CLI: Update Go SDK to 418cdfed18c8cf129147945463ebeccc22c2fb27 and document merchant_country

- Bump kernel-go-sdk to 418cdfed18c8 (Visa passkey approval for Kernel cards)
- Document optional merchant_country (ISO 3166-1 alpha-2, required for
  Visa) on the Kernel card spec, and replace the old "Visa purchases are
  not yet supported" note with the spend_approval flow
- Show merchant_country in display-safe JSON output and as a
  "Merchant country" row for Kernel cards

Tested: go test ./cmd/ passes. On a throwaway vault, vaults cards create
--provider kernel with merchant_country "US" passed spec validation (then
got 409 because the wallet had no enrolled card); "USAX" was rejected with
400 invalid Kernel card spec. The vault was deleted afterwards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: kernel-internal[bot]

cmd/vaults_help.go

@@ -84,15 +84,18 @@ type AgentCardCardSpec = {
 };
 
 // One live purchase with a Kernel-enrolled card. Authorize obtains a network token and
-// one-time code for fill on merchant_url's origin until expires_at. Visa purchases are
-// not yet supported (authorize returns 400). Updates are not supported.
+// one-time code for fill on merchant_url's origin until expires_at. Mastercard purchases
+// need no hosted approval. A Visa purchase returns a spend_approval action: the cardholder
+// approves it with a Visa passkey (the link expires after 30 minutes) before the code is
+// issued. Updates are not supported.
 type KernelCardSpec = {
   provider: "kernel";
   wallet: string;             // Kernel wallet item key
   amount: number;             // integer minor units; 1..50000
   currency: string;           // ISO 4217 three letters
   merchant_name: string;      // 1..255 characters
   merchant_url: string;       // HTTPS merchant checkout URL; fill is locked to its origin
+  merchant_country?: string;  // ISO 3166-1 alpha-2; required for Visa cards
 };
 
 type LinkLineItem = {

cmd/vaults_output.go

@@ -44,7 +44,7 @@ var vaultItemFields = vaultOutputFields{
 	"expanded":             {"payment_methods": vaultMethodFields},
 	"spec": {
 		"provider": nil, "wallet": nil, "user_id": nil, "payment_method_id": nil, "card_id": nil, "checkout_origin": nil,
-		"amount": nil, "currency": nil, "merchant": nil, "merchant_name": nil, "merchant_url": nil,
+		"amount": nil, "currency": nil, "merchant": nil, "merchant_name": nil, "merchant_url": nil, "merchant_country": nil,
 		"context": nil, "expires_at": nil, "description": nil, "account": nil, "connection_id": nil,
 		"requests":        onePasswordRequestFields,
 		"fields":          vaultFieldsOf("name label type required sensitive"),
@@ -381,6 +381,9 @@ func printVaultItem(item *kernel.VaultItemUnion, output string) error {
 		if item.Spec.Provider == "kernel" && item.Spec.MerchantURL != "" {
 			rows = append(rows, []string{"Merchant URL", item.Spec.MerchantURL})
 		}
+		if item.Spec.Provider == "kernel" && item.Spec.MerchantCountry != "" {
+			rows = append(rows, []string{"Merchant country", item.Spec.MerchantCountry})
+		}
 		if masks := item.State.Masks; masks.Last4 != "" || masks.TokenLast4 != "" {
 			rows = append(rows, []string{"Card last4", util.OrDash(masks.Last4)})
 			if masks.TokenLast4 != "" {

cmd/vaults_output_test.go

@@ -104,6 +104,26 @@ func TestVaultOutputLinkHasNoAliases(t *testing.T) {
 	}
 }
 
+func TestVaultOutputKernelCardMerchantCountry(t *testing.T) {
+	var item kernel.VaultItemUnion
+	require.NoError(t, json.Unmarshal([]byte(`{
+		"id":"card-id","key":"order-1","type":"card",
+		"spec":{"provider":"kernel","wallet":"wallet-1","amount":1234,"currency":"usd","merchant_name":"Example Shop","merchant_url":"https://shop.example/checkout","merchant_country":"US"},
+		"state":{"provider":"kernel","status":"pending_authorization"},
+		"available_operations":[],"available_expansions":[]
+	}`), &item))
+	buf := capturePtermOutput(t)
+	require.NoError(t, printVaultItem(&item, ""))
+	assert.Contains(t, buf.String(), "Merchant country")
+	assert.Contains(t, buf.String(), "US")
+	out := captureStdout(t, func() { require.NoError(t, printVaultItem(&item, "json")) })
+	var decoded struct {
+		Spec vaultJSON `json:"spec"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(out), &decoded))
+	assert.JSONEq(t, `"US"`, string(decoded.Spec["merchant_country"]))
+}
+
 func TestVaultOutputAgentCardAuthorizationIsNotPaymentSuccess(t *testing.T) {
 	var item kernel.VaultItemUnion
 	require.NoError(t, json.Unmarshal([]byte(`{

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/joho/godotenv v1.5.1
-	github.com/kernel/kernel-go-sdk v0.119.1-0.20261006183707-be15dab89b9b
+	github.com/kernel/kernel-go-sdk v0.119.1-0.20261006192232-418cdfed18c8
 	github.com/klauspost/compress v1.18.5
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/pterm/pterm v0.12.80

go.sum

@@ -66,8 +66,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/kernel/kernel-go-sdk v0.119.1-0.20261006183707-be15dab89b9b h1:gKAq0sFluyC2GKVHZVrTmT5v5A626dvSxNTT4q3fXnY=
-github.com/kernel/kernel-go-sdk v0.119.1-0.20261006183707-be15dab89b9b/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
+github.com/kernel/kernel-go-sdk v0.119.1-0.20261006192232-418cdfed18c8 h1:g1zA+KLA3DXNHY3rZwr0zZPGUeC6X7PWru0qnWc820I=
+github.com/kernel/kernel-go-sdk v0.119.1-0.20261006192232-418cdfed18c8/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ=
 github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
 github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=