@onkernel/sdk 0.88.0 → 0.91.0

package/src/client.ts

@@ -153,6 +153,9 @@ import {
   BrowserListResponse,
   BrowserListResponsesOffsetPagination,
   BrowserLoadExtensionsParams,
+  BrowserMemory,
+  BrowserMemoryRequest,
+  BrowserNetworkConfig,
   BrowserPoolRef,
   BrowserProxy,
   BrowserProxyConfig,
@@ -177,6 +180,7 @@ import {
   ProjectsOffsetPagination,
   UpdateProjectRequest,
 } from './resources/projects/projects';
+import { Telemetry } from './resources/telemetry/telemetry';
 import { type Fetch } from './internal/builtin-types';
 import { HeadersLike, NullableHeaders, buildHeaders } from './internal/headers';
 import { FinalRequestOptions, RequestOptions } from './internal/request-options';
@@ -204,6 +208,8 @@ export interface ClientOptions {
 
   projectID?: string | null | undefined;
 
+  project?: string | null | undefined;
+
   /**
    * Specifies the environment to use for the API.
    *
@@ -288,6 +294,7 @@ export interface ClientOptions {
 export class Kernel {
   apiKey: string;
   projectID: string | null;
+  project: string | null;
 
   baseURL: string;
   maxRetries: number;
@@ -308,6 +315,7 @@ export class Kernel {
    *
    * @param {string | undefined} [opts.apiKey=process.env['KERNEL_API_KEY'] ?? undefined]
    * @param {string | null | undefined} [opts.projectID]
+   * @param {string | null | undefined} [opts.project]
    * @param {Environment} [opts.environment=production] - Specifies the environment URL to use for the API.
    * @param {string} [opts.baseURL=process.env['KERNEL_BASE_URL'] ?? https://api.onkernel.com/] - Override the default base URL for the API.
    * @param {number} [opts.timeout=1 minute] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
@@ -321,6 +329,7 @@ export class Kernel {
     baseURL = readEnv('KERNEL_BASE_URL'),
     apiKey = readEnv('KERNEL_API_KEY'),
     projectID = null,
+    project = null,
     ...opts
   }: ClientOptions = {}) {
     // Check for Bun runtime in a way that avoids type errors if Bun is not defined
@@ -344,6 +353,7 @@ export class Kernel {
     const options: ClientOptions = {
       apiKey,
       projectID,
+      project,
       ...opts,
       baseURL,
       environment: opts.environment ?? 'production',
@@ -392,6 +402,7 @@ export class Kernel {
 
     this.apiKey = apiKey;
     this.projectID = projectID;
+    this.project = project;
   }
 
   /**
@@ -410,6 +421,7 @@ export class Kernel {
       fetchOptions: this.fetchOptions,
       apiKey: this.apiKey,
       projectID: this.projectID,
+      project: this.project,
       ...options,
     });
     client.browserRouteCache = this.browserRouteCache;
@@ -887,6 +899,7 @@ export class Kernel {
         ...(options.timeout ? { 'X-Stainless-Timeout': String(Math.trunc(options.timeout / 1000)) } : {}),
         ...getPlatformHeaders(),
         'X-Kernel-Project-Id': this.projectID,
+        'X-Kernel-Project': this.project,
       },
       await this.authHeaders(options),
       this._options.defaultHeaders,
@@ -1008,6 +1021,7 @@ export class Kernel {
    */
   profiles: API.Profiles = new API.Profiles(this);
   auth: API.Auth = new API.Auth(this);
+  telemetry: API.Telemetry = new API.Telemetry(this);
   /**
    * Create and manage proxy configurations for routing browser traffic.
    */
@@ -1052,6 +1066,7 @@ Kernel.Invocations = Invocations;
 Kernel.Browsers = Browsers;
 Kernel.Profiles = Profiles;
 Kernel.Auth = Auth;
+Kernel.Telemetry = Telemetry;
 Kernel.Proxies = Proxies;
 Kernel.Extensions = Extensions;
 Kernel.BrowserPools = BrowserPools;
@@ -1115,6 +1130,9 @@ export declare namespace Kernel {
 
   export {
     Browsers as Browsers,
+    type BrowserMemory as BrowserMemory,
+    type BrowserMemoryRequest as BrowserMemoryRequest,
+    type BrowserNetworkConfig as BrowserNetworkConfig,
     type BrowserPoolRef as BrowserPoolRef,
     type BrowserProxy as BrowserProxy,
     type BrowserProxyConfig as BrowserProxyConfig,
@@ -1146,6 +1164,8 @@ export declare namespace Kernel {
 
   export { Auth as Auth };
 
+  export { Telemetry as Telemetry };
+
   export {
     Proxies as Proxies,
     type ProxyCreateResponse as ProxyCreateResponse,

package/src/resources/auth/connections.ts

@@ -648,11 +648,42 @@ export namespace ManagedAuth {
       | 'account'
       | 'other';
 
+    /**
+     * Context captured for a choice.
+     */
+    context?: string | null;
+
     /**
      * Additional context for the choice.
      */
     description?: string | null;
 
+    /**
+     * Display text captured for a choice.
+     */
+    display_text?: string | null;
+
+    /**
+     * Masked phone number or email address shown for an MFA choice.
+     */
+    masked_destination?: string | null;
+
+    /**
+     * Semantic MFA method. Choice id remains the stable identity of the exact option
+     * selected.
+     */
+    mfa_type?:
+      | 'sms'
+      | 'call'
+      | 'email'
+      | 'totp'
+      | 'push'
+      | 'password'
+      | 'passkey'
+      | 'switch'
+      | 'other'
+      | null;
+
     /**
      * Selector for the visible choice, when available.
      */
@@ -754,6 +785,11 @@ export namespace ManagedAuth {
      */
     type: 'identifier' | 'password' | 'code' | 'totp_code' | 'totp_secret' | 'text';
 
+    /**
+     * Context shown near the field, including a masked code destination.
+     */
+    hint?: string;
+
     /**
      * Human-readable label shown to the user.
      */
@@ -1697,11 +1733,42 @@ export namespace ConnectionFollowResponse {
         | 'account'
         | 'other';
 
+      /**
+       * Context captured for a choice.
+       */
+      context?: string | null;
+
       /**
        * Additional context for the choice.
        */
       description?: string | null;
 
+      /**
+       * Display text captured for a choice.
+       */
+      display_text?: string | null;
+
+      /**
+       * Masked phone number or email address shown for an MFA choice.
+       */
+      masked_destination?: string | null;
+
+      /**
+       * Semantic MFA method. Choice id remains the stable identity of the exact option
+       * selected.
+       */
+      mfa_type?:
+        | 'sms'
+        | 'call'
+        | 'email'
+        | 'totp'
+        | 'push'
+        | 'password'
+        | 'passkey'
+        | 'switch'
+        | 'other'
+        | null;
+
       /**
        * Selector for the visible choice, when available.
        */
@@ -1774,6 +1841,11 @@ export namespace ConnectionFollowResponse {
        */
       type: 'identifier' | 'password' | 'code' | 'totp_code' | 'totp_secret' | 'text';
 
+      /**
+       * Context shown near the field, including a masked code destination.
+       */
+      hint?: string;
+
       /**
        * Human-readable label shown to the user.
        */

package/src/resources/browser-pools.ts

@@ -196,6 +196,11 @@ export interface BrowserPool {
    */
   extension_ids: Array<string>;
 
+  /**
+   * Geographic region of the browser pool. Fixed once the pool is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Browser pool name, if set
    */
@@ -258,6 +263,12 @@ export namespace BrowserPool {
      */
     name?: string;
 
+    /**
+     * Network configuration applied to browsers in this pool, if any. Omitted when the
+     * pool has no network configuration.
+     */
+    network?: BrowsersAPI.BrowserNetworkConfig;
+
     /**
      * Profile configuration for browsers in a pool. Provide either id or name.
      * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -363,6 +374,16 @@ export interface BrowserPoolAcquireResponse {
    */
   headless: boolean;
 
+  /**
+   * Memory allocated to the browser session.
+   */
+  memory: BrowsersAPI.BrowserMemory;
+
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -422,6 +443,12 @@ export interface BrowserPoolAcquireResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -536,6 +563,11 @@ export interface BrowserPoolCreateParams {
    */
   name?: string;
 
+  /**
+   * Network configuration applied to browsers in this pool.
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Profile configuration for browsers in a pool. Provide either id or name.
    * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -558,6 +590,13 @@ export interface BrowserPoolCreateParams {
    */
   refresh_on_profile_update?: boolean;
 
+  /**
+   * Geographic region for the browser pool. It is fixed once the pool is created.
+   * Region selection requires a Start-Up or Enterprise plan, defaults to us-east
+   * when omitted on create.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Optional URL to navigate to when a new browser is warmed into the pool.
    * Best-effort: failures to navigate do not fail pool fill. Only applied to
@@ -770,6 +809,15 @@ export interface BrowserPoolUpdateParams {
    */
   name?: string;
 
+  /**
+   * If provided, replaces the pool's network configuration. Omit to leave the
+   * existing configuration unchanged; an empty object ({}) removes it, while
+   * network: {private_hosts: []} sets an explicit empty list. Only applied to
+   * browsers created in the pool after the update; browsers already in the pool keep
+   * their configuration until discarded (see discard_all_idle).
+   */
+  network?: BrowsersAPI.BrowserNetworkConfig;
+
   /**
    * Profile configuration for browsers in a pool. Provide either id or name.
    * Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -976,6 +1024,11 @@ export interface BrowserPoolListParams extends OffsetPaginationParams {
    * value.
    */
   query?: string;
+
+  /**
+   * Filter pools by geographic region. Omit to list pools in all regions.
+   */
+  region?: 'us-east' | 'eu-west';
 }
 
 export interface BrowserPoolDeleteParams {

package/src/resources/browsers/browsers.ts

@@ -281,6 +281,47 @@ export type BrowserListResponsesOffsetPagination = OffsetPagination<BrowserListR
 
 export type ProfilesOffsetPagination = OffsetPagination<Profile>;
 
+/**
+ * Memory allocated to the browser session.
+ */
+export type BrowserMemory = '1GiB' | '2GiB' | '6GiB' | '8GiB' | '16GiB';
+
+/**
+ * Memory requested for a headful, non-GPU browser session.
+ */
+export type BrowserMemoryRequest = '8GiB' | '16GiB';
+
+/**
+ * Network configuration for a browser session or browser pool.
+ */
+export interface BrowserNetworkConfig {
+  /**
+   * Destinations the browser reaches directly through the session's own network
+   * instead of through Kernel-managed egress — for private hosts reachable over a
+   * VPN or tunnel the session has joined (e.g. a Tailscale tailnet). By default,
+   * private IP ranges already route directly: RFC1918 (10.0.0.0/8, 172.16.0.0/12,
+   * 192.168.0.0/16), CGNAT/Tailscale (100.64.0.0/10), and IPv6 ULA (fc00::/7). An
+   * explicitly supplied list replaces those defaults with exactly the entries given,
+   * and an empty list ([]) disables them so all traffic uses Kernel-managed egress;
+   * omit private_hosts to keep the defaults. Entries are hostname patterns
+   * ("_.example.ts.net", "preview.internal") or IP/CIDR literals ("100.64.0.0/10",
+   * "10.1.30.63"). IP and CIDR entries only match URLs written with a literal IP
+   * address; they never match hostnames that resolve into the range, so private DNS
+   * names need a hostname entry even when they resolve inside the default ranges.
+   * CIDRs must be in canonical masked form (host bits zero), and only the private
+   * ranges listed above are accepted; public, loopback, link-local, and unspecified
+   * ranges are rejected. Exact IPv6 addresses must be bracketed ("[fd00::1]"); IPv6
+   * CIDR ranges are unbracketed ("fd00::/8"). Wildcards are limited to one leading
+   * "_." over a suffix with at least two labels that is not a public suffix (so
+   * "_.co.uk" or "_.ts.net" are rejected, while "\*.example.ts.net" is accepted).
+   * Hostname and IP entries may carry a port; CIDR ranges may not. Hostname entries
+   * are not resolved during validation, so callers must ensure they identify private
+   * destinations. Not related to a proxy's bypass_hosts, which selects between
+   * upstream-proxy and Kernel-managed direct egress and cannot reach into a VPN.
+   */
+  private_hosts?: Array<string>;
+}
+
 /**
  * Browser pool this session was acquired from, if any.
  */
@@ -423,6 +464,16 @@ export interface BrowserCreateResponse {
    */
   headless: boolean;
 
+  /**
+   * Memory allocated to the browser session.
+   */
+  memory: BrowserMemory;
+
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -482,6 +533,12 @@ export interface BrowserCreateResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -567,6 +624,16 @@ export interface BrowserRetrieveResponse {
    */
   headless: boolean;
 
+  /**
+   * Memory allocated to the browser session.
+   */
+  memory: BrowserMemory;
+
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -626,6 +693,12 @@ export interface BrowserRetrieveResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -711,6 +784,16 @@ export interface BrowserUpdateResponse {
    */
   headless: boolean;
 
+  /**
+   * Memory allocated to the browser session.
+   */
+  memory: BrowserMemory;
+
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -770,6 +853,12 @@ export interface BrowserUpdateResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -855,6 +944,16 @@ export interface BrowserListResponse {
    */
   headless: boolean;
 
+  /**
+   * Memory allocated to the browser session.
+   */
+  memory: BrowserMemory;
+
+  /**
+   * Geographic region of the browser session. Fixed once the session is created.
+   */
+  region: 'us-east' | 'eu-west';
+
   /**
    * Unique identifier for the browser session
    */
@@ -914,6 +1013,12 @@ export interface BrowserListResponse {
    */
   name?: string;
 
+  /**
+   * Network configuration the session was created with, if any. Omitted when the
+   * session has no network configuration.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Browser pool this session was acquired from, if any.
    */
@@ -1045,6 +1150,11 @@ export interface BrowserCreateParams {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Memory for a headful, non-GPU browser session. Defaults to 8GiB.
+   */
+  memory?: BrowserMemoryRequest;
+
   /**
    * Optional human-readable name for the browser session, used to find it later in
    * the dashboard. Must be unique among active sessions within the project. Can be
@@ -1052,6 +1162,11 @@ export interface BrowserCreateParams {
    */
   name?: string;
 
+  /**
+   * Network configuration for the browser session. Cannot be changed after creation.
+   */
+  network?: BrowserNetworkConfig;
+
   /**
    * Profile selection for the browser session. Provide either id or name. If
    * specified, the matching profile will be loaded into the browser session.
@@ -1076,6 +1191,13 @@ export interface BrowserCreateParams {
    */
   proxy_id?: string;
 
+  /**
+   * Geographic region for the browser session. It is fixed once the session is
+   * created. Region selection requires a Start-Up or Enterprise plan, defaults to
+   * us-east when omitted on create.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Optional URL to open when the browser session is created. Navigation is
    * best-effort, so navigation failures do not prevent the session from being
@@ -1410,6 +1532,11 @@ export interface BrowserListParams extends OffsetPaginationParams {
    */
   query?: string;
 
+  /**
+   * Filter sessions by geographic region. Omit to list sessions in all regions.
+   */
+  region?: 'us-east' | 'eu-west';
+
   /**
    * Filter sessions by status. "active" returns only active sessions (default),
    * "deleted" returns only soft-deleted sessions, "all" returns both.
@@ -1488,6 +1615,9 @@ Browsers.Playwright = Playwright;
 
 export declare namespace Browsers {
   export {
+    type BrowserMemory as BrowserMemory,
+    type BrowserMemoryRequest as BrowserMemoryRequest,
+    type BrowserNetworkConfig as BrowserNetworkConfig,
     type BrowserPoolRef as BrowserPoolRef,
     type BrowserProxy as BrowserProxy,
     type BrowserProxyConfig as BrowserProxyConfig,

package/src/resources/browsers/index.ts

@@ -2,6 +2,9 @@
 
 export {
   Browsers,
+  type BrowserMemory,
+  type BrowserMemoryRequest,
+  type BrowserNetworkConfig,
   type BrowserPoolRef,
   type BrowserProxy,
   type BrowserProxyConfig,

package/src/resources/browsers/telemetry.ts

@@ -10,7 +10,7 @@ import { RequestOptions } from '../../internal/request-options';
 import { path } from '../../internal/utils/path';
 
 /**
- * Stream live telemetry events from a browser session.
+ * Stream live telemetry events from a browser session, and manage the destinations sessions export them to.
  */
 export class Telemetry extends APIResource {
   /**

package/src/resources/credential-providers.ts

@@ -136,7 +136,8 @@ export interface CreateCredentialProviderRequest {
   token: string;
 
   /**
-   * Human-readable name for this provider instance (unique per org)
+   * Human-readable name for this provider instance (unique per org). Surrounding
+   * whitespace is trimmed and the trimmed value must be non-empty.
    */
   name: string;
 
@@ -281,7 +282,8 @@ export interface UpdateCredentialProviderRequest {
   enabled?: boolean;
 
   /**
-   * Human-readable name for this provider instance
+   * Human-readable name for this provider instance. Surrounding whitespace is
+   * trimmed and the trimmed value must be non-empty.
    */
   name?: string;
 
@@ -302,7 +304,8 @@ export interface CredentialProviderCreateParams {
   token: string;
 
   /**
-   * Human-readable name for this provider instance (unique per org)
+   * Human-readable name for this provider instance (unique per org). Surrounding
+   * whitespace is trimmed and the trimmed value must be non-empty.
    */
   name: string;
 
@@ -334,7 +337,8 @@ export interface CredentialProviderUpdateParams {
   enabled?: boolean;
 
   /**
-   * Human-readable name for this provider instance
+   * Human-readable name for this provider instance. Surrounding whitespace is
+   * trimmed and the trimmed value must be non-empty.
    */
   name?: string;
 

package/src/resources/index.ts

@@ -40,6 +40,9 @@ export {
 } from './browser-pools';
 export {
   Browsers,
+  type BrowserMemory,
+  type BrowserMemoryRequest,
+  type BrowserNetworkConfig,
   type BrowserPoolRef,
   type BrowserProxy,
   type BrowserProxyConfig,
@@ -153,3 +156,4 @@ export {
   type ProxyCheckParams,
   type ProxyListResponsesOffsetPagination,
 } from './proxies';
+export { Telemetry } from './telemetry/telemetry';

package/src/resources/invocations.ts

@@ -434,6 +434,16 @@ export namespace InvocationListBrowsersResponse {
      */
     headless: boolean;
 
+    /**
+     * Memory allocated to the browser session.
+     */
+    memory: BrowsersAPI.BrowserMemory;
+
+    /**
+     * Geographic region of the browser session. Fixed once the session is created.
+     */
+    region: 'us-east' | 'eu-west';
+
     /**
      * Unique identifier for the browser session
      */
@@ -493,6 +503,12 @@ export namespace InvocationListBrowsersResponse {
      */
     name?: string;
 
+    /**
+     * Network configuration the session was created with, if any. Omitted when the
+     * session has no network configuration.
+     */
+    network?: BrowsersAPI.BrowserNetworkConfig;
+
     /**
      * Browser pool this session was acquired from, if any.
      */

package/src/resources/organization/limits.ts

@@ -9,9 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's concurrency limit — the maximum browsers running at once
-   * across on-demand sessions and browser pool reservations — and the default
-   * per-project concurrency cap applied to projects without an explicit override.
+   * Get the organization's effective limits and managed auth usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -28,6 +26,26 @@ export class Limits extends APIResource {
 }
 
 export interface OrgLimits {
+  /**
+   * The organization's current non-deleted managed auth connections, counted
+   * org-wide across every project. Compare against max_auth_connections to show
+   * remaining capacity before a create is rejected with 403 insufficient_plan.
+   */
+  auth_connections_used: number;
+
+  /**
+   * Maximum managed auth connections the organization's plan allows. Null means
+   * unlimited. Counted org-wide, so it cannot be multiplied across projects.
+   */
+  max_auth_connections: number | null;
+
+  /**
+   * Smallest health_check_interval the organization's plan accepts on a managed auth
+   * connection. Requests below this are rejected with 400. Existing connections
+   * stored below the floor are grandfathered until edited.
+   */
+  min_health_check_interval_seconds: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects