release: 0.145.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.144.0"
+  ".": "0.145.0"
 }

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.145.0](https://github.com/kernel/kernel-node-sdk/compare/v0.144.0...v0.145.0) (2026-11-10)
+
+
+### Features
+
+* Discard browser sessions on immediate API key revocation ([#5272](https://github.com/kernel/kernel-node-sdk/issues/5272)) ([b6a069d](https://github.com/kernel/kernel-node-sdk/commit/b6a069d808687661dce0ddd2f3cf7d5bc502d3ee))
+* Expose Link card credential_type and explain pay token fill rejections ([37fe4d3](https://github.com/kernel/kernel-node-sdk/commit/37fe4d35c0d9fe1d002dcd31b36af2fdf3c85e20))
+
 ## [0.144.0](https://github.com/kernel/kernel-node-sdk/compare/v0.143.0...v0.144.0) (2026-11-09)
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.144.0",
+  "version": "0.145.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/api-keys.ts

@@ -76,8 +76,9 @@ export class APIKeys extends APIResource {
   }
 
   /**
-   * Delete an API key. A key cannot delete itself; use a different key to delete
-   * this one.
+   * Delete an API key and asynchronously end browser sessions attributed to it,
+   * discarding unsaved profile changes. A key cannot delete itself; use a different
+   * key to delete this one. If cleanup cannot be registered, the key is not deleted.
    *
    * @example
    * ```ts
@@ -94,7 +95,11 @@ export class APIKeys extends APIResource {
   /**
    * Rotate an API key. Issues a new key that copies the name and project of the
    * rotated key, and schedules the rotated key to expire after a grace period so
-   * in-flight callers can swap over. The new plaintext key is returned once.
+   * in-flight callers can swap over. The new plaintext key is returned once. With
+   * expire_in_days set to 0, browser sessions attributed to the old key are ended
+   * asynchronously and unsaved profile changes are discarded. Grace-period and
+   * natural expiry do not end existing browsers. If cleanup cannot be registered, an
+   * immediate rotation is not committed.
    *
    * @example
    * ```ts

src/resources/vaults/items.ts

@@ -428,8 +428,8 @@ export interface AuthorizeVaultItemOperationRequest {
  * be changed with PATCH until the card is authorized at a checkout. Authorize it
  * with the browser at final checkout: Kernel inspects the checkout through WebMCP
  * and internally chooses a merchant-bound Link Pay Token when supported or a
- * virtual card otherwise. Callers never receive or choose how the credential is
- * delivered.
+ * virtual card otherwise. Callers do not choose how the credential is delivered;
+ * after authorize, state.credential_type reports it.
  */
 export type CardVaultItemSpec =
   | CardVaultItemSpec.LinkCardVaultItemSpec
@@ -444,8 +444,8 @@ export namespace CardVaultItemSpec {
    * be changed with PATCH until the card is authorized at a checkout. Authorize it
    * with the browser at final checkout: Kernel inspects the checkout through WebMCP
    * and internally chooses a merchant-bound Link Pay Token when supported or a
-   * virtual card otherwise. Callers never receive or choose how the credential is
-   * delivered.
+   * virtual card otherwise. Callers do not choose how the credential is delivered;
+   * after authorize, state.credential_type reports it.
    */
   export interface LinkCardVaultItemSpec {
     /**
@@ -648,6 +648,15 @@ export namespace CardVaultItemState {
       | 'declined'
       | 'recovery_required';
 
+    /**
+     * The Link spend request's credential_type, set when authorize sends the request
+     * to Link. Absent before authorize and after Link rejects the request; a ready
+     * card without it fills like card. card is a Link virtual card; fill it with field
+     * bindings. link_pay_token is a Link Pay Token that Kernel supplies through the
+     * checkout's Link WebMCP tool; fill it without fields.
+     */
+    credential_type?: 'card' | 'link_pay_token';
+
     domains?: Array<string>;
 
     masks?: LinkCardState.Masks;
@@ -2639,8 +2648,8 @@ export interface PaymentRequestVaultItem {
    * be changed with PATCH until the card is authorized at a checkout. Authorize it
    * with the browser at final checkout: Kernel inspects the checkout through WebMCP
    * and internally chooses a merchant-bound Link Pay Token when supported or a
-   * virtual card otherwise. Callers never receive or choose how the credential is
-   * delivered.
+   * virtual card otherwise. Callers do not choose how the credential is delivered;
+   * after authorize, state.credential_type reports it.
    */
   spec: PaymentRequestVaultItemSpec;
 
@@ -2704,8 +2713,8 @@ export namespace PaymentRequestVaultItem {
  * be changed with PATCH until the card is authorized at a checkout. Authorize it
  * with the browser at final checkout: Kernel inspects the checkout through WebMCP
  * and internally chooses a merchant-bound Link Pay Token when supported or a
- * virtual card otherwise. Callers never receive or choose how the credential is
- * delivered.
+ * virtual card otherwise. Callers do not choose how the credential is delivered;
+ * after authorize, state.credential_type reports it.
  */
 export type PaymentRequestVaultItemSpec =
   | PaymentRequestVaultItemSpec.LinkCardVaultItemSpec
@@ -2717,8 +2726,8 @@ export namespace PaymentRequestVaultItemSpec {
    * be changed with PATCH until the card is authorized at a checkout. Authorize it
    * with the browser at final checkout: Kernel inspects the checkout through WebMCP
    * and internally chooses a merchant-bound Link Pay Token when supported or a
-   * virtual card otherwise. Callers never receive or choose how the credential is
-   * delivered.
+   * virtual card otherwise. Callers do not choose how the credential is delivered;
+   * after authorize, state.credential_type reports it.
    */
   export interface LinkCardVaultItemSpec {
     /**
@@ -2870,6 +2879,15 @@ export namespace PaymentRequestVaultItemState {
       | 'declined'
       | 'recovery_required';
 
+    /**
+     * The Link spend request's credential_type, set when authorize sends the request
+     * to Link. Absent before authorize and after Link rejects the request; a ready
+     * card without it fills like card. card is a Link virtual card; fill it with field
+     * bindings. link_pay_token is a Link Pay Token that Kernel supplies through the
+     * checkout's Link WebMCP tool; fill it without fields.
+     */
+    credential_type?: 'card' | 'link_pay_token';
+
     domains?: Array<string>;
 
     masks?: LinkCardState.Masks;
@@ -3465,8 +3483,8 @@ export namespace VaultItem {
      * be changed with PATCH until the card is authorized at a checkout. Authorize it
      * with the browser at final checkout: Kernel inspects the checkout through WebMCP
      * and internally chooses a merchant-bound Link Pay Token when supported or a
-     * virtual card otherwise. Callers never receive or choose how the credential is
-     * delivered.
+     * virtual card otherwise. Callers do not choose how the credential is delivered;
+     * after authorize, state.credential_type reports it.
      */
     spec: ItemsAPI.CardVaultItemSpec;
 
@@ -3757,8 +3775,8 @@ export namespace VaultItemOperationResponse {
      * be changed with PATCH until the card is authorized at a checkout. Authorize it
      * with the browser at final checkout: Kernel inspects the checkout through WebMCP
      * and internally chooses a merchant-bound Link Pay Token when supported or a
-     * virtual card otherwise. Callers never receive or choose how the credential is
-     * delivered.
+     * virtual card otherwise. Callers do not choose how the credential is delivered;
+     * after authorize, state.credential_type reports it.
      */
     spec: ItemsAPI.CardVaultItemSpec;
 
@@ -4411,8 +4429,8 @@ export declare namespace ItemUpdateParams {
      * The spec can be changed with PATCH until the card is authorized at a checkout.
      * Authorize it with the browser at final checkout: Kernel inspects the checkout
      * through WebMCP and internally chooses a merchant-bound Link Pay Token when
-     * supported or a virtual card otherwise. Callers never receive or choose how the
-     * credential is delivered.
+     * supported or a virtual card otherwise. Callers do not choose how the credential
+     * is delivered; after authorize, state.credential_type reports it.
      */
     spec: CardVaultItemSpec;
 
@@ -4433,8 +4451,8 @@ export declare namespace ItemUpdateParams {
      * The spec can be changed with PATCH until the card is authorized at a checkout.
      * Authorize it with the browser at final checkout: Kernel inspects the checkout
      * through WebMCP and internally chooses a merchant-bound Link Pay Token when
-     * supported or a virtual card otherwise. Callers never receive or choose how the
-     * credential is delivered.
+     * supported or a virtual card otherwise. Callers do not choose how the credential
+     * is delivered; after authorize, state.credential_type reports it.
      */
     spec: PaymentRequestVaultItemSpec;
 
@@ -5213,8 +5231,8 @@ export declare namespace ItemUpsertParams {
      * The spec can be changed with PATCH until the card is authorized at a checkout.
      * Authorize it with the browser at final checkout: Kernel inspects the checkout
      * through WebMCP and internally chooses a merchant-bound Link Pay Token when
-     * supported or a virtual card otherwise. Callers never receive or choose how the
-     * credential is delivered.
+     * supported or a virtual card otherwise. Callers do not choose how the credential
+     * is delivered; after authorize, state.credential_type reports it.
      */
     spec: CardVaultItemSpec;
 
@@ -5235,8 +5253,8 @@ export declare namespace ItemUpsertParams {
      * The spec can be changed with PATCH until the card is authorized at a checkout.
      * Authorize it with the browser at final checkout: Kernel inspects the checkout
      * through WebMCP and internally chooses a merchant-bound Link Pay Token when
-     * supported or a virtual card otherwise. Callers never receive or choose how the
-     * credential is delivered.
+     * supported or a virtual card otherwise. Callers do not choose how the credential
+     * is delivered; after authorize, state.credential_type reports it.
      */
     spec: PaymentRequestVaultItemSpec;
 

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.144.0'; // x-release-please-version
+export const VERSION = '0.145.0'; // x-release-please-version