Support vault provider configs and imported Link wallets

[rgarcia]

Merge gate: stable SDK release required

Do not merge or deploy yet. The committed dependency remains the released @onkernel/sdk (^0.100.0, locked to 0.100.0). It does not contain the new resource or imported-grant request types, so a clean install of the committed dependency cannot typecheck this branch.

Validation used the generated Node SDK preview at ae29b778cecc8aadbf1922c29cd1fcb0464f9ea6, built and packed locally, then installed with bun add --no-save. No staging dependency, local package path, invented stable version, or generated SDK source is committed. The preview also calls itself 0.100.0; that is not a production release of these APIs.

Before merge: release the stable SDK normally, update this dependency and lockfile to its actual released version, and rerun validation from a clean frozen-lockfile install. Ensure the new API routes are available before deployment. Reproduction commands and the API contract comparison are in docs/vault-sdk-preview.md.

Summary

• Add consolidated manage_vault_provider_configs create/list/get/update/delete actions for organization-owned Link and AgentCard configs, with organization-scoped write checks, single-page pagination, secret rotation without identity changes, no retries, and existing deletion/error conventions.
• Extend wallet creation with config ID/name selection and backend-supplied Link grants while retaining Kernel-managed defaults. Preserve resolved bindings in public output; distinguish application credentials from user grants and document immutable grants and refresh ownership.
• Keep secrets out of public projections, validation failures, upstream errors, SDK payload logs, and analytics. Test rejection of misplaced secret keys and redaction of supplied secrets echoed into public fields.
• Update card lifecycle guidance for pending edits, omitted versus empty fields, immutable bindings, and recovery_required. Existing user-approval, entitlement gating, project scoping, and no-payment-retry behavior remain intact.

Validation

Against the exact preview above:

• bun test: 497 passed, 0 failed across 50 files, using mocked transports; covers tool routing, schemas, scopes, pagination, redaction, Kernel-managed compatibility, and recovery behavior.
• bunx tsc --noEmit: passed.
• bun run build: passed with documented dummy build-time OAuth/Clerk configuration; no real authentication or provider operation.
• Prettier on every changed file and git diff --check: passed.
• Reviewed the complete API/SDK contract diff; the latest API main merge leaves all 8 vault paths and 60 relevant schemas unchanged.

The default locked-SDK typecheck is blocked as described above. Without build-time OAuth configuration, Next.js page-data collection fails on existing required client IDs. The existing next lint script is unsupported on Next.js 16; changed-file Prettier was used instead.

No live provider calls, production mutations, deployment, merge, or release. CI and BugBot review are deferred; their status has not been polled or claimed green.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Error		Sep 10, 2026 5:56pm UTC

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dad8381. Configure here.}

[cursor]

Shared forbidden error is too specific

Medium Severity

The new forbidden mapping in throwVaultError is shared by every vault tool, but the curated text only describes provider-configuration organization scope. A 403 on manage_vaults, manage_vault_cards, or other project-owned operations now tells the agent the wrong constraint and can send it down an unrelated retry path.

 

^{Reviewed by Cursor Bugbot for commit dad8381. Configure here.}

[cursor]

Action checks reject out-of-scope fields

Low Severity

manage_vault_provider_configs rejects provider, name, and credentials when they are sent with the wrong action. Multi-action vault tools use a flat schema plus switch(action) and ignore unused fields; scope is already advertised in the .describe() prefixes. These extra action-to-field guards are a second source of truth and will fail otherwise valid list/get/update calls.

 

^{Triggered by learned rule: MCP contract tests must use real McpServer + Client + InMemoryTransport}

^{Reviewed by Cursor Bugbot for commit dad8381. Configure here.}