release: 0.133.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.132.0"
+  ".": "0.133.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.133.0](https://github.com/kernel/kernel-python-sdk/compare/v0.132.0...v0.133.0) (2026-10-27)
+
+
+### Features
+
+* Support multiple Kernel wallet payment methods and payment requests ([99d8515](https://github.com/kernel/kernel-python-sdk/commit/99d851577f0ed2f7ba78849172f8fdddb0a9ce31))
+
 ## [0.132.0](https://github.com/kernel/kernel-python-sdk/compare/v0.131.0...v0.132.0) (2026-10-26)
 
 

api.md

@@ -569,6 +569,8 @@ Types:
 
 ```python
 from kernel.types.vaults import (
+    AddPaymentMethodVaultItemOperationRequest,
+    AddPaymentMethodVaultItemOperationResult,
     AgentcardCheckoutAuthorization,
     AgentcardCheckoutPreparation,
     AgentcardPreparedProcessor,
@@ -602,6 +604,7 @@ from kernel.types.vaults import (
     KernelCredentialVaultItemSpec,
     KernelCredentialVaultItemSpecInput,
     KernelCredentialVaultItemState,
+    KernelPaymentRequestVaultItemSpec,
     KernelWalletState,
     KernelWalletVaultItemSpec,
     LinkShippingAddress,
@@ -621,8 +624,13 @@ from kernel.types.vaults import (
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
     PasskeyVaultItemOperationResult,
+    PaymentRequestVaultItem,
+    PaymentRequestVaultItemSpec,
+    PaymentRequestVaultItemState,
     PrepareCheckoutVaultItemOperationRequest,
     RegisterPasskeyVaultItemOperationRequest,
+    RemovePaymentMethodVaultItemOperationRequest,
+    RemovePaymentMethodVaultItemOperationResult,
     RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.132.0"
+version = "0.133.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.132.0"  # x-release-please-version
+__version__ = "0.133.0"  # x-release-please-version

src/kernel/types/vaults/__init__.py

@@ -27,6 +27,7 @@
 from .one_password_oauth_action import OnePasswordOAuthAction as OnePasswordOAuthAction
 from .card_vault_item_spec_param import CardVaultItemSpecParam as CardVaultItemSpecParam
 from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVaultItemSpec
+from .payment_request_vault_item import PaymentRequestVaultItem as PaymentRequestVaultItem
 from .vault_webmcp_binding_param import VaultWebmcpBindingParam as VaultWebmcpBindingParam
 from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
 from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
@@ -40,8 +41,10 @@
 from .kernel_wallet_vault_item_spec import KernelWalletVaultItemSpec as KernelWalletVaultItemSpec
 from .vault_item_operation_response import VaultItemOperationResponse as VaultItemOperationResponse
 from .agentcard_checkout_preparation import AgentcardCheckoutPreparation as AgentcardCheckoutPreparation
+from .payment_request_vault_item_spec import PaymentRequestVaultItemSpec as PaymentRequestVaultItemSpec
 from .agentcard_checkout_authorization import AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization
 from .fill_vault_item_operation_result import FillVaultItemOperationResult as FillVaultItemOperationResult
+from .payment_request_vault_item_state import PaymentRequestVaultItemState as PaymentRequestVaultItemState
 from .credential_vault_field_definition import CredentialVaultFieldDefinition as CredentialVaultFieldDefinition
 from .kernel_card_vault_item_spec_param import KernelCardVaultItemSpecParam as KernelCardVaultItemSpecParam
 from .kernel_credential_vault_item_spec import KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec
@@ -56,9 +59,13 @@
 from .one_password_credential_account_state import (
     OnePasswordCredentialAccountState as OnePasswordCredentialAccountState,
 )
+from .payment_request_vault_item_spec_param import PaymentRequestVaultItemSpecParam as PaymentRequestVaultItemSpecParam
 from .credential_vault_item_spec_input_param import (
     CredentialVaultItemSpecInputParam as CredentialVaultItemSpecInputParam,
 )
+from .kernel_payment_request_vault_item_spec import (
+    KernelPaymentRequestVaultItemSpec as KernelPaymentRequestVaultItemSpec,
+)
 from .credential_vault_item_spec_update_param import (
     CredentialVaultItemSpecUpdateParam as CredentialVaultItemSpecUpdateParam,
 )
@@ -95,6 +102,9 @@
 from .authorize_vault_item_operation_request_param import (
     AuthorizeVaultItemOperationRequestParam as AuthorizeVaultItemOperationRequestParam,
 )
+from .kernel_payment_request_vault_item_spec_param import (
+    KernelPaymentRequestVaultItemSpecParam as KernelPaymentRequestVaultItemSpecParam,
+)
 from .credential_vault_field_definition_input_param import (
     CredentialVaultFieldDefinitionInputParam as CredentialVaultFieldDefinitionInputParam,
 )
@@ -104,6 +114,9 @@
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .add_payment_method_vault_item_operation_result import (
+    AddPaymentMethodVaultItemOperationResult as AddPaymentMethodVaultItemOperationResult,
+)
 from .arm_passkey_vault_item_operation_request_param import (
     ArmPasskeyVaultItemOperationRequestParam as ArmPasskeyVaultItemOperationRequestParam,
 )
@@ -113,6 +126,9 @@
 from .disarm_passkey_vault_item_operation_request_param import (
     DisarmPasskeyVaultItemOperationRequestParam as DisarmPasskeyVaultItemOperationRequestParam,
 )
+from .remove_payment_method_vault_item_operation_result import (
+    RemovePaymentMethodVaultItemOperationResult as RemovePaymentMethodVaultItemOperationResult,
+)
 from .managed_auth_credential_vault_item_spec_input_param import (
     ManagedAuthCredentialVaultItemSpecInputParam as ManagedAuthCredentialVaultItemSpecInputParam,
 )
@@ -128,6 +144,9 @@
 from .one_password_fill_vault_item_operation_request_param import (
     OnePasswordFillVaultItemOperationRequestParam as OnePasswordFillVaultItemOperationRequestParam,
 )
+from .add_payment_method_vault_item_operation_request_param import (
+    AddPaymentMethodVaultItemOperationRequestParam as AddPaymentMethodVaultItemOperationRequestParam,
+)
 from .confirm_transaction_vault_item_operation_request_param import (
     ConfirmTransactionVaultItemOperationRequestParam as ConfirmTransactionVaultItemOperationRequestParam,
 )
@@ -137,6 +156,9 @@
 from .restart_verification_vault_item_operation_request_param import (
     RestartVerificationVaultItemOperationRequestParam as RestartVerificationVaultItemOperationRequestParam,
 )
+from .remove_payment_method_vault_item_operation_request_param import (
+    RemovePaymentMethodVaultItemOperationRequestParam as RemovePaymentMethodVaultItemOperationRequestParam,
+)
 from .one_password_request_access_vault_item_operation_request_param import (
     OnePasswordRequestAccessVaultItemOperationRequestParam as OnePasswordRequestAccessVaultItemOperationRequestParam,
 )

src/kernel/types/vaults/add_payment_method_vault_item_operation_request_param.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["AddPaymentMethodVaultItemOperationRequestParam"]
+
+
+class AddPaymentMethodVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Start hosted enrollment of a card in a connected Kernel wallet, including its first card, only when the wallet advertises add_payment_method. Returns a new payment method in pending_enrollment with a single-use card_enrollment URL for the cardholder. Card details go directly to the card vault and are never accepted by this API. Each call creates a separate link that expires after 30 minutes; a failed or expired enrollment does not affect the wallet's other payment methods. Scoped API keys require vaults:write in addition to vaults:use on this vault; otherwise the operation returns 403.
+    """
+
+    type: Required[Literal["add_payment_method"]]

src/kernel/types/vaults/add_payment_method_vault_item_operation_result.py

@@ -0,0 +1,19 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing_extensions import Literal
+
+from ..._models import BaseModel
+from .vault_payment_method import VaultPaymentMethod
+
+__all__ = ["AddPaymentMethodVaultItemOperationResult"]
+
+
+class AddPaymentMethodVaultItemOperationResult(BaseModel):
+    """The payment method created in pending_enrollment.
+
+    Deliver action.url to the cardholder; it is a single-use capability and must not be logged. Observe completion through the wallet's payment_methods expansion.
+    """
+
+    payment_method: VaultPaymentMethod
+
+    type: Literal["add_payment_method"]

src/kernel/types/vaults/credential_account_vault_item.py

@@ -46,6 +46,8 @@ class AvailableOperation(BaseModel):
         "1pw_recover",
         "1pw_update_access_token",
         "webmcp_invoke",
+        "add_payment_method",
+        "remove_payment_method",
     ]
 
 

src/kernel/types/vaults/credential_vault_item.py

@@ -53,6 +53,8 @@ class AvailableOperation(BaseModel):
         "1pw_recover",
         "1pw_update_access_token",
         "webmcp_invoke",
+        "add_payment_method",
+        "remove_payment_method",
     ]
 
 

src/kernel/types/vaults/credential_vault_item_request_param.py

@@ -17,7 +17,7 @@ class CredentialVaultItemRequestParam(TypedDict, total=False):
     or that path fails, collect a Kernel-hosted credential item instead. Never
     automatically retry an uncertain 1Password request. After an uncertain fill,
     inspect the page to see the result of the fill.
-    Do not use credential items for credit card data. Use wallet and card item types instead.
+    Do not use credential items for credit card data. Use wallet, payment_request and card item types instead.
     Kernel credentials declare fields and may enter pending_collection.
     1Password credentials either reference a connected credential_account or
     store a supplied access token and integration key encrypted on the item.
@@ -32,10 +32,10 @@ class CredentialVaultItemRequestParam(TypedDict, total=False):
     spec: Required[CredentialVaultItemSpecInputParam]
     """Credential fields are for login and other non-payment credentials.
 
-    Do not store, collect, or fill credit card data in credential items. Use wallet
-    and card item types for credit cards and payment checkout instead. Field order
-    is preserved in the user-facing collection form, so list fields in the same
-    top-to-bottom order as the website.
+    Do not store, collect, or fill credit card data in credential items. Use wallet,
+    payment_request and card item types for credit cards and payment checkout
+    instead. Field order is preserved in the user-facing collection form, so list
+    fields in the same top-to-bottom order as the website.
     """
 
     type: Required[Literal["credential"]]

src/kernel/types/vaults/item_perform_operation_params.py

@@ -29,6 +29,8 @@
     "OnePasswordRecoverVaultItemOperationRequest",
     "OnePasswordUpdateAccessTokenVaultItemOperationRequest",
     "WebmcpInvokeVaultItemOperationRequest",
+    "AddPaymentMethodVaultItemOperationRequest",
+    "RemovePaymentMethodVaultItemOperationRequest",
 ]
 
 
@@ -269,6 +271,21 @@ class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
     """
 
 
+class AddPaymentMethodVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    type: Required[Literal["add_payment_method"]]
+
+
+class RemovePaymentMethodVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    payment_method_id: Required[str]
+    """ID from the wallet's payment_methods expansion."""
+
+    type: Required[Literal["remove_payment_method"]]
+
+
 ItemPerformOperationParams: TypeAlias = Union[
     AuthorizeVaultItemOperationRequest,
     RestartVerificationVaultItemOperationRequest,
@@ -285,4 +302,6 @@ class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordUpdateAccessTokenVaultItemOperationRequest,
     WebmcpInvokeVaultItemOperationRequest,
+    AddPaymentMethodVaultItemOperationRequest,
+    RemovePaymentMethodVaultItemOperationRequest,
 ]

src/kernel/types/vaults/item_update_params.py

@@ -6,9 +6,15 @@
 from typing_extensions import Literal, Required, TypeAlias, TypedDict
 
 from .card_vault_item_spec_param import CardVaultItemSpecParam
+from .payment_request_vault_item_spec_param import PaymentRequestVaultItemSpecParam
 from .credential_vault_item_spec_update_param import CredentialVaultItemSpecUpdateParam
 
-__all__ = ["ItemUpdateParams", "CardVaultItemUpdateRequest", "CredentialVaultItemUpdateRequest"]
+__all__ = [
+    "ItemUpdateParams",
+    "CardVaultItemUpdateRequest",
+    "PaymentRequestVaultItemUpdateRequest",
+    "CredentialVaultItemUpdateRequest",
+]
 
 
 class CardVaultItemUpdateRequest(TypedDict, total=False):
@@ -27,6 +33,22 @@ class CardVaultItemUpdateRequest(TypedDict, total=False):
     type: Literal["card"]
 
 
+class PaymentRequestVaultItemUpdateRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    spec: Required[PaymentRequestVaultItemSpecParam]
+    """Live Link card request.
+
+    Test-mode card creation is not supported. The spec can be changed with PATCH
+    until the card is authorized at a checkout. Authorize it with the browser at
+    final checkout: Kernel inspects the checkout through WebMCP and internally
+    chooses a merchant-bound Link Pay Token when supported or a virtual card
+    otherwise. Callers never receive or choose how the credential is delivered.
+    """
+
+    type: Required[Literal["payment_request"]]
+
+
 class CredentialVaultItemUpdateRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -46,4 +68,6 @@ class CredentialVaultItemUpdateRequest(TypedDict, total=False):
     """
 
 
-ItemUpdateParams: TypeAlias = Union[CardVaultItemUpdateRequest, CredentialVaultItemUpdateRequest]
+ItemUpdateParams: TypeAlias = Union[
+    CardVaultItemUpdateRequest, PaymentRequestVaultItemUpdateRequest, CredentialVaultItemUpdateRequest
+]

src/kernel/types/vaults/item_upsert_params.py

@@ -7,6 +7,7 @@
 
 from .card_vault_item_spec_param import CardVaultItemSpecParam
 from .kernel_wallet_vault_item_spec_param import KernelWalletVaultItemSpecParam
+from .payment_request_vault_item_spec_param import PaymentRequestVaultItemSpecParam
 from .credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
 from .one_password_credential_account_spec_param import OnePasswordCredentialAccountSpecParam
 
@@ -25,6 +26,7 @@
     "WalletVaultItemRequestSpecAgentCardWalletVaultItemSpec",
     "WalletVaultItemRequestSpecAgentCardWalletVaultItemSpecProviderConfig",
     "CardVaultItemRequest",
+    "PaymentRequestVaultItemRequest",
     "CredentialAccountVaultItemRequest",
     "CredentialVaultItemRequest",
 ]
@@ -207,6 +209,22 @@ class CardVaultItemRequest(TypedDict, total=False):
     type: Required[Literal["card"]]
 
 
+class PaymentRequestVaultItemRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    spec: Required[PaymentRequestVaultItemSpecParam]
+    """Live Link card request.
+
+    Test-mode card creation is not supported. The spec can be changed with PATCH
+    until the card is authorized at a checkout. Authorize it with the browser at
+    final checkout: Kernel inspects the checkout through WebMCP and internally
+    chooses a merchant-bound Link Pay Token when supported or a virtual card
+    otherwise. Callers never receive or choose how the credential is delivered.
+    """
+
+    type: Required[Literal["payment_request"]]
+
+
 class CredentialAccountVaultItemRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -221,15 +239,19 @@ class CredentialVaultItemRequest(TypedDict, total=False):
     spec: Required[CredentialVaultItemSpecInputParam]
     """Credential fields are for login and other non-payment credentials.
 
-    Do not store, collect, or fill credit card data in credential items. Use wallet
-    and card item types for credit cards and payment checkout instead. Field order
-    is preserved in the user-facing collection form, so list fields in the same
-    top-to-bottom order as the website.
+    Do not store, collect, or fill credit card data in credential items. Use wallet,
+    payment_request and card item types for credit cards and payment checkout
+    instead. Field order is preserved in the user-facing collection form, so list
+    fields in the same top-to-bottom order as the website.
     """
 
     type: Required[Literal["credential"]]
 
 
 ItemUpsertParams: TypeAlias = Union[
-    WalletVaultItemRequest, CardVaultItemRequest, CredentialAccountVaultItemRequest, CredentialVaultItemRequest
+    WalletVaultItemRequest,
+    CardVaultItemRequest,
+    PaymentRequestVaultItemRequest,
+    CredentialAccountVaultItemRequest,
+    CredentialVaultItemRequest,
 ]

src/kernel/types/vaults/kernel_card_state.py

@@ -68,6 +68,23 @@ class KernelCardState(BaseModel):
     Fill is locked to merchant_url's exact origin.
     """
 
+    funding_status: Optional[Literal["available", "unavailable", "removed"]] = None
+    """Whether payment_method_id can still fund this purchase.
+
+    unavailable means the method is being removed or awaits recovery, so
+    authorization, fill and confirmation are refused until it recovers. removed
+    means the method was removed from its wallet, so this purchase can no longer be
+    paid; create a new purchase with another method. Neither changes status, which
+    still reports what already happened to this purchase.
+    """
+
     masks: Optional[Masks] = None
 
+    payment_method_id: Optional[str] = None
+    """Wallet-scoped ID of the payment method funding this purchase.
+
+    It is bound when the purchase is created and never changes; purchases created
+    before payment methods could be selected report the wallet's default card, card.
+    """
+
     status_reason: Optional[str] = None