kernel 0.127.0__tar.gz → 0.129.0__tar.gz

kernel-0.129.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.129.0"
+}

{kernel-0.127.0 → kernel-0.129.0}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## [0.129.0](https://github.com/kernel/kernel-python-sdk/compare/v0.128.0...v0.129.0) (2026-10-21)
+
+
+### Features
+
+* chore(stlc): seal custom-code tracking files ([3153f7e](https://github.com/kernel/kernel-python-sdk/commit/3153f7ef7838579cd464780b97b28a16d1586b72))
+
+## [0.128.0](https://github.com/kernel/kernel-python-sdk/compare/v0.127.0...v0.128.0) (2026-10-19)
+
+
+### Features
+
+* Add browser location session policy ([48fd526](https://github.com/kernel/kernel-python-sdk/commit/48fd52646ea0dafcecd637d2cae6c71a19318f7a))
+* chore(stlc): seal custom-code tracking files ([457e6c1](https://github.com/kernel/kernel-python-sdk/commit/457e6c14bd10df055044c2b48704b64d90ca8aff))
+* Fence browser allowlist updates with revision checks ([a9ab0d3](https://github.com/kernel/kernel-python-sdk/commit/a9ab0d3955c3535458f99f117fae744e34c66930))
+* Support existing-user AgentCard wallet imports ([c1a6765](https://github.com/kernel/kernel-python-sdk/commit/c1a6765c789f5ed7585a55780f83435cc8c5d4ee))
+
 ## [0.127.0](https://github.com/kernel/kernel-python-sdk/compare/v0.126.0...v0.127.0) (2026-10-16)
 
 

{kernel-0.127.0 → kernel-0.129.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: kernel
-Version: 0.127.0
+Version: 0.129.0
 Summary: The official Python library for the kernel API
 Project-URL: Homepage, https://github.com/kernel/kernel-python-sdk
 Project-URL: Repository, https://github.com/kernel/kernel-python-sdk
@@ -239,9 +239,9 @@ from kernel import Kernel
 client = Kernel()
 
 browser = client.browsers.create(
-    network={},
+    location={},
 )
-print(browser.network)
+print(browser.location)
 ```
 
 ## File uploads

{kernel-0.127.0 → kernel-0.129.0}/README.md

@@ -203,9 +203,9 @@ from kernel import Kernel
 client = Kernel()
 
 browser = client.browsers.create(
-    network={},
+    location={},
 )
-print(browser.network)
+print(browser.location)
 ```
 
 ## File uploads

{kernel-0.127.0 → kernel-0.129.0}/api.md

@@ -117,6 +117,11 @@ Types:
 
 ```python
 from kernel.types import (
+    BrowserAllowlistState,
+    BrowserLocation,
+    BrowserLocationRequest,
+    BrowserLocationSource,
+    BrowserLocationUpdateRequest,
     BrowserMemory,
     BrowserMemoryRequest,
     BrowserNetworkConfig,
@@ -484,11 +489,11 @@ from kernel.types import (
 Methods:
 
 - <code title="post /proxies">client.proxies.<a href="./src/kernel/resources/proxies.py">create</a>(\*\*<a href="src/kernel/types/proxy_create_params.py">params</a>) -> <a href="./src/kernel/types/proxy_create_response.py">ProxyCreateResponse</a></code>
-- <code title="get /proxies/{id}">client.proxies.<a href="./src/kernel/resources/proxies.py">retrieve</a>(id) -> <a href="./src/kernel/types/proxy_retrieve_response.py">ProxyRetrieveResponse</a></code>
-- <code title="patch /proxies/{id}">client.proxies.<a href="./src/kernel/resources/proxies.py">update</a>(id, \*\*<a href="src/kernel/types/proxy_update_params.py">params</a>) -> <a href="./src/kernel/types/proxy_update_response.py">ProxyUpdateResponse</a></code>
+- <code title="get /proxies/{id_or_name}">client.proxies.<a href="./src/kernel/resources/proxies.py">retrieve</a>(id_or_name) -> <a href="./src/kernel/types/proxy_retrieve_response.py">ProxyRetrieveResponse</a></code>
+- <code title="patch /proxies/{id_or_name}">client.proxies.<a href="./src/kernel/resources/proxies.py">update</a>(id_or_name, \*\*<a href="src/kernel/types/proxy_update_params.py">params</a>) -> <a href="./src/kernel/types/proxy_update_response.py">ProxyUpdateResponse</a></code>
 - <code title="get /proxies">client.proxies.<a href="./src/kernel/resources/proxies.py">list</a>(\*\*<a href="src/kernel/types/proxy_list_params.py">params</a>) -> <a href="./src/kernel/types/proxy_list_response.py">SyncOffsetPagination[ProxyListResponse]</a></code>
-- <code title="delete /proxies/{id}">client.proxies.<a href="./src/kernel/resources/proxies.py">delete</a>(id) -> None</code>
-- <code title="post /proxies/{id}/check">client.proxies.<a href="./src/kernel/resources/proxies.py">check</a>(id, \*\*<a href="src/kernel/types/proxy_check_params.py">params</a>) -> <a href="./src/kernel/types/proxy_check_response.py">ProxyCheckResponse</a></code>
+- <code title="delete /proxies/{id_or_name}">client.proxies.<a href="./src/kernel/resources/proxies.py">delete</a>(id_or_name) -> None</code>
+- <code title="post /proxies/{id_or_name}/check">client.proxies.<a href="./src/kernel/resources/proxies.py">check</a>(id_or_name, \*\*<a href="src/kernel/types/proxy_check_params.py">params</a>) -> <a href="./src/kernel/types/proxy_check_response.py">ProxyCheckResponse</a></code>
 
 # Extensions
 

{kernel-0.127.0 → kernel-0.129.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.127.0"
+version = "0.129.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.127.0"  # x-release-please-version
+__version__ = "0.129.0"  # x-release-please-version

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/resources/browsers/browsers.py

@@ -116,8 +116,10 @@ from ...types.browser_proxy_config_param import BrowserProxyConfigParam
 from ...types.browser_network_config_param import BrowserNetworkConfigParam
 from ...types.browser_network_update_param import BrowserNetworkUpdateParam
 from ...types.shared_params.browser_profile import BrowserProfile
+from ...types.browser_location_request_param import BrowserLocationRequestParam
 from ...types.shared_params.browser_viewport import BrowserViewport
 from ...types.shared_params.browser_extension import BrowserExtension
+from ...types.browser_location_update_request_param import BrowserLocationUpdateRequestParam
 
 __all__ = ["BrowsersResource", "AsyncBrowsersResource"]
 
@@ -195,6 +197,7 @@ class BrowsersResource(SyncAPIResource):
         headless: bool | Omit = omit,
         invocation_id: str | Omit = omit,
         kiosk_mode: bool | Omit = omit,
+        location: BrowserLocationRequestParam | Omit = omit,
         memory: BrowserMemoryRequest | Omit = omit,
         name: str | Omit = omit,
         network: BrowserNetworkConfigParam | Omit = omit,
@@ -239,6 +242,9 @@ class BrowsersResource(SyncAPIResource):
           kiosk_mode: If true, launches the browser in kiosk mode to hide address bar and tabs in live
               view.
 
+          location: Optional session-only timezone and locale overrides. Each omitted field uses the
+              default for the browser's region. start_url opens once the location applies.
+
           memory:
               Memory for a non-GPU browser. Headless: 1GiB (default), 2GiB, or 4GiB. Headful:
               8GiB (default) or 16GiB.
@@ -333,6 +339,7 @@ class BrowsersResource(SyncAPIResource):
                     "headless": headless,
                     "invocation_id": invocation_id,
                     "kiosk_mode": kiosk_mode,
+                    "location": location,
                     "memory": memory,
                     "name": name,
                     "network": network,
@@ -404,6 +411,7 @@ class BrowsersResource(SyncAPIResource):
         id_or_name: str,
         *,
         disable_default_proxy: bool | Omit = omit,
+        location: BrowserLocationUpdateRequestParam | Omit = omit,
         name: Optional[str] | Omit = omit,
         network: BrowserNetworkUpdateParam | Omit = omit,
         profile: BrowserProfile | Omit = omit,
@@ -427,6 +435,14 @@ class BrowsersResource(SyncAPIResource):
           disable_default_proxy: If true, stealth browsers connect directly instead of using the default stealth
               proxy. Deprecated in favor of proxy.mode.
 
+          location: Session-only timezone and locale overrides. Omit the object or a field to leave
+              it unchanged; set a string to override; set null to clear that field and use the
+              browser region's default. A browser that cannot change location refuses the
+              request before anything changes. The location applies after the request's other
+              changes, and start_url opens once it has applied. If applying it fails, the
+              other changes and the saved override remain and start_url does not open; retry
+              the request to apply both.
+
           name: Human-readable name for the browser session. Omit to leave unchanged, set to an
               empty string to clear the name. When set, must be unique among active sessions
               within the project.
@@ -478,6 +494,7 @@ class BrowsersResource(SyncAPIResource):
             body=maybe_transform(
                 {
                     "disable_default_proxy": disable_default_proxy,
+                    "location": location,
                     "name": name,
                     "network": network,
                     "profile": profile,
@@ -912,6 +929,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         headless: bool | Omit = omit,
         invocation_id: str | Omit = omit,
         kiosk_mode: bool | Omit = omit,
+        location: BrowserLocationRequestParam | Omit = omit,
         memory: BrowserMemoryRequest | Omit = omit,
         name: str | Omit = omit,
         network: BrowserNetworkConfigParam | Omit = omit,
@@ -956,6 +974,9 @@ class AsyncBrowsersResource(AsyncAPIResource):
           kiosk_mode: If true, launches the browser in kiosk mode to hide address bar and tabs in live
               view.
 
+          location: Optional session-only timezone and locale overrides. Each omitted field uses the
+              default for the browser's region. start_url opens once the location applies.
+
           memory:
               Memory for a non-GPU browser. Headless: 1GiB (default), 2GiB, or 4GiB. Headful:
               8GiB (default) or 16GiB.
@@ -1050,6 +1071,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
                     "headless": headless,
                     "invocation_id": invocation_id,
                     "kiosk_mode": kiosk_mode,
+                    "location": location,
                     "memory": memory,
                     "name": name,
                     "network": network,
@@ -1121,6 +1143,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
         id_or_name: str,
         *,
         disable_default_proxy: bool | Omit = omit,
+        location: BrowserLocationUpdateRequestParam | Omit = omit,
         name: Optional[str] | Omit = omit,
         network: BrowserNetworkUpdateParam | Omit = omit,
         profile: BrowserProfile | Omit = omit,
@@ -1144,6 +1167,14 @@ class AsyncBrowsersResource(AsyncAPIResource):
           disable_default_proxy: If true, stealth browsers connect directly instead of using the default stealth
               proxy. Deprecated in favor of proxy.mode.
 
+          location: Session-only timezone and locale overrides. Omit the object or a field to leave
+              it unchanged; set a string to override; set null to clear that field and use the
+              browser region's default. A browser that cannot change location refuses the
+              request before anything changes. The location applies after the request's other
+              changes, and start_url opens once it has applied. If applying it fails, the
+              other changes and the saved override remain and start_url does not open; retry
+              the request to apply both.
+
           name: Human-readable name for the browser session. Omit to leave unchanged, set to an
               empty string to clear the name. When set, must be unique among active sessions
               within the project.
@@ -1195,6 +1226,7 @@ class AsyncBrowsersResource(AsyncAPIResource):
             body=await async_maybe_transform(
                 {
                     "disable_default_proxy": disable_default_proxy,
+                    "location": location,
                     "name": name,
                     "network": network,
                     "profile": profile,

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/resources/proxies.py

@@ -105,7 +105,7 @@ class ProxiesResource(SyncAPIResource):
 
     def retrieve(
         self,
-        id: str,
+        id_or_name: str,
         *,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -115,7 +115,10 @@ class ProxiesResource(SyncAPIResource):
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> ProxyRetrieveResponse:
         """
-        Retrieve a proxy in the resolved project by ID.
+        Retrieve a proxy in the resolved project by ID or exact name using the database
+        collation. IDs take precedence when a value matches both an ID and a name. Proxy
+        names are not unique; an ambiguous name returns a 400 response with code
+        ambiguous_proxy_name.
 
         Args:
           extra_headers: Send extra headers
@@ -126,10 +129,10 @@ class ProxiesResource(SyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return self._get(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),
@@ -138,7 +141,7 @@ class ProxiesResource(SyncAPIResource):
 
     def update(
         self,
-        id: str,
+        id_or_name: str,
         *,
         name: str,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -150,10 +153,8 @@ class ProxiesResource(SyncAPIResource):
     ) -> ProxyUpdateResponse:
         """Update a proxy's name.
 
-        Proxy names are not unique and are not ID-or-name
-        addressable on this endpoint; duplicate names are allowed. Name-based
-        session-create lookups can remain ambiguous until callers resolve proxies by ID
-        or the API adds a stronger uniqueness contract.
+        Proxy names are not unique and duplicate names are
+        allowed.
 
         Args:
           name: New proxy name. Proxy names are trimmed and length-checked only; duplicates are
@@ -167,10 +168,10 @@ class ProxiesResource(SyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return self._patch(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             body=maybe_transform({"name": name}, proxy_update_params.ProxyUpdateParams),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
@@ -238,7 +239,7 @@ class ProxiesResource(SyncAPIResource):
 
     def delete(
         self,
-        id: str,
+        id_or_name: str,
         *,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -263,11 +264,11 @@ class ProxiesResource(SyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         extra_headers = {"Accept": "*/*", **(extra_headers or {})}
         return self._delete(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),
@@ -276,7 +277,7 @@ class ProxiesResource(SyncAPIResource):
 
     def check(
         self,
-        id: str,
+        id_or_name: str,
         *,
         url: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -317,10 +318,10 @@ class ProxiesResource(SyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return self._post(
-            path_template("/proxies/{id}/check", id=id),
+            path_template("/proxies/{id_or_name}/check", id_or_name=id_or_name),
             body=maybe_transform({"url": url}, proxy_check_params.ProxyCheckParams),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
@@ -406,7 +407,7 @@ class AsyncProxiesResource(AsyncAPIResource):
 
     async def retrieve(
         self,
-        id: str,
+        id_or_name: str,
         *,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -416,7 +417,10 @@ class AsyncProxiesResource(AsyncAPIResource):
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> ProxyRetrieveResponse:
         """
-        Retrieve a proxy in the resolved project by ID.
+        Retrieve a proxy in the resolved project by ID or exact name using the database
+        collation. IDs take precedence when a value matches both an ID and a name. Proxy
+        names are not unique; an ambiguous name returns a 400 response with code
+        ambiguous_proxy_name.
 
         Args:
           extra_headers: Send extra headers
@@ -427,10 +431,10 @@ class AsyncProxiesResource(AsyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return await self._get(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),
@@ -439,7 +443,7 @@ class AsyncProxiesResource(AsyncAPIResource):
 
     async def update(
         self,
-        id: str,
+        id_or_name: str,
         *,
         name: str,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -451,10 +455,8 @@ class AsyncProxiesResource(AsyncAPIResource):
     ) -> ProxyUpdateResponse:
         """Update a proxy's name.
 
-        Proxy names are not unique and are not ID-or-name
-        addressable on this endpoint; duplicate names are allowed. Name-based
-        session-create lookups can remain ambiguous until callers resolve proxies by ID
-        or the API adds a stronger uniqueness contract.
+        Proxy names are not unique and duplicate names are
+        allowed.
 
         Args:
           name: New proxy name. Proxy names are trimmed and length-checked only; duplicates are
@@ -468,10 +470,10 @@ class AsyncProxiesResource(AsyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return await self._patch(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             body=await async_maybe_transform({"name": name}, proxy_update_params.ProxyUpdateParams),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
@@ -539,7 +541,7 @@ class AsyncProxiesResource(AsyncAPIResource):
 
     async def delete(
         self,
-        id: str,
+        id_or_name: str,
         *,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
         # The extra values given here take precedence over values defined on the client or passed to this method.
@@ -564,11 +566,11 @@ class AsyncProxiesResource(AsyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         extra_headers = {"Accept": "*/*", **(extra_headers or {})}
         return await self._delete(
-            path_template("/proxies/{id}", id=id),
+            path_template("/proxies/{id_or_name}", id_or_name=id_or_name),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout
             ),
@@ -577,7 +579,7 @@ class AsyncProxiesResource(AsyncAPIResource):
 
     async def check(
         self,
-        id: str,
+        id_or_name: str,
         *,
         url: str | Omit = omit,
         # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
@@ -618,10 +620,10 @@ class AsyncProxiesResource(AsyncAPIResource):
 
           timeout: Override the client-level default timeout for this request, in seconds
         """
-        if not id:
-            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        if not id_or_name:
+            raise ValueError(f"Expected a non-empty value for `id_or_name` but received {id_or_name!r}")
         return await self._post(
-            path_template("/proxies/{id}/check", id=id),
+            path_template("/proxies/{id_or_name}/check", id_or_name=id_or_name),
             body=await async_maybe_transform({"url": url}, proxy_check_params.ProxyCheckParams),
             options=make_request_options(
                 extra_headers=extra_headers, extra_query=extra_query, extra_body=extra_body, timeout=timeout

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/resources/vaults/items.py

@@ -1236,8 +1236,16 @@ class ItemsResource(SyncAPIResource):
               select a customer-owned configuration. Mode (sandbox vs live) is determined by
               the selected credential; there is no per-item test flag. Without user_id,
               creation returns a hosted enrollment action and Kernel polls until the user
-              connects. user_id may only reference a user already enrolled by a wallet in this
-              organization under the same configuration.
+              connects. With a customer-owned provider_config, user_id imports an existing
+              connection after verifying access with the selected credentials in their sandbox
+              or live mode; no hosted enrollment is needed, even if the connected user has no
+              stored cards. With Kernel-managed credentials, user_id may only reference a user
+              already enrolled by a wallet in this organization under the same configuration.
+              The user and configuration bindings cannot be changed after creation. Import
+              validation is read-only and runs before creation: a failed validation leaves no
+              wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+              imports of the same key may both validate, but create at most one wallet and
+              connected event.
 
           extra_headers: Send extra headers
 
@@ -2609,8 +2617,16 @@ class AsyncItemsResource(AsyncAPIResource):
               select a customer-owned configuration. Mode (sandbox vs live) is determined by
               the selected credential; there is no per-item test flag. Without user_id,
               creation returns a hosted enrollment action and Kernel polls until the user
-              connects. user_id may only reference a user already enrolled by a wallet in this
-              organization under the same configuration.
+              connects. With a customer-owned provider_config, user_id imports an existing
+              connection after verifying access with the selected credentials in their sandbox
+              or live mode; no hosted enrollment is needed, even if the connected user has no
+              stored cards. With Kernel-managed credentials, user_id may only reference a user
+              already enrolled by a wallet in this organization under the same configuration.
+              The user and configuration bindings cannot be changed after creation. Import
+              validation is read-only and runs before creation: a failed validation leaves no
+              wallet or reserved key, so the user_id can be corrected and retried. Concurrent
+              imports of the same key may both validate, but create at most one wallet and
+              connected event.
 
           extra_headers: Send extra headers
 

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/types/__init__.py

@@ -44,6 +44,7 @@ from .created_api_key import CreatedAPIKey as CreatedAPIKey
 from .lookup_response import LookupResponse as LookupResponse
 from .vault_reference import VaultReference as VaultReference
 from .analysis_summary import AnalysisSummary as AnalysisSummary
+from .browser_location import BrowserLocation as BrowserLocation
 from .browser_pool_ref import BrowserPoolRef as BrowserPoolRef
 from .app_list_response import AppListResponse as AppListResponse
 from .no_recommendation import NoRecommendation as NoRecommendation
@@ -98,7 +99,9 @@ from .invocation_list_params import InvocationListParams as InvocationListParams
 from .invocation_state_event import InvocationStateEvent as InvocationStateEvent
 from .recommendation_summary import RecommendationSummary as RecommendationSummary
 from .api_key_retrieve_params import APIKeyRetrieveParams as APIKeyRetrieveParams
+from .browser_allowlist_state import BrowserAllowlistState as BrowserAllowlistState
 from .browser_create_response import BrowserCreateResponse as BrowserCreateResponse
+from .browser_location_source import BrowserLocationSource as BrowserLocationSource
 from .browser_retrieve_params import BrowserRetrieveParams as BrowserRetrieveParams
 from .browser_update_response import BrowserUpdateResponse as BrowserUpdateResponse
 from .extension_list_response import ExtensionListResponse as ExtensionListResponse
@@ -138,10 +141,12 @@ from .browser_network_update_param import BrowserNetworkUpdateParam as BrowserNe
 from .deployment_retrieve_response import DeploymentRetrieveResponse as DeploymentRetrieveResponse
 from .invocation_retrieve_response import InvocationRetrieveResponse as InvocationRetrieveResponse
 from .audit_log_export_chunk_params import AuditLogExportChunkParams as AuditLogExportChunkParams
+from .browser_allowlist_state_param import BrowserAllowlistStateParam as BrowserAllowlistStateParam
 from .browser_pool_acquire_response import BrowserPoolAcquireResponse as BrowserPoolAcquireResponse
 from .config_registry_lookup_params import ConfigRegistryLookupParams as ConfigRegistryLookupParams
 from .credential_totp_code_response import CredentialTotpCodeResponse as CredentialTotpCodeResponse
 from .browser_load_extensions_params import BrowserLoadExtensionsParams as BrowserLoadExtensionsParams
+from .browser_location_request_param import BrowserLocationRequestParam as BrowserLocationRequestParam
 from .config_registry_resolve_params import ConfigRegistryResolveParams as ConfigRegistryResolveParams
 from .credential_provider_list_params import CredentialProviderListParams as CredentialProviderListParams
 from .credential_provider_test_result import CredentialProviderTestResult as CredentialProviderTestResult
@@ -151,6 +156,9 @@ from .invocation_list_browsers_response import InvocationListBrowsersResponse as
 from .vault_provider_config_list_params import VaultProviderConfigListParams as VaultProviderConfigListParams
 from .vault_provider_config_create_params import VaultProviderConfigCreateParams as VaultProviderConfigCreateParams
 from .vault_provider_config_update_params import VaultProviderConfigUpdateParams as VaultProviderConfigUpdateParams
+from .browser_location_update_request_param import (
+    BrowserLocationUpdateRequestParam as BrowserLocationUpdateRequestParam,
+)
 from .credential_provider_list_items_response import (
     CredentialProviderListItemsResponse as CredentialProviderListItemsResponse,
 )

kernel-0.129.0/src/kernel/types/browser_allowlist_state.py

@@ -0,0 +1,21 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+
+from .._models import BaseModel
+
+__all__ = ["BrowserAllowlistState"]
+
+
+class BrowserAllowlistState(BaseModel):
+    revision: str
+    """Opaque revision to pass as network.expected_allowlist_revision on an update."""
+
+    base_revision: Optional[str] = None
+    """
+    Revision against which that mutation was accepted; reuse it when retrying the
+    mutation.
+    """
+
+    mutation_id: Optional[str] = None
+    """ID of the last conditional allowlist update saved on this browser."""

kernel-0.129.0/src/kernel/types/browser_allowlist_state_param.py

@@ -0,0 +1,21 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+__all__ = ["BrowserAllowlistStateParam"]
+
+
+class BrowserAllowlistStateParam(TypedDict, total=False):
+    revision: Required[str]
+    """Opaque revision to pass as network.expected_allowlist_revision on an update."""
+
+    base_revision: str
+    """
+    Revision against which that mutation was accepted; reuse it when retrying the
+    mutation.
+    """
+
+    mutation_id: str
+    """ID of the last conditional allowlist update saved on this browser."""

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/types/browser_create_params.py

@@ -12,6 +12,7 @@ from .browser_memory_request import BrowserMemoryRequest
 from .browser_proxy_config_param import BrowserProxyConfigParam
 from .browser_network_config_param import BrowserNetworkConfigParam
 from .shared_params.browser_profile import BrowserProfile
+from .browser_location_request_param import BrowserLocationRequestParam
 from .shared_params.browser_viewport import BrowserViewport
 from .shared_params.browser_extension import BrowserExtension
 from .browsers.browser_telemetry_categories_config_param import BrowserTelemetryCategoriesConfigParam
@@ -62,6 +63,13 @@ class BrowserCreateParams(TypedDict, total=False):
     view.
     """
 
+    location: BrowserLocationRequestParam
+    """Optional session-only timezone and locale overrides.
+
+    Each omitted field uses the default for the browser's region. start_url opens
+    once the location applies.
+    """
+
     memory: BrowserMemoryRequest
     """Memory for a non-GPU browser.
 

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/types/browser_create_response.py

@@ -11,6 +11,7 @@ from .browser_proxy import BrowserProxy
 from .browser_usage import BrowserUsage
 from .browser_memory import BrowserMemory
 from .vault_reference import VaultReference
+from .browser_location import BrowserLocation
 from .browser_pool_ref import BrowserPoolRef
 from .browser_video_memory import BrowserVideoMemory
 from .browser_network_config import BrowserNetworkConfig
@@ -76,6 +77,9 @@ class BrowserCreateResponse(BaseModel):
     kiosk_mode: Optional[bool] = None
     """Whether the browser session is running in kiosk mode."""
 
+    location: Optional[BrowserLocation] = None
+    """Effective browser timezone and locale with per-field provenance."""
+
     name: Optional[str] = None
     """Human-readable name of the browser session, if one was set at creation."""
 

{kernel-0.127.0 → kernel-0.129.0}/src/kernel/types/browser_list_response.py

@@ -11,6 +11,7 @@ from .browser_proxy import BrowserProxy
 from .browser_usage import BrowserUsage
 from .browser_memory import BrowserMemory
 from .vault_reference import VaultReference
+from .browser_location import BrowserLocation
 from .browser_pool_ref import BrowserPoolRef
 from .browser_video_memory import BrowserVideoMemory
 from .browser_network_config import BrowserNetworkConfig
@@ -76,6 +77,9 @@ class BrowserListResponse(BaseModel):
     kiosk_mode: Optional[bool] = None
     """Whether the browser session is running in kiosk mode."""
 
+    location: Optional[BrowserLocation] = None
+    """Effective browser timezone and locale with per-field provenance."""
+
     name: Optional[str] = None
     """Human-readable name of the browser session, if one was set at creation."""