[kernel-internal]

Summary

• Document @onkernel/sdk changes through 0.148.0.

Changes

Summary

• Document @onkernel/sdk changes through 0.148.0.
• Scoped live view URLs in 0.148.0 were already covered by the recent browsers/live-view.mdx update, so this branch doesn't duplicate that change.

Pages changed

• SDK 0.140.0 — vaults/1password.mdx: updated 1pw_fill guidance after removal of KERNEL's origin gate. The 1Password extension now decides whether an approved login matches the page, entry_id is required only when the page doesn't identify one approved entry, and the obsolete destination_denied outcome is removed.
• SDK 0.148.0 — vaults/1password.mdx: documented action.access_request_reference, optional approval-link return_url, the three-minute status-check window and same-item request restart, paced 1pw_access_request_status checks and rate limiting, and the expired and unknown request states.
• SDK 0.140.0 — integrations/wallets/stripe-link.mdx: documented imported Link grants with authorization.token_refresh: "customer", conditional refresh-token input, the wallet update_access_token operation, and its required vault permissions.
• SDK 0.141.0 — integrations/wallets/stripe-link.mdx: replaced proactive access-token updates with recovery after 409 access_token_rejected: store a fresh token, then retry the Link operation.
• SDK 0.145.0 — integrations/wallets/stripe-link.mdx: documented Link card state.credential_type, including the card and link_pay_token fill shapes and the fallback for a ready card without the field.
• SDK 0.140.0 — integrations/wallets/overview.mdx: clarified that imported Link grants can use either KERNEL-managed or customer-managed refresh-token rotation.
• SDK 0.140.0 and 0.142.0 — info/api-key-permissions.mdx: added the vaults:write requirement for update_access_token; added reserved ISP IP inventory to proxies:read, including its project- or organization-wide grant requirement; and added ISP exit-IP moves to proxies:write.
• SDK 0.142.0 — proxies/isp.mdx: added the reserved config.ip_address parameter and its conditional country default, and corrected static-IP and allowlist guidance now that reserved allocations can move a proxy to another IP.
• SDK 0.142.0 — proxies/overview.mdx and auth/configuration.mdx: clarified that an ISP proxy's primary IP stays fixed unless the user moves a reserved proxy or the ISP replaces it, while backup failover can temporarily use another IP.
• SDK 0.142.0 — browsers/viewport.mdx: documented the 64-pixel minimum for each headful viewport dimension; headless viewports still accept any positive dimensions.
• SDK 0.143.0 — integrations/wallets/bring-your-own-vgs-vault.mdx: documented spec.card_mode: "cvc_only" for merchant-stored cards, the CVC-only request shape, fill fields and masks, and the unchanged VGS proxy egress scope during the payment window.
• SDK 0.144.0 — integrations/wallets/pay-with-multiple-cards.mdx: documented the optional enrollment: "server" mode, its five-minute card_ingest action, and the 409 response when server enrollment isn't configured; generalized pending-enrollment and event guidance for both enrollment modes.
• SDK 0.144.0 — integrations/wallets/pay-with-card.mdx and integrations/wallets/embedded-card-capture.mdx: made the hosted enrollment default explicit and clarified that capture_token exists only on a KERNEL wallet's card_enrollment action.
• SDK 0.144.0 — integrations/wallets/overview.mdx: added card_ingest to the complete action-name list and identified it as an issuer-backend action rather than a user-facing hosted action.
• SDK 0.146.0 — browsers/replays.mdx: documented start_replay for recording from browser creation, as a browser-pool default set by create or update, and as a per-acquisition override, including the default behavior.
• SDK 0.146.0 — browsers/pools.mdx: corrected the fixed-configuration limitation now that start_replay can vary per acquisition and documented pool-level automatic replay recording plus acquire-time overrides.
• SDK 0.147.0 — auth/configuration.mdx: documented browser.location.locale for Managed Auth login, health-check, and reauthentication browsers, including the regional default, canonical BCP 47 format, update-and-clear behavior, and the lack of a per-login override.

Missing coverage

• SDK 0.142.0 — the reserved IP inventory methods (proxyIPs.list() and proxyIPs.retrieve(), proxy_ips in Python, and ProxyIPs.List and ProxyIPs.Get in Go), including active versus excluded status and organization/project usage counts, have no guide workflow.
• SDK 0.142.0 — moving an existing ISP proxy with proxies.update(..., { config: { ip_address } }) and filtering proxies.list() by exact ip_address have no guide examples. The ISP page lists the create-time pinning parameter and corrects the affected behavior statements only.

Languages left unchanged because an SDK lacks the method

None. The checked-out Node, Python, and Go SDKs expose the audited capabilities.

Validation limitations

None.

Validation

• mint broken-links
• git diff --check

Validation

• mint broken-links
• docs.json parses
• git diff --check

---

Note

Low Risk
Documentation-only changes that describe API behavior; no application or infrastructure code is modified.

Overview
This PR updates product docs to match @onkernel/sdk through 0.148.0, covering auth, browsers, proxies, wallets, vaults, and API key permissions.

Managed Auth and browsers: Documents browser.location.locale (BCP 47) for login, health-check, and reauth browsers, including update/clear behavior. Adds start_replay for session and pool recording (pool default plus per-acquire override). Notes the 64px minimum for headful viewport dimensions.

Proxies and keys: Documents reserved ISP ip_address pinning, revised static-IP semantics (moves, failover), and scoped-key changes for reserved IP inventory and moving ISP proxies; links update_access_token to vaults:write.

Wallets: Expands Link customer-managed refresh (token_refresh: "customer", update_access_token, state.credential_type). Adds VGS card_mode: "cvc_only", optional server enrollment via card_ingest, and clearer hosted vs embedded card enrollment wording.

1Password: Reflects extension-side page matching (drops KERNEL origin gate / destination_denied), plus approval return_url, access_request_reference, paced status polling, and expired / unknown request states.

^{Reviewed by Cursor Bugbot for commit d39f10d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 12, 2026, 8:01 PM

💡 Tip: Enable Automations to automatically generate PRs for you.