release: 0.103.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.102.0"
+  ".": "0.103.0"
 }

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.103.0](https://github.com/kernel/kernel-go-sdk/compare/v0.102.0...v0.103.0) (2026-09-14)
+
+
+### Features
+
+* Accept a workload intent and use it to widen vendor coverage ([7c60d81](https://github.com/kernel/kernel-go-sdk/commit/7c60d81c9fa15cc9116c6838a9ba173e8e95405a))
+* Add single-use AgentCard prepare_checkout for Square ([ec63b01](https://github.com/kernel/kernel-go-sdk/commit/ec63b0146054357d65e420f148a1eb980bd051b0))
+* Honor managed auth browser regions ([2e5c061](https://github.com/kernel/kernel-go-sdk/commit/2e5c06117d8597f1808b3bd43a4df746a19fe8c7))
+
 ## [0.102.0](https://github.com/kernel/kernel-go-sdk/compare/v0.101.0...v0.102.0) (2026-09-13)
 
 

README.md

@@ -28,7 +28,7 @@ Or to pin the version:
 <!-- x-release-please-start-version -->
 
 ```sh
-go get -u 'github.com/kernel/kernel-go-sdk@v0.102.0'
+go get -u 'github.com/kernel/kernel-go-sdk@v0.103.0'
 ```
 
 <!-- x-release-please-end -->

api.md

@@ -492,13 +492,17 @@ Methods:
 
 Params Types:
 
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#AuthorizeVaultItemOperationRequestParam">AuthorizeVaultItemOperationRequestParam</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CardVaultItemSpecUnionParam">CardVaultItemSpecUnionParam</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#FillVaultItemOperationRequestParam">FillVaultItemOperationRequestParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#PrepareCheckoutVaultItemOperationRequestParam">PrepareCheckoutVaultItemOperationRequestParam</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#VaultCardFillFieldUnionParam">VaultCardFillFieldUnionParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#VaultCheckoutContextParam">VaultCheckoutContextParam</a>
 
 Response Types:
 
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#AgentcardCheckoutAuthorization">AgentcardCheckoutAuthorization</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#AgentcardCheckoutPreparation">AgentcardCheckoutPreparation</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CardVaultItemSpecUnion">CardVaultItemSpecUnion</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CardVaultItemStateUnion">CardVaultItemStateUnion</a>
 - <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#FillVaultItemOperationResult">FillVaultItemOperationResult</a>

authconnection.go

@@ -952,6 +952,12 @@ type ManagedAuthBrowserConfig struct {
 	// the default from stealth, or on update and login to preserve or inherit the
 	// connection default.
 	Proxy BrowserProxyConfig `json:"proxy"`
+	// Browser region. Omit on create to use us-east, on update to keep the current
+	// region, or on login to inherit it. Login overrides apply only to that login.
+	// Non-default regions require an eligible plan and organization access.
+	//
+	// Any of "us-east", "eu-west", "ap-southeast".
+	Region ManagedAuthBrowserConfigRegion `json:"region"`
 	// Whether managed auth browser sessions use stealth mode. Defaults to true when
 	// omitted.
 	Stealth bool `json:"stealth"`
@@ -960,6 +966,7 @@ type ManagedAuthBrowserConfig struct {
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
 		Proxy       respjson.Field
+		Region      respjson.Field
 		Stealth     respjson.Field
 		Telemetry   respjson.Field
 		ExtraFields map[string]respjson.Field
@@ -983,6 +990,17 @@ func (r ManagedAuthBrowserConfig) ToParam() ManagedAuthBrowserConfigParam {
 	return param.Override[ManagedAuthBrowserConfigParam](json.RawMessage(r.RawJSON()))
 }
 
+// Browser region. Omit on create to use us-east, on update to keep the current
+// region, or on login to inherit it. Login overrides apply only to that login.
+// Non-default regions require an eligible plan and organization access.
+type ManagedAuthBrowserConfigRegion string
+
+const (
+	ManagedAuthBrowserConfigRegionUsEast      ManagedAuthBrowserConfigRegion = "us-east"
+	ManagedAuthBrowserConfigRegionEuWest      ManagedAuthBrowserConfigRegion = "eu-west"
+	ManagedAuthBrowserConfigRegionApSoutheast ManagedAuthBrowserConfigRegion = "ap-southeast"
+)
+
 // Browser telemetry configuration using the same semantics as browser create.
 type ManagedAuthBrowserConfigTelemetry struct {
 	// Per-category capture flags. The operational categories (control, connection,
@@ -1101,6 +1119,12 @@ type ManagedAuthBrowserConfigParam struct {
 	// the default from stealth, or on update and login to preserve or inherit the
 	// connection default.
 	Proxy BrowserProxyConfigParam `json:"proxy,omitzero"`
+	// Browser region. Omit on create to use us-east, on update to keep the current
+	// region, or on login to inherit it. Login overrides apply only to that login.
+	// Non-default regions require an eligible plan and organization access.
+	//
+	// Any of "us-east", "eu-west", "ap-southeast".
+	Region ManagedAuthBrowserConfigRegion `json:"region,omitzero"`
 	paramObj
 }
 

authconnection_test.go

@@ -38,6 +38,7 @@ func TestAuthConnectionNewWithOptionalParams(t *testing.T) {
 					Mode: kernel.BrowserProxyModeDirect,
 					Name: kernel.String("x"),
 				},
+				Region:  kernel.ManagedAuthBrowserConfigRegionUsEast,
 				Stealth: kernel.Bool(false),
 				Telemetry: kernel.ManagedAuthBrowserConfigTelemetryParam{
 					Browser: kernel.BrowserTelemetryCategoriesConfigParam{
@@ -209,6 +210,7 @@ func TestAuthConnectionUpdateWithOptionalParams(t *testing.T) {
 						Mode: kernel.BrowserProxyModeDirect,
 						Name: kernel.String("x"),
 					},
+					Region:  kernel.ManagedAuthBrowserConfigRegionUsEast,
 					Stealth: kernel.Bool(false),
 					Telemetry: kernel.ManagedAuthBrowserConfigTelemetryParam{
 						Browser: kernel.BrowserTelemetryCategoriesConfigParam{
@@ -407,6 +409,7 @@ func TestAuthConnectionLoginWithOptionalParams(t *testing.T) {
 					Mode: kernel.BrowserProxyModeDirect,
 					Name: kernel.String("x"),
 				},
+				Region:  kernel.ManagedAuthBrowserConfigRegionUsEast,
 				Stealth: kernel.Bool(false),
 				Telemetry: kernel.ManagedAuthBrowserConfigTelemetryParam{
 					Browser: kernel.BrowserTelemetryCategoriesConfigParam{

configregistry.go

@@ -201,14 +201,22 @@ type ConfigRegistryResponse struct {
 	// useful without a configuration. Not verified against this target. Null when
 	// nothing applicable was observed or no notes exist.
 	Guidance string `json:"guidance" api:"nullable"`
+	// How far the workload pass got, when an intent was supplied and a pass ran. A run
+	// outcome rather than advice, so it is reported whether or not any guidance could
+	// be assembled. Null when no intent was supplied or no pass ran.
+	//
+	// Any of "completed", "turn_limit", "auth_required", "payment_required",
+	// "blocked", "error".
+	WorkloadOutcome ConfigRegistryResponseWorkloadOutcome `json:"workload_outcome" api:"nullable"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
 	JSON struct {
-		Analysis       respjson.Field
-		Recommendation respjson.Field
-		Target         respjson.Field
-		Guidance       respjson.Field
-		ExtraFields    map[string]respjson.Field
-		raw            string
+		Analysis        respjson.Field
+		Recommendation  respjson.Field
+		Target          respjson.Field
+		Guidance        respjson.Field
+		WorkloadOutcome respjson.Field
+		ExtraFields     map[string]respjson.Field
+		raw             string
 	} `json:"-"`
 }
 
@@ -218,6 +226,20 @@ func (r *ConfigRegistryResponse) UnmarshalJSON(data []byte) error {
 	return apijson.UnmarshalRoot(data, r)
 }
 
+// How far the workload pass got, when an intent was supplied and a pass ran. A run
+// outcome rather than advice, so it is reported whether or not any guidance could
+// be assembled. Null when no intent was supplied or no pass ran.
+type ConfigRegistryResponseWorkloadOutcome string
+
+const (
+	ConfigRegistryResponseWorkloadOutcomeCompleted       ConfigRegistryResponseWorkloadOutcome = "completed"
+	ConfigRegistryResponseWorkloadOutcomeTurnLimit       ConfigRegistryResponseWorkloadOutcome = "turn_limit"
+	ConfigRegistryResponseWorkloadOutcomeAuthRequired    ConfigRegistryResponseWorkloadOutcome = "auth_required"
+	ConfigRegistryResponseWorkloadOutcomePaymentRequired ConfigRegistryResponseWorkloadOutcome = "payment_required"
+	ConfigRegistryResponseWorkloadOutcomeBlocked         ConfigRegistryResponseWorkloadOutcome = "blocked"
+	ConfigRegistryResponseWorkloadOutcomeError           ConfigRegistryResponseWorkloadOutcome = "error"
+)
+
 type Evidence struct {
 	Accessed     int64 `json:"accessed" api:"required"`
 	Blocked      int64 `json:"blocked" api:"required"`
@@ -872,6 +894,14 @@ const (
 type ResolveRequestParam struct {
 	// Public HTTP(S) URL to refresh.
 	URL string `json:"url" api:"required" format:"uri"`
+	// Plain-language description of the workload you intend to run against this
+	// target, in a sentence or two. Requires an https target, because the pass treats
+	// any non-HTTPS destination as off-site and will not drive an http one. Kernel
+	// uses it to drive the browser further into the site, where it can observe
+	// protections that only appear once a session interacts. When this target already
+	// has a verified configuration, the run confirms that one instead of re-deriving
+	// the whole matrix, so supplying an intent narrows what can be recommended.
+	Intent param.Opt[string] `json:"intent,omitzero"`
 	// ISO 3166 country codes Kernel may use when searching for or returning a proxy
 	// configuration. Kernel may test a subset of allowed countries. When omitted,
 	// Kernel uses its default country selection.

configregistry_test.go

@@ -87,6 +87,7 @@ func TestConfigRegistryResolveWithOptionalParams(t *testing.T) {
 		ResolveRequest: kernel.ResolveRequestParam{
 			URL:                   "https://example.com",
 			AllowedProxyCountries: []string{"US"},
+			Intent:                kernel.String("search for a black hoodie and add it to the cart"),
 		},
 	})
 	if err != nil {

internal/version.go

@@ -2,4 +2,4 @@
 
 package internal
 
-const PackageVersion = "0.102.0" // x-release-please-version
+const PackageVersion = "0.103.0" // x-release-please-version

shared/constant/constants.go

@@ -21,7 +21,6 @@ func ValueOf[T Constant[T]]() T {
 type Agentcard string                       // Always "agentcard"
 type APICall string                         // Always "api_call"
 type AppVersionSummary string               // Always "app_version_summary"
-type Authorize string                       // Always "authorize"
 type AutofillTrigger string                 // Always "Autofill.trigger"
 type AwsUsEast1a string                     // Always "aws.us-east-1a"
 type BrowserCancelDownload string           // Always "Browser.cancelDownload"
@@ -133,7 +132,6 @@ type Wallet string                          // Always "wallet"
 func (c Agentcard) Default() Agentcard                           { return "agentcard" }
 func (c APICall) Default() APICall                               { return "api_call" }
 func (c AppVersionSummary) Default() AppVersionSummary           { return "app_version_summary" }
-func (c Authorize) Default() Authorize                           { return "authorize" }
 func (c AutofillTrigger) Default() AutofillTrigger               { return "Autofill.trigger" }
 func (c AwsUsEast1a) Default() AwsUsEast1a                       { return "aws.us-east-1a" }
 func (c BrowserCancelDownload) Default() BrowserCancelDownload   { return "Browser.cancelDownload" }
@@ -267,7 +265,6 @@ func (c Wallet) Default() Wallet                         { return "wallet" }
 func (c Agentcard) MarshalJSON() ([]byte, error)                       { return marshalString(c) }
 func (c APICall) MarshalJSON() ([]byte, error)                         { return marshalString(c) }
 func (c AppVersionSummary) MarshalJSON() ([]byte, error)               { return marshalString(c) }
-func (c Authorize) MarshalJSON() ([]byte, error)                       { return marshalString(c) }
 func (c AutofillTrigger) MarshalJSON() ([]byte, error)                 { return marshalString(c) }
 func (c AwsUsEast1a) MarshalJSON() ([]byte, error)                     { return marshalString(c) }
 func (c BrowserCancelDownload) MarshalJSON() ([]byte, error)           { return marshalString(c) }