[hiroTamada]

Summary

• Add the Embedded Card CVC integration guide and navigation entry for KernelCardCVC in vault-react 0.4.0.
• Document alias-mode purchases on any network, backend capability delivery from the CVC action URL fragment, props, styling/classes, CSP, error recovery and collection-versus-payment semantics.
• Explain the default five-minute ready window, checkout-before-expiry requirement and VGS iframe/PCI boundary without promising SAQ eligibility.
• Correct the already-merged embedded card capture guide: alias-mode CVC can be embedded on any network; Visa network-token authentication remains hosted.

Rollout

Publish after kernel/kernel#4943 is merged/released and its API changes are deployed. That PR now includes both the API and component/hosted consumer changes. The component began stacked on kernel/kernel#4933; that baseline merged during implementation and the implementation PRs now target main.

Verification

• mint broken-links passes.
• Local Mintlify preview renders the new guide in headless Chromium.
• New guide passes Prettier; existing file formatting is preserved outside the edited note/nav entry. Full diff reviewed.
• Implementation render check uses a local GET-only mock and real sandbox Collect: field sized to its box, typed digits visible; no submit.

The optional action.cvc_token schema field is deliberately deferred because the SDK generation workflow hits custom-code conflicts in all three languages. This guide documents the explicitly supported CVC-only fragment extraction fallback, without changing enrollment token delivery. No live purchases, production access, VGS changes or PCI certification claims.

---

Note

Low Risk
Documentation and navigation only; no runtime or API changes in this repo.

Overview
Adds Embedded Card CVC documentation for @onkernel/vault-react@^0.4.0 and registers it under Payments in docs.json.

The new guide covers alias-mode per-purchase CVC via KernelCardCVC: interim backend delivery by parsing the token from a /card-cvc spend_approval URL fragment (until action.cvc_token exists), component usage, styling/CSP, expiry/checkout timing, fixed error codes, and security boundaries (VGS iframe; no SAQ claims).

embedded-card-capture is updated so the note states enrollment and per-purchase CVC can be embedded on any network, while Visa network-token spend_approval stays hosted; Mastercard network-token purchases skip that hosted step.

^{Reviewed by Cursor Bugbot for commit 94fc05c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[hiroTamada]

@cursor review

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 21, 2026, 9:23 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[chruffins]

lgtm