[kernel-internal]

Automated Release PR

0.140.0 (2026-11-04)

Features

• Add single-use Kernel cards to vaults (c11d264)
• Drop Kernel's origin gate from 1Password fill (e5454cb)
• Let customers keep refreshing imported Link wallet grants (f67de9c)
• Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures (56c9983)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

High Risk
Generated types and docs for vault card PAN/CVC storage, Link OAuth token refresh modes, and WebMCP non-retry semantics—integrators must adopt the new contracts correctly to avoid payment or auth failures.

Overview
Release 0.140.0 updates the generated Python SDK to match new vault, Link wallet, 1Password, and WebMCP API behavior (version/changelog bumps only in packaging files).

Vault — single-use Kernel cards: Kernel card create/upsert types now accept an optional single_use_card payload (PAN, expiry, CVC, billing address, reference) instead of payment_method_id, plus optional expires_at. Responses expose KernelSingleUseCard, billing-address types, and card state source (payment_method vs single_use_card) with docs noting fill-on-registrable-domain behavior for single-use cards.

Vault — imported Link wallets: Link wallet import params add token_refresh (kernel vs customer), make refresh_token optional when the customer keeps rotation, and wire a new wallet operation update_access_token (typed overloads on perform_operation and in available-operation unions).

1Password fill: Docs no longer describe Kernel enforcing login origin; entry_id is required when multiple approved entries exist and origin does not uniquely identify one.

WebMCP invoke: Invoke docs describe tool_page_unloaded, non-retryable failures (X-Should-Retry: false), and raise the documented JSON input cap from 1 MiB to 4 MiB.

^{Reviewed by Cursor Bugbot for commit 06f1a77. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

Changelog checked against the API PRs merged since the last release (#5231, #5205, #5209 and the WebMCP invoke change); all four SDK-affecting changes are listed.

[kernel-internal]

🤖 Release is at https://github.com/kernel/kernel-python-sdk/releases/tag/v0.140.0 🌻