release: 0.144.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.143.0"
+  ".": "0.144.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.144.0](https://github.com/kernel/kernel-node-sdk/compare/v0.143.0...v0.144.0) (2026-11-09)
+
+
+### Features
+
+* Add server-to-server card ingest for Kernel wallets ([a00925b](https://github.com/kernel/kernel-node-sdk/commit/a00925b9bbc49a85d1e3589cd5500774e58ab3c5))
+
 ## [0.143.0](https://github.com/kernel/kernel-node-sdk/compare/v0.142.0...v0.143.0) (2026-11-07)
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.143.0",
+  "version": "0.144.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/vaults/items.ts

@@ -157,7 +157,8 @@ export class Items extends APIResource {
    * a failure, an `unknown` outcome, or a transport error.
    *
    * Connected Kernel wallets may advertise add_payment_method, which returns a
-   * single-use hosted card_enrollment link for a card, and remove_payment_method,
+   * single-use hosted card_enrollment link for a card, or with enrollment server a
+   * single-use card_ingest URL for the card's issuer, and remove_payment_method,
    * which removes one card without affecting the others. Both operations require
    * vaults:write in addition to vaults:use on the vault for scoped API keys, and
    * return 403 without both permissions.
@@ -215,22 +216,32 @@ export class Items extends APIResource {
 }
 
 /**
- * Start hosted enrollment of a card in a connected Kernel wallet, including its
- * first card, only when the wallet advertises add_payment_method. Returns a new
- * payment method in pending_enrollment with a single-use card_enrollment URL for
- * the cardholder. Card details go directly to the card vault and are never
- * accepted by this API. Each call creates a separate link that expires after 30
- * minutes; a failed or expired enrollment does not affect the wallet's other
- * payment methods. Scoped API keys require vaults:write in addition to vaults:use
- * on this vault; otherwise the operation returns 403.
+ * Start enrollment of a card in a connected Kernel wallet, including its first
+ * card, only when the wallet advertises add_payment_method. Returns a new payment
+ * method in pending_enrollment with a single-use action. Card details go directly
+ * to the card vault and are never accepted by this API. With enrollment hosted
+ * (the default) the action is a card_enrollment URL for the cardholder, which
+ * expires after 30 minutes. With enrollment server the action is a card_ingest URL
+ * that the card's issuer posts the card to from its backend, which expires after 5
+ * minutes; server enrollment returns 409 when it is not configured for the
+ * organization's card backend. A failed or expired enrollment does not affect the
+ * wallet's other payment methods. Scoped API keys require vaults:write in addition
+ * to vaults:use on this vault; otherwise the operation returns 403.
  */
 export interface AddPaymentMethodVaultItemOperationRequest {
   type: 'add_payment_method';
+
+  /**
+   * hosted returns a card_enrollment link for the cardholder. server returns a
+   * card_ingest URL for the card's issuer to post the card to server to server.
+   */
+  enrollment?: 'hosted' | 'server';
 }
 
 /**
- * The payment method created in pending_enrollment. Deliver action.url to the
- * cardholder; it is a single-use capability and must not be logged. Observe
+ * The payment method created in pending_enrollment. Deliver a card_enrollment
+ * action.url to the cardholder; it is a single-use capability and must not be
+ * logged. A card_ingest action.url is posted to by the card's issuer. Observe
  * completion through the wallet's payment_methods expansion.
  */
 export interface AddPaymentMethodVaultItemOperationResult {
@@ -3835,16 +3846,28 @@ export interface VaultPaymentMethod {
    */
   type: string;
 
+  /**
+   * The open enrollment of a pending payment method. card_enrollment is a single-use
+   * hosted link for the cardholder. card_ingest is a single-use URL on a Kernel
+   * ingest hostname served by the card vault, which the card's issuer posts the card
+   * to from its backend; Kernel never receives the card number or CVC.
+   */
   action?: VaultPaymentMethod.Action;
 
   /**
-   * Expiry of a pending enrollment link.
+   * Expiry of a pending enrollment link or ingest URL.
    */
   expires_at?: string;
 
   /**
-   * Kernel wallets only. pending_enrollment means a card_enrollment link is open;
-   * active means the card is stored and can pay when
+   * Kernel wallets only. The issuer's reference for a card it pushed with a
+   * card_ingest URL.
+   */
+  issuer_reference?: string;
+
+  /**
+   * Kernel wallets only. pending_enrollment means a card_enrollment link or
+   * card_ingest URL is open; active means the card is stored and can pay when
    * capabilities.single_use_card.eligible is true; removal_pending means removal
    * started but the provider outcome is unknown, so retry remove_payment_method;
    * recovery_required means either an enrollment outcome is unknown (remove the
@@ -3855,6 +3878,12 @@ export interface VaultPaymentMethod {
   status?: 'pending_enrollment' | 'active' | 'removal_pending' | 'recovery_required';
 
   status_reason?: string;
+
+  /**
+   * Kernel wallets only. When a card pushed with a card_ingest URL stops being
+   * usable, as its issuer set.
+   */
+  valid_until?: string;
 }
 
 export namespace VaultPaymentMethod {
@@ -3882,15 +3911,21 @@ export namespace VaultPaymentMethod {
     last4?: string;
   }
 
+  /**
+   * The open enrollment of a pending payment method. card_enrollment is a single-use
+   * hosted link for the cardholder. card_ingest is a single-use URL on a Kernel
+   * ingest hostname served by the card vault, which the card's issuer posts the card
+   * to from its backend; Kernel never receives the card number or CVC.
+   */
   export interface Action {
-    name: 'card_enrollment';
+    name: 'card_enrollment' | 'card_ingest';
 
     url: string;
 
     /**
      * Secret bearer capability for embedded card capture with @onkernel/vault-react.
-     * Present only for Kernel wallets; never for AgentCard. Treat it like the
-     * enrollment URL and do not log or persist it in browser storage.
+     * Present only on card_enrollment for Kernel wallets; never for AgentCard. Treat
+     * it like the enrollment URL and do not log or persist it in browser storage.
      */
     capture_token?: string;
   }
@@ -4923,6 +4958,13 @@ export declare namespace ItemPerformOperationParams {
      * Body param
      */
     type: 'add_payment_method';
+
+    /**
+     * Body param: hosted returns a card_enrollment link for the cardholder. server
+     * returns a card_ingest URL for the card's issuer to post the card to server to
+     * server.
+     */
+    enrollment?: 'hosted' | 'server';
   }
 
   export interface RemovePaymentMethodVaultItemOperationRequest {

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.143.0'; // x-release-please-version
+export const VERSION = '0.144.0'; // x-release-please-version