@onkernel/sdk 0.121.0 → 0.123.0

package/resources/vaults/vaults.d.ts

@@ -40,6 +40,23 @@ export declare class Vaults extends APIResource {
      * ```
      */
     delete(idOrName: string, options?: RequestOptions): APIPromise<void>;
+    /**
+     * Returns the public key that custom credential collection web apps use to encrypt
+     * values in the browser. Use this only if you run your own credential collection
+     * web app and want values encrypted in the browser, sent to your backend still
+     * encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+     * including server-side code that already holds the plaintext, use value. The page
+     * encrypts each value to this key, your backend forwards the ciphertext unchanged
+     * as encrypted_value when creating or updating a credential item in this vault,
+     * and Kernel decrypts it.
+     *
+     * @example
+     * ```ts
+     * const vaultEncryptionKey =
+     *   await client.vaults.retrieveEncryptionKey('id_or_name');
+     * ```
+     */
+    retrieveEncryptionKey(idOrName: string, options?: RequestOptions): APIPromise<VaultEncryptionKey>;
     /**
      * Free organizations can store up to 3 non-deleted vaults across all projects.
      * Paid plans and active trials have no vault cap. Retrieving an existing vault by
@@ -64,6 +81,50 @@ export interface Vault {
     name: string;
     updated_at: string;
 }
+/**
+ * Public key for encrypted_value on credential fields. Use this only if you run
+ * your own credential collection web app and want values encrypted in the browser,
+ * sent to your backend still encrypted, and forwarded to Kernel's API still
+ * encrypted. In every other case, including server-side code that already holds
+ * the plaintext, use value. Each vault has its own key; a value encrypted for one
+ * vault is rejected by every other vault. The key is created on first request and
+ * stays the same for the vault's lifetime, so it may be cached.
+ */
+export interface VaultEncryptionKey {
+    /**
+     * JWE key management algorithm.
+     */
+    alg: 'ECDH-ES';
+    /**
+     * JWE content encryption algorithm.
+     */
+    enc: 'A256GCM';
+    /**
+     * P-256 public key in JWK form.
+     */
+    jwk: VaultEncryptionKey.Jwk;
+    /**
+     * Key ID. Set it as the kid protected header of every encrypted_value.
+     */
+    kid: string;
+}
+export declare namespace VaultEncryptionKey {
+    /**
+     * P-256 public key in JWK form.
+     */
+    interface Jwk {
+        crv: 'P-256';
+        kty: 'EC';
+        /**
+         * Base64url-encoded x coordinate.
+         */
+        x: string;
+        /**
+         * Base64url-encoded y coordinate.
+         */
+        y: string;
+    }
+}
 export interface VaultListParams extends OffsetPaginationParams {
     /**
      * Case-insensitive substring match against vault name. IDs match by exact value.
@@ -77,7 +138,7 @@ export interface VaultUpsertParams {
     name: string;
 }
 export declare namespace Vaults {
-    export { type Vault as Vault, type VaultsOffsetPagination as VaultsOffsetPagination, type VaultListParams as VaultListParams, type VaultUpsertParams as VaultUpsertParams, };
+    export { type Vault as Vault, type VaultEncryptionKey as VaultEncryptionKey, type VaultsOffsetPagination as VaultsOffsetPagination, type VaultListParams as VaultListParams, type VaultUpsertParams as VaultUpsertParams, };
     export { Items as Items, type AgentcardCheckoutAuthorization as AgentcardCheckoutAuthorization, type AgentcardCheckoutPreparation as AgentcardCheckoutPreparation, type AgentcardPreparedProcessor as AgentcardPreparedProcessor, type AuthorizeVaultItemOperationRequest as AuthorizeVaultItemOperationRequest, type CardVaultItemSpec as CardVaultItemSpec, type CardVaultItemState as CardVaultItemState, type CollectVaultItemOperationRequest as CollectVaultItemOperationRequest, type CredentialAccountVaultItem as CredentialAccountVaultItem, type CredentialAccountVaultItemRequest as CredentialAccountVaultItemRequest, type CredentialCollectionAction as CredentialCollectionAction, type CredentialVaultFieldDefinition as CredentialVaultFieldDefinition, type CredentialVaultFieldInput as CredentialVaultFieldInput, type CredentialVaultFieldState as CredentialVaultFieldState, type CredentialVaultFieldType as CredentialVaultFieldType, type CredentialVaultFieldUpdate as CredentialVaultFieldUpdate, type CredentialVaultItem as CredentialVaultItem, type CredentialVaultItemRequest as CredentialVaultItemRequest, type CredentialVaultItemSpec as CredentialVaultItemSpec, type CredentialVaultItemSpecInput as CredentialVaultItemSpecInput, type CredentialVaultItemSpecUpdate as CredentialVaultItemSpecUpdate, type CredentialVaultItemState as CredentialVaultItemState, type CredentialVaultItemUpdateRequest as CredentialVaultItemUpdateRequest, type FillVaultItemOperationRequest as FillVaultItemOperationRequest, type FillVaultItemOperationResult as FillVaultItemOperationResult, type KernelCardState as KernelCardState, type KernelCardVaultItemSpec as KernelCardVaultItemSpec, type KernelCredentialVaultItemSpec as KernelCredentialVaultItemSpec, type KernelCredentialVaultItemSpecInput as KernelCredentialVaultItemSpecInput, type KernelCredentialVaultItemState as KernelCredentialVaultItemState, type KernelWalletState as KernelWalletState, type KernelWalletVaultItemSpec as KernelWalletVaultItemSpec, type ManagedAuthCredentialVaultField as ManagedAuthCredentialVaultField, type ManagedAuthCredentialVaultItemSpec as ManagedAuthCredentialVaultItemSpec, type ManagedAuthCredentialVaultItemSpecInput as ManagedAuthCredentialVaultItemSpecInput, type ManagedAuthCredentialVaultItemState as ManagedAuthCredentialVaultItemState, type OnePasswordCredentialAccountSpec as OnePasswordCredentialAccountSpec, type OnePasswordCredentialAccountState as OnePasswordCredentialAccountState, type OnePasswordCredentialVaultItemSpec as OnePasswordCredentialVaultItemSpec, type OnePasswordCredentialVaultItemSpecInput as OnePasswordCredentialVaultItemSpecInput, type OnePasswordCredentialVaultItemState as OnePasswordCredentialVaultItemState, type OnePasswordFillVaultItemOperationRequest as OnePasswordFillVaultItemOperationRequest, type OnePasswordFillVaultItemOperationResult as OnePasswordFillVaultItemOperationResult, type OnePasswordOAuthAction as OnePasswordOAuthAction, type OnePasswordRecoverVaultItemOperationRequest as OnePasswordRecoverVaultItemOperationRequest, type OnePasswordRequestAccessVaultItemOperationRequest as OnePasswordRequestAccessVaultItemOperationRequest, type PrepareCheckoutVaultItemOperationRequest as PrepareCheckoutVaultItemOperationRequest, type VaultCardAliases as VaultCardAliases, type VaultCardFillField as VaultCardFillField, type VaultCheckoutContext as VaultCheckoutContext, type VaultFillField as VaultFillField, type VaultFillFieldResult as VaultFillFieldResult, type VaultItem as VaultItem, type VaultItemAction as VaultItemAction, type VaultItemEvent as VaultItemEvent, type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, type WebmcpInvokeVaultItemOperationResult as WebmcpInvokeVaultItemOperationResult, type ItemListResponse as ItemListResponse, type ItemEventsResponse as ItemEventsResponse, type ItemRetrieveParams as ItemRetrieveParams, type ItemUpdateParams as ItemUpdateParams, type ItemDeleteParams as ItemDeleteParams, type ItemEventsParams as ItemEventsParams, type ItemPerformOperationParams as ItemPerformOperationParams, type ItemUpsertParams as ItemUpsertParams, };
 }
 //# sourceMappingURL=vaults.d.ts.map

package/resources/vaults/vaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,+BAA4B;AAClD,OAAO,KAAK,QAAQ,mBAAgB;AACpC,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,EACxB,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,EACnC,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,EACnC,wCAAwC,EACxC,uCAAuC,EACvC,sBAAsB,EACtB,2CAA2C,EAC3C,iDAAiD,EACjD,wCAAwC,EACxC,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACrC,mBAAgB;AACjB,OAAO,EAAE,UAAU,EAAE,kCAA+B;AACpD,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,WAAW,EAAE,iCAA8B;AAEnG,OAAO,EAAE,cAAc,EAAE,0CAAuC;AAGhE,qBAAa,MAAO,SAAQ,WAAW;IACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAoC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;IAIvE;;;;;;;;;;OAUG;IACH,IAAI,CACF,KAAK,GAAE,eAAe,GAAG,IAAI,GAAG,SAAc,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,sBAAsB,EAAE,KAAK,CAAC;IAI7C;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;IAOpE;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;CAG7E;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAE7D,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IAEX,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,sBAAsB;IAC7D;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAID,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,OAAO,EACL,KAAK,KAAK,IAAI,KAAK,EACnB,KAAK,sBAAsB,IAAI,sBAAsB,EACrD,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,iBAAiB,IAAI,iBAAiB,GAC5C,CAAC;IAEF,OAAO,EACL,KAAK,IAAI,KAAK,EACd,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,iBAAiB,IAAI,iBAAiB,EAC3C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,wBAAwB,IAAI,wBAAwB,EACzD,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,wBAAwB,IAAI,wBAAwB,EACzD,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,iBAAiB,IAAI,iBAAiB,EAC3C,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,wCAAwC,IAAI,wCAAwC,EACzF,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,sBAAsB,IAAI,sBAAsB,EACrD,KAAK,2CAA2C,IAAI,2CAA2C,EAC/F,KAAK,iDAAiD,IAAI,iDAAiD,EAC3G,KAAK,wCAAwC,IAAI,wCAAwC,EACzF,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,cAAc,IAAI,cAAc,EACrC,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,SAAS,IAAI,SAAS,EAC3B,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,cAAc,IAAI,cAAc,EACrC,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,qCAAqC,IAAI,qCAAqC,EACnF,KAAK,oCAAoC,IAAI,oCAAoC,EACjF,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,gBAAgB,IAAI,gBAAgB,GAC1C,CAAC;CACH"}
+{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,+BAA4B;AAClD,OAAO,KAAK,QAAQ,mBAAgB;AACpC,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,kCAAkC,EAClC,iBAAiB,EACjB,kBAAkB,EAClB,gCAAgC,EAChC,0BAA0B,EAC1B,iCAAiC,EACjC,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,wBAAwB,EACxB,gCAAgC,EAChC,6BAA6B,EAC7B,4BAA4B,EAC5B,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,EACL,eAAe,EACf,uBAAuB,EACvB,6BAA6B,EAC7B,kCAAkC,EAClC,8BAA8B,EAC9B,iBAAiB,EACjB,yBAAyB,EACzB,+BAA+B,EAC/B,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,EACnC,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,EACnC,wCAAwC,EACxC,uCAAuC,EACvC,sBAAsB,EACtB,2CAA2C,EAC3C,iDAAiD,EACjD,wCAAwC,EACxC,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qCAAqC,EACrC,oCAAoC,EACrC,mBAAgB;AACjB,OAAO,EAAE,UAAU,EAAE,kCAA+B;AACpD,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,WAAW,EAAE,iCAA8B;AAEnG,OAAO,EAAE,cAAc,EAAE,0CAAuC;AAGhE,qBAAa,MAAO,SAAQ,WAAW;IACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAoC;IAEzD;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;IAIvE;;;;;;;;;;OAUG;IACH,IAAI,CACF,KAAK,GAAE,eAAe,GAAG,IAAI,GAAG,SAAc,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,WAAW,CAAC,sBAAsB,EAAE,KAAK,CAAC;IAI7C;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;IAOpE;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAIjG;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;CAG7E;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAE7D,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IAEX,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,GAAG,EAAE,SAAS,CAAC;IAEf;;OAEG;IACH,GAAG,EAAE,SAAS,CAAC;IAEf;;OAEG;IACH,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;IAE5B;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,yBAAiB,kBAAkB,CAAC;IAClC;;OAEG;IACH,UAAiB,GAAG;QAClB,GAAG,EAAE,OAAO,CAAC;QAEb,GAAG,EAAE,IAAI,CAAC;QAEV;;WAEG;QACH,CAAC,EAAE,MAAM,CAAC;QAEV;;WAEG;QACH,CAAC,EAAE,MAAM,CAAC;KACX;CACF;AAED,MAAM,WAAW,eAAgB,SAAQ,sBAAsB;IAC7D;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAID,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,OAAO,EACL,KAAK,KAAK,IAAI,KAAK,EACnB,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,sBAAsB,IAAI,sBAAsB,EACrD,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,iBAAiB,IAAI,iBAAiB,GAC5C,CAAC;IAEF,OAAO,EACL,KAAK,IAAI,KAAK,EACd,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,iBAAiB,IAAI,iBAAiB,EAC3C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,wBAAwB,IAAI,wBAAwB,EACzD,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,wBAAwB,IAAI,wBAAwB,EACzD,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,4BAA4B,IAAI,4BAA4B,EACjE,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,uBAAuB,IAAI,uBAAuB,EACvD,KAAK,6BAA6B,IAAI,6BAA6B,EACnE,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,8BAA8B,IAAI,8BAA8B,EACrE,KAAK,iBAAiB,IAAI,iBAAiB,EAC3C,KAAK,yBAAyB,IAAI,yBAAyB,EAC3D,KAAK,+BAA+B,IAAI,+BAA+B,EACvE,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,gCAAgC,IAAI,gCAAgC,EACzE,KAAK,iCAAiC,IAAI,iCAAiC,EAC3E,KAAK,kCAAkC,IAAI,kCAAkC,EAC7E,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,mCAAmC,IAAI,mCAAmC,EAC/E,KAAK,wCAAwC,IAAI,wCAAwC,EACzF,KAAK,uCAAuC,IAAI,uCAAuC,EACvF,KAAK,sBAAsB,IAAI,sBAAsB,EACrD,KAAK,2CAA2C,IAAI,2CAA2C,EAC/F,KAAK,iDAAiD,IAAI,iDAAiD,EAC3G,KAAK,wCAAwC,IAAI,wCAAwC,EACzF,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,cAAc,IAAI,cAAc,EACrC,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,SAAS,IAAI,SAAS,EAC3B,KAAK,eAAe,IAAI,eAAe,EACvC,KAAK,cAAc,IAAI,cAAc,EACrC,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,mBAAmB,IAAI,mBAAmB,EAC/C,KAAK,oBAAoB,IAAI,oBAAoB,EACjD,KAAK,qCAAqC,IAAI,qCAAqC,EACnF,KAAK,oCAAoC,IAAI,oCAAoC,EACjF,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,kBAAkB,IAAI,kBAAkB,EAC7C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,KAAK,0BAA0B,IAAI,0BAA0B,EAC7D,KAAK,gBAAgB,IAAI,gBAAgB,GAC1C,CAAC;CACH"}

package/resources/vaults/vaults.js

@@ -57,6 +57,25 @@ class Vaults extends resource_1.APIResource {
             headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
         });
     }
+    /**
+     * Returns the public key that custom credential collection web apps use to encrypt
+     * values in the browser. Use this only if you run your own credential collection
+     * web app and want values encrypted in the browser, sent to your backend still
+     * encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+     * including server-side code that already holds the plaintext, use value. The page
+     * encrypts each value to this key, your backend forwards the ciphertext unchanged
+     * as encrypted_value when creating or updating a credential item in this vault,
+     * and Kernel decrypts it.
+     *
+     * @example
+     * ```ts
+     * const vaultEncryptionKey =
+     *   await client.vaults.retrieveEncryptionKey('id_or_name');
+     * ```
+     */
+    retrieveEncryptionKey(idOrName, options) {
+        return this._client.get((0, path_1.path) `/vaults/${idOrName}/encryption_key`, options);
+    }
     /**
      * Free organizations can store up to 3 non-deleted vaults across all projects.
      * Paid plans and active trials have no vault cap. Retrieving an existing vault by

package/resources/vaults/vaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;AAEtF,qDAAkD;AAClD,6DAAoC;AACpC,sCAuEiB;AAEjB,yDAAmG;AACnG,uDAAsD;AAEtD,uDAAiD;AAEjD,MAAa,MAAO,SAAQ,sBAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAkE3D,CAAC;IAhEC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,6BAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AAnED,wBAmEC;AA+BD,MAAM,CAAC,KAAK,GAAG,aAAK,CAAC"}
+{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":";AAAA,sFAAsF;;;;AAEtF,qDAAkD;AAClD,6DAAoC;AACpC,sCAuEiB;AAEjB,yDAAmG;AACnG,uDAAsD;AAEtD,uDAAiD;AAEjD,MAAa,MAAO,SAAQ,sBAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAsF3D,CAAC;IApFC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,6BAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,QAAgB,EAAE,OAAwB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,WAAI,EAAA,WAAW,QAAQ,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AAvFD,wBAuFC;AAmFD,MAAM,CAAC,KAAK,GAAG,aAAK,CAAC"}

package/resources/vaults/vaults.mjs

@@ -53,6 +53,25 @@ export class Vaults extends APIResource {
             headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
         });
     }
+    /**
+     * Returns the public key that custom credential collection web apps use to encrypt
+     * values in the browser. Use this only if you run your own credential collection
+     * web app and want values encrypted in the browser, sent to your backend still
+     * encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+     * including server-side code that already holds the plaintext, use value. The page
+     * encrypts each value to this key, your backend forwards the ciphertext unchanged
+     * as encrypted_value when creating or updating a credential item in this vault,
+     * and Kernel decrypts it.
+     *
+     * @example
+     * ```ts
+     * const vaultEncryptionKey =
+     *   await client.vaults.retrieveEncryptionKey('id_or_name');
+     * ```
+     */
+    retrieveEncryptionKey(idOrName, options) {
+        return this._client.get(path `/vaults/${idOrName}/encryption_key`, options);
+    }
     /**
      * Free organizations can store up to 3 non-deleted vaults across all projects.
      * Paid plans and active trials have no vault cap. Retrieving an existing vault by

package/resources/vaults/vaults.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.mjs","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,gCAA4B;AAClD,OAAO,KAAK,QAAQ,oBAAgB;AACpC,OAAO,EAiCL,KAAK,GAsCN,oBAAgB;AAEjB,OAAO,EAAE,gBAAgB,EAA4C,kCAA8B;AACnG,OAAO,EAAE,YAAY,EAAE,mCAA+B;AAEtD,OAAO,EAAE,IAAI,EAAE,sCAAkC;AAEjD,MAAM,OAAO,MAAO,SAAQ,WAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAkE3D,CAAC;IAhEC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,gBAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AA+BD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC"}
+{"version":3,"file":"vaults.mjs","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,gCAA4B;AAClD,OAAO,KAAK,QAAQ,oBAAgB;AACpC,OAAO,EAiCL,KAAK,GAsCN,oBAAgB;AAEjB,OAAO,EAAE,gBAAgB,EAA4C,kCAA8B;AACnG,OAAO,EAAE,YAAY,EAAE,mCAA+B;AAEtD,OAAO,EAAE,IAAI,EAAE,sCAAkC;AAEjD,MAAM,OAAO,MAAO,SAAQ,WAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAsF3D,CAAC;IApFC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,gBAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,qBAAqB,CAAC,QAAgB,EAAE,OAAwB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,WAAW,QAAQ,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AAmFD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC"}

package/src/client.ts

@@ -180,6 +180,7 @@ import {
   BrowserUpdateParams,
   BrowserUpdateResponse,
   BrowserUsage,
+  BrowserVideoMemory,
   Browsers,
   Profile,
   Tags,
@@ -232,6 +233,7 @@ import {
 import { Telemetry } from './resources/telemetry/telemetry';
 import {
   Vault,
+  VaultEncryptionKey,
   VaultListParams,
   VaultUpsertParams,
   Vaults,
@@ -1233,6 +1235,7 @@ export declare namespace Kernel {
     type BrowserReplResult as BrowserReplResult,
     type BrowserReplTextContent as BrowserReplTextContent,
     type BrowserUsage as BrowserUsage,
+    type BrowserVideoMemory as BrowserVideoMemory,
     type Profile as Profile,
     type Tags as Tags,
     type VaultReference as VaultReference,
@@ -1313,6 +1316,7 @@ export declare namespace Kernel {
   export {
     Vaults as Vaults,
     type Vault as Vault,
+    type VaultEncryptionKey as VaultEncryptionKey,
     type VaultsOffsetPagination as VaultsOffsetPagination,
     type VaultListParams as VaultListParams,
     type VaultUpsertParams as VaultUpsertParams,

package/src/resources/browser-pools.ts

@@ -517,6 +517,11 @@ export interface BrowserPoolAcquireResponse {
    */
   vaults?: Array<BrowsersAPI.VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowsersAPI.BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -585,7 +590,9 @@ export interface BrowserPoolCreateParams {
   name?: string;
 
   /**
-   * Network configuration applied to browsers in this pool.
+   * Network configuration applied to browsers in this pool. Egress allowlists and
+   * proxy routes require proxy-v3; the pool will not provision browsers through
+   * Envoy if proxy-v3 is unavailable.
    */
   network?: BrowsersAPI.BrowserNetworkConfig;
 
@@ -812,9 +819,11 @@ export interface BrowserPoolUpdateParams {
    * Whether to discard all idle browsers and rebuild them immediately with the new
    * configuration. Defaults to false. Only browsers that are idle when the update
    * runs are rebuilt. A browser that is in use during the update keeps its original
-   * configuration, and if it is later released with `reuse: true` it returns to the
-   * pool with that stale configuration until it is discarded (by this flag on a
-   * later update, or by flushing the pool).
+   * configuration, except that its allowlist is reset to the current pool baseline
+   * on release or the browser is replaced. For other configuration fields, if it is
+   * later released with `reuse: true` it returns to the pool with that stale
+   * configuration until it is discarded (by this flag on a later update, or by
+   * flushing the pool).
    */
   discard_all_idle?: boolean;
 
@@ -857,9 +866,15 @@ export interface BrowserPoolUpdateParams {
   /**
    * If provided, replaces the pool's network configuration. Omit to leave the
    * existing configuration unchanged; an empty object ({}) removes it, while
-   * network: {private_hosts: []} sets an explicit empty list. Only applied to
-   * browsers created in the pool after the update; browsers already in the pool keep
-   * their configuration until discarded (see discard_all_idle).
+   * network: {private_hosts: []} or network: {proxy_routes: []} sets an explicit
+   * empty list; allowed_hosts must be non-empty when supplied. Egress allowlists and
+   * proxy routes require proxy-v3; the pool will not provision browsers through
+   * Envoy if proxy-v3 is unavailable. Changing allowed_hosts automatically replaces
+   * idle browsers. Leased browsers retain their allowlist until release, when it is
+   * reset to the current pool baseline or the browser is replaced if it cannot
+   * safely receive that baseline. Stale browsers cannot be acquired. Other network
+   * fields only apply to browsers created after the update; existing browsers keep
+   * those fields until discarded (see discard_all_idle).
    */
   network?: BrowsersAPI.BrowserNetworkConfig;
 

package/src/resources/browsers/browsers.ts

@@ -349,7 +349,7 @@ export type ProfilesOffsetPagination = OffsetPagination<Profile>;
 /**
  * Memory allocated to the browser session.
  */
-export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '16GiB';
+export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '12GiB' | '16GiB';
 
 /**
  * Memory requested for a headful, non-GPU browser session.
@@ -379,8 +379,11 @@ export interface BrowserNetworkConfig {
    * Enforced at Kernel's egress proxy only: destinations in private_hosts, and
    * processes in the browser VM that do not use the browser's proxy, are not
    * filtered, and Kernel's own control traffic is always allowed. Can be replaced or
-   * removed while the session runs with PATCH /browsers/{id_or_name}. Requires proxy
-   * v3. Not supported on browser pools.
+   * removed while the session runs with PATCH /browsers/{id_or_name}, but not added
+   * to a browser created without one. Supported on browser pools and their leased
+   * browsers. Per-lease changes are reset to the pool's allowlist on release. If a
+   * lessee removes the allowlist and the pool still requires one, the browser is
+   * replaced on release rather than given an allowlist again. Requires proxy v3.
    */
   allowed_hosts?: Array<string>;
 
@@ -411,20 +414,20 @@ export interface BrowserNetworkConfig {
   private_hosts?: Array<string>;
 
   /**
-   * Per-destination proxy routes for a browser session. After setup, a destination
-   * hostname is matched against every route's hosts, regardless of port; route order
-   * does not matter. An exact hostname beats a wildcard, and a longer wildcard
-   * suffix beats a shorter one (for a.b.example.com: "a.b.example.com" >
-   * "_.b.example.com" > "_.example.com"). A host pattern may appear in only one
-   * route. "\*.example.com" matches subdomains only, not example.com. A matched
-   * request selects the route's proxy instead of the session's top-level proxy
-   * (including mode: direct); the route proxy's own bypass_hosts still apply. If the
-   * route proxy becomes unavailable, matched requests fail closed without falling
-   * back. Requests that match no route use the session's default egress from the
-   * top-level proxy field (or the browser default when proxy is omitted: stealth
-   * proxy or direct egress). Routes take effect once the session is created;
-   * start_url and other traffic during browser setup use the top-level proxy.
-   * Setting routes requires proxy v3. Not supported on browser pools.
+   * Per-destination proxy routes for a browser session. A destination hostname is
+   * matched against every route's hosts, regardless of port; route order does not
+   * matter. An exact hostname beats a wildcard, and a longer wildcard suffix beats a
+   * shorter one (for a.b.example.com: "a.b.example.com" > "_.b.example.com" >
+   * "_.example.com"). A host pattern may appear in only one route. "\*.example.com"
+   * matches subdomains only, not example.com. A matched request selects the route's
+   * proxy instead of the session's top-level proxy (including mode: direct); the
+   * route proxy's own bypass_hosts still apply. If the route proxy becomes
+   * unavailable, matched requests fail closed without falling back. Requests that
+   * match no route use the session's default egress from the top-level proxy field
+   * (or the browser default when proxy is omitted: stealth proxy or direct egress).
+   * Routes apply from the start of the session, including to start_url and other
+   * traffic during browser setup. Setting routes requires proxy v3. Browser pools
+   * also support these routes.
    */
   proxy_routes?: Array<BrowserNetworkConfig.ProxyRoute>;
 }
@@ -464,16 +467,20 @@ export namespace BrowserNetworkConfig {
 export interface BrowserNetworkUpdate {
   /**
    * Replaces the session's egress allowlist, using the same entry rules as
-   * network.allowed_hosts on create. Omit to leave the allowlist unchanged, or set
-   * to null to remove it and return to unfiltered egress; an empty list is invalid.
-   * The new list applies without restarting the browser: new requests to
-   * destinations it no longer allows are refused within a few seconds, and open
-   * connections to them are closed within about 30 seconds, or up to 10 minutes
-   * during a Kernel deploy. Connections to destinations it still allows, such as
-   * WebSockets, stay open. A start_url in the same request must be allowed by the
-   * updated list, and is loaded only after the list takes effect. Requires a browser
-   * created with proxy v3, and not supported on pooled browsers. If the request
-   * fails, retry it: the new list may already apply to some requests.
+   * network.allowed_hosts on create. Only an allowlist the browser was created with
+   * can be changed: a browser created without one can't be given one, and an
+   * allowlist removed with null can't be added back. Omit to leave the allowlist
+   * unchanged, or set to null to remove it and return to unfiltered egress; an empty
+   * list is invalid. The new list applies without restarting the browser: new
+   * requests to destinations it no longer allows are refused within a few seconds,
+   * and open connections to them are closed within about 30 seconds, or up to 10
+   * minutes during a Kernel deploy. Connections to destinations it still allows,
+   * such as WebSockets, stay open. A start_url in the same request must be allowed
+   * by the updated list, and is loaded only after the list takes effect. Requires a
+   * browser created with proxy v3. Supported on leased pooled browsers; the pool's
+   * allowlist is restored before reuse, or the browser is destroyed if it cannot be
+   * safely restored. If the request fails, retry it: the new list may already apply
+   * to some requests.
    */
   allowed_hosts?: Array<string> | null;
 }
@@ -667,6 +674,12 @@ export interface BrowserUsage {
   uptime_ms: number;
 }
 
+/**
+ * Video memory (VRAM) of a GPU browser session. 2GiB sessions have 4 vCPU and 6GiB
+ * memory. 4GiB sessions have 8 vCPU and 12GiB memory.
+ */
+export type BrowserVideoMemory = '2GiB' | '4GiB';
+
 /**
  * Browser profile metadata.
  */
@@ -865,6 +878,11 @@ export interface BrowserCreateResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1036,6 +1054,11 @@ export interface BrowserRetrieveResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1207,6 +1230,11 @@ export interface BrowserUpdateResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1378,6 +1406,11 @@ export interface BrowserListResponse {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) of the GPU browser session. Only present when gpu is true.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -1553,6 +1586,13 @@ export interface BrowserCreateParams {
    */
   vaults?: Array<VaultReference>;
 
+  /**
+   * Video memory (VRAM) for a GPU browser session. Requires gpu=true. Defaults to
+   * 2GiB, which comes with 4 vCPU and 6GiB memory. 4GiB comes with 8 vCPU and 12GiB
+   * memory.
+   */
+  video_memory?: BrowserVideoMemory;
+
   /**
    * Initial browser window size in pixels with optional refresh rate. If omitted,
    * image defaults apply (1920x1080@25). For GPU images, the default is
@@ -2013,6 +2053,7 @@ export declare namespace Browsers {
     type BrowserReplResult as BrowserReplResult,
     type BrowserReplTextContent as BrowserReplTextContent,
     type BrowserUsage as BrowserUsage,
+    type BrowserVideoMemory as BrowserVideoMemory,
     type Profile as Profile,
     type Tags as Tags,
     type VaultReference as VaultReference,

package/src/resources/browsers/index.ts

@@ -16,6 +16,7 @@ export {
   type BrowserReplResult,
   type BrowserReplTextContent,
   type BrowserUsage,
+  type BrowserVideoMemory,
   type Profile,
   type Tags,
   type VaultReference,