@onkernel/sdk 0.87.1 → 0.90.0

package/src/resources/browser-pools.ts

@@ -196,6 +196,11 @@ export interface BrowserPool {
    */
   extension_ids: Array<string>;
 
+  /**
+   * Geographic region of the browser pool. Fixed once the pool is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Browser pool name, if set
    */
@@ -258,6 +263,12 @@ export namespace BrowserPool {
      */
     name?: string;
 
+    /**
+     * Network configuration applied to browsers in this pool, if any. Omitted when the
+     * pool has no network configuration.
+     */
+    network?: BrowsersAPI.BrowserNetworkConfig;
+
     /**
      * Profile configuration for browsers in a pool. Provide either id or name.
      * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -363,6 +374,11 @@ export interface BrowserPoolAcquireResponse {
    */
   headless: boolean;
 
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -422,6 +438,12 @@ export interface BrowserPoolAcquireResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -439,7 +461,13 @@ export interface BrowserPoolAcquireResponse {
   profile_save_changes?: boolean;
 
   /**
-   * ID of the proxy associated with this browser session, if any.
+   * Resolved proxy configuration for this browser session.
+   */
+  proxy?: BrowsersAPI.BrowserProxy;
+
+  /**
+   * @deprecated ID of the proxy associated with this browser session, if any.
+   * Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
@@ -530,6 +558,11 @@ export interface BrowserPoolCreateParams {
    */
   name?: string;
 
+  /**
+   * Network configuration applied to browsers in this pool.
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Profile configuration for browsers in a pool. Provide either id or name.
    * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -552,6 +585,13 @@ export interface BrowserPoolCreateParams {
    */
   refresh_on_profile_update?: boolean;
 
+  /**
+   * Geographic region for the browser pool. It is fixed once the pool is created.
+   * Region selection requires a Start-Up or Enterprise plan, defaults to us-east
+   * when omitted on create.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Optional URL to navigate to when a new browser is warmed into the pool.
    * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -764,6 +804,15 @@ export interface BrowserPoolUpdateParams {
    */
   name?: string;
 
+  /**
+   * If provided, replaces the pool's network configuration. Omit to leave the
+   * existing configuration unchanged; an empty object ({}) removes it, while
+   * network: {private_hosts: []} sets an explicit empty list. Only applied to
+   * browsers created in the pool after the update; browsers already in the pool keep
+   * their configuration until discarded (see discard_all_idle).
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Profile configuration for browsers in a pool. Provide either id or name.
    * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -970,6 +1019,11 @@ export interface BrowserPoolListParams extends OffsetPaginationParams {
    * value.
    */
   query?: string;
+
+  /**
+   * Filter pools by geographic region. Omit to list pools in all regions.
+   */
+  region?: 'us-east' | 'eu-west';
 }
 
 export interface BrowserPoolDeleteParams {

package/src/resources/browsers/browsers.ts

@@ -281,6 +281,37 @@ export type BrowserListResponsesOffsetPagination = OffsetPagination<BrowserListR
 
 export type ProfilesOffsetPagination = OffsetPagination<Profile>;
 
+/**
+ * Network configuration for a browser session or browser pool.
+ */
+export interface BrowserNetworkConfig {
+  /**
+   * Destinations the browser reaches directly through the session's own network
+   * instead of through Kernel-managed egress — for private hosts reachable over a
+   * VPN or tunnel the session has joined (e.g. a Tailscale tailnet). By default,
+   * private IP ranges already route directly: RFC1918 (10.0.0.0/8, 172.16.0.0/12,
+   * 192.168.0.0/16), CGNAT/Tailscale (100.64.0.0/10), and IPv6 ULA (fc00::/7). An
+   * explicitly supplied list replaces those defaults with exactly the entries given,
+   * and an empty list ([]) disables them so all traffic uses Kernel-managed egress;
+   * omit private_hosts to keep the defaults. Entries are hostname patterns
+   * ("_.example.ts.net", "preview.internal") or IP/CIDR literals ("100.64.0.0/10",
+   * "10.1.30.63"). IP and CIDR entries only match URLs written with a literal IP
+   * address; they never match hostnames that resolve into the range, so private DNS
+   * names need a hostname entry even when they resolve inside the default ranges.
+   * CIDRs must be in canonical masked form (host bits zero), and only the private
+   * ranges listed above are accepted; public, loopback, link-local, and unspecified
+   * ranges are rejected. Exact IPv6 addresses must be bracketed ("[fd00::1]"); IPv6
+   * CIDR ranges are unbracketed ("fd00::/8"). Wildcards are limited to one leading
+   * "_." over a suffix with at least two labels that is not a public suffix (so
+   * "_.co.uk" or "_.ts.net" are rejected, while "\*.example.ts.net" is accepted).
+   * Hostname and IP entries may carry a port; CIDR ranges may not. Hostname entries
+   * are not resolved during validation, so callers must ensure they identify private
+   * destinations. Not related to a proxy's bypass_hosts, which selects between
+   * upstream-proxy and Kernel-managed direct egress and cannot reach into a VPN.
+   */
+  private_hosts?: Array<string>;
+}
+
 /**
  * Browser pool this session was acquired from, if any.
  */
@@ -296,6 +327,72 @@ export interface BrowserPoolRef {
   name?: string;
 }
 
+/**
+ * Resolved proxy configuration for a browser session. Selected proxies are
+ * returned by stable ID.
+ */
+export interface BrowserProxy {
+  /**
+   * Selected proxy ID.
+   */
+  id?: string;
+
+  /**
+   * Proxy egress mode. direct forces no proxy regardless of stealth. default uses
+   * the browser's stealth-derived default: Kernel's default stealth proxy when
+   * stealth=true, or direct egress when stealth=false. default is primarily useful
+   * on browser update to restore the browser default after selected-proxy egress.
+   */
+  mode?: BrowserProxyMode;
+
+  /**
+   * Selected proxy name.
+   */
+  name?: string;
+}
+
+/**
+ * Browser proxy configuration. Provide exactly one of mode, id, or name; an empty
+ * object is invalid. Set mode to direct for no proxy regardless of stealth. Set
+ * mode to default to use the browser's stealth-derived default: Kernel's default
+ * stealth proxy when stealth=true, or direct egress when stealth=false. Select id
+ * or name to use that proxy regardless of stealth. The selected proxy must be in
+ * the same project as the browser. Names must match exactly one active proxy; use
+ * id for stable references. Proxy configuration changes only egress and does not
+ * change stealth or CAPTCHA solver behavior. A stealth browser using mode=direct
+ * still runs in stealth mode with the CAPTCHA solver enabled. When proxy is
+ * omitted on browser creation, stealth browsers use Kernel's default stealth proxy
+ * and non-stealth browsers use direct egress. When omitted on update, the current
+ * configuration is unchanged.
+ */
+export interface BrowserProxyConfig {
+  /**
+   * Proxy ID.
+   */
+  id?: string;
+
+  /**
+   * Proxy egress mode. direct forces no proxy regardless of stealth. default uses
+   * the browser's stealth-derived default: Kernel's default stealth proxy when
+   * stealth=true, or direct egress when stealth=false. default is primarily useful
+   * on browser update to restore the browser default after selected-proxy egress.
+   */
+  mode?: BrowserProxyMode;
+
+  /**
+   * Proxy name. Must match exactly one active proxy in the project.
+   */
+  name?: string;
+}
+
+/**
+ * Proxy egress mode. direct forces no proxy regardless of stealth. default uses
+ * the browser's stealth-derived default: Kernel's default stealth proxy when
+ * stealth=true, or direct egress when stealth=false. default is primarily useful
+ * on browser update to restore the browser default after selected-proxy egress.
+ */
+export type BrowserProxyMode = 'direct' | 'default';
+
 /**
  * Session usage metrics.
  */
@@ -357,6 +454,11 @@ export interface BrowserCreateResponse {
    */
   headless: boolean;
 
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -416,6 +518,12 @@ export interface BrowserCreateResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -433,7 +541,13 @@ export interface BrowserCreateResponse {
   profile_save_changes?: boolean;
 
   /**
-   * ID of the proxy associated with this browser session, if any.
+   * Resolved proxy configuration for this browser session.
+   */
+  proxy?: BrowserProxy;
+
+  /**
+   * @deprecated ID of the proxy associated with this browser session, if any.
+   * Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
@@ -495,6 +609,11 @@ export interface BrowserRetrieveResponse {
    */
   headless: boolean;
 
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -554,6 +673,12 @@ export interface BrowserRetrieveResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -571,7 +696,13 @@ export interface BrowserRetrieveResponse {
   profile_save_changes?: boolean;
 
   /**
-   * ID of the proxy associated with this browser session, if any.
+   * Resolved proxy configuration for this browser session.
+   */
+  proxy?: BrowserProxy;
+
+  /**
+   * @deprecated ID of the proxy associated with this browser session, if any.
+   * Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
@@ -633,6 +764,11 @@ export interface BrowserUpdateResponse {
    */
   headless: boolean;
 
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -692,6 +828,12 @@ export interface BrowserUpdateResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -709,7 +851,13 @@ export interface BrowserUpdateResponse {
   profile_save_changes?: boolean;
 
   /**
-   * ID of the proxy associated with this browser session, if any.
+   * Resolved proxy configuration for this browser session.
+   */
+  proxy?: BrowserProxy;
+
+  /**
+   * @deprecated ID of the proxy associated with this browser session, if any.
+   * Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
@@ -771,6 +919,11 @@ export interface BrowserListResponse {
    */
   headless: boolean;
 
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -830,6 +983,12 @@ export interface BrowserListResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -847,7 +1006,13 @@ export interface BrowserListResponse {
   profile_save_changes?: boolean;
 
   /**
-   * ID of the proxy associated with this browser session, if any.
+   * Resolved proxy configuration for this browser session.
+   */
+  proxy?: BrowserProxy;
+
+  /**
+   * @deprecated ID of the proxy associated with this browser session, if any.
+   * Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
@@ -962,6 +1127,11 @@ export interface BrowserCreateParams {
    */
   name?: string;
 
+  /**
+   * Network configuration for the browser session. Cannot be changed after creation.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Profile selection for the browser session. Provide either id or name. If
    * specified, the matching profile will be loaded into the browser session.
@@ -970,11 +1140,29 @@ export interface BrowserCreateParams {
   profile?: Shared.BrowserProfile;
 
   /**
-   * Optional proxy to associate to the browser session. Must reference a proxy in
-   * the same project as the browser session.
+   * Proxy configuration for the browser session. Cannot be combined with proxy_id.
+   * Omit to use the browser default: stealth browsers use Kernel's default stealth
+   * proxy, while non-stealth browsers use direct egress. Set mode to direct to force
+   * direct egress regardless of stealth. Set mode to default to explicitly use the
+   * browser default: Kernel's default stealth proxy when stealth=true, or direct
+   * egress when stealth=false. Select id or name to use that proxy regardless of
+   * stealth. Proxy selection does not change stealth or CAPTCHA solver behavior.
+   */
+  proxy?: BrowserProxyConfig;
+
+  /**
+   * @deprecated Optional proxy to associate to the browser session. Must reference a
+   * proxy in the same project as the browser session. Deprecated in favor of proxy.
    */
   proxy_id?: string;
 
+  /**
+   * Geographic region for the browser session. It is fixed once the session is
+   * created. Region selection requires a Start-Up or Enterprise plan, defaults to
+   * us-east when omitted on create.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Optional URL to open when the browser session is created. Navigation is
    * best-effort, so navigation failures do not prevent the session from being
@@ -983,8 +1171,11 @@ export interface BrowserCreateParams {
   start_url?: string;
 
   /**
-   * If true, launches the browser in stealth mode to reduce detection by anti-bot
-   * mechanisms.
+   * If true, launches the browser in stealth mode and enables the CAPTCHA solver.
+   * Defaults to false. When proxy is omitted, stealth browsers use Kernel's default
+   * stealth proxy and non-stealth browsers use direct egress. An explicit proxy
+   * configuration changes only egress; it does not enable or disable stealth or the
+   * CAPTCHA solver.
    */
   stealth?: boolean;
 
@@ -1132,8 +1323,8 @@ export interface BrowserRetrieveParams {
 
 export interface BrowserUpdateParams {
   /**
-   * If true, stealth browsers connect directly instead of using the default stealth
-   * proxy.
+   * @deprecated If true, stealth browsers connect directly instead of using the
+   * default stealth proxy. Deprecated in favor of proxy.mode.
    */
   disable_default_proxy?: boolean;
 
@@ -1151,8 +1342,18 @@ export interface BrowserUpdateParams {
   profile?: Shared.BrowserProfile;
 
   /**
-   * ID of the proxy to use. Omit to leave unchanged, set to empty string to remove
-   * proxy.
+   * Proxy configuration to apply. Omit to leave the current configuration unchanged.
+   * Cannot be combined with proxy_id or disable_default_proxy. Set mode to direct to
+   * switch to direct egress regardless of stealth. Set mode to default to restore
+   * the browser default after using a selected proxy: Kernel's default stealth proxy
+   * for a stealth browser, or direct egress for a non-stealth browser. Updating
+   * proxy does not change stealth or CAPTCHA solver behavior.
+   */
+  proxy?: BrowserProxyConfig;
+
+  /**
+   * @deprecated ID of the proxy to use. Omit to leave unchanged, set to empty string
+   * to remove proxy. Deprecated in favor of proxy.
    */
   proxy_id?: string | null;
 
@@ -1296,6 +1497,11 @@ export interface BrowserListParams extends OffsetPaginationParams {
    */
   query?: string;
 
+  /**
+   * Filter sessions by geographic region. Omit to list sessions in all regions.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Filter sessions by status. "active" returns only active sessions (default),
    * "deleted" returns only soft-deleted sessions, "all" returns both.
@@ -1374,7 +1580,11 @@ Browsers.Playwright = Playwright;
 
 export declare namespace Browsers {
   export {
+    type BrowserNetworkConfig as BrowserNetworkConfig,
     type BrowserPoolRef as BrowserPoolRef,
+    type BrowserProxy as BrowserProxy,
+    type BrowserProxyConfig as BrowserProxyConfig,
+    type BrowserProxyMode as BrowserProxyMode,
     type BrowserUsage as BrowserUsage,
     type Profile as Profile,
     type Tags as Tags,

package/src/resources/browsers/index.ts

@@ -2,7 +2,11 @@
 
 export {
   Browsers,
+  type BrowserNetworkConfig,
   type BrowserPoolRef,
+  type BrowserProxy,
+  type BrowserProxyConfig,
+  type BrowserProxyMode,
   type BrowserUsage,
   type Profile,
   type Tags,

package/src/resources/index.ts

@@ -40,7 +40,11 @@ export {
 } from './browser-pools';
 export {
   Browsers,
+  type BrowserNetworkConfig,
   type BrowserPoolRef,
+  type BrowserProxy,
+  type BrowserProxyConfig,
+  type BrowserProxyMode,
   type BrowserUsage,
   type Profile,
   type Tags,

package/src/resources/invocations.ts

@@ -434,6 +434,11 @@ export namespace InvocationListBrowsersResponse {
      */
     headless: boolean;
 
+    /**
+     * Geographic region of the browser session. Fixed once the session is created.
+     */
+    region: 'us-east' | 'eu-west';
+
     /**
      * Unique identifier for the browser session
      */
@@ -493,6 +498,12 @@ export namespace InvocationListBrowsersResponse {
      */
     name?: string;
 
+    /**
+     * Network configuration the session was created with, if any. Omitted when the
+     * session has no network configuration.
+     */
+    network?: BrowsersAPI.BrowserNetworkConfig;
+
     /**
      * Browser pool this session was acquired from, if any.
      */
@@ -510,7 +521,13 @@ export namespace InvocationListBrowsersResponse {
     profile_save_changes?: boolean;
 
     /**
-     * ID of the proxy associated with this browser session, if any.
+     * Resolved proxy configuration for this browser session.
+     */
+    proxy?: BrowsersAPI.BrowserProxy;
+
+    /**
+     * @deprecated ID of the proxy associated with this browser session, if any.
+     * Deprecated in favor of proxy.
      */
     proxy_id?: string;
 

package/src/resources/organization/limits.ts

@@ -9,9 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's concurrency limit — the maximum browsers running at once
-   * across on-demand sessions and browser pool reservations — and the default
-   * per-project concurrency cap applied to projects without an explicit override.
+   * Get the organization's effective limits and managed auth usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -28,6 +26,26 @@ export class Limits extends APIResource {
 }
 
 export interface OrgLimits {
+  /**
+   * The organization's current non-deleted managed auth connections, counted
+   * org-wide across every project. Compare against max_auth_connections to show
+   * remaining capacity before a create is rejected with 403 insufficient_plan.
+   */
+  auth_connections_used: number;
+
+  /**
+   * Maximum managed auth connections the organization's plan allows. Null means
+   * unlimited. Counted org-wide, so it cannot be multiplied across projects.
+   */
+  max_auth_connections: number | null;
+
+  /**
+   * Smallest health_check_interval the organization's plan accepts on a managed auth
+   * connection. Requests below this are rejected with 400. Existing connections
+   * stored below the floor are grandfathered until edited.
+   */
+  min_health_check_interval_seconds: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects

package/src/resources/projects/limits.ts

@@ -18,12 +18,12 @@ export class Limits extends APIResource {
    * @example
    * ```ts
    * const projectLimits = await client.projects.limits.retrieve(
-   *   'id',
+   *   'id_or_name',
    * );
    * ```
    */
-  retrieve(id: string, options?: RequestOptions): APIPromise<ProjectLimits> {
-    return this._client.get(path`/org/projects/${id}/limits`, options);
+  retrieve(idOrName: string, options?: RequestOptions): APIPromise<ProjectLimits> {
+    return this._client.get(path`/org/projects/${idOrName}/limits`, options);
   }
 
   /**
@@ -34,12 +34,12 @@ export class Limits extends APIResource {
    * @example
    * ```ts
    * const projectLimits = await client.projects.limits.update(
-   *   'id',
+   *   'id_or_name',
    * );
    * ```
    */
-  update(id: string, body: LimitUpdateParams, options?: RequestOptions): APIPromise<ProjectLimits> {
-    return this._client.patch(path`/org/projects/${id}/limits`, { body, ...options });
+  update(idOrName: string, body: LimitUpdateParams, options?: RequestOptions): APIPromise<ProjectLimits> {
+    return this._client.patch(path`/org/projects/${idOrName}/limits`, { body, ...options });
   }
 }