feat: Accept intent creation without a fixed status

Stainless-Generated-From: e2f63de376db35944d1bb3d31420d804f66d36b4

Author: kernel-internal[bot]

api.md

@@ -611,6 +611,7 @@ from kernel.types.vaults import (
     OnePasswordRecoverVaultItemOperationRequest,
     OnePasswordRequestAccessVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,
+    RestartVerificationVaultItemOperationRequest,
     VaultCardAliases,
     VaultCardFillField,
     VaultCheckoutContext,

src/kernel/resources/vaults/items.py

@@ -440,6 +440,53 @@ def perform_operation(
         """
         ...
 
+    @overload
+    def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     def perform_operation(
         self,
@@ -1001,6 +1048,7 @@ def perform_operation(
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
         | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]
@@ -1689,6 +1737,53 @@ async def perform_operation(
         """
         ...
 
+    @overload
+    async def perform_operation(
+        self,
+        key: str,
+        *,
+        id_or_name: str,
+        type: Literal["restart_verification"],
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultItemOperationResponse:
+        """
+        Retrieve the item first and invoke only an operation listed in
+        `available_operations`, following its natural-language description. Availability
+        is rechecked at execution time; unavailable operations return 409. Authorization
+        and preparation may call an external provider and return updated state. Link
+        cards advertise authorize without checkout context. Eligible unused AgentCard
+        cards advertise prepare_checkout, which requires checkout context and obtains
+        device approval before native Square Pay. Keep the returned approval page open,
+        poll until ready_to_submit, then submit before preparation.expires_at. Unused
+        preparations expire automatically and cannot be reused. If spend-request
+        creation is rejected with a non-retryable provider error, the card item is
+        deleted and the provider's error code and message are returned. Rate limits
+        return HTTP 429 and retain the card item; stop, back off, and retry the same
+        authorize operation.
+
+        Fill returns a value-free execution result. Validation failures before writing
+        return 400 (invalid request or targets), 403 (access or destination denied), 404
+        (resource not found), or 409 (item or browser not ready). Once writing starts,
+        known partial failures and indeterminate field outcomes return 200 with status
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        ...
+
     @overload
     async def perform_operation(
         self,
@@ -2250,6 +2345,7 @@ async def perform_operation(
         *,
         id_or_name: str,
         type: Literal["authorize"]
+        | Literal["restart_verification"]
         | Literal["confirm_transaction"]
         | Literal["collect"]
         | Literal["prepare_checkout"]

src/kernel/types/vaults/__init__.py

@@ -119,6 +119,9 @@
 from .one_password_recover_vault_item_operation_request_param import (
     OnePasswordRecoverVaultItemOperationRequestParam as OnePasswordRecoverVaultItemOperationRequestParam,
 )
+from .restart_verification_vault_item_operation_request_param import (
+    RestartVerificationVaultItemOperationRequestParam as RestartVerificationVaultItemOperationRequestParam,
+)
 from .one_password_request_access_vault_item_operation_request_param import (
     OnePasswordRequestAccessVaultItemOperationRequestParam as OnePasswordRequestAccessVaultItemOperationRequestParam,
 )

src/kernel/types/vaults/credential_account_vault_item.py

@@ -32,6 +32,7 @@ class AvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",

src/kernel/types/vaults/credential_vault_item.py

@@ -39,6 +39,7 @@ class AvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",

src/kernel/types/vaults/item_perform_operation_params.py

@@ -15,6 +15,7 @@
 __all__ = [
     "ItemPerformOperationParams",
     "AuthorizeVaultItemOperationRequest",
+    "RestartVerificationVaultItemOperationRequest",
     "ConfirmTransactionVaultItemOperationRequest",
     "CollectVaultItemOperationRequest",
     "PrepareCheckoutVaultItemOperationRequest",
@@ -34,6 +35,12 @@ class AuthorizeVaultItemOperationRequest(TypedDict, total=False):
     type: Required[Literal["authorize"]]
 
 
+class RestartVerificationVaultItemOperationRequest(TypedDict, total=False):
+    id_or_name: Required[str]
+
+    type: Required[Literal["restart_verification"]]
+
+
 class ConfirmTransactionVaultItemOperationRequest(TypedDict, total=False):
     id_or_name: Required[str]
 
@@ -195,6 +202,7 @@ class WebmcpInvokeVaultItemOperationRequest(TypedDict, total=False):
 
 ItemPerformOperationParams: TypeAlias = Union[
     AuthorizeVaultItemOperationRequest,
+    RestartVerificationVaultItemOperationRequest,
     ConfirmTransactionVaultItemOperationRequest,
     CollectVaultItemOperationRequest,
     PrepareCheckoutVaultItemOperationRequest,

src/kernel/types/vaults/kernel_card_state.py

@@ -44,12 +44,16 @@ class KernelCardState(BaseModel):
     """
     pending_authorization on a Visa purchase waits for the cardholder to approve it
     through the spend_approval action; an unused link expires after 30 minutes.
-    recovery_required means approving the purchase or issuing the one-time code has
-    an unresolved outcome. Kernel never approves again or issues another code for
-    the item automatically, and the item cannot be deleted or replaced until the
-    original attempt is reconciled with support. When status_reason says the
-    provider refused retrieval before acceptance, no code was issued and a later
-    read retries. declined means the card network refused to issue a code.
+    recovery_required means verification, approving the purchase or issuing the
+    one-time code has an unresolved outcome. A server-classified initial attestation
+    failure before intent dispatch may advertise restart_verification to prepare a
+    fresh local verification link; this does not approve spending or replay any
+    provider request. Unclassified legacy recovery and uncertain intent creation
+    cannot restart. Kernel never approves again or issues another code for the item
+    automatically, and the item cannot be deleted or replaced until the original
+    attempt is reconciled with support. When status_reason says the provider refused
+    retrieval before acceptance, no code was issued and a later read retries.
+    declined means the card network refused to issue a code.
     """
 
     domains: Optional[List[str]] = None

src/kernel/types/vaults/restart_verification_vault_item_operation_request_param.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Literal, Required, TypedDict
+
+__all__ = ["RestartVerificationVaultItemOperationRequestParam"]
+
+
+class RestartVerificationVaultItemOperationRequestParam(TypedDict, total=False):
+    """
+    Explicitly prepare a fresh local verification session for the same Kernel Visa purchase and connected wallet, only when restart_verification is advertised. Kernel must have durable proof of an initial attestation failure before intent dispatch. Replaces the spend_approval capability and discards session-bound verification data without calling the provider or granting spend consent. The cardholder must use the new link, verify again and explicitly approve the purchase. Unknown intent creation, legacy unclassified recovery, enrollment completion, issuance and confirmation cannot restart. Do not automatically retry this operation.
+    """
+
+    type: Required[Literal["restart_verification"]]

src/kernel/types/vaults/vault_item.py

@@ -47,6 +47,7 @@ class WalletVaultItemAvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",
@@ -123,6 +124,7 @@ class CardVaultItemAvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",

src/kernel/types/vaults/vault_item_operation_response.py

@@ -49,6 +49,7 @@ class WalletVaultItemAvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",
@@ -125,6 +126,7 @@ class CardVaultItemAvailableOperation(BaseModel):
 
     type: Literal[
         "authorize",
+        "restart_verification",
         "confirm_transaction",
         "collect",
         "prepare_checkout",