[kernel-internal]

Summary

• Update the Go SDK to v0.145.0.

Coverage

CLI coverage update for Kernel Go SDK v0.145.0

Summary

• Updated github.com/kernel/kernel-go-sdk from v0.144.0 to v0.145.0 in go.mod and go.sum.
• Added the new Link card/payment-request response field state.credential_type to the CLI's display-safe vault output.
  • JSON output now preserves card or link_pay_token.
  • Human-readable item output shows the credential type when present.
  • Runtime guidance explains that link_pay_token fills without field bindings, while card fills with the advertised card fields.
  • A ready Link item from an older/partial response with no credential_type is treated as card, matching the API contract.
• Updated API-key delete and rotate help and confirmation warnings for their browser-session cleanup behavior.
• Updated reserved ISP IP pagination for the API's increased 1000-item request limit. kernel proxy-ips list --per-page now accepts up to 999 items while reserving one API result for the required pagination lookahead.

No new commands or flags were needed.

SDK and CLI coverage review

A complete enumeration found:

• 178 SDK methods in api.md.
• 6 SDK methods excluded because their Config Registry operations have x-cli-skip: true.
• 172 SDK methods requiring CLI coverage, all mapped to existing CLI commands.
• 238 user-facing CLI command nodes enumerated with their flags.
• No missing commands.
• No missing request flags or established JSON/spec-file inputs.

The v0.144.0 to v0.145.0 SDK diff adds no methods and no request parameter fields. The only new SDK field is the response-only Link credential_type, which is now surfaced by vault item output.

Help text synchronized with the API specification

Updated CLI text and behavior to follow:

• LinkCardState.credential_type (card or link_pay_token)
  • Documents that Kernel chooses the delivery type during authorization.
  • Documents that the field is absent before authorization and after Link rejects the request.
  • Documents that a ready item without the field fills like card.
• Link card/payment-request specification description
  • Shared wallet, card, payment-request, and item-operation help now tells users to inspect state.credential_type rather than choose a delivery type.
• DELETE /org/api_keys/{id}
  • Delete help and confirmation now warn that attributed browser sessions end asynchronously and unsaved profile changes are discarded.
  • Help notes that deletion is not completed if cleanup cannot be scheduled and that a key cannot delete itself.
• POST /org/api_keys/{id}/rotate
  • Rotate help and --expire-in-days usage now explain the immediate-expiry cleanup behavior.
  • Help distinguishes immediate rotation from grace-period or natural expiry, which do not end existing browser sessions.
  • The immediate-rotation confirmation includes the session and unsaved-profile warning.
• GET /proxy_ips query parameter limit
  • The API maximum increased from 100 to 1000. Because the CLI requests one extra item to determine whether another page exists, the user-facing --per-page maximum is 999.

Intentional exclusions

• Config Registry commands were not added because all six corresponding SDK operations are marked x-cli-skip: true.
• credential_type is response state, not user input, so it is displayed rather than exposed as a flag.
• Deprecated SDK compatibility fields continue to use their existing replacement flags or internal compatibility serialization; no duplicate flags were added.

Validation

• go test ./... — passed.
• go build ./... — passed.
• go vet ./... — passed.
• Built the final CLI binary from ./cmd/kernel — passed.
• Help smoke tests confirmed the API-key cleanup text, Link state.credential_type guidance, and --per-page 1-999 usage.
• Local validation confirmed --per-page 1000 fails before an API request with the expected range error.
• A real API read with --per-page 999 reached the service, but the test organization does not have reserved ISP IPs enabled, so a successful reserved-IP response could not be verified.
• Link credential-type output and API-key cleanup messaging were validated with unit tests rather than destructive live payment/API-key operations.

Validation

• Go build
• Go vet
• Go tests

---

Note

Low Risk
Mostly documentation, display filtering, and client-side pagination validation on an SDK bump; no new destructive defaults beyond clearer confirmations for API key operations.

Overview
Bumps github.com/kernel/kernel-go-sdk to v0.145.0 and aligns the CLI with the new API semantics.

Link vault items now surface state.credential_type (card or link_pay_token) in filtered JSON and human item output, with fill guidance that matches each type and treats missing credential_type on ready items like card. Shared Link checkout help documents that Kernel picks the delivery type at authorize time.

API key delete and rotate help, flag usage, and confirmation prompts now warn that immediate expiry or deletion asynchronously ends browser sessions tied to the key and discards unsaved profile changes, and clarify grace-period vs immediate rotation.

Reserved ISP proxy listing raises the effective --per-page ceiling to 999 (one slot reserved for pagination lookahead against the API’s 1000-item limit) and rejects larger values before calling the API.

Unit tests lock in the new help strings, pagination limits, and Link credential-type output.

^{Reviewed by Cursor Bugbot for commit b61594f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.144.0 ⏵ v0.145.0	+1

View full report