Expose browser pool profile refresh state

.github/workflows/acceptance.yml

@@ -24,6 +24,9 @@ jobs:
           - name: Browser pool
             package: ./internal/resources/browserpool
             project_id_required: true
+          - name: Browser pool data source
+            package: ./internal/datasources/browserpool
+            project_id_required: true
           - name: Project
             package: ./internal/resources/project
             project_id_required: false

docs/acceptance.md

@@ -4,7 +4,7 @@ This document is the live-API release gate for the provider's selected public
 surface. Unit tests remain the fast default. Acceptance tests run after changes
 reach `main`, through explicit local opt-in, or by manual workflow dispatch.
 
-The selected surface contains two managed resources and four read-only data
+The selected surface contains two managed resources and five read-only data
 sources. It does not claim coverage for future or unregistered Kernel objects.
 
 ## Gate Rules
@@ -29,7 +29,7 @@ export KERNEL_ALT_PROJECT_ID=... # optional second project
 export KERNEL_BASE_URL=...       # optional non-production API
 ```
 
-`KERNEL_PROJECT_ID` is required for the browser-pool resource and all four data
+`KERNEL_PROJECT_ID` is required for the browser-pool resource and all five data
 sources. The project resource is organization-scoped and does not require it.
 
 ## Matrix
@@ -38,6 +38,7 @@ sources. The project resource is organization-scoped and does not require it.
 | --- | --- | --- |
 | `kernel_project` resource | `./internal/resources/project` | Create, rename with stable ID, no-drift plan, canonical-ID import, post-import no drift, delete, and HTTP 404 verification. |
 | `kernel_browser_pool` resource | `./internal/resources/browserpool` | Create, durable update with stable ID, no-drift plan, provider-default and explicit project scope, bare and project-qualified import, non-force delete, and HTTP 404 verification. |
+| `kernel_browser_pool` data source | `./internal/datasources/browserpool` | Create a unique browser-pool fixture, read it by canonical ID and exact name with explicit project scope, verify normalized durable configuration and no drift, then delete and require coded `not_found`. |
 | `kernel_project` data source | `./internal/datasources/project` | Create a unique project fixture, read it by ID and exact name, read the provider-default project, verify durable metadata and no drift, then delete and require coded `not_found`. |
 | `kernel_profile` data source | `./internal/datasources/profile` | Create a durable profile fixture through the SDK, read it by ID and exact name with explicit and default project scope, verify durable metadata and no drift, then delete and require coded `not_found`. |
 | `kernel_proxy` data source | `./internal/datasources/proxy` | Create a managed datacenter proxy fixture through the SDK, read it by ID and exact name with explicit and default project scope, verify durable masked metadata and no drift, then delete and require coded `not_found`. |
@@ -53,21 +54,21 @@ Run packages independently for fast failure isolation:
 ```sh
 go test -count=1 -timeout=30m -v ./internal/resources/project -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/datasources/browserpool -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/project -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/profile -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/proxy -run TestAcc
 go test -count=1 -timeout=30m -v ./internal/datasources/extension -run TestAcc
 ```
 
-The `Acceptance` workflow runs the same six packages as separate matrix jobs
+The `Acceptance` workflow runs the same seven packages as separate matrix jobs
 with `fail-fast: false` after changes reach `main` and on manual dispatch.
 
 ## Outside The Selected Surface
 
-The release does not include a browser-pool data source or profile, proxy,
-extension, deployment, app, or API-key resources. Runtime/session operations
-remain outside Terraform. Unregistered surfaces are not acceptance blockers for
-this selected release.
+The release does not include profile, proxy, extension, deployment, app, or
+API-key resources. Runtime/session operations remain outside Terraform.
+Unregistered surfaces are not acceptance blockers for this selected release.
 
 ## Release Record
 

docs/data-sources/browser_pool.md

@@ -0,0 +1,47 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "kernel_browser_pool Data Source - Kernel"
+subcategory: ""
+description: |-
+  Lookup durable Kernel browser pool configuration.
+---
+
+# kernel_browser_pool (Data Source)
+
+Lookup durable Kernel browser pool configuration.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `id` (String) Browser pool ID.
+- `name` (String) Browser pool name for exact lookup.
+- `project_id` (String) Project to look the browser pool up in. Defaults to the provider `project_id`; when neither is set, the API key's project binding determines the project.
+
+### Read-Only
+
+- `chrome_policy` (String) Normalized JSON object of Chrome enterprise policy overrides, if configured.
+- `extension_ids` (List of String) Resolved extension IDs attached to the pool, in load order.
+- `fill_rate_per_minute` (Number) Percentage of the pool filled per minute.
+- `headless` (Boolean) Whether browsers use a headless image.
+- `kiosk_mode` (Boolean) Whether browsers launch in kiosk mode.
+- `profile_id` (String) Resolved profile ID attached to the pool, if any.
+- `proxy_id` (String) Proxy ID attached to browsers in the pool, if any.
+- `refresh_on_profile_update` (Boolean) Whether idle browsers are refreshed when the pool's profile is updated.
+- `size` (Number) Number of browsers maintained in the pool.
+- `start_url` (String) URL opened when a browser is warmed into the pool, if configured.
+- `stealth` (Boolean) Whether browsers launch in stealth mode.
+- `timeout_seconds` (Number) Default idle timeout in seconds for acquired browsers.
+- `viewport` (Attributes) Browser viewport configured for the pool, if any. (see [below for nested schema](#nestedatt--viewport))
+
+<a id="nestedatt--viewport"></a>
+### Nested Schema for `viewport`
+
+Read-Only:
+
+- `height` (Number) Browser window height in pixels.
+- `refresh_rate` (Number) Display refresh rate in Hz, if configured.
+- `width` (Number) Browser window width in pixels.

docs/resources/browser_pool.md

@@ -30,6 +30,7 @@ Kernel browser pool durable configuration.
 - `profile_id` (String) Optional profile ID to load for browsers created by this pool.
 - `project_id` (String) Project this browser pool belongs to. Defaults to the provider `project_id` when unset; when neither is set, the API key's project binding determines the project. Once created the pool keeps its project, and changing this attribute replaces the pool.
 - `proxy_id` (String) Optional proxy ID to use for browsers created by this pool.
+- `refresh_on_profile_update` (Boolean) When true, idle browsers are refreshed when the pool's profile is updated. Requires `profile_id` to be set.
 - `start_url` (String) Optional URL to navigate to when a browser is warmed into the pool.
 - `stealth` (Boolean) Launch browsers in stealth mode.
 - `timeout_seconds` (Number) Default idle timeout in seconds for acquired browsers.