[kernel-internal]

Summary

• Document @onkernel/sdk changes through 0.143.0.

Changes

Pages changed

• SDK 0.140.0 — vaults/1password.mdx: updated 1pw_fill guidance after removal of KERNEL's origin gate. The 1Password extension now decides whether an approved login matches the page, entry_id is required only when the page doesn't identify one approved entry, and the obsolete destination_denied outcome is removed.
• SDK 0.140.0 — integrations/wallets/stripe-link.mdx: documented imported Link grants with authorization.token_refresh: "customer", conditional refresh-token input, the wallet update_access_token operation, and its required vault permissions.
• SDK 0.141.0 — integrations/wallets/stripe-link.mdx: replaced proactive access-token updates with recovery after 409 access_token_rejected: store a fresh token, then retry the Link operation.
• SDK 0.140.0 — integrations/wallets/overview.mdx: clarified that imported Link grants can use either KERNEL-managed or customer-managed refresh-token rotation.
• SDK 0.140.0 and 0.142.0 — info/api-key-permissions.mdx: added the vaults:write requirement for update_access_token; added reserved ISP IP inventory to proxies:read, including its project- or organization-wide grant requirement; and added ISP exit-IP moves to proxies:write.
• SDK 0.142.0 — proxies/isp.mdx: added the reserved config.ip_address parameter and its conditional country default, and corrected static-IP and allowlist guidance now that reserved allocations can move a proxy to another IP.
• SDK 0.142.0 — proxies/overview.mdx and auth/configuration.mdx: clarified that an ISP proxy's primary IP stays fixed unless the user moves a reserved proxy or the ISP replaces it, while backup failover can temporarily use another IP.
• SDK 0.142.0 — browsers/viewport.mdx: documented the 64-pixel minimum for each headful viewport dimension; headless viewports still accept any positive dimensions.
• SDK 0.143.0 — integrations/wallets/bring-your-own-vgs-vault.mdx: documented spec.card_mode: "cvc_only" for merchant-stored cards, the CVC-only request shape, fill fields and masks, and the unchanged VGS proxy egress scope during the payment window.

Missing coverage

• SDK 0.142.0 — the reserved IP inventory methods (proxyIPs.list() and proxyIPs.retrieve(), proxy_ips in Python, and ProxyIPs.List and ProxyIPs.Get in Go), including active versus excluded status and organization/project usage counts, have no guide workflow.
• SDK 0.142.0 — moving an existing ISP proxy with proxies.update(..., { config: { ip_address } }) and filtering proxies.list() by exact ip_address have no guide examples. The ISP page lists the create-time pinning parameter and corrects the affected behavior statements only.

Languages left unchanged because an SDK lacks the method

None. The checked-out Node, Python, and Go SDKs expose the audited VGS and reserved ISP capabilities.

Validation limitations

None. mint broken-links and git diff --check completed successfully. docs.json wasn't edited, so jq empty docs.json wasn't required.

Validation

• mint broken-links
• docs.json parses
• git diff --check

---

Note

Low Risk
Documentation-only updates; no runtime or security logic changes in this diff.

Overview
Documentation is brought in line with Node SDK 0.143.0, mainly wallet, proxy, vault, and browser behavior that shipped in recent SDK releases.

Wallets: Stripe Link now documents authorization.token_refresh (kernel vs customer), the wallet update_access_token flow after 409 access_token_rejected, and matching vaults:write scope. VGS BYO vault adds card_mode: "cvc_only" (SDK 0.143.0+) for merchant-on-file CVC-only checkouts, including spec shapes, fill fields, and storage differences. Wallets overview text is updated for customer-managed Link refresh rotation.

Proxies: ISP docs explain reserved ip_address at create time, country defaulting when pinning, and when the exit IP can change (moves, ISP replacement, backup failover). API key permissions add reserved ISP inventory under proxies:read and exit-IP moves under proxies:write.

Other: Headful viewports require at least 64px per dimension. 1Password 1pw_fill guidance reflects the extension (not KERNEL) deciding page/login match; destination_denied is removed and entry_id rules are clarified.

^{Reviewed by Cursor Bugbot for commit 388a079. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 7, 2026, 4:42 PM

💡 Tip: Enable Automations to automatically generate PRs for you.