From 80829c75c62f1c0002e349a3501e3ca866b299f6 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 18:12:58 +0000 Subject: [PATCH 1/6] feat: Remove SerpApi and Valyu search providers Stainless-Generated-From: a2c2ed662cef84914a09c258ac595e5217a50a02 --- src/resources/search/providers.ts | 12 +-- src/resources/search/search.ts | 157 +----------------------------- 2 files changed, 2 insertions(+), 167 deletions(-) diff --git a/src/resources/search/providers.ts b/src/resources/search/providers.ts index 6ed4f077..0514abe1 100644 --- a/src/resources/search/providers.ts +++ b/src/resources/search/providers.ts @@ -176,17 +176,7 @@ export interface ProviderListParams { * Optional concrete provider slug filter. Omit to list every provider. A slug that * is not listed returns an empty array. */ - slug?: - | 'brave' - | 'exa' - | 'perplexity' - | 'context' - | 'parallel' - | 'valyu' - | 'octen' - | 'you' - | 'tavily' - | 'serpapi'; + slug?: 'brave' | 'exa' | 'perplexity' | 'context' | 'parallel' | 'octen' | 'you' | 'tavily'; } export declare namespace Providers { diff --git a/src/resources/search/search.ts b/src/resources/search/search.ts index 7b6e8b83..c0eae7f7 100644 --- a/src/resources/search/search.ts +++ b/src/resources/search/search.ts @@ -74,11 +74,9 @@ export type ProviderTarget = | ProviderTarget.SearchPerplexityTarget | ProviderTarget.SearchContextTarget | ProviderTarget.SearchParallelTarget - | ProviderTarget.SearchValyuTarget | ProviderTarget.SearchOctenTarget | ProviderTarget.SearchYouTarget - | ProviderTarget.SearchTavilyTarget - | ProviderTarget.SearchSerpAPITarget; + | ProviderTarget.SearchTavilyTarget; export namespace ProviderTarget { export interface SearchBraveTarget { @@ -464,78 +462,6 @@ export namespace ProviderTarget { } } - export interface SearchValyuTarget { - provider: 'valyu'; - - options?: SearchValyuTarget.Options; - } - - export namespace SearchValyuTarget { - export interface Options { - /** - * Trade depth for latency. - */ - fast_mode?: boolean; - - /** - * Allow historical cached results. - */ - historical_cache?: boolean; - - /** - * Include abstracts for academic sources. - */ - include_abstracts?: boolean; - - /** - * Natural-language retrieval guidance. - */ - instructions?: string; - - /** - * Mark the search as an agent tool call. - */ - is_tool_call?: boolean; - - /** - * Provider-native count. Lower-only alias for max_results. - */ - max_num_results?: number; - - /** - * Provider-native USD-per-thousand-results price ceiling. Forwarded to Valyu. - */ - max_price?: number; - - /** - * Provider-native minimum relevance threshold. Not a normalized cross-provider - * score. - */ - relevance_threshold?: number; - - /** - * Provider result-content length preset. - */ - response_length?: 'short' | 'medium' | 'large' | 'max'; - - /** - * Corpus selector, including all, web, proprietary, and news. Provider corpus - * choice may change billing; Kernel does not force web-only searches. - */ - search_type?: string; - - /** - * Bias retrieval toward these sources. - */ - source_biases?: Array; - - /** - * Return URLs without content. - */ - url_only?: boolean; - } - } - export interface SearchOctenTarget { provider: 'octen'; @@ -747,87 +673,6 @@ export namespace ProviderTarget { topic?: 'general' | 'news' | 'finance'; } } - - export interface SearchSerpAPITarget { - provider: 'serpapi'; - - options?: SearchSerpAPITarget.Options; - } - - export namespace SearchSerpAPITarget { - export interface Options { - /** - * SerpApi engine identifier. The Kernel integration currently supports google - * only. - */ - engine: string; - - /** - * Device profile used for the search. - */ - device?: 'desktop' | 'mobile' | 'tablet'; - - /** - * Google duplicate-content filter. - */ - filter?: 0 | 1; - - /** - * Two-letter Google country code. - */ - gl?: string; - - /** - * Google domain to search when using the google engine. - */ - google_domain?: string; - - /** - * Interface language code. - */ - hl?: string; - - /** - * Free-form geographic location used for localized results. - */ - location?: string; - - /** - * Google auto-correction filter. - */ - nfpr?: 0 | 1; - - /** - * When true, bypass SerpApi cached results when supported. - */ - no_cache?: boolean; - - /** - * Number of results requested from the search engine. - */ - num?: number; - - /** - * Safe-search setting for engines that support it. - */ - safe?: 'active' | 'off'; - - /** - * Zero-based result offset for pagination. - */ - start?: number; - - /** - * Google vertical search selector, such as images, video, news, or shopping. - */ - tbm?: string; - - /** - * Google time and search modifiers, including freshness filters. - */ - tbs?: string; - } - } } export interface Request { From d8c7df1730838dd4bcdf48b50eda833a77513951 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 18:32:40 +0000 Subject: [PATCH 2/6] feat: Return access_token_rejected code when Link rejects a customer-supplied token Stainless-Generated-From: ae053a1acd9de79e55b175c94b53a90f245ac3c0 --- src/resources/vaults/items.ts | 49 ++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 24 deletions(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index 361bc67d..ffffece8 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -4831,30 +4831,31 @@ export declare namespace ItemUpsertParams { * subsequent refresh-token rotation after a successful import; the customer must * stop refreshing this grant. With token_refresh=customer, send only the access * token: your backend keeps the refresh token and rotates the grant, and Kernel - * never refreshes or revokes it. Replace the stored access token with the wallet's - * update_access_token operation before each step that reaches Link, such as - * creating, authorizing or filling a card. When Link rejects the stored access - * token, operations return 409 without contacting Link again; update the token and - * retry. The remainder of this description applies to token_refresh=kernel. With - * token_refresh=kernel, Kernel owns subsequent refresh-token rotation; the - * customer must stop refreshing this grant. Import does not verify the refresh - * token: if it or the configured client credentials are rejected during a later - * refresh, the imported wallet becomes degraded. An unknown refresh outcome also - * leaves it degraded; Kernel does not retry a refresh token that may already have - * been consumed. There is no in-place reauthorization operation for an imported - * wallet. If this imported wallet's credentials become unusable, obtain a fresh - * Link OAuth grant in your backend and create a wallet under a NEW wallet key. Use - * the new wallet for NEW cards and payments, not to retry an old payment whose - * outcome is uncertain. This does not replace the old grant, rebind existing - * cards, or resolve their payment outcomes. Retain the old wallet and its cards - * while reconciling any uncertain payments with the provider or support. Do not - * repeat an uncertain payment on the new wallet, and do not treat deletion as - * evidence that it did not execute. Deletion of the old wallet can remain blocked - * by unresolved child cards. Repeating a create for the same item key and - * non-secret spec returns the existing wallet without replacing tokens, even if - * they have rotated or the wallet needs reconnection. ID and name references - * resolving to the same config are equivalent. A different config or non-secret - * spec returns 409. This create operation does not replace an existing grant. + * never refreshes or revokes it. When Link rejects the stored access token, any + * operation that reaches Link, such as creating, authorizing or filling a card, + * returns 409 with code access_token_rejected without contacting Link again. Push + * a fresh access token with the wallet's update_access_token operation, then retry + * the operation. The remainder of this description applies to + * token_refresh=kernel. With token_refresh=kernel, Kernel owns subsequent + * refresh-token rotation; the customer must stop refreshing this grant. Import + * does not verify the refresh token: if it or the configured client credentials + * are rejected during a later refresh, the imported wallet becomes degraded. An + * unknown refresh outcome also leaves it degraded; Kernel does not retry a refresh + * token that may already have been consumed. There is no in-place reauthorization + * operation for an imported wallet. If this imported wallet's credentials become + * unusable, obtain a fresh Link OAuth grant in your backend and create a wallet + * under a NEW wallet key. Use the new wallet for NEW cards and payments, not to + * retry an old payment whose outcome is uncertain. This does not replace the old + * grant, rebind existing cards, or resolve their payment outcomes. Retain the old + * wallet and its cards while reconciling any uncertain payments with the provider + * or support. Do not repeat an uncertain payment on the new wallet, and do not + * treat deletion as evidence that it did not execute. Deletion of the old wallet + * can remain blocked by unresolved child cards. Repeating a create for the same + * item key and non-secret spec returns the existing wallet without replacing + * tokens, even if they have rotated or the wallet needs reconnection. ID and name + * references resolving to the same config are equivalent. A different config or + * non-secret spec returns 409. This create operation does not replace an existing + * grant. */ export interface ImportedLinkAuthorizationInput { client: ImportedLinkAuthorizationInput.Client; From 0caa5b0c57b0c4c278f138b41f1504074972f802 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 21:57:58 +0000 Subject: [PATCH 3/6] feat: Add customer-managed VGS vault card payments Stainless-Generated-From: 4c60c71927a9cf37addd1e7d6bd096cbb7a2f9fd --- api.md | 5 + src/resources/vault-provider-configs.ts | 78 +++++++++++- src/resources/vaults/index.ts | 5 + src/resources/vaults/items.ts | 155 +++++++++++++++++++++++- src/resources/vaults/vaults.ts | 10 ++ 5 files changed, 246 insertions(+), 7 deletions(-) diff --git a/api.md b/api.md index bff49bf1..6386621a 100644 --- a/api.md +++ b/api.md @@ -595,6 +595,11 @@ Types: - VaultItemOperationResponse - VaultPaymentMethod - VaultWebmcpBinding +- VgsCardInput +- VgsCardState +- VgsCardVaultItemSpec +- VgsWalletState +- VgsWalletVaultItemSpec - WalletVaultItemSpec - WalletVaultItemState - WebmcpInvokeVaultItemOperationRequest diff --git a/src/resources/vault-provider-configs.ts b/src/resources/vault-provider-configs.ts index 24ba4d00..ece61203 100644 --- a/src/resources/vault-provider-configs.ts +++ b/src/resources/vault-provider-configs.ts @@ -118,7 +118,8 @@ export type VaultProviderConfigsOffsetPagination = OffsetPagination; + + masks?: VgsCardState.Masks; + + status_reason?: string; +} + +export namespace VgsCardState { + export interface Masks { + brand?: string; + + last4?: string; + + /** + * Last four digits of the network token presented to the merchant. + */ + token_last4?: string; + + [k: string]: string | undefined; + } +} + +/** + * One live purchase with a card in the customer's VGS vault. authorize reveals + * card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which + * replaces both with aliases in Kernel's vault before they reach Kernel; Kernel + * never receives the card number or security code. The card is then ready with no + * further approval, until expires_at, by default five minutes after authorize. + * fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy + * replaces them with the card's details when the browser submits checkout. An + * expired card requires a new purchase with a freshly collected CVC alias. The + * amount and merchant are recorded but do not restrict payment requests sent by + * the browser. Card updates are not supported; delete and create a new item + * instead. + */ +export interface VgsCardVaultItemSpec { + /** + * Integer amount in minor currency units (at most 1000000). + */ + amount: number; + + /** + * ISO 4217 code. Supported: aud, brl, cad, chf, czk, dkk, eur, gbp, hkd, inr, jpy, + * krw, mxn, nok, nzd, pln, sek, sgd, usd, zar. + */ + currency: string; + + merchant_name: string; + + /** + * Merchant checkout URL. Fill is allowed only on this URL's origin. + */ + merchant_url: string; + + provider: 'vgs'; + + /** + * Key of the VGS wallet item whose configuration reads the aliases. + */ + wallet: string; +} + +export interface VgsWalletState { + provider: 'vgs'; + + /** + * A VGS wallet is connected on creation. pending_authorization or degraded means + * its creation did not finish; reading the wallet retries it, and a wallet that + * stays degraded can be deleted and created again. Whether its configuration's + * credentials still work is checked when a card is authorized. + */ + status: 'pending_authorization' | 'connected' | 'degraded'; + + status_reason?: string; +} + +/** + * Cards kept in the customer's own VGS vault. The wallet binds a VGS provider + * configuration and is connected on creation; it holds no cards and has no payment + * methods. Each purchase is a card item that carries the card's aliases from the + * customer's vault. The configuration binding cannot be changed after creation. + */ +export interface VgsWalletVaultItemSpec { + provider: 'vgs'; + + /** + * Select a VGS configuration. Required, because there are no Kernel-managed VGS + * credentials for this provider. + */ + provider_config: VgsWalletVaultItemSpec.ProviderConfig; +} + +export namespace VgsWalletVaultItemSpec { + /** + * Select a VGS configuration. Required, because there are no Kernel-managed VGS + * credentials for this provider. + */ + export interface ProviderConfig { + id?: string; + + name?: string; + } +} + /** * AgentCard wallet. Omit provider_config to use Kernel-managed credentials, or * select a customer-owned configuration. Mode (sandbox vs live) is determined by @@ -3935,7 +4072,8 @@ export type WalletVaultItemSpec = | WalletVaultItemSpec.LinkWalletVaultItemSpec | WalletVaultItemSpec.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec - | ShopPayWalletVaultItemSpec; + | ShopPayWalletVaultItemSpec + | VgsWalletVaultItemSpec; export namespace WalletVaultItemSpec { export interface LinkWalletVaultItemSpec { @@ -4035,7 +4173,8 @@ export type WalletVaultItemState = | WalletVaultItemState.LinkWalletState | WalletVaultItemState.AgentCardWalletState | KernelWalletState - | ShopPayWalletState; + | ShopPayWalletState + | VgsWalletState; export namespace WalletVaultItemState { export interface LinkWalletState { @@ -4784,7 +4923,8 @@ export declare namespace ItemUpsertParams { | WalletVaultItemRequest.LinkWalletVaultItemRequestSpec | WalletVaultItemRequest.AgentCardWalletVaultItemSpec | KernelWalletVaultItemSpec - | ShopPayWalletVaultItemSpec; + | ShopPayWalletVaultItemSpec + | VgsWalletVaultItemSpec; /** * Body param @@ -5131,6 +5271,11 @@ export declare namespace Items { type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, + type VgsCardInput as VgsCardInput, + type VgsCardState as VgsCardState, + type VgsCardVaultItemSpec as VgsCardVaultItemSpec, + type VgsWalletState as VgsWalletState, + type VgsWalletVaultItemSpec as VgsWalletVaultItemSpec, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, diff --git a/src/resources/vaults/vaults.ts b/src/resources/vaults/vaults.ts index 53f34a35..e108c3a3 100644 --- a/src/resources/vaults/vaults.ts +++ b/src/resources/vaults/vaults.ts @@ -92,6 +92,11 @@ import { VaultItemOperationResponse, VaultPaymentMethod, VaultWebmcpBinding, + VgsCardInput, + VgsCardState, + VgsCardVaultItemSpec, + VgsWalletState, + VgsWalletVaultItemSpec, WalletVaultItemSpec, WalletVaultItemState, WebmcpInvokeVaultItemOperationRequest, @@ -366,6 +371,11 @@ export declare namespace Vaults { type VaultItemOperationResponse as VaultItemOperationResponse, type VaultPaymentMethod as VaultPaymentMethod, type VaultWebmcpBinding as VaultWebmcpBinding, + type VgsCardInput as VgsCardInput, + type VgsCardState as VgsCardState, + type VgsCardVaultItemSpec as VgsCardVaultItemSpec, + type VgsWalletState as VgsWalletState, + type VgsWalletVaultItemSpec as VgsWalletVaultItemSpec, type WalletVaultItemSpec as WalletVaultItemSpec, type WalletVaultItemState as WalletVaultItemState, type WebmcpInvokeVaultItemOperationRequest as WebmcpInvokeVaultItemOperationRequest, From 83e0781aa667b0cd238acc19b52aa99ce5fed328 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2026 17:06:53 +0000 Subject: [PATCH 4/6] feat: Move GPU browsers to L40S-3Q and 6Q vGPU profiles Stainless-Generated-From: 41d37270913682099a8008a2e3ff1e64b93251ec --- src/resources/browsers/browsers.ts | 11 ++++++----- tests/api-resources/browsers/browsers.test.ts | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/resources/browsers/browsers.ts b/src/resources/browsers/browsers.ts index ed8938f7..0469a262 100644 --- a/src/resources/browsers/browsers.ts +++ b/src/resources/browsers/browsers.ts @@ -838,10 +838,11 @@ export interface BrowserUsage { } /** - * Video memory (VRAM) of a GPU browser session. 2GiB sessions have 4 vCPU and 6GiB - * memory. 4GiB sessions have 8 vCPU and 12GiB memory. + * Video memory (VRAM) of a GPU browser session. 3GiB sessions have 4 vCPU and 6GiB + * memory. 6GiB sessions have 8 vCPU and 12GiB memory. 2GiB and 4GiB are deprecated + * aliases for 3GiB and 6GiB: they are accepted on create and never returned. */ -export type BrowserVideoMemory = '2GiB' | '4GiB'; +export type BrowserVideoMemory = '3GiB' | '6GiB' | '2GiB' | '4GiB'; /** * Browser profile metadata. @@ -1827,8 +1828,8 @@ export interface BrowserCreateParams { /** * Video memory (VRAM) for a GPU browser session. Requires gpu=true. Defaults to - * 2GiB, which comes with 4 vCPU and 6GiB memory. 4GiB comes with 8 vCPU and 12GiB - * memory. + * 3GiB, which comes with 4 vCPU and 6GiB memory. 6GiB comes with 8 vCPU and 12GiB + * memory. 2GiB and 4GiB are deprecated aliases for 3GiB and 6GiB. */ video_memory?: BrowserVideoMemory; diff --git a/tests/api-resources/browsers/browsers.test.ts b/tests/api-resources/browsers/browsers.test.ts index efb216d1..63ada8e7 100644 --- a/tests/api-resources/browsers/browsers.test.ts +++ b/tests/api-resources/browsers/browsers.test.ts @@ -88,7 +88,7 @@ describe('resource browsers', () => { }, timeout_seconds: 10, vaults: [{ id: 'id', name: 'x' }], - video_memory: '2GiB', + video_memory: '3GiB', viewport: { height: 800, width: 1280, From f59f588595cba39391dbf91db44002cf6547bcbb Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2026 22:14:38 +0000 Subject: [PATCH 5/6] fix: generate VGS card aliases in the TypeScript SDK Stainless-Generated-From: faed5338095403e786b5a25846f928a9aa96c2ef --- src/resources/vaults/items.ts | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index 5df386ec..15c9e8a2 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -3922,7 +3922,27 @@ export interface VaultWebmcpBinding { * Write-only: stored encrypted and never returned in the item, its events or logs. * A repeated PUT with the same key must send the same card. */ -export interface VgsCardInput {} +export interface VgsCardInput { + /** + * A volatile alias of a freshly collected security code in the customer's vault. + * It must still exist when authorize runs. + */ + cvc_alias: string; + + exp_month: number; + + exp_year: number; + + /** + * The card number's last four digits, checked against the revealed alias. + */ + last4: string; + + /** + * A persistent alias of the card number in the customer's vault. + */ + pan_alias: string; +} /** * A ready VGS card supports fill, then submit checkout, until expires_at. Kernel @@ -4008,6 +4028,11 @@ export interface VgsCardVaultItemSpec { * Key of the VGS wallet item whose configuration reads the aliases. */ wallet: string; + + /** + * Required when creating the card. Never returned. + */ + card?: VgsCardInput; } export interface VgsWalletState { From 0e7b8c522f9421f857e0d52a25b5965a732b1619 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2026 22:18:32 +0000 Subject: [PATCH 6/6] release: 0.141.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 15 +++++++++++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 593fcf0c..2261026f 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.140.0" + ".": "0.141.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index a901620d..cc8125ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,20 @@ # Changelog +## [0.141.0](https://github.com/kernel/kernel-node-sdk/compare/v0.140.0...v0.141.0) (2026-11-05) + + +### Features + +* Add customer-managed VGS vault card payments ([0caa5b0](https://github.com/kernel/kernel-node-sdk/commit/0caa5b0c57b0c4c278f138b41f1504074972f802)) +* Move GPU browsers to L40S-3Q and 6Q vGPU profiles ([83e0781](https://github.com/kernel/kernel-node-sdk/commit/83e0781aa667b0cd238acc19b52aa99ce5fed328)) +* Remove SerpApi and Valyu search providers ([80829c7](https://github.com/kernel/kernel-node-sdk/commit/80829c75c62f1c0002e349a3501e3ca866b299f6)) +* Return access_token_rejected code when Link rejects a customer-supplied token ([d8c7df1](https://github.com/kernel/kernel-node-sdk/commit/d8c7df1730838dd4bcdf48b50eda833a77513951)) + + +### Bug Fixes + +* generate VGS card aliases in the TypeScript SDK ([f59f588](https://github.com/kernel/kernel-node-sdk/commit/f59f588595cba39391dbf91db44002cf6547bcbb)) + ## [0.140.0](https://github.com/kernel/kernel-node-sdk/compare/v0.139.0...v0.140.0) (2026-11-04) diff --git a/package.json b/package.json index 36d4ef7d..6d234039 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.140.0", + "version": "0.141.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index 47d5dc0b..98896b65 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.140.0'; // x-release-please-version +export const VERSION = '0.141.0'; // x-release-please-version