From a00925b9bbc49a85d1e3589cd5500774e58ab3c5 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 04:15:56 +0000 Subject: [PATCH 1/2] feat: Add server-to-server card ingest for Kernel wallets Stainless-Generated-From: 1e68f6df5dacf5dc8ff38cccfd78737021477dc6 --- src/resources/vaults/items.ts | 76 +++++++++++++++++++++++++++-------- 1 file changed, 59 insertions(+), 17 deletions(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index fbb6c2cc..ecc52272 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -157,7 +157,8 @@ export class Items extends APIResource { * a failure, an `unknown` outcome, or a transport error. * * Connected Kernel wallets may advertise add_payment_method, which returns a - * single-use hosted card_enrollment link for a card, and remove_payment_method, + * single-use hosted card_enrollment link for a card, or with enrollment server a + * single-use card_ingest URL for the card's issuer, and remove_payment_method, * which removes one card without affecting the others. Both operations require * vaults:write in addition to vaults:use on the vault for scoped API keys, and * return 403 without both permissions. @@ -215,22 +216,32 @@ export class Items extends APIResource { } /** - * Start hosted enrollment of a card in a connected Kernel wallet, including its - * first card, only when the wallet advertises add_payment_method. Returns a new - * payment method in pending_enrollment with a single-use card_enrollment URL for - * the cardholder. Card details go directly to the card vault and are never - * accepted by this API. Each call creates a separate link that expires after 30 - * minutes; a failed or expired enrollment does not affect the wallet's other - * payment methods. Scoped API keys require vaults:write in addition to vaults:use - * on this vault; otherwise the operation returns 403. + * Start enrollment of a card in a connected Kernel wallet, including its first + * card, only when the wallet advertises add_payment_method. Returns a new payment + * method in pending_enrollment with a single-use action. Card details go directly + * to the card vault and are never accepted by this API. With enrollment hosted + * (the default) the action is a card_enrollment URL for the cardholder, which + * expires after 30 minutes. With enrollment server the action is a card_ingest URL + * that the card's issuer posts the card to from its backend, which expires after 5 + * minutes; server enrollment returns 409 when it is not configured for the + * organization's card backend. A failed or expired enrollment does not affect the + * wallet's other payment methods. Scoped API keys require vaults:write in addition + * to vaults:use on this vault; otherwise the operation returns 403. */ export interface AddPaymentMethodVaultItemOperationRequest { type: 'add_payment_method'; + + /** + * hosted returns a card_enrollment link for the cardholder. server returns a + * card_ingest URL for the card's issuer to post the card to server to server. + */ + enrollment?: 'hosted' | 'server'; } /** - * The payment method created in pending_enrollment. Deliver action.url to the - * cardholder; it is a single-use capability and must not be logged. Observe + * The payment method created in pending_enrollment. Deliver a card_enrollment + * action.url to the cardholder; it is a single-use capability and must not be + * logged. A card_ingest action.url is posted to by the card's issuer. Observe * completion through the wallet's payment_methods expansion. */ export interface AddPaymentMethodVaultItemOperationResult { @@ -3835,16 +3846,28 @@ export interface VaultPaymentMethod { */ type: string; + /** + * The open enrollment of a pending payment method. card_enrollment is a single-use + * hosted link for the cardholder. card_ingest is a single-use URL on a Kernel + * ingest hostname served by the card vault, which the card's issuer posts the card + * to from its backend; Kernel never receives the card number or CVC. + */ action?: VaultPaymentMethod.Action; /** - * Expiry of a pending enrollment link. + * Expiry of a pending enrollment link or ingest URL. */ expires_at?: string; /** - * Kernel wallets only. pending_enrollment means a card_enrollment link is open; - * active means the card is stored and can pay when + * Kernel wallets only. The issuer's reference for a card it pushed with a + * card_ingest URL. + */ + issuer_reference?: string; + + /** + * Kernel wallets only. pending_enrollment means a card_enrollment link or + * card_ingest URL is open; active means the card is stored and can pay when * capabilities.single_use_card.eligible is true; removal_pending means removal * started but the provider outcome is unknown, so retry remove_payment_method; * recovery_required means either an enrollment outcome is unknown (remove the @@ -3855,6 +3878,12 @@ export interface VaultPaymentMethod { status?: 'pending_enrollment' | 'active' | 'removal_pending' | 'recovery_required'; status_reason?: string; + + /** + * Kernel wallets only. When a card pushed with a card_ingest URL stops being + * usable, as its issuer set. + */ + valid_until?: string; } export namespace VaultPaymentMethod { @@ -3882,15 +3911,21 @@ export namespace VaultPaymentMethod { last4?: string; } + /** + * The open enrollment of a pending payment method. card_enrollment is a single-use + * hosted link for the cardholder. card_ingest is a single-use URL on a Kernel + * ingest hostname served by the card vault, which the card's issuer posts the card + * to from its backend; Kernel never receives the card number or CVC. + */ export interface Action { - name: 'card_enrollment'; + name: 'card_enrollment' | 'card_ingest'; url: string; /** * Secret bearer capability for embedded card capture with @onkernel/vault-react. - * Present only for Kernel wallets; never for AgentCard. Treat it like the - * enrollment URL and do not log or persist it in browser storage. + * Present only on card_enrollment for Kernel wallets; never for AgentCard. Treat + * it like the enrollment URL and do not log or persist it in browser storage. */ capture_token?: string; } @@ -4923,6 +4958,13 @@ export declare namespace ItemPerformOperationParams { * Body param */ type: 'add_payment_method'; + + /** + * Body param: hosted returns a card_enrollment link for the cardholder. server + * returns a card_ingest URL for the card's issuer to post the card to server to + * server. + */ + enrollment?: 'hosted' | 'server'; } export interface RemovePaymentMethodVaultItemOperationRequest { From b7575e05d6143f215b85cb0eec668436a694d705 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 04:19:43 +0000 Subject: [PATCH 2/2] release: 0.144.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 7 +++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index d147a1aa..6255c680 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.143.0" + ".": "0.144.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index a090dab9..1d2cfd13 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [0.144.0](https://github.com/kernel/kernel-node-sdk/compare/v0.143.0...v0.144.0) (2026-11-09) + + +### Features + +* Add server-to-server card ingest for Kernel wallets ([a00925b](https://github.com/kernel/kernel-node-sdk/commit/a00925b9bbc49a85d1e3589cd5500774e58ab3c5)) + ## [0.143.0](https://github.com/kernel/kernel-node-sdk/compare/v0.142.0...v0.143.0) (2026-11-07) diff --git a/package.json b/package.json index f3c6d25a..b6e34a6e 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.143.0", + "version": "0.144.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index 3a6782e3..3a430fbb 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.143.0'; // x-release-please-version +export const VERSION = '0.144.0'; // x-release-please-version