
 from .vault_item_event import VaultItemEvent as VaultItemEvent
+from .kernel_card_state import KernelCardState as KernelCardState
 from .vault_item_action import VaultItemAction as VaultItemAction
 from .item_events_params import ItemEventsParams as ItemEventsParams
 from .item_list_response import ItemListResponse as ItemListResponse
 from .item_update_params import ItemUpdateParams as ItemUpdateParams
 from .item_upsert_params import ItemUpsertParams as ItemUpsertParams
 from .vault_card_aliases import VaultCardAliases as VaultCardAliases
+from .kernel_wallet_state import KernelWalletState as KernelWalletState
 from .card_vault_item_spec import CardVaultItemSpec as CardVaultItemSpec
 from .item_events_response import ItemEventsResponse as ItemEventsResponse
 from .item_retrieve_params import ItemRetrieveParams as ItemRetrieveParams
@@ -26,22 +28,27 @@ from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVau
 from .vault_webmcp_binding_param import VaultWebmcpBindingParam as VaultWebmcpBindingParam
 from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
 from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
+from .kernel_card_vault_item_spec import KernelCardVaultItemSpec as KernelCardVaultItemSpec
 from .agentcard_prepared_processor import AgentcardPreparedProcessor as AgentcardPreparedProcessor
 from .credential_collection_action import CredentialCollectionAction as CredentialCollectionAction
 from .credential_vault_field_state import CredentialVaultFieldState as CredentialVaultFieldState
 from .vault_checkout_context_param import VaultCheckoutContextParam as VaultCheckoutContextParam
 from .credential_account_vault_item import CredentialAccountVaultItem as CredentialAccountVaultItem
 from .item_perform_operation_params import ItemPerformOperationParams as ItemPerformOperationParams
+from .kernel_wallet_vault_item_spec import KernelWalletVaultItemSpec as KernelWalletVaultItemSpec
 from .vault_item_operation_response import VaultItemOperationResponse as VaultItemOperationResponse
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation as AgentcardCheckoutPreparation
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization
 from .fill_vault_item_operation_result import FillVaultItemOperationResult as FillVaultItemOperationResult
 from .credential_vault_field_definition import CredentialVaultFieldDefinition as CredentialVaultFieldDefinition
+from .kernel_card_vault_item_spec_param import KernelCardVaultItemSpecParam as KernelCardVaultItemSpecParam
 from .kernel_credential_vault_item_spec import KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec
 from .credential_vault_field_input_param import CredentialVaultFieldInputParam as CredentialVaultFieldInputParam
 from .kernel_credential_vault_item_state import KernelCredentialVaultItemState as KernelCredentialVaultItemState
 from .credential_vault_field_update_param import CredentialVaultFieldUpdateParam as CredentialVaultFieldUpdateParam
 from .credential_vault_item_request_param import CredentialVaultItemRequestParam as CredentialVaultItemRequestParam
+from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam as KernelWalletVaultItemSpecParam
+from .managed_auth_credential_vault_field import ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField
 from .one_password_credential_account_spec import OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
@@ -55,9 +62,15 @@ from .credential_vault_item_spec_update_param import (
 from .fill_vault_item_operation_request_param import (
     FillVaultItemOperationRequestParam as FillVaultItemOperationRequestParam,
 )
+from .managed_auth_credential_vault_item_spec import (
+    ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec,
+)
 from .one_password_credential_vault_item_spec import (
     OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec,
 )
+from .managed_auth_credential_vault_item_state import (
+    ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState,
+)
 from .one_password_credential_vault_item_state import (
     OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState,
 )
@@ -88,6 +101,9 @@ from .one_password_fill_vault_item_operation_result import (
 from .webmcp_invoke_vault_item_operation_request_param import (
     WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
 )
+from .managed_auth_credential_vault_item_spec_input_param import (
+    ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
+)
 from .one_password_credential_vault_item_spec_input_param import (
     OnePasswordCredentialVaultItemSpecInputParam as OnePasswordCredentialVaultItemSpecInputParam,
 )

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/authorize_vault_item_operation_request_param.py

@@ -8,7 +8,7 @@ __all__ = ["AuthorizeVaultItemOperationRequestParam"]
 
 
 class AuthorizeVaultItemOperationRequestParam(TypedDict, total=False):
-    """Authorize a Link card using its existing purchase specification.
+    """Authorize a Link or Kernel card using its existing purchase specification.
 
     Use only after explicit user approval and when the item advertises authorize. Do not automatically retry provider failures or indeterminate outcomes. Checkout context is not accepted.
     """

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/card_vault_item_spec.py

@@ -5,6 +5,7 @@ from typing_extensions import Literal, Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from ..._models import BaseModel
+from .kernel_card_vault_item_spec import KernelCardVaultItemSpec
 
 __all__ = [
     "CardVaultItemSpec",
@@ -133,5 +134,6 @@ class AgentCardCardVaultItemSpec(BaseModel):
 
 
 CardVaultItemSpec: TypeAlias = Annotated[
-    Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec], PropertyInfo(discriminator="provider")
+    Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec, KernelCardVaultItemSpec],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/card_vault_item_spec_param.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 from typing import Dict, Union, Iterable
 from typing_extensions import Literal, Required, TypeAlias, TypedDict
 
+from .kernel_card_vault_item_spec_param import KernelCardVaultItemSpecParam
+
 __all__ = [
     "CardVaultItemSpecParam",
     "LinkCardVaultItemSpec",
@@ -131,4 +133,6 @@ class AgentCardCardVaultItemSpec(TypedDict, total=False):
     """
 
 
-CardVaultItemSpecParam: TypeAlias = Union[LinkCardVaultItemSpec, AgentCardCardVaultItemSpec]
+CardVaultItemSpecParam: TypeAlias = Union[
+    LinkCardVaultItemSpec, AgentCardCardVaultItemSpec, KernelCardVaultItemSpecParam
+]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/card_vault_item_state.py

@@ -7,6 +7,7 @@ from pydantic import Field as FieldInfo
 
 from ..._utils import PropertyInfo
 from ..._models import BaseModel
+from .kernel_card_state import KernelCardState
 from .vault_card_aliases import VaultCardAliases
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization
@@ -19,6 +20,9 @@ class LinkCardStateMasks(BaseModel):
 
     last4: Optional[str] = None
 
+    token_last4: Optional[str] = None
+    """Last four digits of the network token presented to the merchant."""
+
     if TYPE_CHECKING:
         # Some versions of Pydantic <2.8.0 have a bug and don’t allow assigning a
         # value to this field, so for compatibility we avoid doing it at runtime.
@@ -64,6 +68,9 @@ class AgentCardCardStateMasks(BaseModel):
 
     last4: Optional[str] = None
 
+    token_last4: Optional[str] = None
+    """Last four digits of the network token presented to the merchant."""
+
     if TYPE_CHECKING:
         # Some versions of Pydantic <2.8.0 have a bug and don’t allow assigning a
         # value to this field, so for compatibility we avoid doing it at runtime.
@@ -127,5 +134,5 @@ class AgentCardCardState(BaseModel):
 
 
 CardVaultItemState: TypeAlias = Annotated[
-    Union[LinkCardState, AgentCardCardState], PropertyInfo(discriminator="provider")
+    Union[LinkCardState, AgentCardCardState, KernelCardState], PropertyInfo(discriminator="provider")
 ]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -83,7 +83,8 @@ class CredentialVaultItem(BaseModel):
 
     1Password credentials advertise 1pw_create_access_request until a request is
     made, 1pw_access_request_status while its approval is pending, and 1pw_fill
-    after access is granted.
+    after access is granted. Managed auth credentials advertise fill while ready and
+    nothing otherwise.
     """
 
     created_at: datetime
@@ -106,7 +107,8 @@ class CredentialVaultItem(BaseModel):
     version: int
     """
     Starts at 1 and increments on PATCH and successful hosted submission, but not
-    collection-link renewal.
+    collection-link renewal. Managed auth credentials stay at 1; changes to the
+    underlying credential are read at fill time and do not change the version.
     """
 
     action: Optional[Action] = None

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_request_param.py

@@ -20,9 +20,12 @@ class CredentialVaultItemRequestParam(TypedDict, total=False):
     Kernel credentials declare fields and may enter pending_collection.
     1Password credentials either reference a connected credential_account or
     store a supplied access token and integration key encrypted on the item.
-    They store no login values or selectors. Repeating the original creation
-    request returns the current item without overwriting later state. A
-    different request at the same key returns 409.
+    They store no login values or selectors.
+    Managed auth credentials reference a managed auth connection in the same
+    project that already has a saved credential, and read it at fill time;
+    they store no values.
+    Repeating the original creation request returns the current item without
+    overwriting later state. A different request at the same key returns 409.
     """
 
     spec: Required[CredentialVaultItemSpecInputParam]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_spec.py

@@ -5,10 +5,12 @@ from typing_extensions import Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from .kernel_credential_vault_item_spec import KernelCredentialVaultItemSpec
+from .managed_auth_credential_vault_item_spec import ManagedAuthCredentialVaultItemSpec
 from .one_password_credential_vault_item_spec import OnePasswordCredentialVaultItemSpec
 
 __all__ = ["CredentialVaultItemSpec"]
 
 CredentialVaultItemSpec: TypeAlias = Annotated[
-    Union[KernelCredentialVaultItemSpec, OnePasswordCredentialVaultItemSpec], PropertyInfo(discriminator="provider")
+    Union[KernelCredentialVaultItemSpec, OnePasswordCredentialVaultItemSpec, ManagedAuthCredentialVaultItemSpec],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_spec_input_param.py

@@ -6,10 +6,13 @@ from typing import Union
 from typing_extensions import TypeAlias
 
 from .kernel_credential_vault_item_spec_input_param import KernelCredentialVaultItemSpecInputParam
+from .managed_auth_credential_vault_item_spec_input_param import ManagedAuthCredentialVaultItemSpecInputParam
 from .one_password_credential_vault_item_spec_input_param import OnePasswordCredentialVaultItemSpecInputParam
 
 __all__ = ["CredentialVaultItemSpecInputParam"]
 
 CredentialVaultItemSpecInputParam: TypeAlias = Union[
-    KernelCredentialVaultItemSpecInputParam, OnePasswordCredentialVaultItemSpecInputParam
+    KernelCredentialVaultItemSpecInputParam,
+    OnePasswordCredentialVaultItemSpecInputParam,
+    ManagedAuthCredentialVaultItemSpecInputParam,
 ]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_state.py

@@ -5,10 +5,12 @@ from typing_extensions import Annotated, TypeAlias
 
 from ..._utils import PropertyInfo
 from .kernel_credential_vault_item_state import KernelCredentialVaultItemState
+from .managed_auth_credential_vault_item_state import ManagedAuthCredentialVaultItemState
 from .one_password_credential_vault_item_state import OnePasswordCredentialVaultItemState
 
 __all__ = ["CredentialVaultItemState"]
 
 CredentialVaultItemState: TypeAlias = Annotated[
-    Union[KernelCredentialVaultItemState, OnePasswordCredentialVaultItemState], PropertyInfo(discriminator="provider")
+    Union[KernelCredentialVaultItemState, OnePasswordCredentialVaultItemState, ManagedAuthCredentialVaultItemState],
+    PropertyInfo(discriminator="provider"),
 ]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/credential_vault_item_update_request_param.py

@@ -20,6 +20,7 @@ class CredentialVaultItemUpdateRequestParam(TypedDict, total=False):
     values remain missing, return pending_collection and a fresh collection
     action. Otherwise return ready without an action; collect can open the form
     again without clearing values. Customer URLs have no Kernel-managed expiry.
+    1Password and managed auth credentials return 409.
     """
 
     spec: Required[CredentialVaultItemSpecUpdateParam]

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/fill_vault_item_operation_request_param.py

@@ -12,8 +12,8 @@ __all__ = ["FillVaultItemOperationRequestParam"]
 
 class FillVaultItemOperationRequestParam(TypedDict, total=False):
     """
-    Fill selected fields from one ready credential or ready, unexpired Link card
-    into a browser linked to its vault.
+    Fill selected fields from one ready credential or ready, unexpired Link or
+    Kernel card into a browser linked to its vault.
     Only invoke when the item advertises `fill`. Browser and vault must belong
     to the same project. Kernel checks access and allowed destinations before
     filling; providing a page URL does not authorize a destination.
@@ -34,7 +34,7 @@ class FillVaultItemOperationRequestParam(TypedDict, total=False):
     Fill in request order and stop on the first failure. This operation is
     not atomic: previously filled fields are not rolled back. Never submit
     the form or click buttons, though input/change events may trigger site
-    behavior. Link cards use fill for browser checkout and do not expose
+    behavior. Link and Kernel cards use fill for browser checkout and do not expose
     aliases or support egress substitution. Do not automatically retry a
     failed or indeterminate operation.
 

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/item_retrieve_params.py

@@ -20,4 +20,5 @@ class ItemRetrieveParams(TypedDict, total=False):
     approval, or credential collection. Return the current item when ready or when
     the wait elapses. This does not wait for edits to an already-ready credential;
     poll GET without wait and compare version to observe changes after collect.
+    Managed auth credentials are created ready, so wait returns immediately.
     """

{kernel-0.117.0 → kernel-0.119.0}/src/kernel/types/vaults/item_upsert_params.py

@@ -6,6 +6,7 @@ from typing import Union
 from typing_extensions import Literal, Required, TypeAlias, TypedDict
 
 from .card_vault_item_spec_param import CardVaultItemSpecParam
+from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam
 from .credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
 from .one_password_credential_account_spec_param import OnePasswordCredentialAccountSpecParam
 
@@ -176,7 +177,9 @@ class WalletVaultItemRequestSpecAgentCardWalletVaultItemSpec(TypedDict, total=Fa
 
 
 WalletVaultItemRequestSpec: TypeAlias = Union[
-    WalletVaultItemRequestSpecLinkWalletVaultItemRequestSpec, WalletVaultItemRequestSpecAgentCardWalletVaultItemSpec
+    WalletVaultItemRequestSpecLinkWalletVaultItemRequestSpec,
+    WalletVaultItemRequestSpecAgentCardWalletVaultItemSpec,
+    KernelWalletVaultItemSpecParam,
 ]
 
 

kernel-0.119.0/src/kernel/types/vaults/kernel_card_state.py

@@ -0,0 +1,60 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import TYPE_CHECKING, Dict, List, Optional
+from typing_extensions import Literal
+
+from pydantic import Field as FieldInfo
+
+from ..._models import BaseModel
+
+__all__ = ["KernelCardState", "Masks"]
+
+
+class Masks(BaseModel):
+    brand: Optional[str] = None
+
+    last4: Optional[str] = None
+
+    token_last4: Optional[str] = None
+    """Last four digits of the network token presented to the merchant."""
+
+    if TYPE_CHECKING:
+        # Some versions of Pydantic <2.8.0 have a bug and don’t allow assigning a
+        # value to this field, so for compatibility we avoid doing it at runtime.
+        __pydantic_extra__: Dict[str, str] = FieldInfo(init=False)  # pyright: ignore[reportIncompatibleVariableOverride]
+
+        # Stub to indicate that arbitrary properties are accepted.
+        # To access properties that are not valid identifiers you can use `getattr`, e.g.
+        # `getattr(obj, '$type')`
+        def __getattr__(self, attr: str) -> str: ...
+    else:
+        __pydantic_extra__: Dict[str, str]
+
+
+class KernelCardState(BaseModel):
+    """
+    A ready Kernel card retains its encrypted network token and one-time code for the fill operation until the item's expires_at. Fill and submit checkout before then. Visa cards can be enrolled, but Visa purchases are not yet supported and authorize returns 400; supported Mastercard purchases need no cardholder approval. masks.last4 is the enrolled card's last four digits; masks.token_last4 is the network token's last four digits shown to the merchant. Kernel cards do not expose aliases or support egress substitution. Kernel does not observe whether the merchant charged the card.
+    """
+
+    provider: Literal["kernel"]
+
+    status: Literal[
+        "requested", "pending_authorization", "ready", "consumed", "expired", "declined", "recovery_required"
+    ]
+    """recovery_required means issuing the one-time code has an unresolved outcome.
+
+    Kernel never issues another code for the item automatically, and the item cannot
+    be deleted or replaced until the original attempt is reconciled with support.
+    When status_reason says the provider refused retrieval before acceptance, no
+    code was issued and a later read retries.
+    """
+
+    domains: Optional[List[str]] = None
+    """Informational registrable domain.
+
+    Fill is locked to merchant_url's exact origin.
+    """
+
+    masks: Optional[Masks] = None
+
+    status_reason: Optional[str] = None

kernel-0.119.0/src/kernel/types/vaults/kernel_card_vault_item_spec.py

@@ -0,0 +1,37 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+
+__all__ = ["KernelCardVaultItemSpec"]
+
+
+class KernelCardVaultItemSpec(BaseModel):
+    """One live purchase with a Kernel-enrolled card.
+
+    Authorization obtains an agentic network token number, expiry and one-time 3-digit code. They are stored encrypted for the fill operation, which types them only on merchant_url's origin; the merchant's own checkout submits the payment. The one-time code is valid until the item's expires_at; fill and submit checkout before then. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400. Supported Mastercard purchases need no cardholder approval. Card updates are not supported; delete and create a new item instead.
+    """
+
+    amount: int
+    """
+    Integer amount in minor currency units (at most 50000), bound to the one-time
+    code.
+    """
+
+    currency: str
+    """ISO 4217 code.
+
+    Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy, krw, mxn, nok,
+    nzd, pln, sek, sgd, usd, zar.
+    """
+
+    merchant_name: str
+
+    merchant_url: str
+    """Merchant checkout URL. Fill is allowed only on this URL's origin."""
+
+    provider: Literal["kernel"]
+
+    wallet: str
+    """Key of the Kernel wallet item whose enrolled card pays."""

kernel-0.119.0/src/kernel/types/vaults/kernel_card_vault_item_spec_param.py

@@ -0,0 +1,37 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["KernelCardVaultItemSpecParam"]
+
+
+class KernelCardVaultItemSpecParam(TypedDict, total=False):
+    """One live purchase with a Kernel-enrolled card.
+
+    Authorization obtains an agentic network token number, expiry and one-time 3-digit code. They are stored encrypted for the fill operation, which types them only on merchant_url's origin; the merchant's own checkout submits the payment. The one-time code is valid until the item's expires_at; fill and submit checkout before then. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400. Supported Mastercard purchases need no cardholder approval. Card updates are not supported; delete and create a new item instead.
+    """
+
+    amount: Required[int]
+    """
+    Integer amount in minor currency units (at most 50000), bound to the one-time
+    code.
+    """
+
+    currency: Required[str]
+    """ISO 4217 code.
+
+    Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy, krw, mxn, nok,
+    nzd, pln, sek, sgd, usd, zar.
+    """
+
+    merchant_name: Required[str]
+
+    merchant_url: Required[str]
+    """Merchant checkout URL. Fill is allowed only on this URL's origin."""
+
+    provider: Required[Literal["kernel"]]
+
+    wallet: Required[str]
+    """Key of the Kernel wallet item whose enrolled card pays."""