diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index f118d043..65b6e7b4 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.128.0"
+  ".": "0.129.0"
 }
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a97812d..aa086c90 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.129.0](https://github.com/kernel/kernel-go-sdk/compare/v0.128.0...v0.129.0) (2026-10-21)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([1f0841c](https://github.com/kernel/kernel-go-sdk/commit/1f0841c30810ad2b012024e28b48efe2faa5bfcd))
+
 ## [0.128.0](https://github.com/kernel/kernel-go-sdk/compare/v0.127.0...v0.128.0) (2026-10-19)
 
 
diff --git a/README.md b/README.md
index 57cd5fc2..54e7a130 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ Or to pin the version:
 <!-- x-release-please-start-version -->
 
 ```sh
-go get -u 'github.com/kernel/kernel-go-sdk@v0.128.0'
+go get -u 'github.com/kernel/kernel-go-sdk@v0.129.0'
 ```
 
 <!-- x-release-please-end -->
diff --git a/browser.go b/browser.go
index 99c4fc58..d31c9bda 100644
--- a/browser.go
+++ b/browser.go
@@ -251,16 +251,16 @@ type BrowserLocation struct {
 	// Effective canonical BCP 47 formatting locale selected for the browser session.
 	Locale string `json:"locale" api:"required"`
 	// Where one effective browser location field came from. `override` is set
-	// explicitly on the session; `metro` is the default for the browser's region.
+	// explicitly on the session; `default` comes from the browser's region.
 	//
-	// Any of "override", "metro".
+	// Any of "override", "default".
 	LocaleSource BrowserLocationSource `json:"locale_source" api:"required"`
 	// Effective IANA timezone selected for the browser session.
 	Timezone string `json:"timezone" api:"required"`
 	// Where one effective browser location field came from. `override` is set
-	// explicitly on the session; `metro` is the default for the browser's region.
+	// explicitly on the session; `default` comes from the browser's region.
 	//
-	// Any of "override", "metro".
+	// Any of "override", "default".
 	TimezoneSource BrowserLocationSource `json:"timezone_source" api:"required"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
@@ -298,12 +298,12 @@ func (r *BrowserLocationRequestParam) UnmarshalJSON(data []byte) error {
 }
 
 // Where one effective browser location field came from. `override` is set
-// explicitly on the session; `metro` is the default for the browser's region.
+// explicitly on the session; `default` comes from the browser's region.
 type BrowserLocationSource string
 
 const (
 	BrowserLocationSourceOverride BrowserLocationSource = "override"
-	BrowserLocationSourceMetro    BrowserLocationSource = "metro"
+	BrowserLocationSourceDefault  BrowserLocationSource = "default"
 )
 
 // Omit a field to leave it unchanged, set a string override, or set null to clear
diff --git a/internal/version.go b/internal/version.go
index f03c570a..dae76fee 100644
--- a/internal/version.go
+++ b/internal/version.go
@@ -2,4 +2,4 @@
 
 package internal
 
-const PackageVersion = "0.128.0" // x-release-please-version
+const PackageVersion = "0.129.0" // x-release-please-version
diff --git a/shared/shared.go b/shared/shared.go
index 88d6140c..1d7ae0f2 100644
--- a/shared/shared.go
+++ b/shared/shared.go
@@ -135,8 +135,8 @@ type BrowserViewport struct {
 	Height int64 `json:"height" api:"required"`
 	// Browser window width in pixels. Any positive integer is accepted.
 	Width int64 `json:"width" api:"required"`
-	// Display refresh rate in Hz. Any positive integer is accepted; if omitted,
-	// automatically determined from width and height.
+	// Display refresh rate in Hz. Any positive integer is accepted; if omitted, GPU
+	// browsers default to 60 and other browsers derive it from width and height.
 	RefreshRate int64 `json:"refresh_rate"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
@@ -182,8 +182,8 @@ type BrowserViewportParam struct {
 	Height int64 `json:"height" api:"required"`
 	// Browser window width in pixels. Any positive integer is accepted.
 	Width int64 `json:"width" api:"required"`
-	// Display refresh rate in Hz. Any positive integer is accepted; if omitted,
-	// automatically determined from width and height.
+	// Display refresh rate in Hz. Any positive integer is accepted; if omitted, GPU
+	// browsers default to 60 and other browsers derive it from width and height.
 	RefreshRate param.Opt[int64] `json:"refresh_rate,omitzero"`
 	paramObj
 }
diff --git a/vaultitem.go b/vaultitem.go
index 5fb49bfd..69bcfe80 100644
--- a/vaultitem.go
+++ b/vaultitem.go
@@ -4584,6 +4584,8 @@ func (r *VaultItemUnionStateFields) UnmarshalJSON(data []byte) error {
 type VaultItemUnionAction struct {
 	Name string `json:"name"`
 	URL  string `json:"url"`
+	// This field is from variant [VaultItemActionUnion].
+	CaptureToken string `json:"capture_token"`
 	// This field is from variant [CredentialVaultItemActionUnion].
 	ExpiresAt time.Time `json:"expires_at"`
 	// This field is from variant [CredentialVaultItemActionUnion].
@@ -4591,6 +4593,7 @@ type VaultItemUnionAction struct {
 	JSON         struct {
 		Name         respjson.Field
 		URL          respjson.Field
+		CaptureToken respjson.Field
 		ExpiresAt    respjson.Field
 		Instructions respjson.Field
 		raw          string
@@ -4824,10 +4827,13 @@ type VaultItemActionUnion struct {
 	// "collect", "mfa", "embedded_ceremony", "card_enrollment".
 	Name string `json:"name"`
 	URL  string `json:"url"`
-	JSON struct {
-		Name respjson.Field
-		URL  respjson.Field
-		raw  string
+	// This field is from variant [VaultItemActionCardEnrollment].
+	CaptureToken string `json:"capture_token"`
+	JSON         struct {
+		Name         respjson.Field
+		URL          respjson.Field
+		CaptureToken respjson.Field
+		raw          string
 	} `json:"-"`
 }
 
@@ -5032,12 +5038,17 @@ func (r *VaultItemActionEmbeddedCeremony) UnmarshalJSON(data []byte) error {
 type VaultItemActionCardEnrollment struct {
 	Name constant.CardEnrollment `json:"name" default:"card_enrollment"`
 	URL  string                  `json:"url" api:"required" format:"uri"`
+	// Secret bearer capability for embedded card capture with @onkernel/vault-react.
+	// Present only for Kernel wallets; never for AgentCard. Treat it like the
+	// enrollment URL and do not log or persist it in browser storage.
+	CaptureToken string `json:"capture_token"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
-		Name        respjson.Field
-		URL         respjson.Field
-		ExtraFields map[string]respjson.Field
-		raw         string
+		Name         respjson.Field
+		URL          respjson.Field
+		CaptureToken respjson.Field
+		ExtraFields  map[string]respjson.Field
+		raw          string
 	} `json:"-"`
 }
 
@@ -5513,6 +5524,8 @@ func (r *VaultItemOperationResponseUnionStateFields) UnmarshalJSON(data []byte)
 type VaultItemOperationResponseUnionAction struct {
 	Name string `json:"name"`
 	URL  string `json:"url"`
+	// This field is from variant [VaultItemActionUnion].
+	CaptureToken string `json:"capture_token"`
 	// This field is from variant [CredentialVaultItemActionUnion].
 	ExpiresAt time.Time `json:"expires_at"`
 	// This field is from variant [CredentialVaultItemActionUnion].
@@ -5520,6 +5533,7 @@ type VaultItemOperationResponseUnionAction struct {
 	JSON         struct {
 		Name         respjson.Field
 		URL          respjson.Field
+		CaptureToken respjson.Field
 		ExpiresAt    respjson.Field
 		Instructions respjson.Field
 		raw          string