diff --git a/.release-please-manifest.json b/.release-please-manifest.json index ac48118..2fb68e4 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.144.0" + ".": "0.145.0" } \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 7a11db5..ea3e8f1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## [0.145.0](https://github.com/kernel/kernel-go-sdk/compare/v0.144.0...v0.145.0) (2026-11-10) + + +### Features + +* Discard browser sessions on immediate API key revocation ([#5272](https://github.com/kernel/kernel-go-sdk/issues/5272)) ([88ae60c](https://github.com/kernel/kernel-go-sdk/commit/88ae60c6ebd6479df4019d3d88bd7ec5cb8ae571)) +* Expose Link card credential_type and explain pay token fill rejections ([812ff8e](https://github.com/kernel/kernel-go-sdk/commit/812ff8e625b47bcdc109ee5c84b265210c9d4075)) + ## [0.144.0](https://github.com/kernel/kernel-go-sdk/compare/v0.143.0...v0.144.0) (2026-11-09) diff --git a/README.md b/README.md index 9a2d0d8..1b42508 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ Or to pin the version: ```sh -go get -u 'github.com/kernel/kernel-go-sdk@v0.144.0' +go get -u 'github.com/kernel/kernel-go-sdk@v0.145.0' ``` diff --git a/apikey.go b/apikey.go index bfcce96..dbcc4b6 100644 --- a/apikey.go +++ b/apikey.go @@ -98,8 +98,9 @@ func (r *APIKeyService) ListAutoPaging(ctx context.Context, query APIKeyListPara return pagination.NewOffsetPaginationAutoPager(r.List(ctx, query, opts...)) } -// Delete an API key. A key cannot delete itself; use a different key to delete -// this one. +// Delete an API key and asynchronously end browser sessions attributed to it, +// discarding unsaved profile changes. A key cannot delete itself; use a different +// key to delete this one. If cleanup cannot be registered, the key is not deleted. func (r *APIKeyService) Delete(ctx context.Context, id string, opts ...option.RequestOption) (err error) { opts = slices.Concat(r.Options, opts) opts = append([]option.RequestOption{option.WithHeader("Accept", "*/*")}, opts...) @@ -114,7 +115,11 @@ func (r *APIKeyService) Delete(ctx context.Context, id string, opts ...option.Re // Rotate an API key. Issues a new key that copies the name and project of the // rotated key, and schedules the rotated key to expire after a grace period so -// in-flight callers can swap over. The new plaintext key is returned once. +// in-flight callers can swap over. The new plaintext key is returned once. With +// expire_in_days set to 0, browser sessions attributed to the old key are ended +// asynchronously and unsaved profile changes are discarded. Grace-period and +// natural expiry do not end existing browsers. If cleanup cannot be registered, an +// immediate rotation is not committed. func (r *APIKeyService) Rotate(ctx context.Context, id string, body APIKeyRotateParams, opts ...option.RequestOption) (res *CreatedAPIKey, err error) { opts = slices.Concat(r.Options, opts) if id == "" { diff --git a/internal/version.go b/internal/version.go index 031b1dc..dcdb608 100644 --- a/internal/version.go +++ b/internal/version.go @@ -2,4 +2,4 @@ package internal -const PackageVersion = "0.144.0" // x-release-please-version +const PackageVersion = "0.145.0" // x-release-please-version diff --git a/vaultitem.go b/vaultitem.go index 4b9c50a..6bc58cf 100644 --- a/vaultitem.go +++ b/vaultitem.go @@ -770,8 +770,8 @@ func (r CardVaultItemSpecUnion) ToParam() CardVaultItemSpecUnionParam { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a -// virtual card otherwise. Callers never receive or choose how the credential is -// delivered. +// virtual card otherwise. Callers do not choose how the credential is delivered; +// after authorize, state.credential_type reports it. type CardVaultItemSpecLink struct { // Integer amount in minor currency units, at most 50000. With recurring, the // spending limit per period, not a lifetime total. @@ -1292,8 +1292,8 @@ func init() { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a -// virtual card otherwise. Callers never receive or choose how the credential is -// delivered. +// virtual card otherwise. Callers do not choose how the credential is delivered; +// after authorize, state.credential_type reports it. // // The properties Amount, Context, Currency, MerchantName, MerchantURL, // PaymentMethodID, Provider, Wallet are required. @@ -1476,9 +1476,11 @@ func (r *CardVaultItemSpecAgentcardParam) UnmarshalJSON(data []byte) error { // Use the methods beginning with 'As' to cast the union to one of its variants. type CardVaultItemStateUnion struct { // Any of "link", "agentcard", "kernel", "shop_pay", "vgs". - Provider string `json:"provider"` - Status string `json:"status"` - Domains []string `json:"domains"` + Provider string `json:"provider"` + Status string `json:"status"` + // This field is from variant [CardVaultItemStateLink]. + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` // This field is a union of [CardVaultItemStateLinkMasks], // [CardVaultItemStateAgentcardMasks], [KernelCardStateMasks], // [ShopPayCardStateMasks], [VgsCardStateMasks] @@ -1499,6 +1501,7 @@ type CardVaultItemStateUnion struct { JSON struct { Provider respjson.Field Status respjson.Field + CredentialType respjson.Field Domains respjson.Field Masks respjson.Field StatusReason respjson.Field @@ -1619,19 +1622,28 @@ type CardVaultItemStateLink struct { // // Any of "requested", "pending_authorization", "ready", "consumed", "expired", // "declined", "recovery_required". - Status string `json:"status" api:"required"` - Domains []string `json:"domains"` - Masks CardVaultItemStateLinkMasks `json:"masks"` - StatusReason string `json:"status_reason"` + Status string `json:"status" api:"required"` + // The Link spend request's credential_type, set when authorize sends the request + // to Link. Absent before authorize and after Link rejects the request; a ready + // card without it fills like card. card is a Link virtual card; fill it with field + // bindings. link_pay_token is a Link Pay Token that Kernel supplies through the + // checkout's Link WebMCP tool; fill it without fields. + // + // Any of "card", "link_pay_token". + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` + Masks CardVaultItemStateLinkMasks `json:"masks"` + StatusReason string `json:"status_reason"` // JSON contains metadata for fields, check presence with [respjson.Field.Valid]. JSON struct { - Provider respjson.Field - Status respjson.Field - Domains respjson.Field - Masks respjson.Field - StatusReason respjson.Field - ExtraFields map[string]respjson.Field - raw string + Provider respjson.Field + Status respjson.Field + CredentialType respjson.Field + Domains respjson.Field + Masks respjson.Field + StatusReason respjson.Field + ExtraFields map[string]respjson.Field + raw string } `json:"-"` } @@ -5150,8 +5162,8 @@ type PaymentRequestVaultItem struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec PaymentRequestVaultItemSpecUnion `json:"spec" api:"required"` // Issued Link cards retain encrypted card material for the fill operation. Link // cards do not expose aliases or support egress substitution. @@ -5348,8 +5360,8 @@ func (r PaymentRequestVaultItemSpecUnion) ToParam() PaymentRequestVaultItemSpecU // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a -// virtual card otherwise. Callers never receive or choose how the credential is -// delivered. +// virtual card otherwise. Callers do not choose how the credential is delivered; +// after authorize, state.credential_type reports it. type PaymentRequestVaultItemSpecLink struct { // Integer amount in minor currency units, at most 50000. With recurring, the // spending limit per period, not a lifetime total. @@ -5678,8 +5690,8 @@ func init() { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a -// virtual card otherwise. Callers never receive or choose how the credential is -// delivered. +// virtual card otherwise. Callers do not choose how the credential is delivered; +// after authorize, state.credential_type reports it. // // The properties Amount, Context, Currency, MerchantName, MerchantURL, // PaymentMethodID, Provider, Wallet are required. @@ -5822,9 +5834,11 @@ func (r *PaymentRequestVaultItemSpecLinkTotalParam) UnmarshalJSON(data []byte) e // Use the methods beginning with 'As' to cast the union to one of its variants. type PaymentRequestVaultItemStateUnion struct { // Any of "link", "kernel". - Provider string `json:"provider"` - Status string `json:"status"` - Domains []string `json:"domains"` + Provider string `json:"provider"` + Status string `json:"status"` + // This field is from variant [PaymentRequestVaultItemStateLink]. + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` // This field is a union of [PaymentRequestVaultItemStateLinkMasks], // [KernelCardStateMasks] Masks PaymentRequestVaultItemStateUnionMasks `json:"masks"` @@ -5838,6 +5852,7 @@ type PaymentRequestVaultItemStateUnion struct { JSON struct { Provider respjson.Field Status respjson.Field + CredentialType respjson.Field Domains respjson.Field Masks respjson.Field StatusReason respjson.Field @@ -5928,19 +5943,28 @@ type PaymentRequestVaultItemStateLink struct { // // Any of "requested", "pending_authorization", "ready", "consumed", "expired", // "declined", "recovery_required". - Status string `json:"status" api:"required"` - Domains []string `json:"domains"` - Masks PaymentRequestVaultItemStateLinkMasks `json:"masks"` - StatusReason string `json:"status_reason"` + Status string `json:"status" api:"required"` + // The Link spend request's credential_type, set when authorize sends the request + // to Link. Absent before authorize and after Link rejects the request; a ready + // card without it fills like card. card is a Link virtual card; fill it with field + // bindings. link_pay_token is a Link Pay Token that Kernel supplies through the + // checkout's Link WebMCP tool; fill it without fields. + // + // Any of "card", "link_pay_token". + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` + Masks PaymentRequestVaultItemStateLinkMasks `json:"masks"` + StatusReason string `json:"status_reason"` // JSON contains metadata for fields, check presence with [respjson.Field.Valid]. JSON struct { - Provider respjson.Field - Status respjson.Field - Domains respjson.Field - Masks respjson.Field - StatusReason respjson.Field - ExtraFields map[string]respjson.Field - raw string + Provider respjson.Field + Status respjson.Field + CredentialType respjson.Field + Domains respjson.Field + Masks respjson.Field + StatusReason respjson.Field + ExtraFields map[string]respjson.Field + raw string } `json:"-"` } @@ -7298,8 +7322,9 @@ type VaultItemUnionState struct { Status string `json:"status"` StatusReason string `json:"status_reason"` // This field is from variant [WalletVaultItemStateUnion]. - UserID string `json:"user_id"` - Domains []string `json:"domains"` + UserID string `json:"user_id"` + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` // This field is a union of [CardVaultItemStateLinkMasks], // [CardVaultItemStateAgentcardMasks], [KernelCardStateMasks], // [ShopPayCardStateMasks], [VgsCardStateMasks], @@ -7332,6 +7357,7 @@ type VaultItemUnionState struct { Status respjson.Field StatusReason respjson.Field UserID respjson.Field + CredentialType respjson.Field Domains respjson.Field Masks respjson.Field Aliases respjson.Field @@ -7568,8 +7594,8 @@ type VaultItemCard struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec CardVaultItemSpecUnion `json:"spec" api:"required"` // Issued Link cards retain encrypted card material for the fill operation. Link // cards do not expose aliases or support egress substitution. @@ -8462,8 +8488,9 @@ type VaultItemOperationResponseUnionState struct { Status string `json:"status"` StatusReason string `json:"status_reason"` // This field is from variant [WalletVaultItemStateUnion]. - UserID string `json:"user_id"` - Domains []string `json:"domains"` + UserID string `json:"user_id"` + CredentialType string `json:"credential_type"` + Domains []string `json:"domains"` // This field is a union of [CardVaultItemStateLinkMasks], // [CardVaultItemStateAgentcardMasks], [KernelCardStateMasks], // [ShopPayCardStateMasks], [VgsCardStateMasks], @@ -8496,6 +8523,7 @@ type VaultItemOperationResponseUnionState struct { Status respjson.Field StatusReason respjson.Field UserID respjson.Field + CredentialType respjson.Field Domains respjson.Field Masks respjson.Field Aliases respjson.Field @@ -8737,8 +8765,8 @@ type VaultItemOperationResponseCardVaultItem struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec CardVaultItemSpecUnion `json:"spec" api:"required"` // Issued Link cards retain encrypted card material for the fill operation. Link // cards do not expose aliases or support egress substitution. @@ -10176,8 +10204,8 @@ type VaultItemUpdateParamsBodyCardVaultItemUpdateRequest struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec CardVaultItemSpecUnionParam `json:"spec,omitzero" api:"required"` // Any of "card". Type string `json:"type,omitzero"` @@ -10204,8 +10232,8 @@ type VaultItemUpdateParamsBodyPaymentRequestVaultItemUpdateRequest struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec PaymentRequestVaultItemSpecUnionParam `json:"spec,omitzero" api:"required"` // Any of "payment_request". Type string `json:"type,omitzero" api:"required"` @@ -11219,8 +11247,8 @@ type VaultItemUpsertParamsBodyCard struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec CardVaultItemSpecUnionParam `json:"spec,omitzero" api:"required"` // This field can be elided, and will marshal its zero value as "card". Type constant.Card `json:"type" default:"card"` @@ -11245,8 +11273,8 @@ type VaultItemUpsertParamsBodyPaymentRequest struct { // be changed with PATCH until the card is authorized at a checkout. Authorize it // with the browser at final checkout: Kernel inspects the checkout through WebMCP // and internally chooses a merchant-bound Link Pay Token when supported or a - // virtual card otherwise. Callers never receive or choose how the credential is - // delivered. + // virtual card otherwise. Callers do not choose how the credential is delivered; + // after authorize, state.credential_type reports it. Spec PaymentRequestVaultItemSpecUnionParam `json:"spec,omitzero" api:"required"` // This field can be elided, and will marshal its zero value as "payment_request". Type constant.PaymentRequest `json:"type" default:"payment_request"`