Merge pull request #184 from kernel/release-please--branches--main--changes--next

release: 0.117.0

Author: rgarcia

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.116.0"
+  ".": "0.117.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.117.0](https://github.com/kernel/kernel-python-sdk/compare/v0.116.0...v0.117.0) (2026-10-02)
+
+
+### Features
+
+* Invoke WebMCP tools with vault item fields ([a75eb77](https://github.com/kernel/kernel-python-sdk/commit/a75eb77bb3722e82b45836e1b9f5f6fc43dfa4ff))
+
 ## [0.116.0](https://github.com/kernel/kernel-python-sdk/compare/v0.115.0...v0.116.0) (2026-10-01)
 
 

api.md

@@ -596,8 +596,11 @@ from kernel.types.vaults import (
     VaultItemEvent,
     VaultItemOperationResponse,
     VaultPaymentMethod,
+    VaultWebmcpBinding,
     WalletVaultItemSpec,
     WalletVaultItemState,
+    WebmcpInvokeVaultItemOperationRequest,
+    WebmcpInvokeVaultItemOperationResult,
     ItemListResponse,
     ItemEventsResponse,
 )

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.116.0"
+version = "0.117.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.116.0"  # x-release-please-version
+__version__ = "0.117.0"  # x-release-please-version

src/kernel/resources/vaults/items.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Any, List, Union, Iterable, cast
+from typing import Any, Dict, List, Union, Iterable, cast
 from datetime import datetime
 from typing_extensions import Literal, overload
 
@@ -31,6 +31,7 @@
 from ...types.vaults.item_events_response import ItemEventsResponse
 from ...types.vaults.vault_fill_field_param import VaultFillFieldParam
 from ...types.vaults.card_vault_item_spec_param import CardVaultItemSpecParam
+from ...types.vaults.vault_webmcp_binding_param import VaultWebmcpBindingParam
 from ...types.vaults.vault_checkout_context_param import VaultCheckoutContextParam
 from ...types.vaults.vault_item_operation_response import VaultItemOperationResponse
 from ...types.vaults.credential_vault_item_spec_input_param import CredentialVaultItemSpecInputParam
@@ -857,13 +858,81 @@ def perform_operation(
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     def perform_operation(
         self,
@@ -878,7 +947,8 @@ def perform_operation(
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -891,6 +961,10 @@ def perform_operation(
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -921,6 +995,10 @@ def perform_operation(
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),
@@ -1954,13 +2032,81 @@ async def perform_operation(
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        bindings: Iterable[VaultWebmcpBindingParam],
+        browser_id: str,
+        input: Dict[str, object],
+        page_url: str,
+        tool_ref: str,
+        type: Literal["webmcp_invoke"],
+        timeout_sec: int | Omit = omit,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`, not an automatic-retry signal. A transport error may
+        leave the outcome unknown; do not automatically retry.
+
+        Args:
+          browser_id: Browser session ID, not a reusable browser name.
+
+          input: Public tool arguments with an existing null slot at each binding path. At most
+              64 KiB after JSON serialization, including substituted values. Never include
+              vault values here.
+
+          page_url: Exact top-level URL from the discovered tool source (fragment omitted). This
+              pins the target page; it does not authorize a destination.
+
+          tool_ref: Opaque reference to the exact live WebMCP registration.
+
+          timeout_sec: Tool invocation timeout in seconds; preflight and response handling have an
+              additional bounded allowance. An indeterminate outcome is not retried.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @required_args(
         ["id_or_name", "type"],
         ["id_or_name", "checkout", "type"],
         ["id_or_name", "browser_id", "fields", "type"],
         ["id_or_name", "browser_id", "type"],
         ["id_or_name", "browser_id", "page_url", "type"],
         ["id_or_name", "access_token", "type"],
+        ["id_or_name", "bindings", "browser_id", "input", "page_url", "tool_ref", "type"],
     )
     async def perform_operation(
         self,
@@ -1975,7 +2121,8 @@ async def perform_operation(
         | Literal["1pw_access_request_status"]
         | Literal["1pw_fill"]
         | Literal["1pw_recover"]
-        | Literal["1pw_update_access_token"],
+        | Literal["1pw_update_access_token"]
+        | Literal["webmcp_invoke"],
         checkout: VaultCheckoutContextParam | Omit = omit,
         browser_id: str | Omit = omit,
         fields: Iterable[VaultFillFieldParam] | Omit = omit,
@@ -1988,6 +2135,10 @@ async def perform_operation(
         entry_id: str | Omit = omit,
         access_token: str | Omit = omit,
         access_token_expires_at: Union[str, datetime] | Omit = omit,
+        bindings: Iterable[VaultWebmcpBindingParam] | Omit = omit,
+        input: Dict[str, object] | Omit = omit,
+        tool_ref: str | Omit = omit,
+        timeout_sec: int | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
         extra_headers: Headers | None = None,
@@ -2018,6 +2169,10 @@ async def perform_operation(
                         "entry_id": entry_id,
                         "access_token": access_token,
                         "access_token_expires_at": access_token_expires_at,
+                        "bindings": bindings,
+                        "input": input,
+                        "tool_ref": tool_ref,
+                        "timeout_sec": timeout_sec,
                     },
                     item_perform_operation_params.ItemPerformOperationParams,
                 ),

src/kernel/types/vaults/__init__.py

@@ -23,6 +23,7 @@
 from .one_password_oauth_action import OnePasswordOAuthAction as OnePasswordOAuthAction
 from .card_vault_item_spec_param import CardVaultItemSpecParam as CardVaultItemSpecParam
 from .credential_vault_item_spec import CredentialVaultItemSpec as CredentialVaultItemSpec
+from .vault_webmcp_binding_param import VaultWebmcpBindingParam as VaultWebmcpBindingParam
 from .credential_vault_field_type import CredentialVaultFieldType as CredentialVaultFieldType
 from .credential_vault_item_state import CredentialVaultItemState as CredentialVaultItemState
 from .agentcard_prepared_processor import AgentcardPreparedProcessor as AgentcardPreparedProcessor
@@ -60,6 +61,9 @@
 from .one_password_credential_vault_item_state import (
     OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState,
 )
+from .webmcp_invoke_vault_item_operation_result import (
+    WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult,
+)
 from .collect_vault_item_operation_request_param import (
     CollectVaultItemOperationRequestParam as CollectVaultItemOperationRequestParam,
 )
@@ -81,6 +85,9 @@
 from .one_password_fill_vault_item_operation_result import (
     OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult,
 )
+from .webmcp_invoke_vault_item_operation_request_param import (
+    WebmcpInvokeVaultItemOperationRequestParam as WebmcpInvokeVaultItemOperationRequestParam,
+)
 from .one_password_credential_vault_item_spec_input_param import (
     OnePasswordCredentialVaultItemSpecInputParam as OnePasswordCredentialVaultItemSpecInputParam,
 )

src/kernel/types/vaults/credential_account_vault_item.py

@@ -40,6 +40,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]
 
 

src/kernel/types/vaults/credential_vault_item.py

@@ -47,6 +47,7 @@ class AvailableOperation(BaseModel):
         "1pw_fill",
         "1pw_recover",
         "1pw_update_access_token",
+        "webmcp_invoke",
     ]