release: 0.111.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.110.0"
+  ".": "0.111.0"
 }

.stats.yml

@@ -1 +1 @@
-configured_endpoints: 165
+configured_endpoints: 169

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.111.0](https://github.com/kernel/kernel-go-sdk/compare/v0.110.0...v0.111.0) (2026-09-22)
+
+
+### Features
+
+* Allow managed auth logins to disable learned skills ([aee0b02](https://github.com/kernel/kernel-go-sdk/commit/aee0b02b9b0bdb2f84172ee9b568696dcd8fa482))
+* Distinguish optimistic managed auth reauth ([68c5100](https://github.com/kernel/kernel-go-sdk/commit/68c51002947ba672c74f15f50420184c5b5ecbe7))
+* Implement Search API v1 providers ([0554699](https://github.com/kernel/kernel-go-sdk/commit/05546992051b109e2a59e1b4a7f6f4455b1470db))
+* Persist stable managed auth completion timestamps ([ca8d465](https://github.com/kernel/kernel-go-sdk/commit/ca8d4655a0dc47369135fb4a938eeb5cf5326582))
+* Publish restricted_route_unavailable and unknown proxy_error codes ([6e379e6](https://github.com/kernel/kernel-go-sdk/commit/6e379e6df7b9727b412e028352c25023439fefd8))
+* Support native prepared Adyen Sessions checkout ([dd9a4a4](https://github.com/kernel/kernel-go-sdk/commit/dd9a4a4e3d3ae56a41429901b1cc7eb580febae7))
+
 ## [0.110.0](https://github.com/kernel/kernel-go-sdk/compare/v0.109.0...v0.110.0) (2026-09-18)
 
 

README.md

@@ -28,7 +28,7 @@ Or to pin the version:
 <!-- x-release-please-start-version -->
 
 ```sh
-go get -u 'github.com/kernel/kernel-go-sdk@v0.110.0'
+go get -u 'github.com/kernel/kernel-go-sdk@v0.111.0'
 ```
 
 <!-- x-release-please-end -->

api.md

@@ -703,3 +703,44 @@ Methods:
 - <code title="delete /org/credential_providers/{id}">client.CredentialProviders.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CredentialProviderService.Delete">Delete</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
 - <code title="get /org/credential_providers/{id}/items">client.CredentialProviders.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CredentialProviderService.ListItems">ListItems</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CredentialProviderListItemsResponse">CredentialProviderListItemsResponse</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
 - <code title="post /org/credential_providers/{id}/test">client.CredentialProviders.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CredentialProviderService.Test">Test</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#CredentialProviderTestResult">CredentialProviderTestResult</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+# Search
+
+Params Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#ProviderTargetUnionParam">ProviderTargetUnionParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#RequestParam">RequestParam</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#StrategyUnionParam">StrategyUnionParam</a>
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Attempt">Attempt</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Result">Result</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Search">Search</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Usage">Usage</a>
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Warning">Warning</a>
+
+Methods:
+
+- <code title="post /search">client.Search.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchService.New">New</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, body <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchNewParams">SearchNewParams</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Search">Search</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+- <code title="get /search/{id}">client.Search.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchService.Get">Get</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>) (\*<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Search">Search</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>
+
+## Contents
+
+Params Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#FetchRequestParam">FetchRequestParam</a>
+
+Methods:
+
+- <code title="post /search/{id}/contents">client.Search.Contents.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchContentService.Fetch">Fetch</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, id <a href="https://pkg.go.dev/builtin#string">string</a>, body <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchContentFetchParams">SearchContentFetchParams</a>) <a href="https://pkg.go.dev/builtin#error">error</a></code>
+
+## Providers
+
+Response Types:
+
+- <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Provider">Provider</a>
+
+Methods:
+
+- <code title="get /search/providers">client.Search.Providers.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchProviderService.List">List</a>(ctx <a href="https://pkg.go.dev/context">context</a>.<a href="https://pkg.go.dev/context#Context">Context</a>, query <a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#SearchProviderListParams">SearchProviderListParams</a>) (\*[]<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk">kernel</a>.<a href="https://pkg.go.dev/github.com/kernel/kernel-go-sdk#Provider">Provider</a>, <a href="https://pkg.go.dev/builtin#error">error</a>)</code>

authconnection.go

@@ -302,13 +302,15 @@ type ManagedAuth struct {
 	//
 	// Deprecated: deprecated
 	BrowserTelemetry ManagedAuthBrowserTelemetry `json:"browser_telemetry" api:"nullable"`
-	// Whether Kernel can automatically re-authenticate this connection when the
-	// session expires. Requires a prior successful login plus either a Kernel
-	// credential or an external credential reference. See `can_reauth_reason` for the
-	// specific outcome.
+	// Whether this connection's stored requirements are eligible for unattended
+	// re-authentication. A true value can represent either fully satisfiable
+	// requirements or a best-effort attempt. It does not account for whether automatic
+	// re-authentication is enabled or parent workflow state such as an active flow or
+	// circuit-breaker cooldown, so it does not guarantee an attempt on the next health
+	// check. See `can_reauth_reason` for the specific outcome.
 	CanReauth bool `json:"can_reauth"`
 	// Machine-readable reason for the current value of `can_reauth`. Affirmative
-	// values (re-auth is possible):
+	// values (requirements are eligible for unattended re-authentication):
 	//
 	// - `external_credential` — an external credential provider is attached
 	// - `cua_has_credential` — CUA flow with a stored credential
@@ -317,8 +319,12 @@ type ManagedAuth struct {
 	// - `viable_plans_found` — at least one stored login plan can be replayed
 	// - `no_requirements_recorded` — no recorded credential requirements to fail
 	//   against
-	// - `totp_reauth_allowed` — TOTP is the only recorded requirement and is safe to
-	//   attempt automatically
+	// - `totp_reauth_allowed` — TOTP is the only recorded requirement and a stored
+	//   secret can generate the code
+	// - `optimistic_totp_attempt` — TOTP was previously required but no reusable
+	//   secret is stored; the connection remains eligible for a
+	//   circuit-breaker-bounded attempt because the site may not challenge returning
+	//   sessions
 	// - `requirements_satisfiable` — recorded requirements contain no recognized
 	//   blocker
 	//
@@ -343,10 +349,11 @@ type ManagedAuth struct {
 	//
 	// Any of "external_credential", "cua_has_credential", "has_credential",
 	// "viable_plans_found", "no_requirements_recorded", "totp_reauth_allowed",
-	// "requirements_satisfiable", "no_prior_successful_login", "no_credential",
-	// "no_viable_plans", "viable_plans_require_external_action",
-	// "requires_external_action", "requires_totp_without_secret", "requires_sms_code",
-	// "requires_email_code", "requires_customer_input".
+	// "optimistic_totp_attempt", "requirements_satisfiable",
+	// "no_prior_successful_login", "no_credential", "no_viable_plans",
+	// "viable_plans_require_external_action", "requires_external_action",
+	// "requires_totp_without_secret", "requires_sms_code", "requires_email_code",
+	// "requires_customer_input".
 	CanReauthReason ManagedAuthCanReauthReason `json:"can_reauth_reason"`
 	// Canonical choices awaiting selection. Prefer this over pending_sso_buttons,
 	// mfa_options, and sign_in_options when present.
@@ -613,7 +620,7 @@ func (r *ManagedAuthBrowserTelemetryExportOtlpDestination) UnmarshalJSON(data []
 }
 
 // Machine-readable reason for the current value of `can_reauth`. Affirmative
-// values (re-auth is possible):
+// values (requirements are eligible for unattended re-authentication):
 //
 //   - `external_credential` — an external credential provider is attached
 //   - `cua_has_credential` — CUA flow with a stored credential
@@ -622,8 +629,12 @@ func (r *ManagedAuthBrowserTelemetryExportOtlpDestination) UnmarshalJSON(data []
 //   - `viable_plans_found` — at least one stored login plan can be replayed
 //   - `no_requirements_recorded` — no recorded credential requirements to fail
 //     against
-//   - `totp_reauth_allowed` — TOTP is the only recorded requirement and is safe to
-//     attempt automatically
+//   - `totp_reauth_allowed` — TOTP is the only recorded requirement and a stored
+//     secret can generate the code
+//   - `optimistic_totp_attempt` — TOTP was previously required but no reusable
+//     secret is stored; the connection remains eligible for a
+//     circuit-breaker-bounded attempt because the site may not challenge returning
+//     sessions
 //   - `requirements_satisfiable` — recorded requirements contain no recognized
 //     blocker
 //
@@ -654,6 +665,7 @@ const (
 	ManagedAuthCanReauthReasonViablePlansFound                 ManagedAuthCanReauthReason = "viable_plans_found"
 	ManagedAuthCanReauthReasonNoRequirementsRecorded           ManagedAuthCanReauthReason = "no_requirements_recorded"
 	ManagedAuthCanReauthReasonTotpReauthAllowed                ManagedAuthCanReauthReason = "totp_reauth_allowed"
+	ManagedAuthCanReauthReasonOptimisticTotpAttempt            ManagedAuthCanReauthReason = "optimistic_totp_attempt"
 	ManagedAuthCanReauthReasonRequirementsSatisfiable          ManagedAuthCanReauthReason = "requirements_satisfiable"
 	ManagedAuthCanReauthReasonNoPriorSuccessfulLogin           ManagedAuthCanReauthReason = "no_prior_successful_login"
 	ManagedAuthCanReauthReasonNoCredential                     ManagedAuthCanReauthReason = "no_credential"
@@ -1474,6 +1486,10 @@ type ManagedAuthTimelineEvent struct {
 	Type ManagedAuthTimelineEventType `json:"type" api:"required"`
 	// Browser session that produced the event, if one was created.
 	BrowserSessionID string `json:"browser_session_id"`
+	// When the login/reauth attempt first reached a terminal status. Stable across
+	// retries and subsequent cleanup writes. Absent for in-progress attempts, health
+	// checks, and historical attempts without a recorded completion time.
+	CompletedAt time.Time `json:"completed_at" format:"date-time"`
 	// Machine-readable error code. Present when a login/reauth event failed.
 	ErrorCode string `json:"error_code"`
 	// Human-readable error message. Present when a login/reauth event failed.
@@ -1506,6 +1522,7 @@ type ManagedAuthTimelineEvent struct {
 		Timestamp         respjson.Field
 		Type              respjson.Field
 		BrowserSessionID  respjson.Field
+		CompletedAt       respjson.Field
 		ErrorCode         respjson.Field
 		ErrorMessage      respjson.Field
 		PreviousStatus    respjson.Field
@@ -2321,6 +2338,12 @@ type AuthConnectionLoginParams struct {
 	Browser ManagedAuthBrowserConfigParam `json:"browser,omitzero"`
 	// Deprecated. Use browser.proxy. Retained during migration for existing clients.
 	Proxy AuthConnectionLoginParamsProxy `json:"proxy,omitzero"`
+	// Controls whether this login reads and writes learned domain skills. Automatic
+	// reauths inherit the selected mode until a later accepted login sets enabled or
+	// omits this field. Defaults to enabled when omitted.
+	//
+	// Any of "enabled", "disabled".
+	SkillMode AuthConnectionLoginParamsSkillMode `json:"skill_mode,omitzero"`
 	paramObj
 }
 
@@ -2443,6 +2466,16 @@ func (r *AuthConnectionLoginParamsProxy) UnmarshalJSON(data []byte) error {
 	return apijson.UnmarshalRoot(data, r)
 }
 
+// Controls whether this login reads and writes learned domain skills. Automatic
+// reauths inherit the selected mode until a later accepted login sets enabled or
+// omits this field. Defaults to enabled when omitted.
+type AuthConnectionLoginParamsSkillMode string
+
+const (
+	AuthConnectionLoginParamsSkillModeEnabled  AuthConnectionLoginParamsSkillMode = "enabled"
+	AuthConnectionLoginParamsSkillModeDisabled AuthConnectionLoginParamsSkillMode = "disabled"
+)
+
 type AuthConnectionSubmitParams struct {
 	// Request to submit field values, click an SSO button, select an MFA method, or
 	// select a sign-in option. Prefer canonical selected_choice_id/field_values when

authconnection_test.go

@@ -511,6 +511,7 @@ func TestAuthConnectionLoginWithOptionalParams(t *testing.T) {
 				Name: kernel.String("name"),
 			},
 			RecordSession: kernel.Bool(true),
+			SkillMode:     kernel.AuthConnectionLoginParamsSkillModeEnabled,
 		},
 	)
 	if err != nil {

browsertelemetry.go

@@ -5110,20 +5110,28 @@ type BrowserProxyErrorEventData struct {
 	// Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
 	// branded 5xx error page served by the metro egress host-proxy. Values mirror what
 	// the proxy emits: destination_blocked, provider_blacklisted,
-	// provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
-	// upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
-	// values are dropped.
+	// provider_unreachable, provider_rejected, origin_tls_timeout,
+	// origin_response_incomplete, proxy_unavailable, restricted_route_unavailable,
+	// upstream_timeout, upstream_dns_failure, upstream_connect_failed. A header value
+	// the browser image does not recognize is reported as unknown, with the header
+	// value in raw_code.
 	//
 	// Any of "destination_blocked", "provider_blacklisted", "provider_unreachable",
-	// "provider_rejected", "origin_tls_timeout", "proxy_unavailable",
-	// "upstream_timeout", "upstream_dns_failure", "upstream_connect_failed".
+	// "provider_rejected", "origin_tls_timeout", "origin_response_incomplete",
+	// "proxy_unavailable", "restricted_route_unavailable", "upstream_timeout",
+	// "upstream_dns_failure", "upstream_connect_failed", "unknown".
 	Code string `json:"code" api:"required"`
 	// CDP request identifier matching the originating request.
 	RequestID string `json:"request_id" api:"required"`
 	// HTTP response status of the branded error page (502).
 	Status int64 `json:"status" api:"required"`
 	// HTTP method of the failed request, when known.
 	Method string `json:"method"`
+	// Sanitized X-Kernel-Proxy-Error header value, present only when code is unknown.
+	// Surrounding whitespace is removed, the value is lowercased, characters outside
+	// [a-z0-9_] are replaced with \_, and the result is truncated to at most 64
+	// characters.
+	RawCode string `json:"raw_code"`
 	// CDP Network.ResourceType for the request, when known.
 	ResourceType string `json:"resource_type"`
 	// JSON contains metadata for fields, check presence with [respjson.Field.Valid].
@@ -5132,6 +5140,7 @@ type BrowserProxyErrorEventData struct {
 		RequestID    respjson.Field
 		Status       respjson.Field
 		Method       respjson.Field
+		RawCode      respjson.Field
 		ResourceType respjson.Field
 		ExtraFields  map[string]respjson.Field
 		raw          string
@@ -6102,6 +6111,8 @@ type BrowserTelemetryEventUnionData struct {
 	// This field is from variant [BrowserNetworkLoadingFailedEventData].
 	ErrorText string `json:"error_text"`
 	Code      string `json:"code"`
+	// This field is from variant [BrowserProxyErrorEventData].
+	RawCode string `json:"raw_code"`
 	// This field is from variant [BrowserPageNavigationEventData].
 	ParentFrameID string  `json:"parent_frame_id"`
 	CdpTimestamp  float64 `json:"cdp_timestamp"`
@@ -6415,6 +6426,7 @@ type BrowserTelemetryEventUnionData struct {
 		Canceled                          respjson.Field
 		ErrorText                         respjson.Field
 		Code                              respjson.Field
+		RawCode                           respjson.Field
 		ParentFrameID                     respjson.Field
 		CdpTimestamp                      respjson.Field
 		OpenerID                          respjson.Field

client.go

@@ -55,6 +55,8 @@ type Client struct {
 	APIKeys APIKeyService
 	// Configure external credential providers like 1Password.
 	CredentialProviders CredentialProviderService
+	// Search the web and retrieve content for selected results.
+	Search SearchService
 }
 
 // DefaultClientOptions read from the environment (KERNEL_API_KEY,
@@ -111,6 +113,7 @@ func NewClient(opts ...option.RequestOption) (r Client) {
 	r.AuditLogs = NewAuditLogService(opts...)
 	r.APIKeys = NewAPIKeyService(opts...)
 	r.CredentialProviders = NewCredentialProviderService(opts...)
+	r.Search = NewSearchService(opts...)
 
 	return
 }

internal/version.go

@@ -2,4 +2,4 @@
 
 package internal
 
-const PackageVersion = "0.110.0" // x-release-please-version
+const PackageVersion = "0.111.0" // x-release-please-version