kernel 0.121.0__tar.gz → 0.122.0__tar.gz

kernel-0.122.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.122.0"
+}

{kernel-0.121.0 → kernel-0.122.0}/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.122.0](https://github.com/kernel/kernel-python-sdk/compare/v0.121.0...v0.122.0) (2026-10-09)
+
+
+### Features
+
+* Accept client-encrypted credential values in vault items ([a289cba](https://github.com/kernel/kernel-python-sdk/commit/a289cba652251b6f42b60aad92619627efc9304b))
+* Add feature-gated Korean ISP proxies ([56785ca](https://github.com/kernel/kernel-python-sdk/commit/56785cad65cda7e757258204de47f1a4a5974088))
+* Describe vault fill as safe to retry ([e419d6d](https://github.com/kernel/kernel-python-sdk/commit/e419d6d8970f0e78f91b4771969787bb835a6acf))
+* Infer a challenge result for unobserved captcha providers in the relay ([0e4734c](https://github.com/kernel/kernel-python-sdk/commit/0e4734caedae1068b5f3f9eeb5212871dfc4a0ec))
+* Support proxy routes in browser pools ([669ea52](https://github.com/kernel/kernel-python-sdk/commit/669ea5294ab1da43e5042209992364ca009f7053))
+
 ## [0.121.0](https://github.com/kernel/kernel-python-sdk/compare/v0.120.0...v0.121.0) (2026-10-07)
 
 

{kernel-0.121.0 → kernel-0.122.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.121.0
+Version: 0.122.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk
@@ -22,7 +22,8 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.9
-Requires-Dist: anyio<5,>=3.5.0
+Requires-Dist: anyio<5,>=3.5.0; python_version < '3.10'
+Requires-Dist: anyio<5,>=4.14.2; python_version >= '3.10'
 Requires-Dist: distro<2,>=1.7.0
 Requires-Dist: httpx<1,>=0.23.0
 Requires-Dist: pydantic<3,>=1.9.0

{kernel-0.121.0 → kernel-0.122.0}/api.md

@@ -546,7 +546,7 @@ Methods:
 Types:
 
 ```python
-from kernel.types import Vault
+from kernel.types import Vault, VaultEncryptionKey
 ```
 
 Methods:
@@ -554,6 +554,7 @@ Methods:
 - <code title="get /vaults/{id_or_name}">client.vaults.<a href="./src/kernel/resources/vaults/vaults.py">retrieve</a>(id_or_name) -> <a href="./src/kernel/types/vault.py">Vault</a></code>
 - <code title="get /vaults">client.vaults.<a href="./src/kernel/resources/vaults/vaults.py">list</a>(\*\*<a href="src/kernel/types/vault_list_params.py">params</a>) -> <a href="./src/kernel/types/vault.py">SyncOffsetPagination[Vault]</a></code>
 - <code title="delete /vaults/{id_or_name}">client.vaults.<a href="./src/kernel/resources/vaults/vaults.py">delete</a>(id_or_name) -> None</code>
+- <code title="get /vaults/{id_or_name}/encryption_key">client.vaults.<a href="./src/kernel/resources/vaults/vaults.py">retrieve_encryption_key</a>(id_or_name) -> <a href="./src/kernel/types/vault_encryption_key.py">VaultEncryptionKey</a></code>
 - <code title="post /vaults">client.vaults.<a href="./src/kernel/resources/vaults/vaults.py">upsert</a>(\*\*<a href="src/kernel/types/vault_upsert_params.py">params</a>) -> <a href="./src/kernel/types/vault.py">Vault</a></code>
 
 ## Items

{kernel-0.121.0 → kernel-0.122.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.121.0"
+version = "0.122.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"
@@ -12,7 +12,8 @@ dependencies = [
   "httpx>=0.23.0, <1",
   "pydantic>=1.9.0, <3",
   "typing-extensions>=4.14, <5",
-  "anyio>=3.5.0, <5",
+  "anyio>=4.14.2, <5; python_version >= '3.10'",
+  "anyio>=3.5.0, <5; python_version < '3.10'",
   "distro>=1.7.0, <2",
   "sniffio",
 ]

{kernel-0.121.0 → kernel-0.122.0}/requirements-dev.lock

@@ -19,7 +19,7 @@ aiosignal==1.4.0
     # via aiohttp
 annotated-types==0.7.0
     # via pydantic
-anyio==4.12.1
+anyio==4.14.2
     # via httpx
     # via kernel
 argcomplete==3.6.3
@@ -48,7 +48,7 @@ exceptiongroup==1.3.1
     # via pytest
 execnet==2.1.2
     # via pytest-xdist
-filelock==3.19.1
+filelock==3.32.7
     # via virtualenv
 frozenlist==1.8.0
     # via aiohttp

{kernel-0.121.0 → kernel-0.122.0}/requirements.lock

@@ -19,7 +19,7 @@ aiosignal==1.4.0
     # via aiohttp
 annotated-types==0.7.0
     # via pydantic
-anyio==4.12.1
+anyio==4.14.2
     # via httpx
     # via kernel
 async-timeout==5.0.1

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.121.0"  # x-release-please-version
+__version__ = "0.122.0"  # x-release-please-version

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/resources/browser_pools.py

@@ -123,7 +123,9 @@ class BrowserPoolsResource(SyncAPIResource):
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          network: Network configuration applied to browsers in this pool.
+          network: Network configuration applied to browsers in this pool. Proxy routes require
+              proxy-v3; the pool will not provision browsers through Envoy if proxy-v3 is
+              unavailable.
 
           profile: Profile configuration for browsers in a pool. Provide either id or name.
               Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -318,9 +320,11 @@ class BrowserPoolsResource(SyncAPIResource):
 
           network: If provided, replaces the pool's network configuration. Omit to leave the
               existing configuration unchanged; an empty object ({}) removes it, while
-              network: {private_hosts: []} sets an explicit empty list. Only applied to
-              browsers created in the pool after the update; browsers already in the pool keep
-              their configuration until discarded (see discard_all_idle).
+              network: {private_hosts: []} or network: {proxy_routes: []} sets an explicit
+              empty list. Proxy routes require proxy-v3; the pool will not provision browsers
+              through Envoy if proxy-v3 is unavailable. Only applied to browsers created in
+              the pool after the update; browsers already in the pool keep their configuration
+              until discarded (see discard_all_idle).
 
           profile: Profile configuration for browsers in a pool. Provide either id or name.
               Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -770,7 +774,9 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
 
           name: Optional name for the browser pool. Must be unique within the project.
 
-          network: Network configuration applied to browsers in this pool.
+          network: Network configuration applied to browsers in this pool. Proxy routes require
+              proxy-v3; the pool will not provision browsers through Envoy if proxy-v3 is
+              unavailable.
 
           profile: Profile configuration for browsers in a pool. Provide either id or name.
               Profiles must be created beforehand. Unlike single browser sessions, pools load
@@ -965,9 +971,11 @@ class AsyncBrowserPoolsResource(AsyncAPIResource):
 
           network: If provided, replaces the pool's network configuration. Omit to leave the
               existing configuration unchanged; an empty object ({}) removes it, while
-              network: {private_hosts: []} sets an explicit empty list. Only applied to
-              browsers created in the pool after the update; browsers already in the pool keep
-              their configuration until discarded (see discard_all_idle).
+              network: {private_hosts: []} or network: {proxy_routes: []} sets an explicit
+              empty list. Proxy routes require proxy-v3; the pool will not provision browsers
+              through Envoy if proxy-v3 is unavailable. Only applied to browsers created in
+              the pool after the update; browsers already in the pool keep their configuration
+              until discarded (see discard_all_idle).
 
           profile: Profile configuration for browsers in a pool. Provide either id or name.
               Profiles must be created beforehand. Unlike single browser sessions, pools load

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/resources/vaults/items.py

@@ -426,8 +426,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -473,8 +473,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -521,8 +521,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           checkout: Required when preparing an unused AgentCard card for a supported checkout
@@ -578,8 +578,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.
@@ -640,8 +640,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -688,8 +688,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -739,8 +739,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.
@@ -794,8 +794,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -843,8 +843,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           access_token_expires_at: Optional supplied expiry. Omit to clear the old expiry.
@@ -898,8 +898,8 @@ class ItemsResource(SyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.
@@ -1600,8 +1600,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -1647,8 +1647,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -1695,8 +1695,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           checkout: Required when preparing an unused AgentCard card for a supported checkout
@@ -1752,8 +1752,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.
@@ -1814,8 +1814,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -1862,8 +1862,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -1913,8 +1913,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.
@@ -1968,8 +1968,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           extra_headers: Send extra headers
@@ -2017,8 +2017,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           access_token_expires_at: Optional supplied expiry. Omit to clear the old expiry.
@@ -2072,8 +2072,8 @@ class AsyncItemsResource(AsyncAPIResource):
         return 400 (invalid request or targets), 403 (access or destination denied), 404
         (resource not found), or 409 (item or browser not ready). Once writing starts,
         known partial failures and indeterminate field outcomes return 200 with status
-        `failed` or `unknown`, not an automatic-retry signal. A transport error may
-        leave the outcome unknown; do not automatically retry.
+        `failed` or `unknown`. Fill never submits the page, so it is safe to retry after
+        a failure, an `unknown` outcome, or a transport error.
 
         Args:
           browser_id: Browser session ID, not a reusable browser name.

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/resources/vaults/vaults.py

@@ -26,6 +26,7 @@ from ..._response import (
 from ...pagination import SyncOffsetPagination, AsyncOffsetPagination
 from ...types.vault import Vault
 from ..._base_client import AsyncPaginator, make_request_options
+from ...types.vault_encryption_key import VaultEncryptionKey
 
 __all__ = ["VaultsResource", "AsyncVaultsResource"]
 
@@ -173,6 +174,46 @@ class VaultsResource(SyncAPIResource):
             cast_to=NoneType,
         )
 
+    def retrieve_encryption_key(
+        self,
+        id_or_name: str,
+        *,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultEncryptionKey:
+        """
+        Returns the public key that custom credential collection web apps use to encrypt
+        values in the browser. Use this only if you run your own credential collection
+        web app and want values encrypted in the browser, sent to your backend still
+        encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+        including server-side code that already holds the plaintext, use value. The page
+        encrypts each value to this key, your backend forwards the ciphertext unchanged
+        as encrypted_value when creating or updating a credential item in this vault,
+        and Kernel decrypts it.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
+        return self._get(
+            path_template("/vaults/{id_or_name}/encryption_key", id_or_name=id_or_name),
+            options=make_request_options(
+                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+            ),
+            cast_to=VaultEncryptionKey,
+        )
+
     def upsert(
         self,
         *,
@@ -353,6 +394,46 @@ class AsyncVaultsResource(AsyncAPIResource):
             cast_to=NoneType,
         )
 
+    async def retrieve_encryption_key(
+        self,
+        id_or_name: str,
+        *,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+    ) -> VaultEncryptionKey:
+        """
+        Returns the public key that custom credential collection web apps use to encrypt
+        values in the browser. Use this only if you run your own credential collection
+        web app and want values encrypted in the browser, sent to your backend still
+        encrypted, and forwarded to Kernel's API still encrypted. In every other case,
+        including server-side code that already holds the plaintext, use value. The page
+        encrypts each value to this key, your backend forwards the ciphertext unchanged
+        as encrypted_value when creating or updating a credential item in this vault,
+        and Kernel decrypts it.
+
+        Args:
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+        """
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
+        return await self._get(
+            path_template("/vaults/{id_or_name}/encryption_key", id_or_name=id_or_name),
+            options=make_request_options(
+                extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
+            ),
+            cast_to=VaultEncryptionKey,
+        )
+
     async def upsert(
         self,
         *,
@@ -403,6 +484,9 @@ class VaultsResourceWithRawResponse:
         self.delete = to_raw_response_wrapper(
             vaults.delete,
         )
+        self.retrieve_encryption_key = to_raw_response_wrapper(
+            vaults.retrieve_encryption_key,
+        )
         self.upsert = to_raw_response_wrapper(
             vaults.upsert,
         )
@@ -425,6 +509,9 @@ class AsyncVaultsResourceWithRawResponse:
         self.delete = async_to_raw_response_wrapper(
             vaults.delete,
         )
+        self.retrieve_encryption_key = async_to_raw_response_wrapper(
+            vaults.retrieve_encryption_key,
+        )
         self.upsert = async_to_raw_response_wrapper(
             vaults.upsert,
         )
@@ -447,6 +534,9 @@ class VaultsResourceWithStreamingResponse:
         self.delete = to_streamed_response_wrapper(
             vaults.delete,
         )
+        self.retrieve_encryption_key = to_streamed_response_wrapper(
+            vaults.retrieve_encryption_key,
+        )
         self.upsert = to_streamed_response_wrapper(
             vaults.upsert,
         )
@@ -469,6 +559,9 @@ class AsyncVaultsResourceWithStreamingResponse:
         self.delete = async_to_streamed_response_wrapper(
             vaults.delete,
         )
+        self.retrieve_encryption_key = async_to_streamed_response_wrapper(
+            vaults.retrieve_encryption_key,
+        )
         self.upsert = async_to_streamed_response_wrapper(
             vaults.upsert,
         )

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/types/__init__.py

@@ -67,6 +67,7 @@ from .browser_proxy_config import BrowserProxyConfig as BrowserProxyConfig
 from .browser_repl_content import BrowserReplContent as BrowserReplContent
 from .proxy_check_response import ProxyCheckResponse as ProxyCheckResponse
 from .search_create_params import SearchCreateParams as SearchCreateParams
+from .vault_encryption_key import VaultEncryptionKey as VaultEncryptionKey
 from .api_key_create_params import APIKeyCreateParams as APIKeyCreateParams
 from .api_key_rotate_params import APIKeyRotateParams as APIKeyRotateParams
 from .api_key_update_params import APIKeyUpdateParams as APIKeyUpdateParams

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/types/browser_network_config.py

@@ -51,8 +51,9 @@ class BrowserNetworkConfig(BaseModel):
     Enforced at Kernel's egress proxy only: destinations in private_hosts, and
     processes in the browser VM that do not use the browser's proxy, are not
     filtered, and Kernel's own control traffic is always allowed. Can be replaced or
-    removed while the session runs with PATCH /browsers/{id_or_name}. Requires proxy
-    v3. Not supported on browser pools.
+    removed while the session runs with PATCH /browsers/{id_or_name}, but not added
+    to a browser created without one. Requires proxy v3. Not supported on browser
+    pools.
     """
 
     private_hosts: Optional[List[str]] = None
@@ -84,9 +85,9 @@ class BrowserNetworkConfig(BaseModel):
     proxy_routes: Optional[List[ProxyRoute]] = None
     """Per-destination proxy routes for a browser session.
 
-    After setup, a destination hostname is matched against every route's hosts,
-    regardless of port; route order does not matter. An exact hostname beats a
-    wildcard, and a longer wildcard suffix beats a shorter one (for a.b.example.com:
+    A destination hostname is matched against every route's hosts, regardless of
+    port; route order does not matter. An exact hostname beats a wildcard, and a
+    longer wildcard suffix beats a shorter one (for a.b.example.com:
     "a.b.example.com" > "_.b.example.com" > "_.example.com"). A host pattern may
     appear in only one route. "\\**.example.com" matches subdomains only, not
     example.com. A matched request selects the route's proxy instead of the
@@ -94,8 +95,8 @@ class BrowserNetworkConfig(BaseModel):
     bypass_hosts still apply. If the route proxy becomes unavailable, matched
     requests fail closed without falling back. Requests that match no route use the
     session's default egress from the top-level proxy field (or the browser default
-    when proxy is omitted: stealth proxy or direct egress). Routes take effect once
-    the session is created; start_url and other traffic during browser setup use the
-    top-level proxy. Setting routes requires proxy v3. Not supported on browser
-    pools.
+    when proxy is omitted: stealth proxy or direct egress). Routes apply from the
+    start of the session, including to start_url and other traffic during browser
+    setup. Setting routes requires proxy v3. Browser pools also support these
+    routes.
     """

{kernel-0.121.0 → kernel-0.122.0}/src/kernel/types/browser_network_config_param.py

@@ -54,8 +54,9 @@ class BrowserNetworkConfigParam(TypedDict, total=False):
     Enforced at Kernel's egress proxy only: destinations in private_hosts, and
     processes in the browser VM that do not use the browser's proxy, are not
     filtered, and Kernel's own control traffic is always allowed. Can be replaced or
-    removed while the session runs with PATCH /browsers/{id_or_name}. Requires proxy
-    v3. Not supported on browser pools.
+    removed while the session runs with PATCH /browsers/{id_or_name}, but not added
+    to a browser created without one. Requires proxy v3. Not supported on browser
+    pools.
     """
 
     private_hosts: SequenceNotStr[str]
@@ -87,9 +88,9 @@ class BrowserNetworkConfigParam(TypedDict, total=False):
     proxy_routes: Iterable[ProxyRoute]
     """Per-destination proxy routes for a browser session.
 
-    After setup, a destination hostname is matched against every route's hosts,
-    regardless of port; route order does not matter. An exact hostname beats a
-    wildcard, and a longer wildcard suffix beats a shorter one (for a.b.example.com:
+    A destination hostname is matched against every route's hosts, regardless of
+    port; route order does not matter. An exact hostname beats a wildcard, and a
+    longer wildcard suffix beats a shorter one (for a.b.example.com:
     "a.b.example.com" > "_.b.example.com" > "_.example.com"). A host pattern may
     appear in only one route. "\\**.example.com" matches subdomains only, not
     example.com. A matched request selects the route's proxy instead of the
@@ -97,8 +98,8 @@ class BrowserNetworkConfigParam(TypedDict, total=False):
     bypass_hosts still apply. If the route proxy becomes unavailable, matched
     requests fail closed without falling back. Requests that match no route use the
     session's default egress from the top-level proxy field (or the browser default
-    when proxy is omitted: stealth proxy or direct egress). Routes take effect once
-    the session is created; start_url and other traffic during browser setup use the
-    top-level proxy. Setting routes requires proxy v3. Not supported on browser
-    pools.
+    when proxy is omitted: stealth proxy or direct egress). Routes apply from the
+    start of the session, including to start_url and other traffic during browser
+    setup. Setting routes requires proxy v3. Browser pools also support these
+    routes.
     """