release: 0.133.0

.github/tests/update-coverage-security.test.mjs

@@ -61,10 +61,12 @@ test('changes are restricted to the allowlist before validation', () => {
   assert.ok(jobs.generate.indexOf(snapshot) < jobs.generate.indexOf(verify));
   assert.match(snapshot, /mcp-update-disallowed-paths\.sh/);
   assert.match(snapshot, /git reset -q --hard\n\s+git clean -fdq/);
-  assert.match(snapshot, /MAIN_SHA: \$\{\{ steps\.prepare\.outputs\.main_sha \}\}/);
-  assert.match(snapshot, /git reset -q --soft "\$MAIN_SHA"\n\s+git add -A/);
+  assert.match(snapshot, /AGENT_BASE: \$\{\{ steps\.prepare\.outputs\.agent_base \}\}/);
+  assert.match(snapshot, /git reset -q --soft "\$AGENT_BASE"\n\s+git add -A/);
   const prepare = step('generate', 'Prepare update branch and SDK diff');
   assert.match(prepare, /main_sha=\$\(git rev-parse origin\/main\)/);
+  assert.match(prepare, /git rebase origin\/main; then[\s\S]*else\n\s+echo "rebased=true"/);
+  assert.match(prepare, /agent_base=\$\(git rev-parse HEAD\)[\s\S]*agent_base_tree=/);
   // Only a branch without human commits may be regenerated from main.
   assert.match(
     prepare,
@@ -107,6 +109,14 @@ test('publishing runs in a separate job that never executes repository code', ()
   assert.match(apply, /git apply --index "\$RUNNER_TEMP\/mcp-coverage-update\/changes\.patch"/);
   assert.match(apply, /mcp-update-disallowed-paths\.sh/);
   assert.match(apply, /100644\|100755\|000000/);
+  // Publishing rebuilds the exact head the changes were validated on, so human
+  // commits on the update branch are never squashed or dropped.
+  assert.match(
+    apply,
+    /if \[\[ "\$REBASED" == true \]\]; then\n\s+git switch -c \S+ "\$UPDATE_SHA"\n\s+git rebase -q "\$MAIN_SHA"/,
+  );
+  assert.match(apply, /"\$\(git rev-parse 'HEAD\^\{tree\}'\)" != "\$AGENT_BASE_TREE"[\s\S]*exit 1/);
+  assert.ok(apply.indexOf('AGENT_BASE_TREE') < apply.indexOf('git apply --index'));
   const mint = jobs.publish.indexOf(step('publish', 'Generate MCP repository token'));
   assert.ok(jobs.publish.indexOf(apply) < mint);
   assert.doesNotMatch(jobs.publish.slice(0, mint).join(''), /GH_TOKEN:/);

.github/workflows/update-mcp-coverage.yml

@@ -61,6 +61,8 @@ jobs:
       changed: ${{ steps.snapshot.outputs.changed }}
       main_sha: ${{ steps.prepare.outputs.main_sha }}
       update_sha: ${{ steps.prepare.outputs.update_sha }}
+      rebased: ${{ steps.prepare.outputs.rebased }}
+      agent_base_tree: ${{ steps.prepare.outputs.agent_base_tree }}
     env:
       SDK_VERSION: ${{ needs.sdk-version.outputs.version }}
       SDK_SHA: ${{ needs.sdk-version.outputs.sha }}
@@ -126,10 +128,16 @@ jobs:
               fi
               echo "::warning::$UPDATE_BRANCH conflicts with main; regenerating it from main."
               git switch -C "$UPDATE_BRANCH" origin/main
+            else
+              echo "rebased=true" >> "$GITHUB_OUTPUT"
             fi
           else
             git switch -c "$UPDATE_BRANCH" origin/main
           fi
+          # The agent's changes are published on top of this head, so human
+          # commits on the update branch keep their content and authorship.
+          echo "agent_base=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          echo "agent_base_tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
 
           old_version=$(jq -er '.dependencies["@onkernel/sdk"]' package.json)
           if [[ "$old_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] &&
@@ -221,9 +229,9 @@ jobs:
         id: snapshot
         working-directory: mcp
         env:
-          MAIN_SHA: ${{ steps.prepare.outputs.main_sha }}
+          AGENT_BASE: ${{ steps.prepare.outputs.agent_base }}
         run: |
-          git reset -q --soft "$MAIN_SHA"
+          git reset -q --soft "$AGENT_BASE"
           git add -A
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/excluded-paths"
@@ -276,6 +284,8 @@ jobs:
       SDK_VERSION: ${{ needs.sdk-version.outputs.version }}
       MAIN_SHA: ${{ needs.generate.outputs.main_sha }}
       UPDATE_SHA: ${{ needs.generate.outputs.update_sha }}
+      REBASED: ${{ needs.generate.outputs.rebased }}
+      AGENT_BASE_TREE: ${{ needs.generate.outputs.agent_base_tree }}
       UPDATE_BRANCH: mcp-coverage-update
     steps:
       - name: Checkout updater scripts
@@ -302,7 +312,16 @@ jobs:
         run: |
           git config user.name 'kernel-internal[bot]'
           git config user.email '260533166+kernel-internal[bot]@users.noreply.github.com'
-          git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
+          if [[ "$REBASED" == true ]]; then
+            git switch -c "$UPDATE_BRANCH" "$UPDATE_SHA"
+            git rebase -q "$MAIN_SHA"
+          else
+            git switch -c "$UPDATE_BRANCH" "$MAIN_SHA"
+          fi
+          if [[ "$(git rev-parse 'HEAD^{tree}')" != "$AGENT_BASE_TREE" ]]; then
+            echo "::error::The rebuilt update branch differs from the one the changes were validated on."
+            exit 1
+          fi
           git apply --index "$RUNNER_TEMP/mcp-coverage-update/changes.patch"
           git diff --cached --name-only --no-renames -z \
             | bash ../.github/scripts/mcp-update-disallowed-paths.sh > "$RUNNER_TEMP/disallowed-paths"

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.132.0"
+  ".": "0.133.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.133.0](https://github.com/kernel/kernel-node-sdk/compare/v0.132.0...v0.133.0) (2026-10-27)
+
+
+### Features
+
+* Support multiple Kernel wallet payment methods and payment requests ([e338fed](https://github.com/kernel/kernel-node-sdk/commit/e338fedec0766e6f214cc0bec287c8819f402e0b))
+
 ## [0.132.0](https://github.com/kernel/kernel-node-sdk/compare/v0.131.0...v0.132.0) (2026-10-26)
 
 

api.md

@@ -512,6 +512,8 @@ Methods:
 
 Types:
 
+- <code><a href="./src/resources/vaults/items.ts">AddPaymentMethodVaultItemOperationRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">AddPaymentMethodVaultItemOperationResult</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AgentcardCheckoutAuthorization</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AgentcardCheckoutPreparation</a></code>
 - <code><a href="./src/resources/vaults/items.ts">AgentcardPreparedProcessor</a></code>
@@ -545,6 +547,7 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">KernelCredentialVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelCredentialVaultItemSpecInput</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelCredentialVaultItemState</a></code>
+- <code><a href="./src/resources/vaults/items.ts">KernelPaymentRequestVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelWalletState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelWalletVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">LinkShippingAddress</a></code>
@@ -564,8 +567,13 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">OnePasswordRecoverVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">OnePasswordRequestAccessVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">PasskeyVaultItemOperationResult</a></code>
+- <code><a href="./src/resources/vaults/items.ts">PaymentRequestVaultItem</a></code>
+- <code><a href="./src/resources/vaults/items.ts">PaymentRequestVaultItemSpec</a></code>
+- <code><a href="./src/resources/vaults/items.ts">PaymentRequestVaultItemState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">PrepareCheckoutVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">RegisterPasskeyVaultItemOperationRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">RemovePaymentMethodVaultItemOperationRequest</a></code>
+- <code><a href="./src/resources/vaults/items.ts">RemovePaymentMethodVaultItemOperationResult</a></code>
 - <code><a href="./src/resources/vaults/items.ts">RestartVerificationVaultItemOperationRequest</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardAliases</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardFillField</a></code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.132.0",
+  "version": "0.133.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/vaults/index.ts

@@ -2,6 +2,8 @@
 
 export {
   Items,
+  type AddPaymentMethodVaultItemOperationRequest,
+  type AddPaymentMethodVaultItemOperationResult,
   type AgentcardCheckoutAuthorization,
   type AgentcardCheckoutPreparation,
   type AgentcardPreparedProcessor,
@@ -35,6 +37,7 @@ export {
   type KernelCredentialVaultItemSpec,
   type KernelCredentialVaultItemSpecInput,
   type KernelCredentialVaultItemState,
+  type KernelPaymentRequestVaultItemSpec,
   type KernelWalletState,
   type KernelWalletVaultItemSpec,
   type LinkShippingAddress,
@@ -54,8 +57,13 @@ export {
   type OnePasswordRecoverVaultItemOperationRequest,
   type OnePasswordRequestAccessVaultItemOperationRequest,
   type PasskeyVaultItemOperationResult,
+  type PaymentRequestVaultItem,
+  type PaymentRequestVaultItemSpec,
+  type PaymentRequestVaultItemState,
   type PrepareCheckoutVaultItemOperationRequest,
   type RegisterPasskeyVaultItemOperationRequest,
+  type RemovePaymentMethodVaultItemOperationRequest,
+  type RemovePaymentMethodVaultItemOperationResult,
   type RestartVerificationVaultItemOperationRequest,
   type VaultCardAliases,
   type VaultCardFillField,