Merge pull request #213 from kernel/release-please--branches--main--changes--next

release: 0.143.0

Author: hiroTamada

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.142.0"
+  ".": "0.143.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.143.0](https://github.com/kernel/kernel-python-sdk/compare/v0.142.0...v0.143.0) (2026-11-07)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([3bd8370](https://github.com/kernel/kernel-python-sdk/commit/3bd8370746886f275a57362ba00e267e8d6a52aa))
+
 ## [0.142.0](https://github.com/kernel/kernel-python-sdk/compare/v0.141.0...v0.142.0) (2026-11-06)
 
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.142.0"
+version = "0.143.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.142.0"  # x-release-please-version
+__version__ = "0.143.0"  # x-release-please-version

src/kernel/types/vaults/vgs_card_input.py

@@ -1,28 +1,38 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
+from typing import Optional
+
 from ..._models import BaseModel
 
 __all__ = ["VgsCardInput"]
 
 
 class VgsCardInput(BaseModel):
-    """The card's aliases in the customer's VGS vault, its expiry and last four digits.
+    """The card supplied to a purchase, as aliases in the customer's VGS vault.
 
-    Write-only: stored encrypted and never returned in the item, its events or logs. A repeated PUT with the same key must send the same card.
+    With card_mode full it is a whole card: a persistent alias of its number, a freshly collected volatile alias of its security code, its expiry and its last four digits. With card_mode cvc_only it is a CVC alias alone, because the merchant holds the rest on file. pan_alias, exp_month, exp_year and last4 are required with card_mode full and rejected with card_mode cvc_only. Write-only: stored encrypted and never returned in the item, its events or logs. A repeated PUT with the same key must send the same card.
     """
 
     cvc_alias: str
     """A volatile alias of a freshly collected security code in the customer's vault.
 
-    It must still exist when authorize runs.
+    It must still exist when authorize runs. Required in both modes.
     """
 
-    exp_month: int
+    exp_month: Optional[int] = None
+    """Required with card_mode full, rejected with card_mode cvc_only."""
+
+    exp_year: Optional[int] = None
+    """Required with card_mode full, rejected with card_mode cvc_only."""
 
-    exp_year: int
+    last4: Optional[str] = None
+    """The card number's last four digits, checked against the revealed alias.
 
-    last4: str
-    """The card number's last four digits, checked against the revealed alias."""
+    Required with card_mode full, rejected with card_mode cvc_only.
+    """
 
-    pan_alias: str
-    """A persistent alias of the card number in the customer's vault."""
+    pan_alias: Optional[str] = None
+    """A persistent alias of the card number in the customer's vault.
+
+    Required with card_mode full, rejected with card_mode cvc_only.
+    """

src/kernel/types/vaults/vgs_card_input_param.py

@@ -8,23 +8,31 @@
 
 
 class VgsCardInputParam(TypedDict, total=False):
-    """The card's aliases in the customer's VGS vault, its expiry and last four digits.
+    """The card supplied to a purchase, as aliases in the customer's VGS vault.
 
-    Write-only: stored encrypted and never returned in the item, its events or logs. A repeated PUT with the same key must send the same card.
+    With card_mode full it is a whole card: a persistent alias of its number, a freshly collected volatile alias of its security code, its expiry and its last four digits. With card_mode cvc_only it is a CVC alias alone, because the merchant holds the rest on file. pan_alias, exp_month, exp_year and last4 are required with card_mode full and rejected with card_mode cvc_only. Write-only: stored encrypted and never returned in the item, its events or logs. A repeated PUT with the same key must send the same card.
     """
 
     cvc_alias: Required[str]
     """A volatile alias of a freshly collected security code in the customer's vault.
 
-    It must still exist when authorize runs.
+    It must still exist when authorize runs. Required in both modes.
     """
 
-    exp_month: Required[int]
+    exp_month: int
+    """Required with card_mode full, rejected with card_mode cvc_only."""
 
-    exp_year: Required[int]
+    exp_year: int
+    """Required with card_mode full, rejected with card_mode cvc_only."""
 
-    last4: Required[str]
-    """The card number's last four digits, checked against the revealed alias."""
+    last4: str
+    """The card number's last four digits, checked against the revealed alias.
 
-    pan_alias: Required[str]
-    """A persistent alias of the card number in the customer's vault."""
+    Required with card_mode full, rejected with card_mode cvc_only.
+    """
+
+    pan_alias: str
+    """A persistent alias of the card number in the customer's vault.
+
+    Required with card_mode full, rejected with card_mode cvc_only.
+    """

src/kernel/types/vaults/vgs_card_vault_item_spec.py

@@ -12,7 +12,7 @@
 class VgsCardVaultItemSpec(BaseModel):
     """One live purchase with a card in the customer's VGS vault.
 
-    authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which replaces both with aliases in Kernel's vault before they reach Kernel; Kernel never receives the card number or security code. The card is then ready with no further approval, until expires_at, by default five minutes after authorize. fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's details when the browser submits checkout. An expired card requires a new purchase with a freshly collected CVC alias. The amount and merchant are recorded but do not restrict payment requests sent by the browser. Card updates are not supported; delete and create a new item instead.
+    With card_mode full, authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy; with card_mode cvc_only, for a card the merchant already holds on file whose checkout page asks only for the security code, it reveals card.cvc_alias alone. The proxy replaces each revealed value with an alias in Kernel's vault before it reaches Kernel; Kernel never receives the card number or security code. The card is then ready with no further approval, until expires_at, by default five minutes after authorize. fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's details when the browser submits checkout; a cvc_only card fills only the cvc field, and reports no masks because it has no last4 to verify. A cvc_only card's payment window routes all of the browser's egress through Kernel's VGS outbound proxy, exactly as widely as a full card's: while it is open the proxy reveals the card's aliases to any destination the browser sends them to, not only the security code. An expired card requires a new purchase with a freshly collected CVC alias. The amount and merchant are recorded but do not restrict payment requests sent by the browser. Card updates are not supported; delete and create a new item instead.
     """
 
     amount: int
@@ -37,3 +37,12 @@ class VgsCardVaultItemSpec(BaseModel):
 
     card: Optional[VgsCardInput] = None
     """Required when creating the card. Never returned."""
+
+    card_mode: Optional[Literal["full", "cvc_only"]] = None
+    """Which card this purchase supplies, and the only part of it a read returns.
+
+    full is a whole card from the customer's vault. cvc_only is a card the merchant
+    already holds on file, whose checkout page asks for nothing but the security
+    code. It must match spec.card: a full card that is missing pan_alias is rejected
+    rather than treated as cvc_only. Omit it for full, which a read also omits.
+    """

src/kernel/types/vaults/vgs_card_vault_item_spec_param.py

@@ -12,7 +12,7 @@
 class VgsCardVaultItemSpecParam(TypedDict, total=False):
     """One live purchase with a card in the customer's VGS vault.
 
-    authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which replaces both with aliases in Kernel's vault before they reach Kernel; Kernel never receives the card number or security code. The card is then ready with no further approval, until expires_at, by default five minutes after authorize. fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's details when the browser submits checkout. An expired card requires a new purchase with a freshly collected CVC alias. The amount and merchant are recorded but do not restrict payment requests sent by the browser. Card updates are not supported; delete and create a new item instead.
+    With card_mode full, authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy; with card_mode cvc_only, for a card the merchant already holds on file whose checkout page asks only for the security code, it reveals card.cvc_alias alone. The proxy replaces each revealed value with an alias in Kernel's vault before it reaches Kernel; Kernel never receives the card number or security code. The card is then ready with no further approval, until expires_at, by default five minutes after authorize. fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's details when the browser submits checkout; a cvc_only card fills only the cvc field, and reports no masks because it has no last4 to verify. A cvc_only card's payment window routes all of the browser's egress through Kernel's VGS outbound proxy, exactly as widely as a full card's: while it is open the proxy reveals the card's aliases to any destination the browser sends them to, not only the security code. An expired card requires a new purchase with a freshly collected CVC alias. The amount and merchant are recorded but do not restrict payment requests sent by the browser. Card updates are not supported; delete and create a new item instead.
     """
 
     amount: Required[int]
@@ -37,3 +37,12 @@ class VgsCardVaultItemSpecParam(TypedDict, total=False):
 
     card: VgsCardInputParam
     """Required when creating the card. Never returned."""
+
+    card_mode: Literal["full", "cvc_only"]
+    """Which card this purchase supplies, and the only part of it a read returns.
+
+    full is a whole card from the customer's vault. cvc_only is a card the merchant
+    already holds on file, whose checkout page asks for nothing but the security
+    code. It must match spec.card: a full card that is missing pan_alias is rejected
+    rather than treated as cvc_only. Omit it for full, which a read also omits.
+    """