From b6a069d808687661dce0ddd2f3cf7d5bc502d3ee Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 22:41:44 +0000 Subject: [PATCH 1/3] feat: Discard browser sessions on immediate API key revocation (#5272) Stainless-Generated-From: 8e3be4a874f251815e7b645fd9d22fd398033ee5 --- src/resources/api-keys.ts | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/resources/api-keys.ts b/src/resources/api-keys.ts index c0e0cbb0..9b851bd4 100644 --- a/src/resources/api-keys.ts +++ b/src/resources/api-keys.ts @@ -76,8 +76,9 @@ export class APIKeys extends APIResource { } /** - * Delete an API key. A key cannot delete itself; use a different key to delete - * this one. + * Delete an API key and asynchronously end browser sessions attributed to it, + * discarding unsaved profile changes. A key cannot delete itself; use a different + * key to delete this one. If cleanup cannot be registered, the key is not deleted. * * @example * ```ts @@ -94,7 +95,11 @@ export class APIKeys extends APIResource { /** * Rotate an API key. Issues a new key that copies the name and project of the * rotated key, and schedules the rotated key to expire after a grace period so - * in-flight callers can swap over. The new plaintext key is returned once. + * in-flight callers can swap over. The new plaintext key is returned once. With + * expire_in_days set to 0, browser sessions attributed to the old key are ended + * asynchronously and unsaved profile changes are discarded. Grace-period and + * natural expiry do not end existing browsers. If cleanup cannot be registered, an + * immediate rotation is not committed. * * @example * ```ts From 37fe4d35c0d9fe1d002dcd31b36af2fdf3c85e20 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Tue, 10 Nov 2026 03:12:18 +0000 Subject: [PATCH 2/3] feat: Expose Link card credential_type and explain pay token fill rejections Stainless-Generated-From: e0e3da155cb2bc8f5f6a09ae6df84dab6c125a71 --- src/resources/vaults/items.ts | 62 ++++++++++++++++++++++------------- 1 file changed, 40 insertions(+), 22 deletions(-) diff --git a/src/resources/vaults/items.ts b/src/resources/vaults/items.ts index ecc52272..e0ed2692 100644 --- a/src/resources/vaults/items.ts +++ b/src/resources/vaults/items.ts @@ -428,8 +428,8 @@ export interface AuthorizeVaultItemOperationRequest { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ export type CardVaultItemSpec = | CardVaultItemSpec.LinkCardVaultItemSpec @@ -444,8 +444,8 @@ export namespace CardVaultItemSpec { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ export interface LinkCardVaultItemSpec { /** @@ -648,6 +648,15 @@ export namespace CardVaultItemState { | 'declined' | 'recovery_required'; + /** + * The Link spend request's credential_type, set when authorize sends the request + * to Link. Absent before authorize and after Link rejects the request; a ready + * card without it fills like card. card is a Link virtual card; fill it with field + * bindings. link_pay_token is a Link Pay Token that Kernel supplies through the + * checkout's Link WebMCP tool; fill it without fields. + */ + credential_type?: 'card' | 'link_pay_token'; + domains?: Array; masks?: LinkCardState.Masks; @@ -2639,8 +2648,8 @@ export interface PaymentRequestVaultItem { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ spec: PaymentRequestVaultItemSpec; @@ -2704,8 +2713,8 @@ export namespace PaymentRequestVaultItem { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ export type PaymentRequestVaultItemSpec = | PaymentRequestVaultItemSpec.LinkCardVaultItemSpec @@ -2717,8 +2726,8 @@ export namespace PaymentRequestVaultItemSpec { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ export interface LinkCardVaultItemSpec { /** @@ -2870,6 +2879,15 @@ export namespace PaymentRequestVaultItemState { | 'declined' | 'recovery_required'; + /** + * The Link spend request's credential_type, set when authorize sends the request + * to Link. Absent before authorize and after Link rejects the request; a ready + * card without it fills like card. card is a Link virtual card; fill it with field + * bindings. link_pay_token is a Link Pay Token that Kernel supplies through the + * checkout's Link WebMCP tool; fill it without fields. + */ + credential_type?: 'card' | 'link_pay_token'; + domains?: Array; masks?: LinkCardState.Masks; @@ -3465,8 +3483,8 @@ export namespace VaultItem { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ spec: ItemsAPI.CardVaultItemSpec; @@ -3757,8 +3775,8 @@ export namespace VaultItemOperationResponse { * be changed with PATCH until the card is authorized at a checkout. Authorize it * with the browser at final checkout: Kernel inspects the checkout through WebMCP * and internally chooses a merchant-bound Link Pay Token when supported or a - * virtual card otherwise. Callers never receive or choose how the credential is - * delivered. + * virtual card otherwise. Callers do not choose how the credential is delivered; + * after authorize, state.credential_type reports it. */ spec: ItemsAPI.CardVaultItemSpec; @@ -4411,8 +4429,8 @@ export declare namespace ItemUpdateParams { * The spec can be changed with PATCH until the card is authorized at a checkout. * Authorize it with the browser at final checkout: Kernel inspects the checkout * through WebMCP and internally chooses a merchant-bound Link Pay Token when - * supported or a virtual card otherwise. Callers never receive or choose how the - * credential is delivered. + * supported or a virtual card otherwise. Callers do not choose how the credential + * is delivered; after authorize, state.credential_type reports it. */ spec: CardVaultItemSpec; @@ -4433,8 +4451,8 @@ export declare namespace ItemUpdateParams { * The spec can be changed with PATCH until the card is authorized at a checkout. * Authorize it with the browser at final checkout: Kernel inspects the checkout * through WebMCP and internally chooses a merchant-bound Link Pay Token when - * supported or a virtual card otherwise. Callers never receive or choose how the - * credential is delivered. + * supported or a virtual card otherwise. Callers do not choose how the credential + * is delivered; after authorize, state.credential_type reports it. */ spec: PaymentRequestVaultItemSpec; @@ -5213,8 +5231,8 @@ export declare namespace ItemUpsertParams { * The spec can be changed with PATCH until the card is authorized at a checkout. * Authorize it with the browser at final checkout: Kernel inspects the checkout * through WebMCP and internally chooses a merchant-bound Link Pay Token when - * supported or a virtual card otherwise. Callers never receive or choose how the - * credential is delivered. + * supported or a virtual card otherwise. Callers do not choose how the credential + * is delivered; after authorize, state.credential_type reports it. */ spec: CardVaultItemSpec; @@ -5235,8 +5253,8 @@ export declare namespace ItemUpsertParams { * The spec can be changed with PATCH until the card is authorized at a checkout. * Authorize it with the browser at final checkout: Kernel inspects the checkout * through WebMCP and internally chooses a merchant-bound Link Pay Token when - * supported or a virtual card otherwise. Callers never receive or choose how the - * credential is delivered. + * supported or a virtual card otherwise. Callers do not choose how the credential + * is delivered; after authorize, state.credential_type reports it. */ spec: PaymentRequestVaultItemSpec; From bd25031d926b2ffc26b623b280ae4c66a31190b1 Mon Sep 17 00:00:00 2001 From: "kernel-internal[bot]" <260533166+kernel-internal[bot]@users.noreply.github.com> Date: Tue, 10 Nov 2026 03:17:32 +0000 Subject: [PATCH 3/3] release: 0.145.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 8 ++++++++ package.json | 2 +- src/version.ts | 2 +- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 6255c680..80e5148f 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.144.0" + ".": "0.145.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d2cfd13..5cdb5fb0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## [0.145.0](https://github.com/kernel/kernel-node-sdk/compare/v0.144.0...v0.145.0) (2026-11-10) + + +### Features + +* Discard browser sessions on immediate API key revocation ([#5272](https://github.com/kernel/kernel-node-sdk/issues/5272)) ([b6a069d](https://github.com/kernel/kernel-node-sdk/commit/b6a069d808687661dce0ddd2f3cf7d5bc502d3ee)) +* Expose Link card credential_type and explain pay token fill rejections ([37fe4d3](https://github.com/kernel/kernel-node-sdk/commit/37fe4d35c0d9fe1d002dcd31b36af2fdf3c85e20)) + ## [0.144.0](https://github.com/kernel/kernel-node-sdk/compare/v0.143.0...v0.144.0) (2026-11-09) diff --git a/package.json b/package.json index b6e34a6e..833d03b4 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@onkernel/sdk", - "version": "0.144.0", + "version": "0.145.0", "description": "The official TypeScript library for the Kernel API", "author": "Kernel <>", "types": "dist/index.d.ts", diff --git a/src/version.ts b/src/version.ts index 3a430fbb..cce58f68 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1 +1 @@ -export const VERSION = '0.144.0'; // x-release-please-version +export const VERSION = '0.145.0'; // x-release-please-version