@onkernel/sdk 0.141.0 → 0.143.0

package/src/resources/config-registry/config-registry.ts

@@ -337,9 +337,21 @@ export namespace Proxy {
       export interface IspProxyConfig {
         /**
          * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-         * Defaults to US if not provided.
+         * Defaults to US if not provided, or to the country of ip_address when that is
+         * set.
          */
         country?: string;
+
+        /**
+         * Reserved exit IP to pin the proxy to. Available only to organizations with a
+         * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+         * when country is also set, in that country. Omit to let Kernel choose an IP. A
+         * proxy read includes it only when the proxy's primary exit IP is one of the
+         * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+         * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+         * one that cannot currently be assigned, with 409 ip_unavailable.
+         */
+        ip_address?: string;
       }
 
       /**

package/src/resources/index.ts

@@ -195,6 +195,13 @@ export {
   type ProxyCheckParams,
   type ProxyListResponsesOffsetPagination,
 } from './proxies';
+export {
+  ProxyIPs,
+  type ProxyIP,
+  type ProxyIPDetail,
+  type ProxyIPListParams,
+  type ProxyIPsOffsetPagination,
+} from './proxy-ips';
 export {
   SearchResource,
   type Attempt,

package/src/resources/proxies.ts

@@ -39,14 +39,17 @@ export class Proxies extends APIResource {
   }
 
   /**
-   * Update a proxy's name. Proxy names are not unique and duplicate names are
-   * allowed.
+   * Update a proxy's name, or move an ISP proxy to another reserved exit IP. Proxy
+   * names are not unique and duplicate names are allowed. Moving requires a reserved
+   * ISP allocation and is accepted only for proxies of type isp: the new endpoint is
+   * probed first and nothing changes if the probe fails. An IP outside the
+   * allocation is a 400 with code ip_not_reserved. A 409 means the IP cannot
+   * currently be assigned or the proxy was changed concurrently; read it back and
+   * retry.
    *
    * @example
    * ```ts
-   * const proxy = await client.proxies.update('id_or_name', {
-   *   name: 'my-renamed-proxy',
-   * });
+   * const proxy = await client.proxies.update('id_or_name');
    * ```
    */
   update(
@@ -172,9 +175,21 @@ export namespace ProxyCreateResponse {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -321,9 +336,21 @@ export namespace ProxyRetrieveResponse {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -470,9 +497,21 @@ export namespace ProxyUpdateResponse {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -619,9 +658,21 @@ export namespace ProxyListResponse {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -768,9 +819,21 @@ export namespace ProxyCheckResponse {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -897,9 +960,21 @@ export namespace ProxyCreateParams {
   export interface IspProxyConfig {
     /**
      * ISO 3166 country code. Supported countries are US, GB, FR, DE, SG, and KR.
-     * Defaults to US if not provided.
+     * Defaults to US if not provided, or to the country of ip_address when that is
+     * set.
      */
     country?: string;
+
+    /**
+     * Reserved exit IP to pin the proxy to. Available only to organizations with a
+     * reserved ISP allocation; the IP must be active in it (see GET /proxy_ips) and,
+     * when country is also set, in that country. Omit to let Kernel choose an IP. A
+     * proxy read includes it only when the proxy's primary exit IP is one of the
+     * organization's reserved IPs; every ISP proxy's exit IP is on the top-level
+     * ip_address. An IP outside the allocation is rejected with code ip_not_reserved;
+     * one that cannot currently be assigned, with 409 ip_unavailable.
+     */
+    ip_address?: string;
   }
 
   /**
@@ -994,14 +1069,42 @@ export namespace ProxyCreateParams {
 }
 
 export interface ProxyUpdateParams {
+  /**
+   * Changes to an ISP proxy's exit IP. Accepted only for proxies of type `isp`.
+   */
+  config?: ProxyUpdateParams.Config;
+
   /**
    * New proxy name. Proxy names are trimmed and length-checked only; duplicates are
    * allowed because proxies are updated by ID, not by name.
    */
-  name: string;
+  name?: string;
+}
+
+export namespace ProxyUpdateParams {
+  /**
+   * Changes to an ISP proxy's exit IP. Accepted only for proxies of type `isp`.
+   */
+  export interface Config {
+    /**
+     * Reserved exit IP to move the proxy to. The IP must be active in the
+     * organization's allocation and in the proxy's country. The proxy keeps its ID.
+     * The new endpoint is probed before anything changes; a failed probe leaves the
+     * proxy as it was. Live browsers open new connections on the new IP within a few
+     * seconds; established connections drain on the old one.
+     */
+    ip_address: string;
+  }
 }
 
 export interface ProxyListParams extends OffsetPaginationParams {
+  /**
+   * Exact match on the primary exit IP of ISP proxies. Must be an IPv4 address. Only
+   * ISP proxies are matched: the ip_address shown on other proxy types is a one-time
+   * observation, not a stable identity.
+   */
+  ip_address?: string;
+
   /**
    * Exact-match filter on proxy name using the database collation. In production,
    * matching is case- and accent-insensitive. Names are not required to be unique,

package/src/resources/proxy-ips.ts

@@ -0,0 +1,130 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { OffsetPagination, type OffsetPaginationParams, PagePromise } from '../core/pagination';
+import { RequestOptions } from '../internal/request-options';
+import { path } from '../internal/utils/path';
+
+/**
+ * Create and manage proxy configurations for routing browser traffic.
+ */
+export class ProxyIPs extends APIResource {
+  /**
+   * Retrieve one reserved IP with the ISP proxies using it as their primary exit.
+   * proxy_count spans the organization; proxies lists only those in the current
+   * project. Returns 404 when the IP is not in the organization's allocation and 403
+   * with code reserved_isp_not_enabled when the organization has none. Scoped API
+   * keys require proxies:read on the whole project or organization, not on
+   * individual proxies; otherwise the operation returns 403 with code
+   * insufficient_scope.
+   */
+  retrieve(ipAddress: string, options?: RequestOptions): APIPromise<ProxyIPDetail> {
+    return this._client.get(path`/proxy_ips/${ipAddress}`, options);
+  }
+
+  /**
+   * List the IP addresses reserved for the organization's ISP proxies, with each
+   * IP's country and whether it can currently be assigned. Available only to
+   * organizations with a reserved ISP allocation; others receive a 403 with code
+   * reserved_isp_not_enabled. Served from the allocation itself, so IPs appear
+   * whether or not a proxy uses them. Scoped API keys require proxies:read on the
+   * whole project or organization, not on individual proxies; otherwise the
+   * operation returns 403 with code insufficient_scope.
+   */
+  list(
+    query: ProxyIPListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<ProxyIPsOffsetPagination, ProxyIP> {
+    return this._client.getAPIList('/proxy_ips', OffsetPagination<ProxyIP>, { query, ...options });
+  }
+}
+
+export type ProxyIPsOffsetPagination = OffsetPagination<ProxyIP>;
+
+/**
+ * One IP address reserved for the organization's ISP proxies.
+ */
+export interface ProxyIP {
+  /**
+   * ISO 3166 country code of the IP.
+   */
+  country: string;
+
+  /**
+   * Reserved exit IP address.
+   */
+  ip_address: string;
+
+  /**
+   * Whether the IP can currently be assigned. An excluded IP is listed but cannot be
+   * pinned or moved to; proxies already on it keep working.
+   */
+  status: 'active' | 'excluded';
+}
+
+/**
+ * A reserved IP with the ISP proxies using it as their primary exit. Reservations
+ * are organization-wide, so proxy_count covers every project while proxies lists
+ * only those in the current project.
+ */
+export interface ProxyIPDetail {
+  /**
+   * ISO 3166 country code of the IP.
+   */
+  country: string;
+
+  /**
+   * Reserved exit IP address.
+   */
+  ip_address: string;
+
+  /**
+   * ISP proxies in the current project whose primary exit IP is this address.
+   */
+  proxies: Array<ProxyIPDetail.Proxy>;
+
+  /**
+   * Number of ISP proxies across the organization whose primary exit IP is this
+   * address.
+   */
+  proxy_count: number;
+
+  /**
+   * Whether the IP can currently be assigned. An excluded IP is listed but cannot be
+   * pinned or moved to; proxies already on it keep working.
+   */
+  status: 'active' | 'excluded';
+}
+
+export namespace ProxyIPDetail {
+  /**
+   * An ISP proxy whose primary exit is the reserved IP.
+   */
+  export interface Proxy {
+    id: string;
+
+    name?: string;
+  }
+}
+
+export interface ProxyIPListParams extends OffsetPaginationParams {
+  /**
+   * ISO 3166 country code to filter by. Must be a country ISP proxies support.
+   */
+  country?: string;
+
+  /**
+   * Filter by whether the IP can currently be assigned.
+   */
+  status?: 'active' | 'excluded';
+}
+
+export declare namespace ProxyIPs {
+  export {
+    type ProxyIP as ProxyIP,
+    type ProxyIPDetail as ProxyIPDetail,
+    type ProxyIPsOffsetPagination as ProxyIPsOffsetPagination,
+    type ProxyIPListParams as ProxyIPListParams,
+  };
+}

package/src/resources/shared.ts

@@ -79,12 +79,14 @@ export interface BrowserProfile {
  */
 export interface BrowserViewport {
   /**
-   * Browser window height in pixels. Any positive integer is accepted.
+   * Browser window height in pixels. Any positive integer is accepted; headful
+   * browsers require at least 64.
    */
   height: number;
 
   /**
-   * Browser window width in pixels. Any positive integer is accepted.
+   * Browser window width in pixels. Any positive integer is accepted; headful
+   * browsers require at least 64.
    */
   width: number;
 

package/src/resources/vaults/items.ts

@@ -3918,30 +3918,43 @@ export interface VaultWebmcpBinding {
 }
 
 /**
- * The card's aliases in the customer's VGS vault, its expiry and last four digits.
- * Write-only: stored encrypted and never returned in the item, its events or logs.
- * A repeated PUT with the same key must send the same card.
+ * The card supplied to a purchase, as aliases in the customer's VGS vault. With
+ * card_mode full it is a whole card: a persistent alias of its number, a freshly
+ * collected volatile alias of its security code, its expiry and its last four
+ * digits. With card_mode cvc_only it is a CVC alias alone, because the merchant
+ * holds the rest on file. pan_alias, exp_month, exp_year and last4 are required
+ * with card_mode full and rejected with card_mode cvc_only. Write-only: stored
+ * encrypted and never returned in the item, its events or logs. A repeated PUT
+ * with the same key must send the same card.
  */
 export interface VgsCardInput {
   /**
    * A volatile alias of a freshly collected security code in the customer's vault.
-   * It must still exist when authorize runs.
+   * It must still exist when authorize runs. Required in both modes.
    */
   cvc_alias: string;
 
-  exp_month: number;
+  /**
+   * Required with card_mode full, rejected with card_mode cvc_only.
+   */
+  exp_month?: number;
 
-  exp_year: number;
+  /**
+   * Required with card_mode full, rejected with card_mode cvc_only.
+   */
+  exp_year?: number;
 
   /**
-   * The card number's last four digits, checked against the revealed alias.
+   * The card number's last four digits, checked against the revealed alias. Required
+   * with card_mode full, rejected with card_mode cvc_only.
    */
-  last4: string;
+  last4?: string;
 
   /**
-   * A persistent alias of the card number in the customer's vault.
+   * A persistent alias of the card number in the customer's vault. Required with
+   * card_mode full, rejected with card_mode cvc_only.
    */
-  pan_alias: string;
+  pan_alias?: string;
 }
 
 /**
@@ -3991,17 +4004,24 @@ export namespace VgsCardState {
 }
 
 /**
- * One live purchase with a card in the customer's VGS vault. authorize reveals
- * card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which
- * replaces both with aliases in Kernel's vault before they reach Kernel; Kernel
- * never receives the card number or security code. The card is then ready with no
- * further approval, until expires_at, by default five minutes after authorize.
- * fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy
- * replaces them with the card's details when the browser submits checkout. An
- * expired card requires a new purchase with a freshly collected CVC alias. The
- * amount and merchant are recorded but do not restrict payment requests sent by
- * the browser. Card updates are not supported; delete and create a new item
- * instead.
+ * One live purchase with a card in the customer's VGS vault. With card_mode full,
+ * authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS
+ * outbound proxy; with card_mode cvc_only, for a card the merchant already holds
+ * on file whose checkout page asks only for the security code, it reveals
+ * card.cvc_alias alone. The proxy replaces each revealed value with an alias in
+ * Kernel's vault before it reaches Kernel; Kernel never receives the card number
+ * or security code. The card is then ready with no further approval, until
+ * expires_at, by default five minutes after authorize. fill types Kernel's aliases
+ * on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's
+ * details when the browser submits checkout; a cvc_only card fills only the cvc
+ * field, and reports no masks because it has no last4 to verify. A cvc_only card's
+ * payment window routes all of the browser's egress through Kernel's VGS outbound
+ * proxy, exactly as widely as a full card's: while it is open the proxy reveals
+ * the card's aliases to any destination the browser sends them to, not only the
+ * security code. An expired card requires a new purchase with a freshly collected
+ * CVC alias. The amount and merchant are recorded but do not restrict payment
+ * requests sent by the browser. Card updates are not supported; delete and create
+ * a new item instead.
  */
 export interface VgsCardVaultItemSpec {
   /**
@@ -4033,6 +4053,15 @@ export interface VgsCardVaultItemSpec {
    * Required when creating the card. Never returned.
    */
   card?: VgsCardInput;
+
+  /**
+   * Which card this purchase supplies, and the only part of it a read returns. full
+   * is a whole card from the customer's vault. cvc_only is a card the merchant
+   * already holds on file, whose checkout page asks for nothing but the security
+   * code. It must match spec.card: a full card that is missing pan_alias is rejected
+   * rather than treated as cvc_only. Omit it for full, which a read also omits.
+   */
+  card_mode?: 'full' | 'cvc_only';
 }
 
 export interface VgsWalletState {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.141.0'; // x-release-please-version
+export const VERSION = '0.143.0'; // x-release-please-version

package/version.d.mts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.141.0";
+export declare const VERSION = "0.143.0";
 //# sourceMappingURL=version.d.mts.map

package/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.141.0";
+export declare const VERSION = "0.143.0";
 //# sourceMappingURL=version.d.ts.map

package/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = '0.141.0'; // x-release-please-version
+exports.VERSION = '0.143.0'; // x-release-please-version
 //# sourceMappingURL=version.js.map

package/version.mjs

@@ -1,2 +1,2 @@
-export const VERSION = '0.141.0'; // x-release-please-version
+export const VERSION = '0.143.0'; // x-release-please-version
 //# sourceMappingURL=version.mjs.map