release: 0.128.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.127.0"
+  ".": "0.128.0"
 }

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.128.0](https://github.com/kernel/kernel-node-sdk/compare/v0.127.0...v0.128.0) (2026-10-19)
+
+
+### Features
+
+* Add browser location session policy ([942881d](https://github.com/kernel/kernel-node-sdk/commit/942881d4f685d73cecdfc040115066852b7bf05a))
+* chore(stlc): seal custom-code tracking files ([784dff8](https://github.com/kernel/kernel-node-sdk/commit/784dff8affa0abb1e752609bd1d645578e30677c))
+* Fence browser allowlist updates with revision checks ([733ca11](https://github.com/kernel/kernel-node-sdk/commit/733ca11d1d2ec987d6ffc6e1a1ef96ba769b7bf6))
+* Support existing-user AgentCard wallet imports ([e84e82f](https://github.com/kernel/kernel-node-sdk/commit/e84e82fd96e784397eff238790ab3fc495bc562c))
+
 ## [0.127.0](https://github.com/kernel/kernel-node-sdk/compare/v0.126.0...v0.127.0) (2026-10-16)
 
 

api.md

@@ -99,6 +99,11 @@ Methods:
 
 Types:
 
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserAllowlistState</a></code>
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserLocation</a></code>
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserLocationRequest</a></code>
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserLocationSource</a></code>
+- <code><a href="./src/resources/browsers/browsers.ts">BrowserLocationUpdateRequest</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserMemory</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserMemoryRequest</a></code>
 - <code><a href="./src/resources/browsers/browsers.ts">BrowserNetworkConfig</a></code>
@@ -433,11 +438,11 @@ Types:
 Methods:
 
 - <code title="post /proxies">client.proxies.<a href="./src/resources/proxies.ts">create</a>({ ...params }) -> ProxyCreateResponse</code>
-- <code title="get /proxies/{id}">client.proxies.<a href="./src/resources/proxies.ts">retrieve</a>(id) -> ProxyRetrieveResponse</code>
-- <code title="patch /proxies/{id}">client.proxies.<a href="./src/resources/proxies.ts">update</a>(id, { ...params }) -> ProxyUpdateResponse</code>
+- <code title="get /proxies/{id_or_name}">client.proxies.<a href="./src/resources/proxies.ts">retrieve</a>(idOrName) -> ProxyRetrieveResponse</code>
+- <code title="patch /proxies/{id_or_name}">client.proxies.<a href="./src/resources/proxies.ts">update</a>(idOrName, { ...params }) -> ProxyUpdateResponse</code>
 - <code title="get /proxies">client.proxies.<a href="./src/resources/proxies.ts">list</a>({ ...params }) -> ProxyListResponsesOffsetPagination</code>
-- <code title="delete /proxies/{id}">client.proxies.<a href="./src/resources/proxies.ts">delete</a>(id) -> void</code>
-- <code title="post /proxies/{id}/check">client.proxies.<a href="./src/resources/proxies.ts">check</a>(id, { ...params }) -> ProxyCheckResponse</code>
+- <code title="delete /proxies/{id_or_name}">client.proxies.<a href="./src/resources/proxies.ts">delete</a>(idOrName) -> void</code>
+- <code title="post /proxies/{id_or_name}/check">client.proxies.<a href="./src/resources/proxies.ts">check</a>(idOrName, { ...params }) -> ProxyCheckResponse</code>
 
 # Extensions
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -153,6 +153,7 @@ import {
 } from './resources/audit-logs/audit-logs';
 import { Auth } from './resources/auth/auth';
 import {
+  BrowserAllowlistState,
   BrowserCreateParams,
   BrowserCreateResponse,
   BrowserCurlParams,
@@ -161,6 +162,10 @@ import {
   BrowserListResponse,
   BrowserListResponsesOffsetPagination,
   BrowserLoadExtensionsParams,
+  BrowserLocation,
+  BrowserLocationRequest,
+  BrowserLocationSource,
+  BrowserLocationUpdateRequest,
   BrowserMemory,
   BrowserMemoryRequest,
   BrowserNetworkConfig,
@@ -1221,6 +1226,11 @@ export declare namespace Kernel {
 
   export {
     Browsers as Browsers,
+    type BrowserAllowlistState as BrowserAllowlistState,
+    type BrowserLocation as BrowserLocation,
+    type BrowserLocationRequest as BrowserLocationRequest,
+    type BrowserLocationSource as BrowserLocationSource,
+    type BrowserLocationUpdateRequest as BrowserLocationUpdateRequest,
     type BrowserMemory as BrowserMemory,
     type BrowserMemoryRequest as BrowserMemoryRequest,
     type BrowserNetworkConfig as BrowserNetworkConfig,

src/resources/browser-pools.ts

@@ -443,6 +443,11 @@ export interface BrowserPoolAcquireResponse {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Effective browser timezone and locale with per-field provenance.
+   */
+  location?: BrowsersAPI.BrowserLocation;
+
   /**
    * Human-readable name of the browser session, if one was set at creation.
    */

src/resources/browsers/browsers.ts

@@ -346,6 +346,86 @@ export type BrowserListResponsesOffsetPagination = OffsetPagination<BrowserListR
 
 export type ProfilesOffsetPagination = OffsetPagination<Profile>;
 
+export interface BrowserAllowlistState {
+  /**
+   * Opaque revision to pass as network.expected_allowlist_revision on an update.
+   */
+  revision: string;
+
+  /**
+   * Revision against which that mutation was accepted; reuse it when retrying the
+   * mutation.
+   */
+  base_revision?: string;
+
+  /**
+   * ID of the last conditional allowlist update saved on this browser.
+   */
+  mutation_id?: string;
+}
+
+export interface BrowserLocation {
+  /**
+   * Effective canonical BCP 47 formatting locale selected for the browser session.
+   */
+  locale: string;
+
+  /**
+   * Where one effective browser location field came from. `override` is set
+   * explicitly on the session; `metro` is the default for the browser's region.
+   */
+  locale_source: BrowserLocationSource;
+
+  /**
+   * Effective IANA timezone selected for the browser session.
+   */
+  timezone: string;
+
+  /**
+   * Where one effective browser location field came from. `override` is set
+   * explicitly on the session; `metro` is the default for the browser's region.
+   */
+  timezone_source: BrowserLocationSource;
+}
+
+export interface BrowserLocationRequest {
+  /**
+   * Session-only supported canonical BCP 47 locale override. Omit to use the default
+   * for the browser's region.
+   */
+  locale?: string;
+
+  /**
+   * Session-only IANA timezone override. Omit to use the default for the browser's
+   * region.
+   */
+  timezone?: string;
+}
+
+/**
+ * Where one effective browser location field came from. `override` is set
+ * explicitly on the session; `metro` is the default for the browser's region.
+ */
+export type BrowserLocationSource = 'override' | 'metro';
+
+/**
+ * Omit a field to leave it unchanged, set a string override, or set null to clear
+ * the override and use the default for the browser's region.
+ */
+export interface BrowserLocationUpdateRequest {
+  /**
+   * Session-only supported canonical BCP 47 locale override. Null clears the
+   * override and uses the browser region's default.
+   */
+  locale?: string | null;
+
+  /**
+   * Session-only IANA timezone override. Null clears the override and uses the
+   * browser region's default.
+   */
+  timezone?: string | null;
+}
+
 /**
  * Memory allocated to the browser session.
  */
@@ -388,6 +468,14 @@ export interface BrowserNetworkConfig {
    */
   allowed_hosts?: Array<string>;
 
+  /**
+   * Concurrency metadata for a browser's saved allowlist configuration. Browser
+   * pools omit it. This remains present after removal so an uncertain removal can be
+   * retried. It does not prove proxy or VM application completed. Do not include it
+   * in creation or pool updates.
+   */
+  allowlist_state?: BrowserAllowlistState;
+
   /**
    * Destinations the browser reaches directly through the session's own network
    * instead of through Kernel-managed egress — for private hosts reachable over a
@@ -484,6 +572,25 @@ export interface BrowserNetworkUpdate {
    * to some requests.
    */
   allowed_hosts?: Array<string> | null;
+
+  /**
+   * The network.allowlist_state.revision from the browser's last saved snapshot.
+   * Supply together with mutation_id to opt into conditional allowlist updates. The
+   * revision is checked atomically with the configuration write. A stale request
+   * returns 409 stale_network without changing the allowlist. A GET alone does not
+   * fence an earlier unfinished PATCH.
+   */
+  expected_allowlist_revision?: string;
+
+  /**
+   * A unique ID for this allowlist update, supplied together with
+   * expected_allowlist_revision. Reuse both values and the identical allowed_hosts
+   * payload when retrying an uncertain update. If it is still the current mutation,
+   * the retry finishes proxy and VM application without creating another revision. A
+   * superseded mutation returns 409 stale_network. These fields guard only
+   * network.allowed_hosts, not other browser update fields.
+   */
+  mutation_id?: string;
 }
 
 /**
@@ -805,6 +912,11 @@ export interface BrowserCreateResponse {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Effective browser timezone and locale with per-field provenance.
+   */
+  location?: BrowserLocation;
+
   /**
    * Human-readable name of the browser session, if one was set at creation.
    */
@@ -981,6 +1093,11 @@ export interface BrowserRetrieveResponse {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Effective browser timezone and locale with per-field provenance.
+   */
+  location?: BrowserLocation;
+
   /**
    * Human-readable name of the browser session, if one was set at creation.
    */
@@ -1157,6 +1274,11 @@ export interface BrowserUpdateResponse {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Effective browser timezone and locale with per-field provenance.
+   */
+  location?: BrowserLocation;
+
   /**
    * Human-readable name of the browser session, if one was set at creation.
    */
@@ -1333,6 +1455,11 @@ export interface BrowserListResponse {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Effective browser timezone and locale with per-field provenance.
+   */
+  location?: BrowserLocation;
+
   /**
    * Human-readable name of the browser session, if one was set at creation.
    */
@@ -1491,6 +1618,12 @@ export interface BrowserCreateParams {
    */
   kiosk_mode?: boolean;
 
+  /**
+   * Optional session-only timezone and locale overrides. Each omitted field uses the
+   * default for the browser's region. start_url opens once the location applies.
+   */
+  location?: BrowserLocationRequest;
+
   /**
    * Memory for a non-GPU browser. Headless: 1GiB (default), 2GiB, or 4GiB. Headful:
    * 8GiB (default) or 16GiB.
@@ -1736,6 +1869,17 @@ export interface BrowserUpdateParams {
    */
   disable_default_proxy?: boolean;
 
+  /**
+   * Session-only timezone and locale overrides. Omit the object or a field to leave
+   * it unchanged; set a string to override; set null to clear that field and use the
+   * browser region's default. A browser that cannot change location refuses the
+   * request before anything changes. The location applies after the request's other
+   * changes, and start_url opens once it has applied. If applying it fails, the
+   * other changes and the saved override remain and start_url does not open; retry
+   * the request to apply both.
+   */
+  location?: BrowserLocationUpdateRequest;
+
   /**
    * Human-readable name for the browser session. Omit to leave unchanged, set to an
    * empty string to clear the name. When set, must be unique among active sessions
@@ -2041,6 +2185,11 @@ Browsers.Webmcp = Webmcp;
 
 export declare namespace Browsers {
   export {
+    type BrowserAllowlistState as BrowserAllowlistState,
+    type BrowserLocation as BrowserLocation,
+    type BrowserLocationRequest as BrowserLocationRequest,
+    type BrowserLocationSource as BrowserLocationSource,
+    type BrowserLocationUpdateRequest as BrowserLocationUpdateRequest,
     type BrowserMemory as BrowserMemory,
     type BrowserMemoryRequest as BrowserMemoryRequest,
     type BrowserNetworkConfig as BrowserNetworkConfig,

src/resources/browsers/index.ts

@@ -2,6 +2,11 @@
 
 export {
   Browsers,
+  type BrowserAllowlistState,
+  type BrowserLocation,
+  type BrowserLocationRequest,
+  type BrowserLocationSource,
+  type BrowserLocationUpdateRequest,
   type BrowserMemory,
   type BrowserMemoryRequest,
   type BrowserNetworkConfig,

src/resources/index.ts

@@ -40,6 +40,11 @@ export {
 } from './browser-pools';
 export {
   Browsers,
+  type BrowserAllowlistState,
+  type BrowserLocation,
+  type BrowserLocationRequest,
+  type BrowserLocationSource,
+  type BrowserLocationUpdateRequest,
   type BrowserMemory,
   type BrowserMemoryRequest,
   type BrowserNetworkConfig,

src/resources/invocations.ts

@@ -527,6 +527,11 @@ export namespace InvocationListBrowsersResponse {
      */
     kiosk_mode?: boolean;
 
+    /**
+     * Effective browser timezone and locale with per-field provenance.
+     */
+    location?: BrowsersAPI.BrowserLocation;
+
     /**
      * Human-readable name of the browser session, if one was set at creation.
      */