Skip to content

release: 0.143.0 #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hiroTamada merged 2 commits into from
Nov 7, 2026
Merged

release: 0.143.0 #224

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f0ab2b0
feat: chore(stlc): seal custom-code tracking files
kernel-internal[bot] Nov 7, 2026
285ee21
release: 0.143.0
kernel-internal[bot] Nov 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .release-please-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
{
".": "0.142.0"
".": "0.143.0"
}
7 changes: 7 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
# Changelog

## [0.143.0](https://github.com/kernel/kernel-go-sdk/compare/v0.142.0...v0.143.0) (2026-11-07)


### Features

* chore(stlc): seal custom-code tracking files ([f0ab2b0](https://github.com/kernel/kernel-go-sdk/commit/f0ab2b0eeb69704802d77b7e95dfcc12a951963c))

## [0.142.0](https://github.com/kernel/kernel-go-sdk/compare/v0.141.0...v0.142.0) (2026-11-06)


Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Or to pin the version:
<!-- x-release-please-start-version -->

```sh
go get -u 'github.com/kernel/kernel-go-sdk@v0.142.0'
go get -u 'github.com/kernel/kernel-go-sdk@v0.143.0'
```

<!-- x-release-please-end -->
Expand Down
2 changes: 1 addition & 1 deletion internal/version.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@

package internal

const PackageVersion = "0.142.0" // x-release-please-version
const PackageVersion = "0.143.0" // x-release-please-version
166 changes: 122 additions & 44 deletions vaultitem.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,7 +583,9 @@ type CardVaultItemSpecUnion struct {
SingleUseCard KernelSingleUseCard `json:"single_use_card"`
// This field is from variant [VgsCardVaultItemSpec].
Card VgsCardInput `json:"card"`
JSON struct {
// This field is from variant [VgsCardVaultItemSpec].
CardMode VgsCardVaultItemSpecCardMode `json:"card_mode"`
JSON struct {
Amount respjson.Field
Context respjson.Field
Currency respjson.Field
Expand All @@ -605,6 +607,7 @@ type CardVaultItemSpecUnion struct {
MerchantCountry respjson.Field
SingleUseCard respjson.Field
Card respjson.Field
CardMode respjson.Field
raw string
} `json:"-"`
}
Expand Down Expand Up @@ -1071,6 +1074,14 @@ func (u CardVaultItemSpecUnionParam) GetCard() *VgsCardInputParam {
return nil
}

// Returns a pointer to the underlying variant's property, if present.
func (u CardVaultItemSpecUnionParam) GetCardMode() *string {
if vt := u.OfVgs; vt != nil {
return (*string)(&vt.CardMode)
}
return nil
}

// Returns a pointer to the underlying variant's property, if present.
func (u CardVaultItemSpecUnionParam) GetAmount() *int64 {
if vt := u.OfLink; vt != nil {
Expand Down Expand Up @@ -7053,6 +7064,8 @@ type VaultItemUnionSpec struct {
SingleUseCard KernelSingleUseCard `json:"single_use_card"`
// This field is from variant [CardVaultItemSpecUnion].
Card VgsCardInput `json:"card"`
// This field is from variant [CardVaultItemSpecUnion].
CardMode VgsCardVaultItemSpecCardMode `json:"card_mode"`
// This field is from variant [CredentialVaultItemSpecUnion].
Fields []CredentialVaultFieldDefinition `json:"fields"`
Description string `json:"description"`
Expand Down Expand Up @@ -7089,6 +7102,7 @@ type VaultItemUnionSpec struct {
MerchantCountry respjson.Field
SingleUseCard respjson.Field
Card respjson.Field
CardMode respjson.Field
Fields respjson.Field
Description respjson.Field
Requests respjson.Field
Expand Down Expand Up @@ -8211,6 +8225,8 @@ type VaultItemOperationResponseUnionSpec struct {
SingleUseCard KernelSingleUseCard `json:"single_use_card"`
// This field is from variant [CardVaultItemSpecUnion].
Card VgsCardInput `json:"card"`
// This field is from variant [CardVaultItemSpecUnion].
CardMode VgsCardVaultItemSpecCardMode `json:"card_mode"`
// This field is from variant [CredentialVaultItemSpecUnion].
Fields []CredentialVaultFieldDefinition `json:"fields"`
Description string `json:"description"`
Expand Down Expand Up @@ -8247,6 +8263,7 @@ type VaultItemOperationResponseUnionSpec struct {
MerchantCountry respjson.Field
SingleUseCard respjson.Field
Card respjson.Field
CardMode respjson.Field
Fields respjson.Field
Description respjson.Field
Requests respjson.Field
Expand Down Expand Up @@ -8958,19 +8975,28 @@ func (r *VaultWebmcpBindingParam) UnmarshalJSON(data []byte) error {
return apijson.UnmarshalRoot(data, r)
}

// The card's aliases in the customer's VGS vault, its expiry and last four digits.
// Write-only: stored encrypted and never returned in the item, its events or logs.
// A repeated PUT with the same key must send the same card.
// The card supplied to a purchase, as aliases in the customer's VGS vault. With
// card_mode full it is a whole card: a persistent alias of its number, a freshly
// collected volatile alias of its security code, its expiry and its last four
// digits. With card_mode cvc_only it is a CVC alias alone, because the merchant
// holds the rest on file. pan_alias, exp_month, exp_year and last4 are required
// with card_mode full and rejected with card_mode cvc_only. Write-only: stored
// encrypted and never returned in the item, its events or logs. A repeated PUT
// with the same key must send the same card.
type VgsCardInput struct {
// A volatile alias of a freshly collected security code in the customer's vault.
// It must still exist when authorize runs.
// It must still exist when authorize runs. Required in both modes.
CvcAlias string `json:"cvc_alias" api:"required"`
ExpMonth int64 `json:"exp_month" api:"required"`
ExpYear int64 `json:"exp_year" api:"required"`
// The card number's last four digits, checked against the revealed alias.
Last4 string `json:"last4" api:"required"`
// A persistent alias of the card number in the customer's vault.
PanAlias string `json:"pan_alias" api:"required"`
// Required with card_mode full, rejected with card_mode cvc_only.
ExpMonth int64 `json:"exp_month"`
// Required with card_mode full, rejected with card_mode cvc_only.
ExpYear int64 `json:"exp_year"`
// The card number's last four digits, checked against the revealed alias. Required
// with card_mode full, rejected with card_mode cvc_only.
Last4 string `json:"last4"`
// A persistent alias of the card number in the customer's vault. Required with
// card_mode full, rejected with card_mode cvc_only.
PanAlias string `json:"pan_alias"`
// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
JSON struct {
CvcAlias respjson.Field
Expand Down Expand Up @@ -8998,21 +9024,30 @@ func (r VgsCardInput) ToParam() VgsCardInputParam {
return param.Override[VgsCardInputParam](json.RawMessage(r.RawJSON()))
}

// The card's aliases in the customer's VGS vault, its expiry and last four digits.
// Write-only: stored encrypted and never returned in the item, its events or logs.
// A repeated PUT with the same key must send the same card.
// The card supplied to a purchase, as aliases in the customer's VGS vault. With
// card_mode full it is a whole card: a persistent alias of its number, a freshly
// collected volatile alias of its security code, its expiry and its last four
// digits. With card_mode cvc_only it is a CVC alias alone, because the merchant
// holds the rest on file. pan_alias, exp_month, exp_year and last4 are required
// with card_mode full and rejected with card_mode cvc_only. Write-only: stored
// encrypted and never returned in the item, its events or logs. A repeated PUT
// with the same key must send the same card.
//
// The properties CvcAlias, ExpMonth, ExpYear, Last4, PanAlias are required.
// The property CvcAlias is required.
type VgsCardInputParam struct {
// A volatile alias of a freshly collected security code in the customer's vault.
// It must still exist when authorize runs.
// It must still exist when authorize runs. Required in both modes.
CvcAlias string `json:"cvc_alias" api:"required"`
ExpMonth int64 `json:"exp_month" api:"required"`
ExpYear int64 `json:"exp_year" api:"required"`
// The card number's last four digits, checked against the revealed alias.
Last4 string `json:"last4" api:"required"`
// A persistent alias of the card number in the customer's vault.
PanAlias string `json:"pan_alias" api:"required"`
// Required with card_mode full, rejected with card_mode cvc_only.
ExpMonth param.Opt[int64] `json:"exp_month,omitzero"`
// Required with card_mode full, rejected with card_mode cvc_only.
ExpYear param.Opt[int64] `json:"exp_year,omitzero"`
// The card number's last four digits, checked against the revealed alias. Required
// with card_mode full, rejected with card_mode cvc_only.
Last4 param.Opt[string] `json:"last4,omitzero"`
// A persistent alias of the card number in the customer's vault. Required with
// card_mode full, rejected with card_mode cvc_only.
PanAlias param.Opt[string] `json:"pan_alias,omitzero"`

@cursor cursor Bot Nov 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undocumented required-to-optional field change

Medium Severity

Existing VgsCardInputParam fields ExpMonth, ExpYear, Last4, and PanAlias changed from required concrete types to param.Opt, so assignments like params.ExpMonth = 12 no longer compile. CHANGELOG.md and the release notes do not name these fields or the required-to-optional shift.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by learned rule: Flag undocumented Params required↔optional type changes

Reviewed by Cursor Bugbot for commit 285ee21. Configure here.

paramObj
}

Expand Down Expand Up @@ -9113,17 +9148,24 @@ func (r *VgsCardStateMasks) UnmarshalJSON(data []byte) error {
return apijson.UnmarshalRoot(data, r)
}

// One live purchase with a card in the customer's VGS vault. authorize reveals
// card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which
// replaces both with aliases in Kernel's vault before they reach Kernel; Kernel
// never receives the card number or security code. The card is then ready with no
// further approval, until expires_at, by default five minutes after authorize.
// fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy
// replaces them with the card's details when the browser submits checkout. An
// expired card requires a new purchase with a freshly collected CVC alias. The
// amount and merchant are recorded but do not restrict payment requests sent by
// the browser. Card updates are not supported; delete and create a new item
// instead.
// One live purchase with a card in the customer's VGS vault. With card_mode full,
// authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS
// outbound proxy; with card_mode cvc_only, for a card the merchant already holds
// on file whose checkout page asks only for the security code, it reveals
// card.cvc_alias alone. The proxy replaces each revealed value with an alias in
// Kernel's vault before it reaches Kernel; Kernel never receives the card number
// or security code. The card is then ready with no further approval, until
// expires_at, by default five minutes after authorize. fill types Kernel's aliases
// on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's
// details when the browser submits checkout; a cvc_only card fills only the cvc
// field, and reports no masks because it has no last4 to verify. A cvc_only card's
// payment window routes all of the browser's egress through Kernel's VGS outbound
// proxy, exactly as widely as a full card's: while it is open the proxy reveals
// the card's aliases to any destination the browser sends them to, not only the
// security code. An expired card requires a new purchase with a freshly collected
// CVC alias. The amount and merchant are recorded but do not restrict payment
// requests sent by the browser. Card updates are not supported; delete and create
// a new item instead.
type VgsCardVaultItemSpec struct {
// Integer amount in minor currency units (at most 1000000).
Amount int64 `json:"amount" api:"required"`
Expand All @@ -9139,6 +9181,14 @@ type VgsCardVaultItemSpec struct {
Wallet string `json:"wallet" api:"required"`
// Required when creating the card. Never returned.
Card VgsCardInput `json:"card"`
// Which card this purchase supplies, and the only part of it a read returns. full
// is a whole card from the customer's vault. cvc_only is a card the merchant
// already holds on file, whose checkout page asks for nothing but the security
// code. It must match spec.card: a full card that is missing pan_alias is rejected
// rather than treated as cvc_only. Omit it for full, which a read also omits.
//
// Any of "full", "cvc_only".
CardMode VgsCardVaultItemSpecCardMode `json:"card_mode"`
// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
JSON struct {
Amount respjson.Field
Expand All @@ -9148,6 +9198,7 @@ type VgsCardVaultItemSpec struct {
Provider respjson.Field
Wallet respjson.Field
Card respjson.Field
CardMode respjson.Field
ExtraFields map[string]respjson.Field
raw string
} `json:"-"`
Expand All @@ -9174,17 +9225,36 @@ const (
VgsCardVaultItemSpecProviderVgs VgsCardVaultItemSpecProvider = "vgs"
)

// One live purchase with a card in the customer's VGS vault. authorize reveals
// card.pan_alias and card.cvc_alias through Kernel's VGS outbound proxy, which
// replaces both with aliases in Kernel's vault before they reach Kernel; Kernel
// never receives the card number or security code. The card is then ready with no
// further approval, until expires_at, by default five minutes after authorize.
// fill types Kernel's aliases on merchant_url's origin, and Kernel's VGS proxy
// replaces them with the card's details when the browser submits checkout. An
// expired card requires a new purchase with a freshly collected CVC alias. The
// amount and merchant are recorded but do not restrict payment requests sent by
// the browser. Card updates are not supported; delete and create a new item
// instead.
// Which card this purchase supplies, and the only part of it a read returns. full
// is a whole card from the customer's vault. cvc_only is a card the merchant
// already holds on file, whose checkout page asks for nothing but the security
// code. It must match spec.card: a full card that is missing pan_alias is rejected
// rather than treated as cvc_only. Omit it for full, which a read also omits.
type VgsCardVaultItemSpecCardMode string

const (
VgsCardVaultItemSpecCardModeFull VgsCardVaultItemSpecCardMode = "full"
VgsCardVaultItemSpecCardModeCvcOnly VgsCardVaultItemSpecCardMode = "cvc_only"
)

// One live purchase with a card in the customer's VGS vault. With card_mode full,
// authorize reveals card.pan_alias and card.cvc_alias through Kernel's VGS
// outbound proxy; with card_mode cvc_only, for a card the merchant already holds
// on file whose checkout page asks only for the security code, it reveals
// card.cvc_alias alone. The proxy replaces each revealed value with an alias in
// Kernel's vault before it reaches Kernel; Kernel never receives the card number
// or security code. The card is then ready with no further approval, until
// expires_at, by default five minutes after authorize. fill types Kernel's aliases
// on merchant_url's origin, and Kernel's VGS proxy replaces them with the card's
// details when the browser submits checkout; a cvc_only card fills only the cvc
// field, and reports no masks because it has no last4 to verify. A cvc_only card's
// payment window routes all of the browser's egress through Kernel's VGS outbound
// proxy, exactly as widely as a full card's: while it is open the proxy reveals
// the card's aliases to any destination the browser sends them to, not only the
// security code. An expired card requires a new purchase with a freshly collected
// CVC alias. The amount and merchant are recorded but do not restrict payment
// requests sent by the browser. Card updates are not supported; delete and create
// a new item instead.
//
// The properties Amount, Currency, MerchantName, MerchantURL, Provider, Wallet are
// required.
Expand All @@ -9203,6 +9273,14 @@ type VgsCardVaultItemSpecParam struct {
Wallet string `json:"wallet" api:"required"`
// Required when creating the card. Never returned.
Card VgsCardInputParam `json:"card,omitzero"`
// Which card this purchase supplies, and the only part of it a read returns. full
// is a whole card from the customer's vault. cvc_only is a card the merchant
// already holds on file, whose checkout page asks for nothing but the security
// code. It must match spec.card: a full card that is missing pan_alias is rejected
// rather than treated as cvc_only. Omit it for full, which a read also omits.
//
// Any of "full", "cvc_only".
CardMode VgsCardVaultItemSpecCardMode `json:"card_mode,omitzero"`
paramObj
}

Expand Down
Loading