release: 0.111.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.110.0"
+  ".": "0.111.0"
 }

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.111.0](https://github.com/kernel/kernel-node-sdk/compare/v0.110.0...v0.111.0) (2026-09-21)
+
+
+### Features
+
+* Allow managed auth logins to disable learned skills ([44a8405](https://github.com/kernel/kernel-node-sdk/commit/44a84053583ee6cc6a9d4dd606e5ea451df84639))
+* Distinguish optimistic managed auth reauth ([3e5f69d](https://github.com/kernel/kernel-node-sdk/commit/3e5f69d8cdeacb19c724492b3f7b1807e5bd4410))
+* Persist stable managed auth completion timestamps ([5495ce6](https://github.com/kernel/kernel-node-sdk/commit/5495ce64ac30df65e4550101a3e206b1bf011cb5))
+* Publish restricted_route_unavailable and unknown proxy_error codes ([e1593e6](https://github.com/kernel/kernel-node-sdk/commit/e1593e60bd25ccf001acf7ad35ebc46e1c00dffc))
+* Support native prepared Adyen Sessions checkout ([53311cd](https://github.com/kernel/kernel-node-sdk/commit/53311cd171547408c410b4389197abb8b100febc))
+
 ## [0.110.0](https://github.com/kernel/kernel-node-sdk/compare/v0.109.0...v0.110.0) (2026-09-18)
 
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.110.0",
+  "version": "0.111.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/resources/auth/connections.ts

@@ -314,16 +314,18 @@ export interface ManagedAuth {
   browser_telemetry?: ManagedAuth.BrowserTelemetry | null;
 
   /**
-   * Whether Kernel can automatically re-authenticate this connection when the
-   * session expires. Requires a prior successful login plus either a Kernel
-   * credential or an external credential reference. See `can_reauth_reason` for the
-   * specific outcome.
+   * Whether this connection's stored requirements are eligible for unattended
+   * re-authentication. A true value can represent either fully satisfiable
+   * requirements or a best-effort attempt. It does not account for whether automatic
+   * re-authentication is enabled or parent workflow state such as an active flow or
+   * circuit-breaker cooldown, so it does not guarantee an attempt on the next health
+   * check. See `can_reauth_reason` for the specific outcome.
    */
   can_reauth?: boolean;
 
   /**
    * Machine-readable reason for the current value of `can_reauth`. Affirmative
-   * values (re-auth is possible):
+   * values (requirements are eligible for unattended re-authentication):
    *
    * - `external_credential` — an external credential provider is attached
    * - `cua_has_credential` — CUA flow with a stored credential
@@ -332,8 +334,12 @@ export interface ManagedAuth {
    * - `viable_plans_found` — at least one stored login plan can be replayed
    * - `no_requirements_recorded` — no recorded credential requirements to fail
    *   against
-   * - `totp_reauth_allowed` — TOTP is the only recorded requirement and is safe to
-   *   attempt automatically
+   * - `totp_reauth_allowed` — TOTP is the only recorded requirement and a stored
+   *   secret can generate the code
+   * - `optimistic_totp_attempt` — TOTP was previously required but no reusable
+   *   secret is stored; the connection remains eligible for a
+   *   circuit-breaker-bounded attempt because the site may not challenge returning
+   *   sessions
    * - `requirements_satisfiable` — recorded requirements contain no recognized
    *   blocker
    *
@@ -363,6 +369,7 @@ export interface ManagedAuth {
     | 'viable_plans_found'
     | 'no_requirements_recorded'
     | 'totp_reauth_allowed'
+    | 'optimistic_totp_attempt'
     | 'requirements_satisfiable'
     | 'no_prior_successful_login'
     | 'no_credential'
@@ -1298,6 +1305,13 @@ export interface ManagedAuthTimelineEvent {
    */
   browser_session_id?: string;
 
+  /**
+   * When the login/reauth attempt first reached a terminal status. Stable across
+   * retries and subsequent cleanup writes. Absent for in-progress attempts, health
+   * checks, and historical attempts without a recorded completion time.
+   */
+  completed_at?: string;
+
   /**
    * Machine-readable error code. Present when a login/reauth event failed.
    */
@@ -2478,6 +2492,13 @@ export interface ConnectionLoginParams {
    * When omitted, the connection's record_session default is used.
    */
   record_session?: boolean;
+
+  /**
+   * Controls whether this login reads and writes learned domain skills. Automatic
+   * reauths inherit the selected mode until a later accepted login sets enabled or
+   * omits this field. Defaults to enabled when omitted.
+   */
+  skill_mode?: 'enabled' | 'disabled';
 }
 
 export namespace ConnectionLoginParams {

src/resources/browsers/telemetry.ts

@@ -4338,20 +4338,25 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
-     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
-     * values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout,
+     * origin_response_incomplete, proxy_unavailable, restricted_route_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. A header value
+     * the browser image does not recognize is reported as unknown, with the header
+     * value in raw_code.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
       | 'provider_rejected'
       | 'origin_tls_timeout'
+      | 'origin_response_incomplete'
       | 'proxy_unavailable'
+      | 'restricted_route_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'
-      | 'upstream_connect_failed';
+      | 'upstream_connect_failed'
+      | 'unknown';
 
     /**
      * CDP request identifier matching the originating request.
@@ -4368,6 +4373,14 @@ export namespace BrowserProxyErrorEvent {
      */
     method?: string;
 
+    /**
+     * Sanitized X-Kernel-Proxy-Error header value, present only when code is unknown.
+     * Surrounding whitespace is removed, the value is lowercased, characters outside
+     * [a-z0-9_] are replaced with \_, and the result is truncated to at most 64
+     * characters.
+     */
+    raw_code?: string;
+
     /**
      * CDP Network.ResourceType for the request, when known.
      */

src/resources/vaults/items.ts

@@ -259,8 +259,10 @@ export interface AgentcardCheckoutAuthorization {
 
 /**
  * One-use processor-bound checkout preparation. Keep the approval page open
- * through token handoff. The amount is display-only and does not constrain the
- * merchant's eventual charge.
+ * through device handoff, including Adyen encryption. The amount is declared by
+ * the caller and does not constrain the merchant's eventual charge. Adyen device
+ * approval and browser Authorised responses are not capture or fulfillment
+ * evidence.
  */
 export interface AgentcardCheckoutPreparation {
   browser_id: string;
@@ -293,7 +295,13 @@ export interface AgentcardCheckoutPreparation {
   expires_at?: string;
 }
 
-export type AgentcardPreparedProcessor = 'square' | 'braintree' | 'worldpay' | 'bambora' | 'mercado_pago';
+export type AgentcardPreparedProcessor =
+  | 'square'
+  | 'braintree'
+  | 'worldpay'
+  | 'bambora'
+  | 'mercado_pago'
+  | 'adyen';
 
 /**
  * Authorize a Link card using its existing purchase specification. Use only after
@@ -522,8 +530,10 @@ export namespace CardVaultItemState {
 
     /**
      * One-use processor-bound checkout preparation. Keep the approval page open
-     * through token handoff. The amount is display-only and does not constrain the
-     * merchant's eventual charge.
+     * through device handoff, including Adyen encryption. The amount is declared by
+     * the caller and does not constrain the merchant's eventual charge. Adyen device
+     * approval and browser Authorised responses are not capture or fulfillment
+     * evidence.
      */
     preparation?: ItemsAPI.AgentcardCheckoutPreparation;
 
@@ -997,16 +1007,16 @@ export interface FillVaultItemOperationResult {
 }
 
 /**
- * Prepare an unused AgentCard card for a supported tokenization checkout. Deliver
- * the returned approval URL and keep the approval page open. Poll the item until
+ * Prepare an unused AgentCard card for a supported checkout. Deliver the returned
+ * approval URL and keep the approval page open. Poll the item until
  * ready_to_submit, then submit native Pay before preparation.expires_at. Readiness
  * lasts at most 30 seconds. Unused preparations expire automatically. Preparations
  * are single-use even after failure or expiry; do not automatically retry and
  * reconcile uncertain outcomes with the merchant.
  */
 export interface PrepareCheckoutVaultItemOperationRequest {
   /**
-   * Required when preparing an unused AgentCard card for a supported tokenization
+   * Required when preparing an unused AgentCard card for a supported checkout
    * processor. Consent is bound to this browser and declared merchant origin, not a
    * tab. Wait for the item's ready_to_submit status before native Pay and submit
    * within its readiness deadline. Unused preparations expire automatically; every
@@ -1083,7 +1093,7 @@ export namespace VaultCardFillField {
 }
 
 /**
- * Required when preparing an unused AgentCard card for a supported tokenization
+ * Required when preparing an unused AgentCard card for a supported checkout
  * processor. Consent is bound to this browser and declared merchant origin, not a
  * tab. Wait for the item's ready_to_submit status before native Pay and submit
  * within its readiness deadline. Unused preparations expire automatically; every
@@ -1096,8 +1106,8 @@ export interface VaultCheckoutContext {
   browser_id: string;
 
   /**
-   * Use production or sandbox for Square, Braintree and Worldpay; shared for Bambora
-   * and Mercado Pago. Shared endpoints do not establish test mode. Merchant
+   * Use production or sandbox for Square, Braintree, Worldpay and Adyen; shared for
+   * Bambora and Mercado Pago. Shared endpoints do not establish test mode. Merchant
    * credentials/configuration determine processor test mode, independently of the
    * AgentCard credential mode.
    */
@@ -1110,8 +1120,11 @@ export interface VaultCheckoutContext {
   merchant_origin: string;
 
   /**
-   * Tokenization processor. Omit for Square compatibility. Non-Square processors
-   * require multi-processor preparation enablement.
+   * Checkout processor. Omit for Square compatibility. Adyen supports fresh-card
+   * Sessions requests on Adyen hosts only. Use public dummy card fields, not vault
+   * aliases. The unique armed preparation is associated with the subsequent eligible
+   * request from this browser and declared merchant origin; competing preparations
+   * are rejected.
    */
   psp?: AgentcardPreparedProcessor;
 }
@@ -1791,7 +1804,7 @@ export declare namespace ItemPerformOperationParams {
 
     /**
      * Body param: Required when preparing an unused AgentCard card for a supported
-     * tokenization processor. Consent is bound to this browser and declared merchant
+     * checkout processor. Consent is bound to this browser and declared merchant
      * origin, not a tab. Wait for the item's ready_to_submit status before native Pay
      * and submit within its readiness deadline. Unused preparations expire
      * automatically; every preparation is single-use, including after failure or

src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.110.0'; // x-release-please-version
+export const VERSION = '0.111.0'; // x-release-please-version

tests/api-resources/auth/connections.test.ts

@@ -257,6 +257,7 @@ describe('resource connections', () => {
           },
           proxy: { id: 'id', name: 'name' },
           record_session: true,
+          skill_mode: 'enabled',
         },
         { path: '/_stainless_unknown_path' },
       ),