feat: Connect Kernel wallets once the card is stored, with best-effort network tokens

Stainless-Generated-From: e1a019f24061298df8d1360397d091fa2b480e1e

Author: kernel-internal[bot]

src/kernel/types/vaults/kernel_wallet_state.py

@@ -14,10 +14,11 @@ class KernelWalletState(BaseModel):
     status: Literal["pending_authorization", "connected", "reconnect_required", "degraded"]
     """pending_authorization asks the cardholder to use the card_enrollment action.
 
-    connected is ready for supported purchases. reconnect_required asks the
-    cardholder to use a new card_enrollment action after an uncertain enrollment was
-    safely removed. degraded means the enrollment outcome is unknown and the wallet
-    must be deleted before adding another card.
+    connected means the card is stored; it can pay once payment_methods reports
+    capabilities.single_use_card.eligible. reconnect_required asks the cardholder to
+    use a new card_enrollment action after an uncertain enrollment was safely
+    removed. degraded means the enrollment outcome is unknown and the wallet must be
+    deleted before adding another card.
     """
 
     status_reason: Optional[str] = None

src/kernel/types/vaults/kernel_wallet_vault_item_spec.py

@@ -8,8 +8,9 @@
 
 
 class KernelWalletVaultItemSpec(BaseModel):
-    """
-    One card Kernel enrolls for Visa or Mastercard agentic network tokens using Kernel-managed credentials. Creation returns a card_enrollment action: the cardholder enters the card and their email on a Kernel-hosted page, then Kernel enrolls the securely stored card. The card number never reaches Kernel. The connected wallet's payment_methods expansion lists the enrolled card. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400.
+    """One card stored with Kernel-managed credentials.
+
+    Creation returns a card_enrollment action: the cardholder enters the card and their email on a Kernel-hosted page, and the wallet connects once the card is stored. Kernel then enrolls it for an agentic network token when the issuer supports it. The card number never reaches Kernel. The connected wallet's payment_methods expansion lists the card; capabilities.single_use_card.eligible is false, with a network_token_* reason, until the card has a network token, and authorize returns 400 for such a card. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400.
     """
 
     provider: Literal["kernel"]

src/kernel/types/vaults/kernel_wallet_vault_item_spec_param.py

@@ -8,8 +8,9 @@
 
 
 class KernelWalletVaultItemSpecParam(TypedDict, total=False):
-    """
-    One card Kernel enrolls for Visa or Mastercard agentic network tokens using Kernel-managed credentials. Creation returns a card_enrollment action: the cardholder enters the card and their email on a Kernel-hosted page, then Kernel enrolls the securely stored card. The card number never reaches Kernel. The connected wallet's payment_methods expansion lists the enrolled card. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400.
+    """One card stored with Kernel-managed credentials.
+
+    Creation returns a card_enrollment action: the cardholder enters the card and their email on a Kernel-hosted page, and the wallet connects once the card is stored. Kernel then enrolls it for an agentic network token when the issuer supports it. The card number never reaches Kernel. The connected wallet's payment_methods expansion lists the card; capabilities.single_use_card.eligible is false, with a network_token_* reason, until the card has a network token, and authorize returns 400 for such a card. Visa cards can be enrolled, but Visa purchases are not yet supported: authorize returns 400.
     """
 
     provider: Required[Literal["kernel"]]