Docs: Update for Node SDK 0.148.0

auth/configuration.mdx

@@ -572,20 +572,28 @@ _ = auth
 
 Set `browser.region` to choose where Managed Auth runs the connection's initial login, health checks, and automatic reauthentication. Choose from `us-east`, `eu-west`, and `ap-southeast`. Region selection is available on [Start-Up and Enterprise plans](/info/pricing); omitted values default to `us-east`.
 
+Set `browser.location.locale` to a supported canonical BCP 47 locale, such as `sv-SE`, for the browser language and `Accept-Language` header in login, health-check, and reauthentication sessions. Omit it when creating a connection to use the browser region's default locale.
+
 <CodeGroup>
 ```typescript TypeScript
 const auth = await kernel.auth.connections.create({
   domain: 'example.com',
   profile_name: 'my-profile',
-  browser: { region: 'eu-west' },
+  browser: {
+    region: 'eu-west',
+    location: { locale: 'sv-SE' },
+  },
 });
 ```
 
 ```python Python
 auth = await kernel.auth.connections.create(
     domain="example.com",
     profile_name="my-profile",
-    browser={"region": "eu-west"},
+    browser={
+        "region": "eu-west",
+        "location": {"locale": "sv-SE"},
+    },
 )
 ```
 
@@ -596,6 +604,9 @@ auth, err := client.Auth.Connections.New(ctx, kernel.AuthConnectionNewParams{
 		ProfileName: "my-profile",
 		Browser: kernel.ManagedAuthBrowserConfigParam{
 			Region: kernel.ManagedAuthBrowserConfigRegionEuWest,
+			Location: kernel.ManagedAuthBrowserLocationParam{
+				Locale: kernel.String("sv-SE"),
+			},
 		},
 	},
 })
@@ -606,7 +617,7 @@ _ = auth
 ```
 </CodeGroup>
 
-Updating `browser.region` changes the connection default for browsers created afterward. It doesn't move or restart an active login, health check, or reauthentication browser.
+Updating `browser.region` or `browser.location.locale` changes the connection default for browsers created afterward. It doesn't move or restart an active login, health check, or reauthentication browser. When you update the locale, omit `locale` to keep its current value or set it to `null` to clear the override and return to the region's default. You can't override the locale on `.login()`.
 
 You can override the connection region for one login without changing its default:
 
@@ -685,7 +696,7 @@ Pin the auth flow to a specific [proxy](/proxies/overview) so logins, health che
 
 How stable the exit IP is depends on the proxy type:
 
-- **[ISP](/proxies/isp)** proxies provide a static exit IP that persists across sessions, so the initial login, health checks, and reauths all exit through the same IP. The IP only changes in rare ISP-initiated replacement events or a temporary [failover to a backup endpoint](/proxies/isp#backup-endpoint-failover).
+- **[ISP](/proxies/isp)** proxies provide a static exit IP that persists across sessions, so the initial login, health checks, and reauths all exit through the same IP. The primary IP stays fixed unless you move a proxy backed by a reserved ISP allocation or an ISP initiates a replacement; traffic can temporarily use a different IP during a [failover to a backup endpoint](/proxies/isp#backup-endpoint-failover).
 - **[Residential](/proxies/residential)** proxies rotate IPs per connection — use them when you need legitimacy from a real ISP pool but can tolerate IP changes.
 - **[Custom (BYO)](/proxies/custom)** proxies route through whatever you point them at, so pick one if the static IP must be infrastructure you control (e.g. an allowlisted egress your security team owns).
 
@@ -919,6 +930,7 @@ After creating a connection, you can update its configuration with `auth.connect
 | `save_credentials` | Whether to save credentials on successful login |
 | `record_session` | Record a [replay](/browsers/replays) of every auth browser session for this connection (logins, health checks, and reauths) |
 | `browser.region` | Region for login, health-check, and reauth browsers. Takes effect on the next browser created for the connection |
+| `browser.location.locale` | Canonical BCP 47 locale for login, health-check, and reauth browsers. Omit it on update to keep the current value, or set it to `null` to use the region's default |
 | `proxy` | Pin login, health-check, and reauth sessions to a proxy. Takes effect on the next health check or reauth |
 
 Only the fields you include are updated—everything else stays the same. Changes to `health_check_interval`, `health_checks`, `auto_reauth`, and `proxy` take effect immediately on the running connection.

browsers/pools.mdx

@@ -28,14 +28,14 @@ Idle browsers in a pool aren't billed, but the pool's capacity counts against yo
 A few constraints to weigh before moving a workload onto a browser pool:
 
 - **No GPU browsers.** GPU-accelerated browsers are on-demand only. Use `browsers.create()` for WebGL, video, or canvas-heavy work.
-- **One fixed configuration per browser pool**, with `start_url` the only setting you can override per acquisition — see [Create a browser pool](#create-a-browser-pool).
+- **One fixed base configuration per browser pool.** You can override selected lease settings, including `start_url` and `start_replay`, per acquisition — see [Acquire a browser](#acquire-a-browser).
 - **A profile set on the browser pool loads read-only**, and a browser pool holds one at a time — see [Per-user profiles with browser pools](#per-user-profiles-with-browser-pools) for how to persist state per user.
 - **Browser pool capacity counts against your [concurrency limit](/browsers/concurrency-and-limits#concurrency)** whether or not its browsers are acquired, though idle pooled browsers aren't billed.
 - **Plan-gated.** Browser pools are available on the Start-Up and Enterprise plans.
 
 ## Create a browser pool
 
-Create a browser pool with a size and the configuration every browser in it should use.
+Create a browser pool with a size and the configuration every browser in it should use. Set `start_replay: true` to start a [replay recording](/browsers/replays) automatically whenever a browser is acquired.
 
 <CodeGroup>
 ```typescript Typescript/Javascript
@@ -121,7 +121,7 @@ func main() {
 
 ## Acquire a browser
 
-Acquire a browser from the browser pool. The request returns immediately if a browser is available, or waits until one becomes available. Use `acquire_timeout_seconds` to bound that wait.
+Acquire a browser from the browser pool. The request returns immediately if a browser is available, or waits until one becomes available. Use `acquire_timeout_seconds` to bound that wait. Omit `start_replay` to use the pool's replay default, or set it to `true` or `false` for that acquisition.
 
 <CodeGroup>
 ```typescript Typescript/Javascript

browsers/replays.mdx

@@ -7,7 +7,9 @@ Replays capture browser sessions as video recordings that you can view or downlo
 
 ## Starting and stopping recordings
 
-To start recording a browser session, use the replays API on an active browser:
+To record from the beginning of a session, set `start_replay: true` when you create the browser. For a browser pool, set `start_replay` when you create or update the pool to control the default for future acquisitions, or pass it to `acquire()` to override the pool default for one acquisition. Browser and pool creation default to `false`; an acquisition that omits the setting uses the pool default.
+
+To start recording after a browser is active, use the replays API:
 
 <CodeGroup>
 ```typescript Typescript/Javascript

browsers/viewport.mdx

@@ -198,7 +198,7 @@ Kernel supports specific viewport configurations tuned for optimal performance a
 | Mobile | 390 | 844 | 60 Hz |
 
 When specifying a viewport:
-- **Width** and **Height** are required
+- **Width** and **Height** are required. Headful browsers require each dimension to be at least 64 pixels; headless browsers accept any positive integer.
 - **Viewport configurations** outside of the supported list are available, but they are provided on a "use at your own risk" basis and may not work as expected.
 - **Refresh Rate** is optional - if omitted, it will be automatically determined from the width and height combination
 

info/api-key-permissions.mdx

@@ -43,17 +43,17 @@ Resources must be inside the new key's organization, or its project for a projec
 | `vaults:create` | Create vaults. Grant it on a project or organization. |
 | `vaults:read` | List vaults and view vault and item metadata. |
 | `vaults:use` | Link vaults to browsers, fill credentials, and run vault item operations. |
-| `vaults:write` | Create, update, and delete vault items. |
+| `vaults:write` | Create, update, and delete vault items, including replacing a customer-refreshed wallet's stored access token. |
 | `vaults:delete` | Delete vaults and their items. |
 
 ### Proxies
 
 | Action | Allows |
 | --- | --- |
 | `proxies:create` | Create proxies. Grant it on a project or organization. |
-| `proxies:read` | List proxies and view their configuration, without credentials. |
+| `proxies:read` | List proxies and reserved ISP IPs, and view proxy configuration without credentials. Reserved IP inventory requires a grant on the whole project or organization. |
 | `proxies:use` | Select saved proxies for browsers and run health checks. |
-| `proxies:write` | Rename proxies. |
+| `proxies:write` | Rename proxies and move ISP proxies to reserved exit IPs. |
 | `proxies:delete` | Delete proxies. |
 
 ## Operations that need more than one action
@@ -64,7 +64,8 @@ Resources must be inside the new key's organization, or its project for a projec
 | Any operation on an existing browser | The browser action, plus `profiles:use` on its attached profile and `vaults:use` on every linked vault. If the browser saves profile changes, `profiles:write` on that profile too. |
 | Update a browser | `browsers:write` and `browsers:use`, plus `use` on any profile, vault, or proxy the update adds. |
 | Fill from a vault | `vaults:use` on the vault and `browsers:use` on the browser. |
-| Add or remove a card in a Kernel wallet (`add_payment_method`, `remove_payment_method`) | `vaults:use` and `vaults:write` on the vault. Without `vaults:write`, the wallet doesn't list either operation in `available_operations`, and invoking one returns `403` with `insufficient_scope`. Other wallet and purchase operations need only `vaults:use`. |
+| Replace a customer-refreshed wallet's access token (`update_access_token`) | `vaults:use` and `vaults:write` on the vault. |
+| Add or remove a card in a Kernel wallet (`add_payment_method`, `remove_payment_method`) | `vaults:use` and `vaults:write` on the vault. Without `vaults:write`, the wallet doesn't list either operation in `available_operations`, and invoking one returns `403` with `insufficient_scope`. |
 | Run a proxy health check | `proxies:use` and `proxies:read`. |
 
 List endpoints return only the objects the key can access, so a key without a matching grant gets an empty list.