[kernel-internal]

Summary

• Document @onkernel/sdk changes through 0.144.0.

Changes

Pages changed

• SDK 0.140.0 — vaults/1password.mdx: updated 1pw_fill guidance after removal of KERNEL's origin gate. The 1Password extension now decides whether an approved login matches the page, entry_id is required only when the page doesn't identify one approved entry, and the obsolete destination_denied outcome is removed.
• SDK 0.140.0 — integrations/wallets/stripe-link.mdx: documented imported Link grants with authorization.token_refresh: "customer", conditional refresh-token input, the wallet update_access_token operation, and its required vault permissions.
• SDK 0.141.0 — integrations/wallets/stripe-link.mdx: replaced proactive access-token updates with recovery after 409 access_token_rejected: store a fresh token, then retry the Link operation.
• SDK 0.140.0 — integrations/wallets/overview.mdx: clarified that imported Link grants can use either KERNEL-managed or customer-managed refresh-token rotation.
• SDK 0.140.0 and 0.142.0 — info/api-key-permissions.mdx: added the vaults:write requirement for update_access_token; added reserved ISP IP inventory to proxies:read, including its project- or organization-wide grant requirement; and added ISP exit-IP moves to proxies:write.
• SDK 0.142.0 — proxies/isp.mdx: added the reserved config.ip_address parameter and its conditional country default, and corrected static-IP and allowlist guidance now that reserved allocations can move a proxy to another IP.
• SDK 0.142.0 — proxies/overview.mdx and auth/configuration.mdx: clarified that an ISP proxy's primary IP stays fixed unless the user moves a reserved proxy or the ISP replaces it, while backup failover can temporarily use another IP.
• SDK 0.142.0 — browsers/viewport.mdx: documented the 64-pixel minimum for each headful viewport dimension; headless viewports still accept any positive dimensions.
• SDK 0.143.0 — integrations/wallets/bring-your-own-vgs-vault.mdx: documented spec.card_mode: "cvc_only" for merchant-stored cards, the CVC-only request shape, fill fields and masks, and the unchanged VGS proxy egress scope during the payment window.
• SDK 0.144.0 — integrations/wallets/pay-with-multiple-cards.mdx: documented the optional enrollment: "server" mode, its five-minute card_ingest action, and the 409 response when server enrollment isn't configured; generalized pending-enrollment and event guidance for both enrollment modes.
• SDK 0.144.0 — integrations/wallets/pay-with-card.mdx and integrations/wallets/embedded-card-capture.mdx: made the hosted enrollment default explicit and clarified that capture_token exists only on a KERNEL wallet's card_enrollment action.
• SDK 0.144.0 — integrations/wallets/overview.mdx: added card_ingest to the complete action-name list and identified it as an issuer-backend action rather than a user-facing hosted action.

Missing coverage

• SDK 0.142.0 — the reserved IP inventory methods (proxyIPs.list() and proxyIPs.retrieve(), proxy_ips in Python, and ProxyIPs.List and ProxyIPs.Get in Go), including active versus excluded status and organization/project usage counts, have no guide workflow.
• SDK 0.142.0 — moving an existing ISP proxy with proxies.update(..., { config: { ip_address } }) and filtering proxies.list() by exact ip_address have no guide examples. The ISP page lists the create-time pinning parameter and corrects the affected behavior statements only.

Languages left unchanged because an SDK lacks the method

None. The checked-out Node, Python, and Go SDKs expose the audited capabilities.

Validation limitations

None. mint broken-links and git diff --check completed successfully. docs.json wasn't edited, so jq empty docs.json wasn't required.

Validation

• mint broken-links
• docs.json parses
• git diff --check

---

Note

Low Risk
Documentation-only updates aligning guides with SDK APIs and behavior; no application code or infrastructure changes.

Overview
Updates product docs to match @onkernel/sdk behavior through 0.144.0. No runtime code changes.

Wallets and payments: Documents Stripe Link authorization.token_refresh: "customer", the update_access_token wallet operation (and vaults:write), and recovery after 409 access_token_rejected. Adds VGS card_mode: "cvc_only" for merchant-held cards. Describes optional enrollment: "server" on add_payment_method, its five-minute card_ingest action, and clarifies hosted card_enrollment / capture_token defaults.

Proxies: Documents reserved ISP config.ip_address, when country defaults from that IP, and that the primary exit IP can change when moving reserved allocations (with backup failover still able to use a temporary IP). Extends proxies:read / proxies:write permission wording for reserved ISP inventory and IP moves.

Other: 1Password 1pw_fill — extension now decides page/login match; destination_denied removed; entry_id rules updated. Headful viewports require at least 64px per dimension.

^{Reviewed by Cursor Bugbot for commit 4ecf437. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 9, 2026, 2:42 PM

💡 Tip: Enable Automations to automatically generate PRs for you.