feat: Expose Link card credential_type and explain pay token fill rejections

Stainless-Generated-From: e3670e2e4190f4bca739941906edad5ca3908134

Author: kernel-internal[bot]

src/kernel/resources/vaults/items.py

@@ -166,8 +166,8 @@ def update(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -218,8 +218,8 @@ def update(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -1928,8 +1928,8 @@ def upsert(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -1977,8 +1977,8 @@ def upsert(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -2257,8 +2257,8 @@ async def update(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -2309,8 +2309,8 @@ async def update(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -4019,8 +4019,8 @@ async def upsert(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 
@@ -4068,8 +4068,8 @@ async def upsert(
               be changed with PATCH until the card is authorized at a checkout. Authorize it
               with the browser at final checkout: Kernel inspects the checkout through WebMCP
               and internally chooses a merchant-bound Link Pay Token when supported or a
-              virtual card otherwise. Callers never receive or choose how the credential is
-              delivered.
+              virtual card otherwise. Callers do not choose how the credential is delivered;
+              after authorize, state.credential_type reports it.
 
           extra_headers: Send extra headers
 

src/kernel/types/vaults/card_vault_item_spec.py

@@ -74,7 +74,7 @@ class LinkCardVaultItemSpecTotal(BaseModel):
 class LinkCardVaultItemSpec(BaseModel):
     """Live Link card request.
 
-    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers never receive or choose how the credential is delivered.
+    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers do not choose how the credential is delivered; after authorize, state.credential_type reports it.
     """
 
     amount: int

src/kernel/types/vaults/card_vault_item_spec_param.py

@@ -74,7 +74,7 @@ class LinkCardVaultItemSpecTotal(TypedDict, total=False):
 class LinkCardVaultItemSpec(TypedDict, total=False):
     """Live Link card request.
 
-    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers never receive or choose how the credential is delivered.
+    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers do not choose how the credential is delivered; after authorize, state.credential_type reports it.
     """
 
     amount: Required[int]

src/kernel/types/vaults/card_vault_item_state.py

@@ -58,6 +58,15 @@ class LinkCardState(BaseModel):
     and should approve only the new one.
     """
 
+    credential_type: Optional[Literal["card", "link_pay_token"]] = None
+    """
+    The Link spend request's credential_type, set when authorize sends the request
+    to Link. Absent before authorize and after Link rejects the request; a ready
+    card without it fills like card. card is a Link virtual card; fill it with field
+    bindings. link_pay_token is a Link Pay Token that Kernel supplies through the
+    checkout's Link WebMCP tool; fill it without fields.
+    """
+
     domains: Optional[List[str]] = None
 
     masks: Optional[LinkCardStateMasks] = None

src/kernel/types/vaults/item_update_params.py

@@ -27,7 +27,8 @@ class CardVaultItemUpdateRequest(TypedDict, total=False):
     until the card is authorized at a checkout. Authorize it with the browser at
     final checkout: Kernel inspects the checkout through WebMCP and internally
     chooses a merchant-bound Link Pay Token when supported or a virtual card
-    otherwise. Callers never receive or choose how the credential is delivered.
+    otherwise. Callers do not choose how the credential is delivered; after
+    authorize, state.credential_type reports it.
     """
 
     type: Literal["card"]
@@ -43,7 +44,8 @@ class PaymentRequestVaultItemUpdateRequest(TypedDict, total=False):
     until the card is authorized at a checkout. Authorize it with the browser at
     final checkout: Kernel inspects the checkout through WebMCP and internally
     chooses a merchant-bound Link Pay Token when supported or a virtual card
-    otherwise. Callers never receive or choose how the credential is delivered.
+    otherwise. Callers do not choose how the credential is delivered; after
+    authorize, state.credential_type reports it.
     """
 
     type: Required[Literal["payment_request"]]

src/kernel/types/vaults/item_upsert_params.py

@@ -219,7 +219,8 @@ class CardVaultItemRequest(TypedDict, total=False):
     until the card is authorized at a checkout. Authorize it with the browser at
     final checkout: Kernel inspects the checkout through WebMCP and internally
     chooses a merchant-bound Link Pay Token when supported or a virtual card
-    otherwise. Callers never receive or choose how the credential is delivered.
+    otherwise. Callers do not choose how the credential is delivered; after
+    authorize, state.credential_type reports it.
     """
 
     type: Required[Literal["card"]]
@@ -235,7 +236,8 @@ class PaymentRequestVaultItemRequest(TypedDict, total=False):
     until the card is authorized at a checkout. Authorize it with the browser at
     final checkout: Kernel inspects the checkout through WebMCP and internally
     chooses a merchant-bound Link Pay Token when supported or a virtual card
-    otherwise. Callers never receive or choose how the credential is delivered.
+    otherwise. Callers do not choose how the credential is delivered; after
+    authorize, state.credential_type reports it.
     """
 
     type: Required[Literal["payment_request"]]

src/kernel/types/vaults/payment_request_vault_item.py

@@ -76,7 +76,8 @@ class PaymentRequestVaultItem(BaseModel):
     until the card is authorized at a checkout. Authorize it with the browser at
     final checkout: Kernel inspects the checkout through WebMCP and internally
     chooses a merchant-bound Link Pay Token when supported or a virtual card
-    otherwise. Callers never receive or choose how the credential is delivered.
+    otherwise. Callers do not choose how the credential is delivered; after
+    authorize, state.credential_type reports it.
     """
 
     state: PaymentRequestVaultItemState

src/kernel/types/vaults/payment_request_vault_item_spec.py

@@ -71,7 +71,7 @@ class LinkCardVaultItemSpecTotal(BaseModel):
 class LinkCardVaultItemSpec(BaseModel):
     """Live Link card request.
 
-    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers never receive or choose how the credential is delivered.
+    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers do not choose how the credential is delivered; after authorize, state.credential_type reports it.
     """
 
     amount: int

src/kernel/types/vaults/payment_request_vault_item_spec_param.py

@@ -71,7 +71,7 @@ class LinkCardVaultItemSpecTotal(TypedDict, total=False):
 class LinkCardVaultItemSpec(TypedDict, total=False):
     """Live Link card request.
 
-    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers never receive or choose how the credential is delivered.
+    Test-mode card creation is not supported. The spec can be changed with PATCH until the card is authorized at a checkout. Authorize it with the browser at final checkout: Kernel inspects the checkout through WebMCP and internally chooses a merchant-bound Link Pay Token when supported or a virtual card otherwise. Callers do not choose how the credential is delivered; after authorize, state.credential_type reports it.
     """
 
     amount: Required[int]

src/kernel/types/vaults/payment_request_vault_item_state.py

@@ -53,6 +53,15 @@ class LinkCardState(BaseModel):
     and should approve only the new one.
     """
 
+    credential_type: Optional[Literal["card", "link_pay_token"]] = None
+    """
+    The Link spend request's credential_type, set when authorize sends the request
+    to Link. Absent before authorize and after Link rejects the request; a ready
+    card without it fills like card. card is a Link virtual card; fill it with field
+    bindings. link_pay_token is a Link Pay Token that Kernel supplies through the
+    checkout's Link WebMCP tool; fill it without fields.
+    """
+
     domains: Optional[List[str]] = None
 
     masks: Optional[LinkCardStateMasks] = None