kernel 0.123.0__tar.gz → 0.124.0__tar.gz

kernel-0.124.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.124.0"
+}

{kernel-0.123.0 → kernel-0.124.0}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.124.0](https://github.com/kernel/kernel-python-sdk/compare/v0.123.0...v0.124.0) (2026-10-13)
+
+
+### Features
+
+* Accept intent creation without a fixed status ([e6e016a](https://github.com/kernel/kernel-python-sdk/commit/e6e016a5cea493c505b16a05cb8ad2fa6ed9f13b))
+* Complete Visa vault verification and transaction reporting ([fc4b0de](https://github.com/kernel/kernel-python-sdk/commit/fc4b0de79e3242361ef7b11acbd2cbaeb058265e))
+
+
+### Bug Fixes
+
+* seal browser pool acquire SDK results ([4d81af2](https://github.com/kernel/kernel-python-sdk/commit/4d81af2b6103571b59cd1bb520eb85e28488b51c))
+
 ## [0.123.0](https://github.com/kernel/kernel-python-sdk/compare/v0.122.0...v0.123.0) (2026-10-09)
 
 

{kernel-0.123.0 → kernel-0.124.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.123.0
+Version: 0.124.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk

{kernel-0.123.0 → kernel-0.124.0}/api.md

@@ -571,6 +571,7 @@ from kernel.types.vaults import (
     CardVaultItemSpec,
     CardVaultItemState,
     CollectVaultItemOperationRequest,
+    ConfirmTransactionVaultItemOperationRequest,
     CredentialAccountVaultItem,
     CredentialAccountVaultItemRequest,
     CredentialCollectionAction,
@@ -610,6 +611,7 @@ from kernel.types.vaults import (
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,
+    RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,
     VaultCheckoutContext,

{kernel-0.123.0 → kernel-0.124.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.123.0"
+version = "0.124.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/_response.py

@@ -24,7 +24,7 @@ import anyio
 import httpx
 import pydantic
 
-from ._types import NoneType
+from ._types import NoneType, NoContentAsNone
 from ._utils import is_given, extract_type_arg, is_annotated_type, is_type_alias_type, extract_type_var_from_base
 from ._models import BaseModel, is_basemodel
 from ._constants import RAW_RESPONSE_HEADER, OVERRIDE_CAST_TO_HEADER
@@ -185,6 +185,13 @@ class BaseAPIResponse(Generic[R]):
             return cast(R, None)
 
         response = self.http_response
+        if (
+            response.status_code == 204
+            and to is None
+            and isinstance(origin, type)
+            and issubclass(origin, NoContentAsNone)
+        ):
+            return cast(R, None)
         if cast_to == str:
             return cast(R, response.text)
 

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/_types.py

@@ -44,6 +44,12 @@ AsyncTransport = AsyncBaseTransport
 Query = Mapping[str, object]
 Body = object
 AnyMapping = Mapping[str, object]
+
+
+class NoContentAsNone:
+    pass
+
+
 ModelT = TypeVar("ModelT", bound=pydantic.BaseModel)
 _T = TypeVar("_T")
 

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.123.0"  # x-release-please-version
+__version__ = "0.124.0"  # x-release-please-version

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/resources/browser_pools.py

@@ -542,7 +542,7 @@ class BrowserPoolsResource(SyncAPIResource):
         extra_query: Query | None = None,
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
-    ) -> BrowserPoolAcquireResponse:
+    ) -> Optional[BrowserPoolAcquireResponse]:
         """Long-polling endpoint to acquire a browser from the pool.
 
         Returns immediately
@@ -1199,7 +1199,7 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
         extra_query: Query | None = None,
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
-    ) -> BrowserPoolAcquireResponse:
+    ) -> Optional[BrowserPoolAcquireResponse]:
         """Long-polling endpoint to acquire a browser from the pool.
 
         Returns immediately

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/resources/browsers/playwright/playwright.py

@@ -114,10 +114,6 @@ class PlaywrightResource(SyncAPIResource):
         executors are not removed automatically while the browser runs; when it shuts
         down, they are removed and their tabs closed.
 
-        A named call to a browser whose image predates executors fails with 400 instead
-        of running on the active tab; calls without 'executor' keep working on every
-        image.
-
         Args:
           code: TypeScript/JavaScript code to execute. The code has access to 'page', 'context',
               and 'browser' variables. It runs within a function, so you can use a return
@@ -244,10 +240,6 @@ class AsyncPlaywrightResource(AsyncAPIResource):
         executors are not removed automatically while the browser runs; when it shuts
         down, they are removed and their tabs closed.
 
-        A named call to a browser whose image predates executors fails with 400 instead
-        of running on the active tab; calls without 'executor' keep working on every
-        image.
-
         Args:
           code: TypeScript/JavaScript code to execute. The code has access to 'page', 'context',
               and 'browser' variables. It runs within a function, so you can use a return

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/resources/vaults/items.py

@@ -440,6 +440,113 @@ class ItemsResource(SyncAPIResource):
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        amount: int,
+        currency: str,
+        occurred_at: Union[str, datetime],
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"],
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ],
+        type: Literal["confirm_transaction"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          amount: Actual transaction amount in minor units, no greater than the approved limit.
+
+          currency: Must match the approved purchase currency.
+
+          occurred_at: Time the merchant outcome was observed.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     def perform_operation(
         self,
@@ -928,6 +1035,7 @@ class ItemsResource(SyncAPIResource):
 
     @required_args(
         ["id_or_name", "type"],
+        ["id_or_name", "amount", "currency", "occurred_at", "status", "transaction_type", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
@@ -940,6 +1048,8 @@ class ItemsResource(SyncAPIResource):
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
+        | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
@@ -949,6 +1059,14 @@ class ItemsResource(SyncAPIResource):
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
         | Literal["webmcp_invoke"],
+        amount: int | Omit = omit,
+        currency: str | Omit = omit,
+        occurred_at: Union[str, datetime] | Omit = omit,
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"] | Omit = omit,
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ]
+        | Omit = omit,
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -983,6 +1101,11 @@ class ItemsResource(SyncAPIResource):
                 body=maybe_transform(
                     {
                         "type": type,
+                        "amount": amount,
+                        "currency": currency,
+                        "occurred_at": occurred_at,
+                        "status": status,
+                        "transaction_type": transaction_type,
                         "checkout": checkout,
                         "browser_id": browser_id,
                         "fields": fields,
@@ -1614,6 +1737,113 @@ class AsyncItemsResource(AsyncAPIResource):
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        amount: int,
+        currency: str,
+        occurred_at: Union[str, datetime],
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"],
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ],
+        type: Literal["confirm_transaction"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          amount: Actual transaction amount in minor units, no greater than the approved limit.
+
+          currency: Must match the approved purchase currency.
+
+          occurred_at: Time the merchant outcome was observed.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     async def perform_operation(
         self,
@@ -2102,6 +2332,7 @@ class AsyncItemsResource(AsyncAPIResource):
 
     @required_args(
         ["id_or_name", "type"],
+        ["id_or_name", "amount", "currency", "occurred_at", "status", "transaction_type", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
@@ -2114,6 +2345,8 @@ class AsyncItemsResource(AsyncAPIResource):
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
+        | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]
         | Literal["fill"]
@@ -2123,6 +2356,14 @@ class AsyncItemsResource(AsyncAPIResource):
         | Literal["1pw_recover"]
         | Literal["1pw_update_access_token"]
         | Literal["webmcp_invoke"],
+        amount: int | Omit = omit,
+        currency: str | Omit = omit,
+        occurred_at: Union[str, datetime] | Omit = omit,
+        status: Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"] | Omit = omit,
+        transaction_type: Literal[
+            "PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"
+        ]
+        | Omit = omit,
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -2157,6 +2398,11 @@ class AsyncItemsResource(AsyncAPIResource):
                 body=await async_maybe_transform(
                     {
                         "type": type,
+                        "amount": amount,
+                        "currency": currency,
+                        "occurred_at": occurred_at,
+                        "status": status,
+                        "transaction_type": transaction_type,
                         "checkout": checkout,
                         "browser_id": browser_id,
                         "fields": fields,

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/browser_pool_acquire_response.py

@@ -5,6 +5,7 @@ from datetime import datetime
 from typing_extensions import Literal
 
 from .tags import Tags
+from .._types import NoContentAsNone
 from .profile import Profile
 from .._models import BaseModel
 from .browser_proxy import BrowserProxy
@@ -20,7 +21,7 @@ from .browsers.browser_telemetry_config import BrowserTelemetryConfig
 __all__ = ["BrowserPoolAcquireResponse"]
 
 
-class BrowserPoolAcquireResponse(BaseModel):
+class BrowserPoolAcquireResponse(NoContentAsNone, BaseModel):
     cdp_ws_url: str
     """Websocket URL for Chrome DevTools Protocol connections to the browser session"""
 

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/__init__.py

@@ -113,9 +113,15 @@ from .prepare_checkout_vault_item_operation_request_param import (
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )
+from .confirm_transaction_vault_item_operation_request_param import (
+    ConfirmTransactionVaultItemOperationRequestParam as ConfirmTransactionVaultItemOperationRequestParam,
+)
 from .one_password_recover_vault_item_operation_request_param import (
     OnePasswordRecoverVaultItemOperationRequestParam as OnePasswordRecoverVaultItemOperationRequestParam,
 )
+from .restart_verification_vault_item_operation_request_param import (
+    RestartVerificationVaultItemOperationRequestParam as RestartVerificationVaultItemOperationRequestParam,
+)
 from .one_password_request_access_vault_item_operation_request_param import (
     OnePasswordRequestAccessVaultItemOperationRequestParam as OnePasswordRequestAccessVaultItemOperationRequestParam,
 )

kernel-0.124.0/src/kernel/types/vaults/confirm_transaction_vault_item_operation_request_param.py

@@ -0,0 +1,35 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing import Union
+from datetime import datetime
+from typing_extensions import Literal, Required, Annotated, TypedDict
+
+from ..._utils import PropertyInfo
+
+__all__ = ["ConfirmTransactionVaultItemOperationRequestParam"]
+
+
+class ConfirmTransactionVaultItemOperationRequestParam(TypedDict, total=False):
+    """Report a real merchant transaction outcome for an issued Kernel Visa credential.
+
+    Never infer success from filling checkout or receiving a credential. Supply the observed status, transaction type, actual amount, currency and timestamp. Unknown outcomes require manual reconciliation, not retry. Each purchase accepts one report.
+    """
+
+    amount: Required[int]
+    """Actual transaction amount in minor units, no greater than the approved limit."""
+
+    currency: Required[str]
+    """Must match the approved purchase currency."""
+
+    occurred_at: Required[Annotated[Union[str, datetime], PropertyInfo(format="iso8601")]]
+    """Time the merchant outcome was observed."""
+
+    status: Required[Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"]]
+
+    transaction_type: Required[
+        Literal["PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"]
+    ]
+
+    type: Required[Literal["confirm_transaction"]]

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/credential_account_vault_item.py

@@ -32,6 +32,8 @@ class AvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
+        "confirm_transaction",
         "collect",
         "prepare_checkout",
         "fill",

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/credential_vault_item.py

@@ -39,6 +39,8 @@ class AvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
+        "confirm_transaction",
         "collect",
         "prepare_checkout",
         "fill",

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/item_perform_operation_params.py

@@ -15,6 +15,8 @@ from .vault_checkout_context_param import VaultCheckoutContextParam
 __all__ = [
     "ItemPerformOperationParams",
     "AuthorizeVaultItemOperationRequest",
+    "RestartVerificationVaultItemOperationRequest",
+    "ConfirmTransactionVaultItemOperationRequest",
     "CollectVaultItemOperationRequest",
     "PrepareCheckoutVaultItemOperationRequest",
     "FillVaultItemOperationRequest",
@@ -33,6 +35,33 @@ class AuthorizeVaultItemOperationRequest(TypedDict, total=False):
     type: Required[Literal["authorize"]]
 
 
+class RestartVerificationVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    type: Required[Literal["restart_verification"]]
+
+
+class ConfirmTransactionVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    amount: Required[int]
+    """Actual transaction amount in minor units, no greater than the approved limit."""
+
+    currency: Required[str]
+    """Must match the approved purchase currency."""
+
+    occurred_at: Required[Annotated[Union[str, datetime], PropertyInfo(format="iso8601")]]
+    """Time the merchant outcome was observed."""
+
+    status: Required[Literal["APPROVED", "DECLINED", "PENDING", "ERROR", "CANCELLED"]]
+
+    transaction_type: Required[
+        Literal["PURCHASE", "AUTHORIZATION", "CAPTURE", "REFUND", "REVERSAL", "VERIFICATION", "CHARGEBACK", "FRAUD"]
+    ]
+
+    type: Required[Literal["confirm_transaction"]]
+
+
 class CollectVaultItemOperationRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -173,6 +202,8 @@ class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
 
 ItemPerformOperationParams: TypeAlias = Union[
     AuthorizeVaultItemOperationRequest,
+    RestartVerificationVaultItemOperationRequest,
+    ConfirmTransactionVaultItemOperationRequest,
     CollectVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,
     FillVaultItemOperationRequest,

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/kernel_card_state.py

@@ -44,12 +44,16 @@ class KernelCardState(BaseModel):
     """
     pending_authorization on a Visa purchase waits for the cardholder to approve it
     through the spend_approval action; an unused link expires after 30 minutes.
-    recovery_required means approving the purchase or issuing the one-time code has
-    an unresolved outcome. Kernel never approves again or issues another code for
-    the item automatically, and the item cannot be deleted or replaced until the
-    original attempt is reconciled with support. When status_reason says the
-    provider refused retrieval before acceptance, no code was issued and a later
-    read retries. declined means the card network refused to issue a code.
+    recovery_required means verification, approving the purchase or issuing the
+    one-time code has an unresolved outcome. A server-classified initial attestation
+    failure before intent dispatch may advertise restart_verification to prepare a
+    fresh local verification link; this does not approve spending or replay any
+    provider request. Unclassified legacy recovery and uncertain intent creation
+    cannot restart. Kernel never approves again or issues another code for the item
+    automatically, and the item cannot be deleted or replaced until the original
+    attempt is reconciled with support. When status_reason says the provider refused
+    retrieval before acceptance, no code was issued and a later read retries.
+    declined means the card network refused to issue a code.
     """
 
     domains: Optional[List[str]] = None

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/kernel_card_vault_item_spec.py

@@ -37,6 +37,15 @@ class KernelCardVaultItemSpec(BaseModel):
     wallet: str
     """Key of the Kernel wallet item whose enrolled card pays."""
 
+    merchant_category: Optional[str] = None
+    """Actual merchant category when known. Omit rather than invent a category."""
+
+    merchant_category_code: Optional[str] = None
+    """Actual merchant MCC when known.
+
+    Omit rather than invent a code. 0000 is not accepted.
+    """
+
     merchant_country: Optional[str] = None
     """The merchant's ISO 3166-1 alpha-2 country code.
 

{kernel-0.123.0 → kernel-0.124.0}/src/kernel/types/vaults/kernel_card_vault_item_spec_param.py

@@ -36,6 +36,15 @@ class KernelCardVaultItemSpecParam(TypedDict, total=False):
     wallet: Required[str]
     """Key of the Kernel wallet item whose enrolled card pays."""
 
+    merchant_category: str
+    """Actual merchant category when known. Omit rather than invent a category."""
+
+    merchant_category_code: str
+    """Actual merchant MCC when known.
+
+    Omit rather than invent a code. 0000 is not accepted.
+    """
+
     merchant_country: str
     """The merchant's ISO 3166-1 alpha-2 country code.