release: 0.140.0

.github/prompts/update-mcp-coverage.md

@@ -8,7 +8,9 @@ Do not downgrade or change that version.
 ## Audit and implement
 
 1. Read `$RUNNER_TEMP/sdk-diff.patch`, `../sdk/api.md`, and the parameter types in
-   `../sdk/src/resources`. Enumerate SDK methods and their parameters, including
+   `../sdk/src/resources`. The diff covers every release since the SDK version on
+   origin/main, so earlier runs may already have covered part of it on this branch.
+   Enumerate SDK methods and their parameters, including
    nested options, new enum values, pagination, streaming, and changed signatures.
 2. Read `src/lib/mcp/register.ts`, `src/lib/mcp/tools/`, and shared MCP schemas.
    Map SDK methods/parameters to registered MCP tools, actions, and input fields.
@@ -31,10 +33,15 @@ Do not downgrade or change that version.
 
 The Kernel API spec as of this SDK release is at
 `$RUNNER_TEMP/kernel-api/packages/api/openapi.yaml`, and `$RUNNER_TEMP/openapi-diff.patch`
-shows spec changes between the previous SDK release and this one. The SDK is generated
+shows spec changes between origin/main's SDK release and this one. The SDK is generated
 from this spec, so its endpoint, parameter, and schema descriptions are the source of
 truth for what the API does.
 
+The spec is taken from the API's main branch at release time and can be ahead of the
+released SDK. The SDK defines what exists: never add tools, actions, or inputs for
+operations or fields `../sdk` does not have. Use the spec only for the meaning of
+things the SDK has.
+
 1. For every changed `summary` or `description` in the spec diff that belongs to an
    endpoint, parameter, or field the MCP server exposes, update the matching tool
    description, action description, or input `.describe()` text. Use the spec text
@@ -68,7 +75,9 @@ unrelated code, workflows, generated App bundles, or authentication configuratio
 Read the complete diff against origin/main before finishing. Remove unnecessary
 comments, type casts, defensive wrappers, and unrelated changes.
 
-Write `$RUNNER_TEMP/mcp-coverage-report.md` with concise sections describing:
+Write `$RUNNER_TEMP/mcp-coverage-report.md`. It replaces the PR description, so it
+must describe every change in the diff against origin/main, including changes earlier
+runs left on this branch, not only this run's. Use concise sections describing:
 
 - Added or updated MCP tools, actions, and fields, with their SDK counterparts.
 - Descriptions updated to match spec changes, with the spec operation or field each

.github/workflows/update-mcp-coverage.yml

@@ -147,11 +147,15 @@ jobs:
             exit 0
           fi
 
+          # The report replaces the PR description, so audit every release since
+          # main's SDK version, not only the ones since the last run.
+          old_version=$(git show origin/main:package.json | jq -er '.dependencies["@onkernel/sdk"]')
           if git -C ../sdk rev-parse --verify "refs/tags/v$old_version" >/dev/null 2>&1; then
-            git -C ../sdk diff "refs/tags/v$old_version" "$SDK_SHA" -- api.md src/resources > "$RUNNER_TEMP/sdk-diff.patch"
+            git -C ../sdk diff "refs/tags/v$old_version" "$SDK_SHA" \
+              -- api.md src/client.ts src/lib src/resources > "$RUNNER_TEMP/sdk-diff.patch"
             echo "old_date=$(TZ=UTC git -C ../sdk log -1 --date=format-local:%Y-%m-%dT%H:%M:%SZ --format=%cd "refs/tags/v$old_version")" >> "$GITHUB_OUTPUT"
           else
-            printf 'Baseline %s unavailable; audit all of api.md and src/resources.\n' "$old_version" > "$RUNNER_TEMP/sdk-diff.patch"
+            printf 'Baseline %s unavailable; audit all of api.md, src/client.ts, src/lib, and src/resources.\n' "$old_version" > "$RUNNER_TEMP/sdk-diff.patch"
           fi
           echo "new_date=$(TZ=UTC git -C ../sdk log -1 --date=format-local:%Y-%m-%dT%H:%M:%SZ --format=%cd "$SDK_SHA")" >> "$GITHUB_OUTPUT"
           echo "update=true" >> "$GITHUB_OUTPUT"

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.139.0"
+  ".": "0.140.0"
 }

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.140.0](https://github.com/kernel/kernel-node-sdk/compare/v0.139.0...v0.140.0) (2026-11-04)
+
+
+### Features
+
+* Add single-use Kernel cards to vaults ([05a01e6](https://github.com/kernel/kernel-node-sdk/commit/05a01e6dd33052d7fd8efa188111ad0b3ee9c5a8))
+* Drop Kernel's origin gate from 1Password fill ([7d574cd](https://github.com/kernel/kernel-node-sdk/commit/7d574cd28c308cb6e13d16f3a86a88930feb6bf7))
+* Let customers keep refreshing imported Link wallet grants ([49af4e9](https://github.com/kernel/kernel-node-sdk/commit/49af4e96ee6b3b0b86cfcf43ee3fafa47ffac590))
+* Pass through tool_page_unloaded and disable SDK retries for WebMCP invoke failures ([15c227b](https://github.com/kernel/kernel-node-sdk/commit/15c227b28055c40c82087e23cddba3bdcad836f0))
+
 ## [0.139.0](https://github.com/kernel/kernel-node-sdk/compare/v0.138.0...v0.139.0) (2026-10-30)
 
 

api.md

@@ -551,6 +551,7 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">KernelCredentialVaultItemSpecInput</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelCredentialVaultItemState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelPaymentRequestVaultItemSpec</a></code>
+- <code><a href="./src/resources/vaults/items.ts">KernelSingleUseCard</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelWalletState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">KernelWalletVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">LinkShippingAddress</a></code>
@@ -582,6 +583,7 @@ Types:
 - <code><a href="./src/resources/vaults/items.ts">ShopPayCardVaultItemSpec</a></code>
 - <code><a href="./src/resources/vaults/items.ts">ShopPayWalletState</a></code>
 - <code><a href="./src/resources/vaults/items.ts">ShopPayWalletVaultItemSpec</a></code>
+- <code><a href="./src/resources/vaults/items.ts">SingleUseCardBillingAddress</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardAliases</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCardFillField</a></code>
 - <code><a href="./src/resources/vaults/items.ts">VaultCheckoutContext</a></code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.139.0",
+  "version": "0.140.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/browsers/webmcp/webmcp.ts

@@ -28,9 +28,13 @@ export class Webmcp extends APIResource {
    * across navigation. Inspect a populated form, obtain any required confirmation,
    * then submit through Playwright or computer interaction without invoking the tool
    * again. If the tab or embedded frame disappears, or the request times out after
-   * invocation begins, the response reports outcome_unknown and the tool is not
-   * retried. CDP-backed custom tool outputs above 240 KiB return an error rather
-   * than a truncated result.
+   * invocation begins, the response reports outcome_unknown. If the tool's page is
+   * reloaded or replaced by a navigation the tool did not start, and the tool never
+   * responds, the response reports tool_page_unloaded once the replacement page
+   * loads, or right away if the tool's tab crashes. Neither failure is retried, and
+   * both set X-Should-Retry to false because the tool may have had side effects.
+   * CDP-backed custom tool outputs above 240 KiB return an error rather than a
+   * truncated result.
    *
    * @example
    * ```ts
@@ -84,7 +88,7 @@ export interface CustomToolSource {
 }
 
 export interface InvocationFailure {
-  code: 'outcome_unknown';
+  code: 'outcome_unknown' | 'tool_page_unloaded';
 
   message: string;
 
@@ -113,7 +117,7 @@ export interface InvocationResult {
 
 export interface InvokeRequest {
   /**
-   * Tool input, limited to 1 MiB after JSON serialization.
+   * Tool input, limited to 4 MiB after JSON serialization.
    */
   input: { [key: string]: unknown };
 
@@ -249,7 +253,7 @@ export interface ToolsResponse {
 
 export interface WebmcpInvokeToolParams {
   /**
-   * Tool input, limited to 1 MiB after JSON serialization.
+   * Tool input, limited to 4 MiB after JSON serialization.
    */
   input: { [key: string]: unknown };
 

src/resources/vaults/index.ts

@@ -38,6 +38,7 @@ export {
   type KernelCredentialVaultItemSpecInput,
   type KernelCredentialVaultItemState,
   type KernelPaymentRequestVaultItemSpec,
+  type KernelSingleUseCard,
   type KernelWalletState,
   type KernelWalletVaultItemSpec,
   type LinkShippingAddress,
@@ -69,6 +70,7 @@ export {
   type ShopPayCardVaultItemSpec,
   type ShopPayWalletState,
   type ShopPayWalletVaultItemSpec,
+  type SingleUseCardBillingAddress,
   type VaultCardAliases,
   type VaultCardFillField,
   type VaultCheckoutContext,