[kernel-internal]

Summary

• Document @onkernel/sdk changes through 0.142.0.

Changes

Documents @onkernel/sdk changes through 0.142.0.

Pages changed

• SDK 0.140.0 — vaults/1password.mdx: updated 1pw_fill guidance after removal of KERNEL's origin gate. The 1Password extension now decides whether an approved login matches the page, entry_id is required only when the page doesn't identify one approved entry, and the obsolete destination_denied outcome is removed.
• SDK 0.140.0 — integrations/wallets/stripe-link.mdx: documented imported Link grants with authorization.token_refresh: "customer", conditional refresh-token input, the wallet update_access_token operation, and its required vault permissions.
• SDK 0.141.0 — integrations/wallets/stripe-link.mdx: replaced proactive access-token updates with recovery after 409 access_token_rejected: store a fresh token, then retry the Link operation.
• SDK 0.140.0 — integrations/wallets/overview.mdx: clarified that imported Link grants can use either KERNEL-managed or customer-managed refresh-token rotation.
• SDK 0.140.0 and 0.142.0 — info/api-key-permissions.mdx: added the vaults:write requirement for update_access_token; added reserved ISP IP inventory to proxies:read, including its project- or organization-wide grant requirement; and added ISP exit-IP moves to proxies:write.
• SDK 0.142.0 — proxies/isp.mdx: added the reserved config.ip_address parameter and its conditional country default, and corrected static-IP and allowlist guidance now that reserved allocations can move a proxy to another IP.
• SDK 0.142.0 — proxies/overview.mdx and auth/configuration.mdx: clarified that an ISP proxy's primary IP stays fixed unless the user moves a reserved proxy or the ISP replaces it, while backup failover can temporarily use another IP.
• SDK 0.142.0 — browsers/viewport.mdx: documented the 64-pixel minimum for each headful viewport dimension; headless viewports still accept any positive dimensions.

Missing coverage

• SDK 0.142.0 — the reserved IP inventory methods (proxyIPs.list() and proxyIPs.retrieve(), or proxy_ips in Python), including active versus excluded status and organization/project usage counts, have no guide workflow.
• SDK 0.142.0 — moving an existing ISP proxy with proxies.update(..., { config: { ip_address } }) and filtering proxies.list() by exact ip_address have no guide examples. The ISP page now lists the create-time pinning parameter and corrects the affected behavior statements only.

Languages left unchanged because an SDK lacks the method

• SDK 0.142.0 reserved ISP IP workflows — the checked-out Go SDK doesn't expose the ProxyIPs resource, ISP create/update config.ip_address parameters, or the exact-IP proxy list filter, so existing Go examples remain unchanged.

Validation limitations

None. mint broken-links and git diff --check completed successfully. docs.json wasn't edited, so jq empty docs.json wasn't required.

Validation

• mint broken-links
• docs.json parses
• git diff --check

---

Note

Low Risk
Documentation-only updates to permissions, wallet, proxy, 1Password, and viewport guides; no executable code paths changed.

Overview
Updates public docs to match recent SDK and API behavior—no runtime code.

Link by Stripe — Describes default KERNEL-managed refresh-token rotation, optional authorization.token_refresh: "customer" (access token only in vault, refresh kept in your backend), and recovery after 409/access_token_rejected via update_access_token plus required vaults:write. Wallets overview and item-reference tables reflect the same. API key permissions now call out vaults:write for token replacement and tighten wallet card operations.

ISP proxies — Clarifies that the primary exit IP stays stable unless you move a reserved allocation or the ISP replaces it, with backup failover temporarily using another IP. Documents optional config.ip_address (reserved allocation), country defaulting from that IP when set, and allowlist updates if you move a proxy to a new reserved IP. Overview and managed-auth proxy sections mirror that wording.

1Password autofill — KERNEL no longer gates origin: the extension decides if an approved login matches the page. entry_id is needed when multiple entries are approved and the page origin doesn’t pick one; the obsolete destination_denied fill outcome is removed from the table.

Viewports — Headful sessions require at least 64px width and height; headless still allows any positive size.

API key permissions — proxies:read covers reserved ISP IP inventory (whole project/org grant); proxies:write includes moving ISP proxies to reserved exit IPs.

The PR description notes gaps: no guide yet for reserved IP list/retrieve APIs or proxies.update / list-by-IP workflows; Go examples unchanged where the SDK lacks those methods.

^{Reviewed by Cursor Bugbot for commit 8f87b80. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 6, 2026, 8:51 PM

💡 Tip: Enable Automations to automatically generate PRs for you.