@checkbox-site/node 0.2.6 → 0.2.8

package/dist/client.d.ts

@@ -45,7 +45,7 @@ export interface Checkbox extends ResourceInstances {
  */
 export declare class Checkbox implements RequestSender {
     #private;
-    static readonly VERSION = "0.2.6";
+    static readonly VERSION = "0.2.8";
     static readonly API_VERSION = "2026-10-30";
     static readonly errors: typeof errors;
     static readonly webhooks: Webhooks;

package/dist/generated/operations.d.ts

@@ -3098,7 +3098,7 @@ export declare class ChecksResource extends Resource {
     /**
      * Check a subscription lifecycle email.
      *
-     * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the result is at most needs_review and Next is update_setup (update the site's plans first). Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
+     * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the verdict is still judged with the terms you sent and a `site_plans_differ` warning says to update the site's plans (update_setup) once the change is deployed. Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
      *
      * @see POST /v1/checks/email (operation `checkEmail`, scope `checks:read`)
      */

package/dist/generated/operations.js

@@ -2622,7 +2622,7 @@ export class ChecksResource extends Resource {
     /**
      * Check a subscription lifecycle email.
      *
-     * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the result is at most needs_review and Next is update_setup (update the site's plans first). Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
+     * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the verdict is still judged with the terms you sent and a `site_plans_differ` warning says to update the site's plans (update_setup) once the change is deployed. Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
      *
      * @see POST /v1/checks/email (operation `checkEmail`, scope `checks:read`)
      */

package/dist/generated/types.d.ts

@@ -266,7 +266,7 @@ export type GoLive = {
     /** The steps, in order. */
     steps: Array<{
         /** Stable step key. */
-        key: "verify_domain" | "stripe_terms_url" | "live_stripe_key" | "live_checkout" | "promote_site";
+        key: "verify_domain" | "stripe_terms_url" | "live_stripe_key" | "live_portal_cancel" | "live_checkout" | "deactivate_old_live_link" | "swap_test_urls" | "promote_site";
         /** Who takes the step: person (only the owner can: DNS, the Stripe Dashboard, live keys) or agent (a code change). */
         who: "person" | "agent";
         /** The step in plain words. */
@@ -448,6 +448,24 @@ export interface SetupSession {
         /** When it started. Unix timestamp in seconds. */
         created: number;
     } | null;
+    /** Round 35: the plan's batched owner questions (the same as retrieveCompliancePlan owner_questions), so next_action's "as owner_questions says" can be followed from this response. Null when there is none. */
+    owner_questions?: {
+        /** How to ask them: once, in one message, while the fixes go on. */
+        description: string;
+        /** Every choice only the owner makes, together. */
+        questions: Array<{
+            /** "email_sender" (who sends the required emails), "notices_support_email" / "notices_cancel_timing" (what Checkbox Notices needs before it sends), "stripe_terms_url" (a step only the owner takes in the Stripe Dashboard: the Terms of Service URL Stripe needs before it collects consent, in test mode too), or the id of the task whose question it is. */
+            id: string;
+            /** The question, in plain words for the owner. */
+            text: string;
+            /** The answers. */
+            options: Array<string>;
+            /** The tasks the answer settles. */
+            tasks: Array<string>;
+            /** What the agent does with each answer. */
+            on_answer: Record<string, string>;
+        }>;
+    } | null;
     /** The plans Checkbox judges the site against: the declared plans as reconciled with the connected Stripe Prices (Stripe wins), the plans the pay buttons sell and the account's Prices of a declared plan. Empty until a plan is known (updateSetupSession plans[], or connect Stripe). */
     site_plans: Array<{
         /** Plan name (or its price and interval). */
@@ -680,6 +698,56 @@ export interface SetupVerification {
     next_action: SetupNextAction;
     /** The same as setup_session.steps, at the top level: the setup checklist, in order. */
     steps: Array<SetupStep>;
+    /** The same as setup_session.compliance, at the top level: the site's status label and to-do list after this re-check (null before the first evaluation). */
+    compliance: {
+        /** When it was evaluated (Unix seconds; a time, not a count). Unix timestamp in seconds. */
+        evaluated: number;
+        /** The same time as evaluated, in ISO 8601. */
+        evaluated_at: string;
+        /**
+         * Deprecated: open failing findings (per check). Read `label` (counted in tasks) and `todo` instead.
+         * @deprecated
+         */
+        failing: number;
+        /**
+         * Deprecated: open needs-review findings (per check). Read `label` (counted in tasks) and `todo` instead.
+         * @deprecated
+         */
+        needs_review: number;
+        /** The site roll-up label, the same everywhere (dashboard, plan, emails): "2 fixes needed · 1 your call", "Checks pass · 2 live checks pending". */
+        label: string | null;
+        /** The site roll-up status: needs_fix, your_call, incomplete, compliant or not_checked. */
+        status: string | null;
+        /**
+         * Deprecated: open findings (evidence). The to-do list is `todo` (the compliance plan's ordered open tasks).
+         * @deprecated
+         */
+        top_findings: Array<{
+            /** Unique identifier of the finding (fnd_…). */
+            id: string;
+            /** Check id. */
+            check_id: string;
+            /** fail or needs_review. */
+            status: string;
+            /** critical, high, medium or low. */
+            severity: string;
+            /** What is wrong. */
+            title: string;
+        }>;
+        /** The to-do list: the compliance plan's ordered open required tasks (same titles, order and counts as the dashboard, MCP get_site_status and the summary email). */
+        todo?: Array<{
+            /** Plan task id (task_…); its findings are the evidence. */
+            task: string;
+            /** Task key. */
+            key: string;
+            /** Task title, the same as in the plan. */
+            title: string;
+            /** The status the site roll-up counts the task under. */
+            status: "needs_fix" | "not_set_up" | "your_call" | "not_checked";
+            /** Needs a fix, Not set up yet, Your call or Not checked yet. */
+            label: string;
+        }>;
+    } | null;
     setup_session: SetupSession;
 }
 /** Account default retention (sites without their own setting use it). */
@@ -1088,6 +1156,13 @@ export interface Site {
         devices: Array<"desktop" | "mobile">;
         /** Number of configured checkout steps. */
         checkout_steps: number;
+        /** The other checkout pages, one per plan (checkout_pages), each loaded on every scan. */
+        pages: Array<{
+            /** The plan's checkout page. */
+            url: string;
+            /** The plan it sells, when given. */
+            plan: string | null;
+        }>;
         /** A synthetic sign-up is configured. */
         completes_purchase: boolean;
         /** A test account for the cancellation test is configured. */
@@ -1200,8 +1275,8 @@ export interface SiteTestAccount {
     login_url: string;
     /** Test account email. */
     email: string;
-    /** Test account password (write-only; encrypted at rest). */
-    password: string;
+    /** Test account password (write-only; encrypted at rest). Leave it out for an email-only login (no password field); the stored password is kept when one was saved before. */
+    password?: string;
     /** Custom login steps. */
     login_steps?: Array<ScanStep>;
     /** Optional page on your site that RE-ACTIVATES the test subscription (a test-only route). The cancellation test really cancels the test account; the scanner opens this page after logging in, before cancelling, so every scan starts subscribed. Without it, a scan after a completed cancellation reports "not observed: the test account has no active subscription" (needs review). (Replaces reset_url, now a deprecated alias.) */
@@ -1227,6 +1302,13 @@ export interface CreateSiteParams {
     terms_url?: string | null;
     /** Steps to reach the final pre-payment screen. */
     checkout_steps?: Array<ScanStep>;
+    /** More checkout pages, one per plan, when each plan has its own (e.g. /checkout?plan=annual next to checkout_url /checkout?plan=monthly). Every scan loads each one and judges it against the plan it sells. At most 4; replaces the stored list; null or [] clears it. */
+    checkout_pages?: Array<{
+        /** A plan's own checkout page, on the checkout page's site. */
+        url: string;
+        /** The plan this page sells (its name as in your plans). */
+        plan?: string;
+    }> | null;
     purchase?: SitePurchase;
     test_account?: SiteTestAccount;
     /** Explicit cancellation steps (otherwise auto-discovered). */
@@ -1258,6 +1340,13 @@ export interface UpdateSiteParams {
     terms_url?: string | null;
     /** Steps to reach the final pre-payment screen. */
     checkout_steps?: Array<ScanStep>;
+    /** More checkout pages, one per plan, when each plan has its own (e.g. /checkout?plan=annual next to checkout_url /checkout?plan=monthly). Every scan loads each one and judges it against the plan it sells. At most 4; replaces the stored list; null or [] clears it. */
+    checkout_pages?: Array<{
+        /** A plan's own checkout page, on the checkout page's site. */
+        url: string;
+        /** The plan this page sells (its name as in your plans). */
+        plan?: string;
+    }> | null;
     purchase?: SitePurchase;
     test_account?: SiteTestAccount;
     /** Explicit cancellation steps (otherwise auto-discovered). */
@@ -1569,6 +1658,17 @@ export interface Finding {
     /** User-facing status. needs_fix (a requirement is clearly not met: `compliance.fix` is the one change), pending_live_check (everything Checkbox can see is right; the live event has not been observed yet — counts as passing the checks), verified_live (observed live: proof run, real BCC'd send, Stripe-confirmed cancellation), your_call (a real decision for a person: `compliance.question`), compliant (passes; grey areas carry a `compliance.note`), not_applicable, not_set_up (no sign the email or setting exists yet: `compliance.fix` is the one-click way to set it up; never counts as passing the checks), not_checked (Checkbox has not tried it yet, e.g. the cancel flow: `compliance.fix` says how; never counts as passing the checks). */
     compliance_status: "needs_fix" | "pending_live_check" | "verified_live" | "your_call" | "compliant" | "not_applicable" | "not_set_up" | "not_checked";
     compliance: ComplianceInfo;
+    /** The compliance plan task this check belongs to and what the plan says about it. The plan decides what is left to do: when compliance and plan_task.label differ (a check pending a live send, a decision you recorded), follow the plan. Null when no task covers the check. */
+    plan_task?: {
+        /** Unique identifier of the task (task_…). */
+        id: string;
+        /** The task title. */
+        title: string;
+        /** The task status in the compliance plan. */
+        status: string;
+        /** What the compliance plan says about it, in its own words (the to-do label, Done, Checks pass · live check pending, ...). */
+        label: string;
+    } | null;
     /** Scan that produced the latest result. */
     scan: string | null;
     /** First time the check was evaluated. Unix timestamp in seconds. */
@@ -1762,8 +1862,8 @@ export interface Task {
     last_verification: {
         /** Unique identifier of the verification (ver_…). */
         id: string;
-        /** Result. */
-        status: "pending" | "passed" | "failed";
+        /** Result. incomplete: every check observed passes, but something the task covers was not given to Checkbox yet (e.g. a plan's Checkout config is not registered); not done. */
+        status: "pending" | "passed" | "incomplete" | "failed";
         /** When it was requested. Unix timestamp in seconds. */
         created: number;
     } | null;
@@ -1781,6 +1881,13 @@ export interface Task {
     verification_level: "not_seen" | "template_checked" | "delivery_seen" | null;
     /** When the task first appeared. Unix timestamp in seconds. */
     first_seen: number;
+    /** Present on an open task that was not in the site's first plan: a later check found it. Tell the human it is new, and what found it. */
+    found_after_first_plan?: {
+        /** When it first appeared. Unix timestamp in seconds. */
+        found: number;
+        /** What found it, in plain words (the scan of your checkout page, the read of your Terms, the Stripe read, ...). */
+        found_by: string;
+    };
     /** When it was done. Unix timestamp in seconds. */
     done_at: number | null;
 }
@@ -1857,7 +1964,7 @@ export interface CompliancePlan {
         description: string;
         /** Every choice only the owner makes, together. */
         questions: Array<{
-            /** "email_sender" (who sends the required emails), "notices_support_email" / "notices_cancel_timing" (what Checkbox Notices needs before it sends), or the id of the task whose question it is. */
+            /** "email_sender" (who sends the required emails), "notices_support_email" / "notices_cancel_timing" (what Checkbox Notices needs before it sends), "stripe_terms_url" (a step only the owner takes in the Stripe Dashboard: the Terms of Service URL Stripe needs before it collects consent, in test mode too), or the id of the task whose question it is. */
             id: string;
             /** The question, in plain words for the owner. */
             text: string;
@@ -1953,8 +2060,8 @@ export interface Verification {
     task: string | null;
     /** One task or the whole site. */
     scope: "task" | "site";
-    /** pending (waiting for the confirming scan / re-evaluation), passed (Checkbox observed the expected result: every check passes or does not apply), passed_with_gaps (nothing observed fails, but some checks could not be observed: observed missing_data — not verified), passed_with_notes (nothing observed fails and the task counts as passing, but a check is still needs_review on a part that is not yours to change, such as Stripe's own page layout: see checks), not_checked (a task whose checks could only not be observed yet: nothing to change in the code; next_action says what evidence to provide), pending_live_check (an email whose content passes but that Checkbox has not seen sent for a real event yet: nothing to change; it completes on the first real send or a proof run), needs_review (nothing observed fails, but a check is still undecided, e.g. a cancellation not tried yet or a styling estimate: not done; next_action says what decides it), failed (a check was observed failing: see diff), superseded (this verification did not pass, but newer evidence, such as a test run or a later evaluation, settled the task since: see superseded and follow next_action; nothing to change for it). */
-    status: "pending" | "passed" | "passed_with_gaps" | "passed_with_notes" | "not_checked" | "pending_live_check" | "needs_review" | "failed" | "superseded";
+    /** pending (waiting for the confirming scan / re-evaluation), passed (Checkbox observed the expected result: every check passes or does not apply), passed_with_gaps (nothing observed fails, but some checks could not be observed: observed missing_data — not verified), passed_with_notes (nothing observed fails and the task counts as passing, but a check is still needs_review on a part that is not yours to change, such as Stripe's own page layout: see checks), not_checked (a task whose checks could only not be observed yet: nothing to change in the code; next_action says what evidence to provide), pending_live_check (an email whose content passes but that Checkbox has not seen sent for a real event yet: nothing to change; it completes on the first real send or a proof run), needs_review (nothing observed fails, but a check is still undecided, e.g. a cancellation not tried yet or a styling estimate: not done; next_action says what decides it), incomplete (every check observed passes, but something the task covers was not given to Checkbox yet, e.g. one plan's Stripe Checkout config is not registered: not done; next_action says what to register), failed (a check was observed failing: see diff), superseded (this verification did not pass, but newer evidence, such as a test run or a later evaluation, settled the task since: see superseded and follow next_action; nothing to change for it). */
+    status: "pending" | "passed" | "passed_with_gaps" | "passed_with_notes" | "not_checked" | "pending_live_check" | "needs_review" | "incomplete" | "failed" | "superseded";
     /** Set when newer evidence settled the task after this verification finished (status superseded). */
     superseded?: {
         /** The task's status in the current plan. */
@@ -2334,6 +2441,8 @@ export interface NoticeSettings {
     real_sends: "test_mode" | "confirmed" | "needs_confirmation" | "off";
     /** Where subscribers cancel online (site domain, hosted cancellation page or billing portal). */
     cancel_url: string | null;
+    /** Round 35: set when every notice links to cancel_url while Checkbox has not seen a working online cancellation (cancel.online_available is not passing). Fix the cancel option there, or point cancel_url at one that works (e.g. the hosted cancellation page). */
+    cancel_url_warning?: string | null;
     /** Hex brand colour. */
     brand_color: string | null;
     /** Mailbox name of the sender. */
@@ -2854,13 +2963,13 @@ export interface DisclosureCheckParams {
     trial_days?: number;
     /** Intro / first-period price in major units ("$34.50 for your first box, then $69 every 2 weeks"). Or give `intro_amount` in minor units. */
     intro_price?: number | string;
-    /** Intro / first-period price in minor units. */
+    /** Intro / first-period price in minor units (999 = $9.99), like `amount`. Units never mix: price / intro_price are major units, amount / intro_amount / intro_amount_off are minor units; with `price` in major units, a value under 100 that reads like major units is refused with both ways to send it. */
     intro_amount?: number;
     /** How many billing periods the intro price lasts (default 1). */
     intro_periods?: number;
     /** Intro discount as a percentage off the recurring price (a Stripe coupon's percent_off: 20 for "20% off your first month"). Lasts `intro_periods` billing periods. Give one of intro_price / intro_amount, intro_percent_off or intro_amount_off. */
     intro_percent_off?: number;
-    /** Intro discount as an amount off in minor units (a Stripe coupon's amount_off: 200 for $2.00 off). Lasts `intro_periods` billing periods. */
+    /** Intro discount as an amount off in minor units (a Stripe coupon's amount_off: 200 for $2.00 off), like `amount`, even when the price is sent as `price` in major units. Lasts `intro_periods` billing periods. */
     intro_amount_off?: number;
     /** https URL where subscribers cancel online (used in generated text; a {{cancel_url}} placeholder otherwise). */
     cancel_url?: string;
@@ -2900,6 +3009,8 @@ export interface DisclosureCheckParams {
         /** The form cannot be submitted without ticking it (default true). */
         required?: boolean;
     };
+    /** Where the shopper pays: own_page (a form on this page), stripe_checkout or payment_link (a Stripe-hosted page that collects consent, so no checkbox is needed next to this text; consent is then left to that page and checked with checkStripeCheckoutSession / checkStripePaymentLink). With site, the site's checkout type is used when absent (declared, or Stripe Checkout when the site has a registered Stripe Checkout config). */
+    checkout_type?: "own_page" | "stripe_checkout" | "payment_link";
     /** Evaluate the law as of this date (YYYY-MM-DD, default today). */
     as_of?: string;
     /** Round 23: a site of yours (site_…): the disclosure is judged against the plan it states among the site's plans (the connected Stripe Prices win over plans typed in setup), with the site's merchant name, cancellation URL and jurisdictions, as verifyTask judges it. Plan fields you send are replaced by the plan's. "none" judges only what you send. */
@@ -3013,13 +3124,13 @@ export interface CheckPlanTerms {
     trial_days?: number;
     /** Intro / first-period price in major units ("$34.50 for your first box, then $69 every 2 weeks"). Or give `intro_amount` in minor units. */
     intro_price?: number | string;
-    /** Intro / first-period price in minor units. */
+    /** Intro / first-period price in minor units (999 = $9.99), like `amount`. Units never mix: price / intro_price are major units, amount / intro_amount / intro_amount_off are minor units; with `price` in major units, a value under 100 that reads like major units is refused with both ways to send it. */
     intro_amount?: number;
     /** How many billing periods the intro price lasts (default 1). */
     intro_periods?: number;
     /** Intro discount as a percentage off the recurring price (a Stripe coupon's percent_off: 20 for "20% off your first month"). Lasts `intro_periods` billing periods. Give one of intro_price / intro_amount, intro_percent_off or intro_amount_off. */
     intro_percent_off?: number;
-    /** Intro discount as an amount off in minor units (a Stripe coupon's amount_off: 200 for $2.00 off). Lasts `intro_periods` billing periods. */
+    /** Intro discount as an amount off in minor units (a Stripe coupon's amount_off: 200 for $2.00 off), like `amount`, even when the price is sent as `price` in major units. Lasts `intro_periods` billing periods. */
     intro_amount_off?: number;
     /** https URL where subscribers cancel online (used in generated text; a {{cancel_url}} placeholder otherwise). */
     cancel_url?: string;
@@ -4455,7 +4566,7 @@ export interface TestRunStep {
     checks: Array<{
         /** Machine check id (see listRules / the legal catalog). */
         check_id: string;
-        /** pass, fail, needs_review or not_applicable, judged from this run's observations. */
+        /** pass, fail, needs_review or not_applicable, judged from this run's observations; informational on a step that is informational only (a mirrored page that is not your checkout): listed, never a failure, nothing to fix. */
         status: string;
         /** What was observed. */
         message: string;
@@ -5610,7 +5721,7 @@ export declare const ERROR_CODES: {
     readonly test_key_declined: {
         readonly status: 403;
         readonly type: "permission_error";
-        readonly description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard.";
+        readonly description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. next_action.url is a one-click allow page for this agent or app (dashboard /allow-stripe-test-key, signed in, no new sign-in); or the human adds the key themselves in the dashboard.";
     };
     readonly test_key_rejected: {
         readonly status: 400;

package/dist/generated/types.js

@@ -21,7 +21,7 @@ export const ERROR_CODES = {
     test_key_missing: { status: 400, type: "invalid_request_error", description: "A Stripe test run needs a Stripe TEST-mode key stored for the site: the agent stores the restricted test key (rk_test_…) with createTestCredential, or a person adds it in the dashboard." },
     test_key_not_test_mode: { status: 400, type: "invalid_request_error", description: "The billing key is a live-mode (or malformed) key. Agents only store TEST-mode restricted keys (rk_test_…); a human adds live keys in the Checkbox dashboard." },
     test_key_not_restricted: { status: 400, type: "invalid_request_error", description: "The key is a full Stripe secret key (sk_test_… or sk_live_…), which is refused on every connect path (createTestCredential, connectBillingPlatform, the dashboard). Use a restricted key (rk_test_…) with the permissions on Checkbox's key checklist instead; `message` lists them." },
-    test_key_declined: { status: 403, type: "permission_error", description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. Ask them to allow it on the approval page (sign in again) or to add the key themselves in the dashboard." },
+    test_key_declined: { status: 403, type: "permission_error", description: "The owner did not tick “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in, device login) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection, OAuth) on the approval page (checkbox id consent-stripe-test-key). Nothing was stored. next_action.url is a one-click allow page for this agent or app (dashboard /allow-stripe-test-key, signed in, no new sign-in); or the human adds the key themselves in the dashboard." },
     test_key_rejected: { status: 400, type: "invalid_request_error", description: "Stripe rejected the test-mode key or it lacks a permission test runs need; `message` names it." },
     authorization_pending: { status: 400, type: "invalid_request_error", description: "Device login: the human has not approved yet. Keep polling createDeviceToken every `interval` seconds." },
     slow_down: { status: 400, type: "rate_limit_error", description: "Device login: polling too fast. Add 5 seconds to the interval and keep polling." },

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
-export declare const SDK_VERSION = "0.2.6";
+export declare const SDK_VERSION = "0.2.8";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Version of this SDK (kept equal to packages/sdk-node/package.json "version"; a test checks it). */
-export const SDK_VERSION = '0.2.6';
+export const SDK_VERSION = '0.2.8';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/node",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Checkbox Node.js SDK: auto-renewal law and subscription compliance checks (FTC ROSCA, California ARL, New York and other state laws) for Stripe Checkout and other subscription checkouts. Zero dependencies. Published to npm as @checkbox-site/node.",
   "keywords": [
     "subscription",