release: 0.111.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.110.0"
+  ".": "0.111.0"
 }

.stats.yml

@@ -1 +1 @@
-configured_endpoints: 165
+configured_endpoints: 169

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.111.0](https://github.com/kernel/kernel-node-sdk/compare/v0.110.0...v0.111.0) (2026-09-22)
+
+
+### Features
+
+* Allow managed auth logins to disable learned skills ([44a8405](https://github.com/kernel/kernel-node-sdk/commit/44a84053583ee6cc6a9d4dd606e5ea451df84639))
+* Distinguish optimistic managed auth reauth ([3e5f69d](https://github.com/kernel/kernel-node-sdk/commit/3e5f69d8cdeacb19c724492b3f7b1807e5bd4410))
+* Implement Search API v1 providers ([114768a](https://github.com/kernel/kernel-node-sdk/commit/114768a44145ce1eaaf13345bf2f5ae665b7947a))
+* Persist stable managed auth completion timestamps ([5495ce6](https://github.com/kernel/kernel-node-sdk/commit/5495ce64ac30df65e4550101a3e206b1bf011cb5))
+* Publish restricted_route_unavailable and unknown proxy_error codes ([e1593e6](https://github.com/kernel/kernel-node-sdk/commit/e1593e60bd25ccf001acf7ad35ebc46e1c00dffc))
+* Support native prepared Adyen Sessions checkout ([53311cd](https://github.com/kernel/kernel-node-sdk/commit/53311cd171547408c410b4389197abb8b100febc))
+
 ## [0.110.0](https://github.com/kernel/kernel-node-sdk/compare/v0.109.0...v0.110.0) (2026-09-18)
 
 

api.md

@@ -654,3 +654,43 @@ Methods:
 - <code title="delete /org/credential_providers/{id}">client.credentialProviders.<a href="./src/resources/credential-providers.ts">delete</a>(id) -> void</code>
 - <code title="get /org/credential_providers/{id}/items">client.credentialProviders.<a href="./src/resources/credential-providers.ts">listItems</a>(id) -> CredentialProviderListItemsResponse</code>
 - <code title="post /org/credential_providers/{id}/test">client.credentialProviders.<a href="./src/resources/credential-providers.ts">test</a>(id) -> CredentialProviderTestResult</code>
+
+# Search
+
+Types:
+
+- <code><a href="./src/resources/search/search.ts">Attempt</a></code>
+- <code><a href="./src/resources/search/search.ts">ProviderTarget</a></code>
+- <code><a href="./src/resources/search/search.ts">Request</a></code>
+- <code><a href="./src/resources/search/search.ts">Result</a></code>
+- <code><a href="./src/resources/search/search.ts">Search</a></code>
+- <code><a href="./src/resources/search/search.ts">Strategy</a></code>
+- <code><a href="./src/resources/search/search.ts">Usage</a></code>
+- <code><a href="./src/resources/search/search.ts">Warning</a></code>
+
+Methods:
+
+- <code title="post /search">client.search.<a href="./src/resources/search/search.ts">create</a>({ ...params }) -> Search</code>
+- <code title="get /search/{id}">client.search.<a href="./src/resources/search/search.ts">retrieve</a>(id) -> Search</code>
+
+## Contents
+
+Types:
+
+- <code><a href="./src/resources/search/contents.ts">FetchRequest</a></code>
+- <code><a href="./src/resources/search/contents.ts">Response</a></code>
+
+Methods:
+
+- <code title="post /search/{id}/contents">client.search.contents.<a href="./src/resources/search/contents.ts">fetch</a>(id, { ...params }) -> void</code>
+
+## Providers
+
+Types:
+
+- <code><a href="./src/resources/search/providers.ts">Provider</a></code>
+- <code><a href="./src/resources/search/providers.ts">ProviderListResponse</a></code>
+
+Methods:
+
+- <code title="get /search/providers">client.search.providers.<a href="./src/resources/search/providers.ts">list</a>({ ...params }) -> ProviderListResponse</code>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.110.0",
+  "version": "0.111.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -216,6 +216,18 @@ import {
   ProjectsOffsetPagination,
   UpdateProjectRequest,
 } from './resources/projects/projects';
+import {
+  Attempt,
+  ProviderTarget,
+  Request,
+  Result,
+  Search,
+  SearchCreateParams,
+  SearchResource,
+  Strategy,
+  Usage,
+  Warning,
+} from './resources/search/search';
 import { Telemetry } from './resources/telemetry/telemetry';
 import {
   Vault,
@@ -1104,6 +1116,10 @@ export class Kernel {
    * Configure external credential providers like 1Password.
    */
   credentialProviders: API.CredentialProviders = new API.CredentialProviders(this);
+  /**
+   * Search the web and retrieve content for selected results.
+   */
+  search: API.SearchResource = new API.SearchResource(this);
 }
 
 Kernel.Deployments = Deployments;
@@ -1125,6 +1141,7 @@ Kernel.Organization = Organization;
 Kernel.AuditLogs = AuditLogs;
 Kernel.APIKeys = APIKeys;
 Kernel.CredentialProviders = CredentialProviders;
+Kernel.SearchResource = SearchResource;
 
 export declare namespace Kernel {
   export type RequestOptions = Opts.RequestOptions;
@@ -1358,6 +1375,19 @@ export declare namespace Kernel {
     type CredentialProviderListParams as CredentialProviderListParams,
   };
 
+  export {
+    SearchResource as SearchResource,
+    type Attempt as Attempt,
+    type ProviderTarget as ProviderTarget,
+    type Request as Request,
+    type Result as Result,
+    type Search as Search,
+    type Strategy as Strategy,
+    type Usage as Usage,
+    type Warning as Warning,
+    type SearchCreateParams as SearchCreateParams,
+  };
+
   export type AppAction = API.AppAction;
   export type BrowserExtension = API.BrowserExtension;
   export type BrowserProfile = API.BrowserProfile;

src/resources/auth/connections.ts

@@ -314,16 +314,18 @@ export interface ManagedAuth {
   browser_telemetry?: ManagedAuth.BrowserTelemetry | null;
 
   /**
-   * Whether Kernel can automatically re-authenticate this connection when the
-   * session expires. Requires a prior successful login plus either a Kernel
-   * credential or an external credential reference. See `can_reauth_reason` for the
-   * specific outcome.
+   * Whether this connection's stored requirements are eligible for unattended
+   * re-authentication. A true value can represent either fully satisfiable
+   * requirements or a best-effort attempt. It does not account for whether automatic
+   * re-authentication is enabled or parent workflow state such as an active flow or
+   * circuit-breaker cooldown, so it does not guarantee an attempt on the next health
+   * check. See `can_reauth_reason` for the specific outcome.
    */
   can_reauth?: boolean;
 
   /**
    * Machine-readable reason for the current value of `can_reauth`. Affirmative
-   * values (re-auth is possible):
+   * values (requirements are eligible for unattended re-authentication):
    *
    * - `external_credential` — an external credential provider is attached
    * - `cua_has_credential` — CUA flow with a stored credential
@@ -332,8 +334,12 @@ export interface ManagedAuth {
    * - `viable_plans_found` — at least one stored login plan can be replayed
    * - `no_requirements_recorded` — no recorded credential requirements to fail
    *   against
-   * - `totp_reauth_allowed` — TOTP is the only recorded requirement and is safe to
-   *   attempt automatically
+   * - `totp_reauth_allowed` — TOTP is the only recorded requirement and a stored
+   *   secret can generate the code
+   * - `optimistic_totp_attempt` — TOTP was previously required but no reusable
+   *   secret is stored; the connection remains eligible for a
+   *   circuit-breaker-bounded attempt because the site may not challenge returning
+   *   sessions
    * - `requirements_satisfiable` — recorded requirements contain no recognized
    *   blocker
    *
@@ -363,6 +369,7 @@ export interface ManagedAuth {
     | 'viable_plans_found'
     | 'no_requirements_recorded'
     | 'totp_reauth_allowed'
+    | 'optimistic_totp_attempt'
     | 'requirements_satisfiable'
     | 'no_prior_successful_login'
     | 'no_credential'
@@ -1298,6 +1305,13 @@ export interface ManagedAuthTimelineEvent {
    */
   browser_session_id?: string;
 
+  /**
+   * When the login/reauth attempt first reached a terminal status. Stable across
+   * retries and subsequent cleanup writes. Absent for in-progress attempts, health
+   * checks, and historical attempts without a recorded completion time.
+   */
+  completed_at?: string;
+
   /**
    * Machine-readable error code. Present when a login/reauth event failed.
    */
@@ -2478,6 +2492,13 @@ export interface ConnectionLoginParams {
    * When omitted, the connection's record_session default is used.
    */
   record_session?: boolean;
+
+  /**
+   * Controls whether this login reads and writes learned domain skills. Automatic
+   * reauths inherit the selected mode until a later accepted login sets enabled or
+   * omits this field. Defaults to enabled when omitted.
+   */
+  skill_mode?: 'enabled' | 'disabled';
 }
 
 export namespace ConnectionLoginParams {

src/resources/browsers/telemetry.ts

@@ -4338,20 +4338,25 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
-     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
-     * values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout,
+     * origin_response_incomplete, proxy_unavailable, restricted_route_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. A header value
+     * the browser image does not recognize is reported as unknown, with the header
+     * value in raw_code.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
       | 'provider_rejected'
       | 'origin_tls_timeout'
+      | 'origin_response_incomplete'
       | 'proxy_unavailable'
+      | 'restricted_route_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'
-      | 'upstream_connect_failed';
+      | 'upstream_connect_failed'
+      | 'unknown';
 
     /**
      * CDP request identifier matching the originating request.
@@ -4368,6 +4373,14 @@ export namespace BrowserProxyErrorEvent {
      */
     method?: string;
 
+    /**
+     * Sanitized X-Kernel-Proxy-Error header value, present only when code is unknown.
+     * Surrounding whitespace is removed, the value is lowercased, characters outside
+     * [a-z0-9_] are replaced with \_, and the result is truncated to at most 64
+     * characters.
+     */
+    raw_code?: string;
+
     /**
      * CDP Network.ResourceType for the request, when known.
      */

src/resources/index.ts

@@ -185,6 +185,18 @@ export {
   type ProxyCheckParams,
   type ProxyListResponsesOffsetPagination,
 } from './proxies';
+export {
+  SearchResource,
+  type Attempt,
+  type ProviderTarget,
+  type Request,
+  type Result,
+  type Search,
+  type Strategy,
+  type Usage,
+  type Warning,
+  type SearchCreateParams,
+} from './search/search';
 export { Telemetry } from './telemetry/telemetry';
 export {
   VaultProviderConfigs,

src/resources/search.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './search/index';