@weaccelerateinc/agent-sdk 0.12.0 → 0.13.0

package/README.md

@@ -1,13 +1,15 @@
-# @weaccelerateinc/agent-sdk 0.12.0
+# @weaccelerateinc/agent-sdk 0.13.0
 
-SDK 0.12.0 adds opt-in Browser Use run-created fill-only checkout, exact additional-extension policies, and private WhatsApp adapters with durable sent-receipt reconciliation. The platform must implement durable owner/session/viewer fences and qualify its provider. Existing connector defaults and the 0.11.0 customer-final-click purchase contract remain. The approved extension ZIP is unchanged; its compatibility metadata includes 0.12.0.
+SDK 0.13.0 lets authenticated integrations attach their customer-owned Browser Use browser without a separate merchant opt-in or an inventory of other installed extensions. Accelerate verifies its own extension, ownership and run binding. The run-created flow remains fill-only with private verification, durable scheduling/viewer fences, replay protection and cleanup. The approved extension ZIP is unchanged; its compatibility metadata includes 0.13.0.
+
+Apply required migration 004 and deploy the matching wallet/gateway and reaper before the managed service, then install this SDK. SDK 0.12.0 retains its original opt-in and inventory checks. The customer controls its browser and other extensions; Accelerate does not claim isolation from them.
 
 Version 0.11.0 is a breaking release: **Accelerate never sends the final payment click.** A purchase arms one short click, the customer's agent performs it once through its own browser connection (`BrowserConnectorHost.performFinalClick`) in the customer's existing browser, then Accelerate observes the outcome. Purchase requires `final_click_actor:'customer'` and that host; the managed Kernel browser is fill-only. `client.checkouts.submit` rejects locally with `customer_click_required`. See [customer-owned final click](../../docs/customer-final-click.md). Release 0.10.3 keeps its existing behavior. Merchant layouts remain limited to the qualified sandbox page; this SDK release does not by itself qualify any merchant layout, a service deployment or production payments.
 
-Server-only ESM SDK with TypeScript declarations, Node 22+, zero runtime dependencies. New partners use their existing browser and explicitly select `managed_review_v2`, which continues an armed fill immediately after private CVV verification. Existing callers keep `managed_review_v1` unless they opt in. Public npm releases use `@weaccelerateinc/agent-sdk`; install an exact available version with `npm install @weaccelerateinc/agent-sdk@0.12.0`. Check `npm view @weaccelerateinc/agent-sdk@0.12.0 version` to confirm registry availability. The package remains `UNLICENSED`.
+Server-only ESM SDK with TypeScript declarations, Node 22+, zero runtime dependencies. New partners use their existing browser and explicitly select `managed_review_v2`, which continues an armed fill immediately after private CVV verification. Existing callers keep `managed_review_v1` unless they opt in. Public npm releases use `@weaccelerateinc/agent-sdk`; install an exact available version with `npm install @weaccelerateinc/agent-sdk@0.13.0`. Check `npm view @weaccelerateinc/agent-sdk@0.13.0 version` to confirm registry availability. The package remains `UNLICENSED`.
 
 ```sh
-npm install --ignore-scripts @weaccelerateinc/agent-sdk@0.12.0
+npm install --ignore-scripts @weaccelerateinc/agent-sdk@0.13.0
 npx --no-install accelerate-agent init ./partner-demo --browser existing
 ```
 

package/approved-extension-releases/0.0.0.1.json

@@ -28,7 +28,8 @@
       "0.10.3",
       "0.10.4",
       "0.11.0",
-      "0.12.0"
+      "0.12.0",
+      "0.13.0"
     ],
     "executor_contract": "accelerate_manual_checkout_v1"
   },

package/approved-extension-releases/0.0.0.2.json

@@ -27,7 +27,8 @@
       "0.10.3",
       "0.10.4",
       "0.11.0",
-      "0.12.0"
+      "0.12.0",
+      "0.13.0"
     ],
     "executor_contract": "accelerate_manual_checkout_v1"
   },

package/approved-extension.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 
-const SDK_VERSION = '0.12.0';
+const SDK_VERSION = '0.13.0';
 const EXECUTOR_CONTRACT = 'accelerate_manual_checkout_v1';
 const BRIDGE_PROTOCOL = 'accelerate_extension_bridge_v1';
 const LEGACY_SHA256 = '65574cbb27ab344687963f72a136f2653551b57458b284e486946b27699099c8';

package/browser-use-host.d.ts

@@ -42,14 +42,14 @@ export function createBrowserUseHost(options: {
   merchantId: string;
   extensionId: string;
   /** Primary runtime ID pinned in durable operator installation configuration.
-   * Required for run-created or multi-extension mode; stable across host restarts. */
+   * Required when the resolved browser has run provenance; stable across host restarts. */
   extensionRuntimeId?: string;
   extensionRelease: ApprovedExtensionRelease;
   host: BrowserUsePlatformHost;
-  /** Requires a durable owned run reservation and a fence covering all session runs and queued work.
-   * The executor must separately enable this merchant. Default false. */
+  /** @deprecated Ignored. Run-created browsers require a durable owned reservation,
+   * a pinned extensionRuntimeId and a fence covering all session runs and queued work. */
   allowRunCreatedBrowsers?: boolean;
-  /** Complete additional extension set approved for this merchant/provider. This is not qualification evidence. */
+  /** @deprecated Ignored. The customer manages its other browser extensions. */
   additionalExtensions?: ReadonlyArray<Readonly<{ id: string; runtimeId: string; version: string }>>;
   fetchImpl?: typeof fetch;
   /** Test clock only. */

package/browser-use-host.js

@@ -45,23 +45,14 @@ const freeze = value => {
 };
 
 export function createBrowserUseHost(configuration = {}) {
+  // Legacy opt-in and extension-inventory options remain accepted but have no effect.
   exact(configuration, ['apiKey', 'merchantId', 'extensionId', 'extensionRelease', 'host'], ['fetchImpl', 'now', 'allowRunCreatedBrowsers', 'additionalExtensions', 'extensionRuntimeId']);
-  const { apiKey, merchantId, extensionId, host, fetchImpl = fetch, now = Date.now,
-    allowRunCreatedBrowsers = false, additionalExtensions = [], extensionRuntimeId } = configuration;
+  const { apiKey, merchantId, extensionId, host, fetchImpl = fetch, now = Date.now, extensionRuntimeId } = configuration;
   check(typeof apiKey === 'string' && apiKey.length >= 16 && apiKey.length <= 500 && !/[\u0000-\u0020\u007f]/u.test(apiKey) &&
     UUID.test(merchantId) && UUID.test(extensionId) && typeof fetchImpl === 'function' && typeof now === 'function' && host &&
     ['resolveOwnedBrowser', 'drainAndFence', 'bindCheckout', 'resolveCheckoutBrowser', 'inspectDocument', 'confirmLocalCleanup']
       .every(key => typeof host[key] === 'function'), 'configuration_invalid');
-  check(typeof allowRunCreatedBrowsers === 'boolean' && Array.isArray(additionalExtensions) && additionalExtensions.length <= 2, 'configuration_invalid');
   check(extensionRuntimeId === undefined || RUNTIME.test(extensionRuntimeId), 'configuration_invalid');
-  check(!(allowRunCreatedBrowsers || additionalExtensions.length) || RUNTIME.test(extensionRuntimeId ?? ''), 'configuration_invalid');
-  const extensionIds = new Set([extensionId]), runtimes = new Set();
-  const extras = additionalExtensions.map(value => {
-    exact(value, ['id', 'runtimeId', 'version']);
-    check(UUID.test(value.id) && RUNTIME.test(value.runtimeId) && typeof value.version === 'string' &&
-      /^\d+(?:\.\d+){0,3}$/u.test(value.version) && !extensionIds.has(value.id) && !runtimes.has(value.runtimeId), 'configuration_invalid');
-    extensionIds.add(value.id); runtimes.add(value.runtimeId); return Object.freeze({ ...value });
-  });
   let release;
   try { release = validateApprovedExtensionRelease(configuration.extensionRelease); }
   catch { throw new AccelerateError('configuration_invalid'); }
@@ -81,7 +72,8 @@ export function createBrowserUseHost(configuration = {}) {
     catch { throw new AccelerateError('permission_denied'); }
     let provenance;
     if (Object.hasOwn(document.browser, 'provenance')) {
-      check(allowRunCreatedBrowsers || cleanup && typeof document.fence_id === 'string' && document.fence_id.length > 0, 'permission_denied');
+      check(RUNTIME.test(extensionRuntimeId ?? ''), 'configuration_invalid');
+      check(!cleanup || typeof document.fence_id === 'string' && document.fence_id.length > 0, 'permission_denied');
       try { provenance = browserUseRunProvenance(document.browser.provenance); }
       catch { throw new AccelerateError('permission_denied'); }
     }
@@ -139,23 +131,23 @@ export function createBrowserUseHost(configuration = {}) {
         metadata.accelerate_extension_sha256 === release.artifact.sha256 && metadata.accelerate_extension_version === release.extension_version) &&
         typeof value.timeoutAt === 'string' && Number.isFinite(Date.parse(value.timeoutAt)) &&
         (requiredStatus === 'stopped' || Date.parse(value.timeoutAt) > now()) &&
-        Array.isArray(value.extensions) && value.extensions.length === extras.length + 1 &&
-        new Set(value.extensions.map(item => item?.id)).size === value.extensions.length &&
-        new Set(value.extensions.map(item => item?.runtimeId)).size === value.extensions.length);
-      const primary = value.extensions.find(item => item?.id === extensionId);
-      check(primary?.version === release.extension_version && RUNTIME.test(primary?.runtimeId ?? '') &&
-        extras.every(expected => value.extensions.some(item => ['id', 'version', 'runtimeId'].every(key => item?.[key] === expected[key]))));
+        Array.isArray(value.extensions));
+      const primaries = value.extensions.filter(item => item?.id === extensionId);
+      check(primaries.length === 1);
+      const primary = primaries[0];
+      check(primary.version === release.extension_version && RUNTIME.test(primary.runtimeId ?? '') &&
+        !value.extensions.some(item => item !== primary && item?.runtimeId === primary.runtimeId));
       check(extensionRuntimeId === undefined || primary.runtimeId === extensionRuntimeId);
       // Deliberately project away provider CDP/viewer URLs and unknown response fields.
       const read = freeze({ expires_at: value.timeoutAt, runtime_id: primary.runtimeId });
       if (!options.withConnection) return read;
       check(typeof value.cdpUrl === 'string' && value.cdpUrl.length <= 2048 && typeof value.startedAt === 'string');
       return freeze({ ...read, connection: freeze({ id: value.id, status: value.status, cdpUrl: value.cdpUrl, startedAt: value.startedAt,
-        timeoutAt: value.timeoutAt, recordingAvailable: false,
+        timeoutAt: value.timeoutAt, recordingAvailable: false, accelerate_extension_id: extensionId,
         metadata: binding.provenance ? {} : Object.fromEntries(['accelerate_merchant_id', 'accelerate_owner_user_id',
           'accelerate_workspace_id', 'accelerate_custody_mode', 'accelerate_agent_extension_id',
           'accelerate_extension_sha256', 'accelerate_extension_version'].map(key => [key, metadata[key]])),
-        extensions: value.extensions.map(item => ({ id: item.id, runtimeId: item.runtimeId, version: item.version })),
+        extensions: [{ id: extensionId, runtimeId: primary.runtimeId, version: primary.version }],
         ...runEvidence }) });
     } catch {
       throw new AccelerateError(options.signal?.aborted ? 'request_cancelled' : 'integration_unavailable');

package/index.d.ts

@@ -166,9 +166,13 @@ export interface CreateCheckout {
    * Send it on every create. It is held in memory for this checkout and never stored. */
   browser_resource?: ClientBrowserResource;
 }
-/** The fields of Browser Use `GET /api/v4/browsers/{id}` that Accelerate needs. */
+/** Private projection of Browser Use `GET /api/v4/browsers/{id}`, with the
+ * Accelerate extension selected by the authenticated backend. */
 export interface ClientBrowserResource {
   id: string;
+  /** Accelerate extension selected from the backend's durable installation configuration.
+   * Other extensions in the customer-owned browser are outside this projection. */
+  accelerate_extension_id?: string;
   status: 'active';
   cdpUrl: string;
   startedAt: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaccelerateinc/agent-sdk",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Server-only payment SDK, existing-browser connectors and private host adapters for agent platforms",
   "type": "module",
   "main": "./index.js",

package/partner-starter/README.md

@@ -1,15 +1,15 @@
 # Existing-browser payment starter
 
-SDK 0.12.0, explicit `managed_review_v2`, `customer_backend_trusted`. Newly generated existing-browser apps default to `purpose:'purchase'` with the submit tool enabled. The matching service must support this profile; publishing the SDK does not deploy the service or qualify a merchant layout. Your platform creates its browser and installs the approved extension. This starter attaches that same browser at payment; it never creates a replacement. The older `accelerate-agent init <dir>` starter still selects Accelerate-managed Kernel custody and its fill-only default.
+SDK 0.13.0, explicit `managed_review_v2`, `customer_backend_trusted`. Newly generated existing-browser apps default to `purpose:'purchase'` with the submit tool enabled. The matching service must support this profile; publishing the SDK does not deploy the service or qualify a merchant layout. Your platform creates its browser and installs the approved extension. This starter attaches that same browser at payment; it never creates a replacement. The older `accelerate-agent init <dir>` starter still selects Accelerate-managed Kernel custody and its fill-only default.
 
 ## Run without credentials
 
-Once Accelerate supplies the matching verified 0.12.0 archive, install it, then:
+Once Accelerate supplies the matching verified 0.13.0 archive, install it, then:
 
 ```sh
 npx --no-install accelerate-agent init ./partner-demo --browser existing
 cd partner-demo
-npm install /secure/downloads/weaccelerateinc-agent-sdk-0.12.0.tgz
+npm install /secure/downloads/weaccelerateinc-agent-sdk-0.13.0.tgz
 npm test
 npm run smoke
 ```

package/partner-starter/package.json

@@ -12,7 +12,7 @@
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@weaccelerateinc/agent-sdk": "0.12.0",
+    "@weaccelerateinc/agent-sdk": "0.13.0",
     "@modelcontextprotocol/server": "2.3.1"
   },
   "devDependencies": {

package/partner-starter/synthetic.mjs

@@ -225,7 +225,7 @@ export function createSyntheticDependencies({ purpose = 'sandbox_fill_only', pro
     artifact: { format: 'zip', sha256: 'a'.repeat(64), bytes: 1234 },
     bridge: { protocol: 'accelerate_extension_bridge_v1', sha256: 'b'.repeat(64) },
     capabilities: { manual_card_fill: true, document_bound_single_use: true, autosave_disabled: true, automatic_submit: false, maximum_retention_ms: 480000 },
-    compatibility: { sdk_versions: ['0.10.1', '0.10.2', '0.10.3', '0.10.4', '0.11.0', '0.12.0'], executor_contract: 'accelerate_manual_checkout_v1' },
+    compatibility: { sdk_versions: ['0.10.1', '0.10.2', '0.10.3', '0.10.4', '0.11.0', '0.12.0', '0.13.0'], executor_contract: 'accelerate_manual_checkout_v1' },
     qualifications: [{ provider: 'connector', scope: 'synthetic_only', evidence: 'docs/evidence/synthetic-starter.json' }],
   }; // Fake metadata for this in-process fixture only; never load it in live mode.
   const browser = { owner: context, browser: { provider: 'connector', connector_id: 'synthetic_cdp', browser_id: 'existing:browser:1', custody_mode: 'customer_backend_trusted' },

package/starter/README.md

@@ -6,12 +6,12 @@ The default runnable mode is **synthetic**. It uses the real SDK, managed MCP ad
 
 ## Install and run
 
-Requires Node.js 22 or newer. Install the exact SDK 0.9.0 archive and checksum supplied by Accelerate; [release distribution](https://github.com/weaccelerateinc/accelerate-agent-sdk/blob/main/docs/releases.md) records verified availability. Do not assume npm publication.
+Requires Node.js 22 or newer. Install the exact SDK 0.13.0 archive and checksum supplied by Accelerate; [release distribution](https://github.com/weaccelerateinc/accelerate/blob/main/products/agent-sdk/docs/releases.md) records verified availability. Do not assume npm publication.
 
 ```sh
 npx --no-install accelerate-agent init ./accelerate-demo
 cd accelerate-demo
-npm install /absolute/path/to/accelerate-agent-sdk-0.9.0.tgz
+npm install /absolute/path/to/weaccelerateinc-agent-sdk-0.13.0.tgz
 npm test
 npm run smoke
 ```

package/starter/package.json

@@ -12,7 +12,7 @@
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@weaccelerateinc/agent-sdk": "0.12.0",
+    "@weaccelerateinc/agent-sdk": "0.13.0",
     "@modelcontextprotocol/server": "2.3.1"
   },
   "devDependencies": {