@checkbox-site/node 0.2.4 → 0.2.6

package/dist/client.d.ts

@@ -45,7 +45,7 @@ export interface Checkbox extends ResourceInstances {
  */
 export declare class Checkbox implements RequestSender {
     #private;
-    static readonly VERSION = "0.2.4";
+    static readonly VERSION = "0.2.6";
     static readonly API_VERSION = "2026-10-30";
     static readonly errors: typeof errors;
     static readonly webhooks: Webhooks;

package/dist/generated/operations.d.ts

@@ -3323,7 +3323,7 @@ export declare class TestCredentialsResource extends Resource {
     /**
      * Store a billing test-mode key.
      *
-     * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked "Let your agent store a Stripe test-mode key" on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
+     * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked the box “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection) (checkbox id consent-stripe-test-key) on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
      *
      * @param site Unique identifier of the site (site_…).
      * @see POST /v1/sites/{site}/test_credentials (operation `createTestCredential`, scope `test_runs:write`)

package/dist/generated/operations.js

@@ -2895,7 +2895,7 @@ export class TestCredentialsResource extends Resource {
     /**
      * Store a billing test-mode key.
      *
-     * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked "Let your agent store a Stripe test-mode key" on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
+     * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked the box “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection) (checkbox id consent-stripe-test-key) on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
      *
      * @param site Unique identifier of the site (site_…).
      * @see POST /v1/sites/{site}/test_credentials (operation `createTestCredential`, scope `test_runs:write`)

package/dist/generated/types.d.ts

@@ -255,6 +255,28 @@ export type UnverifiedScan = {
     /** What an unverified scan is (show it with the results). */
     note: string;
 } | null;
+/** Test mode only: the steps left before real customers are covered, with who takes each (the compliance plan's go_live). When next_action is done, report "set up in test mode; N steps before real customers" (go_live.summary), never a plain done. Null in live mode or before the first checks. */
+export type GoLive = {
+    /** Everything Checkbox observed came from Stripe test mode. */
+    mode: "test";
+    /** Heading. */
+    title: string;
+    /** One sentence before the steps. */
+    lead: string;
+    /** The steps, in order. */
+    steps: Array<{
+        /** Stable step key. */
+        key: "verify_domain" | "stripe_terms_url" | "live_stripe_key" | "live_checkout" | "promote_site";
+        /** Who takes the step: person (only the owner can: DNS, the Stripe Dashboard, live keys) or agent (a code change). */
+        who: "person" | "agent";
+        /** The step in plain words. */
+        text: string;
+        /** Where the person does it, when there is one fixed place. */
+        url?: string;
+    }>;
+    /** What the agent tells the person instead of "done": set up in test mode, N steps left before real customers. */
+    summary: string;
+} | null;
 /** One step of the setup checklist. */
 export interface SetupStep {
     /** Stable step key. */
@@ -388,7 +410,7 @@ export interface SetupSession {
     }>;
     /** Stripe test mode for lifecycle test runs. */
     stripe: {
-        /** Whether the human ticked “Let your agent store a Stripe test-mode key” on the approval page (device login or OAuth connection). False: the agent may not store one (createTestCredential answers test_key_declined); the human adds it in the dashboard. Sessions started with a key the human made in the dashboard: true. */
+        /** Whether the human ticked the box “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection) (checkbox id consent-stripe-test-key) on the approval page (device login or OAuth connection). False: the agent may not store one (createTestCredential answers test_key_declined); the human adds it in the dashboard. Sessions started with a key the human made in the dashboard: true. */
         test_key_consent: boolean;
         /** Hint of the restricted test key the CLI found (never the key). */
         test_key_hint: string | null;
@@ -456,8 +478,10 @@ export interface SetupSession {
     }>;
     /** Latest verdict of the test-mode site. */
     compliance: {
-        /** When it was evaluated. Unix timestamp in seconds. */
+        /** When it was evaluated (Unix seconds; a time, not a count). Unix timestamp in seconds. */
         evaluated: number;
+        /** The same time as evaluated, in ISO 8601. */
+        evaluated_at: string;
         /**
          * Deprecated: open failing findings (per check). Read `label` (counted in tasks) and `todo` instead.
          * @deprecated
@@ -503,6 +527,7 @@ export interface SetupSession {
         }>;
     } | null;
     unverified_scan: UnverifiedScan;
+    go_live: GoLive;
     /** The setup checklist, in order. */
     steps: Array<SetupStep>;
     next_action: SetupNextAction;
@@ -573,13 +598,15 @@ export interface SetupSessionUpdate {
         env_file?: string;
         /** Static files directory (for /.well-known). */
         public_dir?: string;
+        /** The email library the project sends with (nodemailer, resend, @sendgrid/mail…), or "none" when nothing in it sends email (a static site): the plan then offers Checkbox Notices first for the required emails. */
+        mailer?: string;
         /** Where checkout sessions / payment links are created: an ARRAY of { file, kind, line?, snippet? } objects, one per place (not a string), e.g. [{"file": "app.py", "line": 40, "kind": "stripe_checkout_session"}]. */
         checkout_code?: Array<SetupCodeRef>;
         /** Where the subscribe / pay buttons are rendered. */
         pay_buttons?: Array<SetupCodeRef>;
     };
-    /** File the snippet tag was added to. */
-    snippet_installed_in?: string;
+    /** File the snippet tag was added to, or a list of files (e.g. ["app/layout.tsx", "app/account/layout.tsx"]). */
+    snippet_installed_in?: string | Array<string>;
     /** File the API keys were written to (never committed). */
     env_written?: string;
     /** Live-mode site (site_…) you created with the live key, so the checklist tracks its domain verification. */
@@ -650,6 +677,9 @@ export interface SetupVerification {
         /** Why not (limits: one per site per 24 h, three unverified sites per account in 30 days). */
         reason: string | null;
     } | null;
+    next_action: SetupNextAction;
+    /** The same as setup_session.steps, at the top level: the setup checklist, in order. */
+    steps: Array<SetupStep>;
     setup_session: SetupSession;
 }
 /** Account default retention (sites without their own setting use it). */
@@ -1689,7 +1719,7 @@ export interface Task {
         /** What Checkbox must observe for the task to be done. */
         expected: string;
     };
-    /** What Checkbox needs before it can give the exact change (observation: it has not seen the page / email yet; facts: plan, price, cancel URL or merchant name). The title stays the same either way. */
+    /** What Checkbox needs before it can give the exact change or verify it (observation: it has not seen the page / email yet; facts: plan, price, cancel URL or merchant name; verify_domain: the site's domain is not verified yet, so Checkbox cannot visit it to verify this task: do the verify_domain task first). The title stays the same either way. */
     blocked_on: string | null;
     /** Done / declined tasks: verified (its checks pass), no_longer_applicable (its checks no longer apply, e.g. the data source changed), superseded, declined, decided (the owner confirmed a decision, e.g. New York notices by email only: closed, but its checks are not verified). */
     closed_reason: "verified" | "no_longer_applicable" | "superseded" | "declined" | "decided" | null;
@@ -1764,8 +1794,10 @@ export interface CompliancePlan {
     livemode: boolean;
     /** The site. */
     site: string;
-    /** action_required (an agent can apply open tasks now), verifying (changes applied; waiting for confirming observations), compliant (every required check passes or only waits for a live check — an automated assessment, not a legal determination; see compliance.pending_live_checks and coverage), blocked (only human answers ("Your call") or declined critical tasks remain). */
+    /** action_required (an agent can apply open tasks now), verifying (changes applied; waiting for confirming observations), compliant (every required check passes or only waits for a live check — an automated assessment, not a legal determination; see compliance.pending_live_checks and coverage), blocked (only human answers ("Your call") or declined critical tasks remain). The value "compliant" is kept so published SDKs keep working; prefer checks_status ("checks_pass") and show status_label to people: never tell anyone the site "is compliant". */
     status: "action_required" | "verifying" | "compliant" | "blocked";
+    /** The same as status, with "checks_pass" in place of the older value "compliant" (every required check passes or only waits for a live check: an automated assessment, not a legal determination). Read this one in new code. */
+    checks_status?: "action_required" | "verifying" | "checks_pass" | "blocked";
     /** The plan status in words to show a person, from the same counts as the summary ("1 fix needed · 2 to set up", "1 decision for you"; else action_required "Fixes needed", blocked "Your call"), "Checks still running (N)" while checks are still running (verifying), compliant "Checks pass"; while an agent works the site and everything left waits for a deploy or the owner (next_action done_for_now): "Waiting on deploy and you" or "Waiting on deploy". Show this, never the machine value (`compliant` is a status name, not a legal conclusion). */
     status_label?: string;
     /** The evaluation the plan was built from (null before the first check). */
@@ -1837,6 +1869,7 @@ export interface CompliancePlan {
             on_answer: Record<string, string>;
         }>;
     };
+    go_live?: GoLive;
     /** Evidence level per required email kind. A plan never reaches status compliant on template_checked emails. */
     email_verification: Array<{
         /** Email kind (acknowledgment, trial_ending, renewal_reminder, annual_terms, charge_notice, price_change, cancellation_confirmation). */
@@ -1899,7 +1932,7 @@ export interface VerificationCheck {
     check_id: string;
     /** Status the task needs. */
     expected: string;
-    /** Status observed (pass, fail, needs_review, not_applicable, unknown). */
+    /** Status observed (pass, fail, needs_review, missing_data, not_checked, not_applicable, unknown, or informational: a note on a part that is not yours to change, such as Stripe's own hosted page layout; it never holds a verification back). */
     observed: string;
     /** Where the observation comes from: evaluation, static_fetch, html, stripe_params, email, policy_fetch. */
     source: string;
@@ -1920,8 +1953,17 @@ export interface Verification {
     task: string | null;
     /** One task or the whole site. */
     scope: "task" | "site";
-    /** pending (waiting for the confirming scan / re-evaluation), passed (Checkbox observed the expected result: every check passes or does not apply), passed_with_gaps (nothing observed fails, but some checks could not be observed: observed missing_data — not verified), passed_with_notes (nothing observed fails and the task counts as passing, but a check is still needs_review on a part that is not yours to change, such as Stripe's own page layout: see checks), not_checked (a task whose checks could only not be observed yet: nothing to change in the code; next_action says what evidence to provide), pending_live_check (an email whose content passes but that Checkbox has not seen sent for a real event yet: nothing to change; it completes on the first real send or a proof run), failed (it did not: see diff). */
-    status: "pending" | "passed" | "passed_with_gaps" | "passed_with_notes" | "not_checked" | "pending_live_check" | "failed";
+    /** pending (waiting for the confirming scan / re-evaluation), passed (Checkbox observed the expected result: every check passes or does not apply), passed_with_gaps (nothing observed fails, but some checks could not be observed: observed missing_data — not verified), passed_with_notes (nothing observed fails and the task counts as passing, but a check is still needs_review on a part that is not yours to change, such as Stripe's own page layout: see checks), not_checked (a task whose checks could only not be observed yet: nothing to change in the code; next_action says what evidence to provide), pending_live_check (an email whose content passes but that Checkbox has not seen sent for a real event yet: nothing to change; it completes on the first real send or a proof run), needs_review (nothing observed fails, but a check is still undecided, e.g. a cancellation not tried yet or a styling estimate: not done; next_action says what decides it), failed (a check was observed failing: see diff), superseded (this verification did not pass, but newer evidence, such as a test run or a later evaluation, settled the task since: see superseded and follow next_action; nothing to change for it). */
+    status: "pending" | "passed" | "passed_with_gaps" | "passed_with_notes" | "not_checked" | "pending_live_check" | "needs_review" | "failed" | "superseded";
+    /** Set when newer evidence settled the task after this verification finished (status superseded). */
+    superseded?: {
+        /** The task's status in the current plan. */
+        task_status: string;
+        /** What settled the task: a test run (run_…) or the latest evaluation. */
+        by: string;
+        /** In words: what this verification found and what settled the task since. */
+        detail: string;
+    } | null;
     /** How it was re-checked. */
     method: "page_fetch" | "policy_refetch" | "stripe_params" | "email_copy" | "platform_sync" | "attestation" | "evaluation" | "test_run";
     /** What this verification checked, in words: "the params you sent", "Checkout Sessions read from Stripe", "registered configs", "the HTML you sent", "the email copy you sent (plan …)", "the live page …, fetched now"… */
@@ -1951,7 +1993,7 @@ export interface Verification {
         checks: Array<{
             /** Check id. */
             check_id: string;
-            /** Pre-check result: pass, fail, needs_review or not_applicable. */
+            /** Pre-check result: pass, fail, needs_review, not_applicable, or informational (a note on Stripe's own hosted page layout: nothing to change, never holds the verification back). */
             status: string;
             /** What the pre-check found, in one line. */
             reason: string;
@@ -4425,7 +4467,7 @@ export interface TestRunStep {
     observations: Record<string, unknown>;
     /** Evidence records (screenshots, page captures, raw emails) behind the step. */
     evidence: Array<string>;
-    /** Warning or failure code of the step (stable): key_missing, key_not_test_mode, key_invalid, key_permission_missing, checkout_config_missing, price_not_in_test_mode, checkout_session_failed, checkout_page_unreadable, checkout_not_completed, subscription_create_failed, test_clock_failed, no_email_received_within, reminder_not_received, portal_not_configured, cancel_not_completed, cancellation_email_not_received, checkout_url_missing, real_checkout_not_completed, payment_link_not_found, webhook_not_delivered, reminder_outside_window, reminder_timing_not_observed, cancel_flow_not_configured, cancel_not_confirmed_in_stripe, acknowledgment_content_incomplete, cancel_replaced_by_other_subscription, not_judged, scan_config_missing, domain_not_verified, scanner_failed, stripe_api_error, timeout, canceled, internal_error. */
+    /** Warning or failure code of the step (stable): key_missing, key_not_test_mode, key_invalid, key_permission_missing, checkout_config_missing, price_not_in_test_mode, checkout_session_failed, checkout_page_unreadable, checkout_not_completed, subscription_create_failed, test_clock_failed, no_email_received_within, reminder_not_received, portal_not_configured, cancel_not_completed, cancellation_email_not_received, checkout_url_missing, real_checkout_not_completed, payment_link_not_found, webhook_not_delivered, reminder_outside_window, reminder_timing_not_observed, cancel_flow_not_configured, cancel_not_confirmed_in_stripe, acknowledgment_content_incomplete, required_notice_skipped, cancel_replaced_by_other_subscription, not_judged, scan_config_missing, domain_not_verified, scanner_failed, stripe_api_error, timeout, canceled, internal_error. */
     code: string | null;
     fix: TestRunFix;
 }
@@ -4443,7 +4485,7 @@ export interface TestRun {
     type: "stripe" | "generic";
     /** Stripe runs: mirror (Checkbox mirrors your checkout into test mode and moves a test clock through trial and renewal) or real_checkout (the shopper buys through YOUR checkout on your test deployment, so your own webhook handlers and email code fire: the proof that your real system works). null for generic runs. */
     mode: "mirror" | "real_checkout" | null;
-    /** succeeded means the run finished every step and no step failed (steps may still have warnings to review); incomplete means no step failed, but a step could not finish what it set out to observe (for example the online cancellation could not be completed): not a pass; failed means it stopped early, or finished with a failed step (see failure and steps[].fix). */
+    /** succeeded means the run finished every step and no step failed (steps may still have warnings to review); incomplete means no step failed, but a step could not finish what it set out to observe (for example the online cancellation could not be completed, or a required email never arrived): not a pass; failed means it stopped early, or finished with a failed step (see failure and steps[].fix). */
     status: "queued" | "running" | "succeeded" | "incomplete" | "failed" | "canceled";
     /** The status in plain words, counting steps: "Finished with 6 warnings to review", "Finished with 1 failed step", "Finished: every observed step passed". succeeded with warnings is not a clean pass. */
     status_label: string;
@@ -4476,11 +4518,15 @@ export interface TestRun {
     started: number | null;
     /** When it finished. Unix timestamp in seconds. */
     finished: number | null;
+    /** The same as finished (the name verifications use): when the run finished; null while it runs. Unix timestamp in seconds. */
+    completed: number | null;
+    /** How long the run took, from started (or created) to finished, in seconds; null while it runs. */
+    duration_seconds: number | null;
     /** Lifecycle steps in order. */
     steps: Array<TestRunStep>;
     /** Why the run stopped (failed / canceled runs). */
     failure: {
-        /** Stable failure code: key_missing, key_not_test_mode, key_invalid, key_permission_missing, checkout_config_missing, price_not_in_test_mode, checkout_session_failed, checkout_page_unreadable, checkout_not_completed, subscription_create_failed, test_clock_failed, no_email_received_within, reminder_not_received, portal_not_configured, cancel_not_completed, cancellation_email_not_received, checkout_url_missing, real_checkout_not_completed, payment_link_not_found, webhook_not_delivered, reminder_outside_window, reminder_timing_not_observed, cancel_flow_not_configured, cancel_not_confirmed_in_stripe, acknowledgment_content_incomplete, cancel_replaced_by_other_subscription, not_judged, scan_config_missing, domain_not_verified, scanner_failed, stripe_api_error, timeout, canceled, internal_error. */
+        /** Stable failure code: key_missing, key_not_test_mode, key_invalid, key_permission_missing, checkout_config_missing, price_not_in_test_mode, checkout_session_failed, checkout_page_unreadable, checkout_not_completed, subscription_create_failed, test_clock_failed, no_email_received_within, reminder_not_received, portal_not_configured, cancel_not_completed, cancellation_email_not_received, checkout_url_missing, real_checkout_not_completed, payment_link_not_found, webhook_not_delivered, reminder_outside_window, reminder_timing_not_observed, cancel_flow_not_configured, cancel_not_confirmed_in_stripe, acknowledgment_content_incomplete, required_notice_skipped, cancel_replaced_by_other_subscription, not_judged, scan_config_missing, domain_not_verified, scanner_failed, stripe_api_error, timeout, canceled, internal_error. */
         code: string;
         /** What went wrong. */
         message: string;
@@ -4523,6 +4569,17 @@ export interface TestRun {
             /** Why something was kept in the run report only. */
             notes: Array<string>;
         };
+        /** Notices Checkbox Notices owed the run's subscriber (an applicable law requires them) but skipped or failed to send. Not empty: the run is not a clean pass, and the setup is not "all set". */
+        notices_skipped: Array<{
+            /** Notice kind. */
+            kind: string;
+            /** skipped or failed. */
+            status: string;
+            /** Why Checkbox Notices did not send it. */
+            reason: string | null;
+            /** The step that reports it (now a warning, code required_notice_skipped). */
+            step: string;
+        }>;
     } | null;
     /** Stripe test-mode objects of the run (type stripe). */
     stripe: {
@@ -4766,7 +4823,7 @@ export interface CompliancePlanSummary {
     livemode: boolean;
     /** The site. */
     site: string;
-    /** action_required (an agent can apply open tasks now), verifying (changes applied; waiting for confirming observations), compliant (every required check passes or only waits for a live check — an automated assessment, not a legal determination; see compliance.pending_live_checks and coverage), blocked (only human answers ("Your call") or declined critical tasks remain). */
+    /** action_required (an agent can apply open tasks now), verifying (changes applied; waiting for confirming observations), compliant (every required check passes or only waits for a live check — an automated assessment, not a legal determination; see compliance.pending_live_checks and coverage), blocked (only human answers ("Your call") or declined critical tasks remain). The value "compliant" is kept so published SDKs keep working; prefer checks_status ("checks_pass") and show status_label to people: never tell anyone the site "is compliant". */
     status: "action_required" | "verifying" | "compliant" | "blocked";
     /** The plan status in words to show a person, from the same counts as the summary ("1 fix needed · 2 to set up", "1 decision for you"; else action_required "Fixes needed", blocked "Your call"), "Checks still running (N)" while checks are still running (verifying), compliant "Checks pass"; while an agent works the site and everything left waits for a deploy or the owner (next_action done_for_now): "Waiting on deploy and you" or "Waiting on deploy". Show this, never the machine value (`compliant` is a status name, not a legal conclusion). */
     status_label?: string;
@@ -5553,7 +5610,7 @@ export declare const ERROR_CODES: {
     readonly test_key_declined: {
         readonly status: 403;
         readonly type: "permission_error";
-        readonly description: "The owner did not tick “Let your agent store a Stripe test-mode key” on the approval page of this agent's sign-in (device login) or connection (OAuth). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard.";
+        readonly description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard.";
     };
     readonly test_key_rejected: {
         readonly status: 400;

package/dist/generated/types.js

@@ -21,7 +21,7 @@ export const ERROR_CODES = {
     test_key_missing: { status: 400, type: "invalid_request_error", description: "A Stripe test run needs a Stripe TEST-mode key stored for the site: the agent stores the restricted test key (rk_test_…) with createTestCredential, or a person adds it in the dashboard." },
     test_key_not_test_mode: { status: 400, type: "invalid_request_error", description: "The billing key is a live-mode (or malformed) key. Agents only store TEST-mode restricted keys (rk_test_…); a human adds live keys in the Checkbox dashboard." },
     test_key_not_restricted: { status: 400, type: "invalid_request_error", description: "The key is a full Stripe secret key (sk_test_… or sk_live_…), which is refused on every connect path (createTestCredential, connectBillingPlatform, the dashboard). Use a restricted key (rk_test_…) with the permissions on Checkbox's key checklist instead; `message` lists them." },
-    test_key_declined: { status: 403, type: "permission_error", description: "The owner did not tick “Let your agent store a Stripe test-mode key” on the approval page of this agent's sign-in (device login) or connection (OAuth). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard." },
+    test_key_declined: { status: 403, type: "permission_error", description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard." },
     test_key_rejected: { status: 400, type: "invalid_request_error", description: "Stripe rejected the test-mode key or it lacks a permission test runs need; `message` names it." },
     authorization_pending: { status: 400, type: "invalid_request_error", description: "Device login: the human has not approved yet. Keep polling createDeviceToken every `interval` seconds." },
     slow_down: { status: 400, type: "rate_limit_error", description: "Device login: polling too fast. Add 5 seconds to the interval and keep polling." },

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
-export declare const SDK_VERSION = "0.2.4";
+export declare const SDK_VERSION = "0.2.6";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
-export const SDK_VERSION = '0.2.4';
+export const SDK_VERSION = '0.2.6';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/node",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Checkbox Node.js SDK: auto-renewal law and subscription compliance checks (FTC ROSCA, California ARL, New York and other state laws) for Stripe Checkout and other subscription checkouts. Zero dependencies. Published to npm as @checkbox-site/node.",
   "keywords": [
     "subscription",