@weaccelerateinc/agent-sdk 0.12.0 → 0.14.0

package/README.md

@@ -1,13 +1,17 @@
-# @weaccelerateinc/agent-sdk 0.12.0
+# @weaccelerateinc/agent-sdk 0.14.0
 
-SDK 0.12.0 adds opt-in Browser Use run-created fill-only checkout, exact additional-extension policies, and private WhatsApp adapters with durable sent-receipt reconciliation. The platform must implement durable owner/session/viewer fences and qualify its provider. Existing connector defaults and the 0.11.0 customer-final-click purchase contract remain. The approved extension ZIP is unchanged; its compatibility metadata includes 0.12.0.
+SDK 0.14.0 adds `client.checkouts.erase(id, binding)` for account deletion and negotiated `number_required` hints in private chat. Erasure retains cleanup ownership until browser retirement succeeds. A false or absent card hint does not establish readiness; verification can still require CVV or full card details.
+
+SDK 0.14.0 also lets authenticated integrations attach their customer-owned Browser Use browser without a separate merchant opt-in or an inventory of other installed extensions. Accelerate verifies its own extension, ownership and run binding. The run-created flow remains fill-only with private verification, durable scheduling/viewer fences, replay protection and cleanup. The approved extension ZIP is unchanged; its compatibility metadata includes 0.14.0.
+
+The browser-attachment baseline requires migration 004 and its matching gateway/reaper. For the 0.14.0 card hint, deploy the updated managed service before the wallet card-number passthrough and deploy the API flag in the same target environment. Then install this SDK. SDK 0.12.0 retains its original opt-in and inventory checks. The customer controls its browser and other extensions; Accelerate does not claim isolation from them.
 
 Version 0.11.0 is a breaking release: **Accelerate never sends the final payment click.** A purchase arms one short click, the customer's agent performs it once through its own browser connection (`BrowserConnectorHost.performFinalClick`) in the customer's existing browser, then Accelerate observes the outcome. Purchase requires `final_click_actor:'customer'` and that host; the managed Kernel browser is fill-only. `client.checkouts.submit` rejects locally with `customer_click_required`. See [customer-owned final click](../../docs/customer-final-click.md). Release 0.10.3 keeps its existing behavior. Merchant layouts remain limited to the qualified sandbox page; this SDK release does not by itself qualify any merchant layout, a service deployment or production payments.
 
-Server-only ESM SDK with TypeScript declarations, Node 22+, zero runtime dependencies. New partners use their existing browser and explicitly select `managed_review_v2`, which continues an armed fill immediately after private CVV verification. Existing callers keep `managed_review_v1` unless they opt in. Public npm releases use `@weaccelerateinc/agent-sdk`; install an exact available version with `npm install @weaccelerateinc/agent-sdk@0.12.0`. Check `npm view @weaccelerateinc/agent-sdk@0.12.0 version` to confirm registry availability. The package remains `UNLICENSED`.
+Server-only ESM SDK with TypeScript declarations, Node 22+, zero runtime dependencies. New partners use their existing browser and explicitly select `managed_review_v2`, which continues an armed fill immediately after private CVV verification. Existing callers keep `managed_review_v1` unless they opt in. Public npm releases use `@weaccelerateinc/agent-sdk`; install an exact available version with `npm install @weaccelerateinc/agent-sdk@0.14.0`. Check `npm view @weaccelerateinc/agent-sdk@0.14.0 version` to confirm registry availability. The package remains `UNLICENSED`.
 
 ```sh
-npm install --ignore-scripts @weaccelerateinc/agent-sdk@0.12.0
+npm install --ignore-scripts @weaccelerateinc/agent-sdk@0.14.0
 npx --no-install accelerate-agent init ./partner-demo --browser existing
 ```
 

package/approved-extension-releases/0.0.0.1.json

@@ -28,7 +28,9 @@
       "0.10.3",
       "0.10.4",
       "0.11.0",
-      "0.12.0"
+      "0.12.0",
+      "0.13.0",
+      "0.14.0"
     ],
     "executor_contract": "accelerate_manual_checkout_v1"
   },

package/approved-extension-releases/0.0.0.2.json

@@ -27,7 +27,9 @@
       "0.10.3",
       "0.10.4",
       "0.11.0",
-      "0.12.0"
+      "0.12.0",
+      "0.13.0",
+      "0.14.0"
     ],
     "executor_contract": "accelerate_manual_checkout_v1"
   },

package/approved-extension.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 
-const SDK_VERSION = '0.12.0';
+const SDK_VERSION = '0.14.0';
 const EXECUTOR_CONTRACT = 'accelerate_manual_checkout_v1';
 const BRIDGE_PROTOCOL = 'accelerate_extension_bridge_v1';
 const LEGACY_SHA256 = '65574cbb27ab344687963f72a136f2653551b57458b284e486946b27699099c8';

package/browser-use-host.d.ts

@@ -42,14 +42,14 @@ export function createBrowserUseHost(options: {
   merchantId: string;
   extensionId: string;
   /** Primary runtime ID pinned in durable operator installation configuration.
-   * Required for run-created or multi-extension mode; stable across host restarts. */
+   * Required when the resolved browser has run provenance; stable across host restarts. */
   extensionRuntimeId?: string;
   extensionRelease: ApprovedExtensionRelease;
   host: BrowserUsePlatformHost;
-  /** Requires a durable owned run reservation and a fence covering all session runs and queued work.
-   * The executor must separately enable this merchant. Default false. */
+  /** @deprecated Ignored. Run-created browsers require a durable owned reservation,
+   * a pinned extensionRuntimeId and a fence covering all session runs and queued work. */
   allowRunCreatedBrowsers?: boolean;
-  /** Complete additional extension set approved for this merchant/provider. This is not qualification evidence. */
+  /** @deprecated Ignored. The customer manages its other browser extensions. */
   additionalExtensions?: ReadonlyArray<Readonly<{ id: string; runtimeId: string; version: string }>>;
   fetchImpl?: typeof fetch;
   /** Test clock only. */

package/browser-use-host.js

@@ -45,23 +45,14 @@ const freeze = value => {
 };
 
 export function createBrowserUseHost(configuration = {}) {
+  // Legacy opt-in and extension-inventory options remain accepted but have no effect.
   exact(configuration, ['apiKey', 'merchantId', 'extensionId', 'extensionRelease', 'host'], ['fetchImpl', 'now', 'allowRunCreatedBrowsers', 'additionalExtensions', 'extensionRuntimeId']);
-  const { apiKey, merchantId, extensionId, host, fetchImpl = fetch, now = Date.now,
-    allowRunCreatedBrowsers = false, additionalExtensions = [], extensionRuntimeId } = configuration;
+  const { apiKey, merchantId, extensionId, host, fetchImpl = fetch, now = Date.now, extensionRuntimeId } = configuration;
   check(typeof apiKey === 'string' && apiKey.length >= 16 && apiKey.length <= 500 && !/[\u0000-\u0020\u007f]/u.test(apiKey) &&
     UUID.test(merchantId) && UUID.test(extensionId) && typeof fetchImpl === 'function' && typeof now === 'function' && host &&
     ['resolveOwnedBrowser', 'drainAndFence', 'bindCheckout', 'resolveCheckoutBrowser', 'inspectDocument', 'confirmLocalCleanup']
       .every(key => typeof host[key] === 'function'), 'configuration_invalid');
-  check(typeof allowRunCreatedBrowsers === 'boolean' && Array.isArray(additionalExtensions) && additionalExtensions.length <= 2, 'configuration_invalid');
   check(extensionRuntimeId === undefined || RUNTIME.test(extensionRuntimeId), 'configuration_invalid');
-  check(!(allowRunCreatedBrowsers || additionalExtensions.length) || RUNTIME.test(extensionRuntimeId ?? ''), 'configuration_invalid');
-  const extensionIds = new Set([extensionId]), runtimes = new Set();
-  const extras = additionalExtensions.map(value => {
-    exact(value, ['id', 'runtimeId', 'version']);
-    check(UUID.test(value.id) && RUNTIME.test(value.runtimeId) && typeof value.version === 'string' &&
-      /^\d+(?:\.\d+){0,3}$/u.test(value.version) && !extensionIds.has(value.id) && !runtimes.has(value.runtimeId), 'configuration_invalid');
-    extensionIds.add(value.id); runtimes.add(value.runtimeId); return Object.freeze({ ...value });
-  });
   let release;
   try { release = validateApprovedExtensionRelease(configuration.extensionRelease); }
   catch { throw new AccelerateError('configuration_invalid'); }
@@ -81,7 +72,8 @@ export function createBrowserUseHost(configuration = {}) {
     catch { throw new AccelerateError('permission_denied'); }
     let provenance;
     if (Object.hasOwn(document.browser, 'provenance')) {
-      check(allowRunCreatedBrowsers || cleanup && typeof document.fence_id === 'string' && document.fence_id.length > 0, 'permission_denied');
+      check(RUNTIME.test(extensionRuntimeId ?? ''), 'configuration_invalid');
+      check(!cleanup || typeof document.fence_id === 'string' && document.fence_id.length > 0, 'permission_denied');
       try { provenance = browserUseRunProvenance(document.browser.provenance); }
       catch { throw new AccelerateError('permission_denied'); }
     }
@@ -139,23 +131,23 @@ export function createBrowserUseHost(configuration = {}) {
         metadata.accelerate_extension_sha256 === release.artifact.sha256 && metadata.accelerate_extension_version === release.extension_version) &&
         typeof value.timeoutAt === 'string' && Number.isFinite(Date.parse(value.timeoutAt)) &&
         (requiredStatus === 'stopped' || Date.parse(value.timeoutAt) > now()) &&
-        Array.isArray(value.extensions) && value.extensions.length === extras.length + 1 &&
-        new Set(value.extensions.map(item => item?.id)).size === value.extensions.length &&
-        new Set(value.extensions.map(item => item?.runtimeId)).size === value.extensions.length);
-      const primary = value.extensions.find(item => item?.id === extensionId);
-      check(primary?.version === release.extension_version && RUNTIME.test(primary?.runtimeId ?? '') &&
-        extras.every(expected => value.extensions.some(item => ['id', 'version', 'runtimeId'].every(key => item?.[key] === expected[key]))));
+        Array.isArray(value.extensions));
+      const primaries = value.extensions.filter(item => item?.id === extensionId);
+      check(primaries.length === 1);
+      const primary = primaries[0];
+      check(primary.version === release.extension_version && RUNTIME.test(primary.runtimeId ?? '') &&
+        !value.extensions.some(item => item !== primary && item?.runtimeId === primary.runtimeId));
       check(extensionRuntimeId === undefined || primary.runtimeId === extensionRuntimeId);
       // Deliberately project away provider CDP/viewer URLs and unknown response fields.
       const read = freeze({ expires_at: value.timeoutAt, runtime_id: primary.runtimeId });
       if (!options.withConnection) return read;
       check(typeof value.cdpUrl === 'string' && value.cdpUrl.length <= 2048 && typeof value.startedAt === 'string');
       return freeze({ ...read, connection: freeze({ id: value.id, status: value.status, cdpUrl: value.cdpUrl, startedAt: value.startedAt,
-        timeoutAt: value.timeoutAt, recordingAvailable: false,
+        timeoutAt: value.timeoutAt, recordingAvailable: false, accelerate_extension_id: extensionId,
         metadata: binding.provenance ? {} : Object.fromEntries(['accelerate_merchant_id', 'accelerate_owner_user_id',
           'accelerate_workspace_id', 'accelerate_custody_mode', 'accelerate_agent_extension_id',
           'accelerate_extension_sha256', 'accelerate_extension_version'].map(key => [key, metadata[key]])),
-        extensions: value.extensions.map(item => ({ id: item.id, runtimeId: item.runtimeId, version: item.version })),
+        extensions: [{ id: extensionId, runtimeId: primary.runtimeId, version: primary.version }],
         ...runEvidence }) });
     } catch {
       throw new AccelerateError(options.signal?.aborted ? 'request_cancelled' : 'integration_unavailable');

package/index.d.ts

@@ -81,6 +81,12 @@ export type CheckoutReconciliationRequest = {
   currency?: 'USD';
   source: string;
 };
+/** Derive from your server's authenticated owner, never model input. */
+export interface CheckoutErasureRequest {
+  customer_id: string;
+  workspace_id: string;
+  conversation_id?: string;
+}
 /** Server-owned existing browser, resolved from the authenticated application's
  * durable browser record. Never accept this binding from model arguments.
  * The customer backend retains provider access; this is not private-from-creation custody. */
@@ -166,9 +172,13 @@ export interface CreateCheckout {
    * Send it on every create. It is held in memory for this checkout and never stored. */
   browser_resource?: ClientBrowserResource;
 }
-/** The fields of Browser Use `GET /api/v4/browsers/{id}` that Accelerate needs. */
+/** Private projection of Browser Use `GET /api/v4/browsers/{id}`, with the
+ * Accelerate extension selected by the authenticated backend. */
 export interface ClientBrowserResource {
   id: string;
+  /** Accelerate extension selected from the backend's durable installation configuration.
+   * Other extensions in the customer-owned browser are outside this projection. */
+  accelerate_extension_id?: string;
   status: 'active';
   cdpUrl: string;
   startedAt: string;
@@ -261,6 +271,11 @@ export class AccelerateClient {
     /** Backend only: observe the customer's click once. Dispatch claims are not sent; never retry. */
     completeFinalClick(id: CheckoutId, input: { revision: number; arm_id: string }, options?: RequestOptions): Promise<Checkout>;
     cancel(id: CheckoutId, options?: RequestOptions): Promise<Checkout>;
+    /** Server only, for a deleted customer: erase a closed checkout's encrypted record, idempotency key and review binding.
+     * The binding must match creation; chat checkouts also need conversation_id. An open checkout is refused with
+     * checkout_active unless it has expired, and an unreconciled purchase submit with reconciliation_required.
+     * A checkout that is already gone reports erased. Hash-only browser run claims are kept. */
+    erase(id: CheckoutId, input: CheckoutErasureRequest, options?: RequestOptions): Promise<{ erased: true }>;
     /** Records one merchant result after submit. Repeating the same input returns the same result; different input is refused. */
     reconcile(id: CheckoutId, input: CheckoutReconciliationRequest, options?: RequestOptions): Promise<ReconciledCheckout>;
   };

package/index.js

@@ -22,7 +22,8 @@ const ERROR_CODES = new Set(['invalid_input', 'unauthorized', 'permission_denied
   'checkout_busy', 'store_unavailable', 'store_integrity_error', 'selection_rejected', 'upstream_invalid',
   'upstream_request_invalid', 'upstream_response_invalid', 'configuration_error', 'configuration_invalid',
   'route_not_found', 'method_not_allowed', 'json_required', 'invalid_json', 'request_too_large', 'checkout_event_unconfirmed',
-  'reconciliation_unavailable', 'reconciliation_mismatch', 'reconciliation_conflict', 'customer_click_required', 'final_click_in_progress']);
+  'reconciliation_unavailable', 'reconciliation_mismatch', 'reconciliation_conflict', 'customer_click_required', 'final_click_in_progress',
+  'checkout_active', 'reconciliation_required']);
 const MESSAGES = {
   invalid_input: 'Invalid Accelerate client request.',
   invalid_response: 'Accelerate returned an unrecognized private response.',
@@ -76,6 +77,10 @@ for (const [codes, message, nextAction] of [
     'The order does not match the approved quote. Nothing was recorded. Check the merchant order.', 'reconcile_order'],
   [['reconciliation_conflict'],
     'A different result is already recorded for this checkout. It cannot be replaced.', 'check_status'],
+  [['checkout_active'],
+    'This checkout is still open and was not erased. Cancel it, then erase it.', 'check_status'],
+  [['reconciliation_required'],
+    'This purchase has an unreconciled submit outcome and was kept. Reconcile the merchant order before erasing it.', 'reconcile_order'],
 ]) for (const code of codes) GUIDANCE[code] = Object.freeze({ message, nextAction });
 
 /** Safe diagnostics only: no response body, URL, credentials, cause or provider stack. */
@@ -269,6 +274,10 @@ function retirementInspectionInput(input) {
   const { revision, ...scope } = input;
   return { ...creationInspectionInput(scope), revision: integer(revision, 1, 2147483647) };
 }
+function erasureResponse(value) {
+  keys(value, ['erased'], ['erased'], 'invalid_response'); check(value.erased === true, 'invalid_response');
+  return Object.freeze({ erased: true });
+}
 function retirementInspectionResponse(value, id, input) {
   if (value?.confirmed === false) { keys(value, ['confirmed'], undefined, 'invalid_response'); return value; }
   keys(value, ['confirmed', 'checkout_id', 'revision', 'status', 'purpose', 'approval_policy', 'submit_allowed',
@@ -398,6 +407,12 @@ export class AccelerateClient {
         return result;
       },
       cancel: async (id, options) => this.#request('POST', checkoutId(id), '/cancel', {}, options),
+      erase: async (id, input, options) => {
+        keys(input, ['customer_id', 'workspace_id', 'conversation_id'], ['customer_id', 'workspace_id']);
+        string(input.customer_id, 500); string(input.workspace_id, 500);
+        if (input.conversation_id !== undefined) string(input.conversation_id, 500);
+        return this.#request('POST', checkoutId(id), '/erase', { ...input }, options);
+      },
       reconcile: async (id, input, options) => {
         const body = reconciliationInput(input);
         const result = await this.#request('POST', checkoutId(id), '/reconcile', body, options);
@@ -480,7 +495,7 @@ export class AccelerateClient {
     check(options.signal === undefined || options.signal instanceof AbortSignal);
     const controller = new AbortController();
     const milliseconds = connection ? 45000 : ['/inspect-creation', '/inspect-retirement'].includes(suffix) ? 60000 : id === null ? 245000 : ({ '/fill': 235000, '/details': 125000, '/verify-quote': 125000, '/approval': 125000,
-      '/final-click/arm': 20000, '/final-click/complete': 125000, '/browser': 85000, '/cancel': 45000, '/reconcile': 45000, '': 45000 })[suffix];
+      '/final-click/arm': 20000, '/final-click/complete': 125000, '/browser': 85000, '/cancel': 45000, '/erase': 45000, '/reconcile': 45000, '': 45000 })[suffix];
     const timer = setTimeout(() => controller.abort(), milliseconds); timer.unref?.();
     const signal = AbortSignal.any([controller.signal, ...(options.signal ? [options.signal] : [])]);
     const url = connection ? `${this.#origin}/v1/connection` :
@@ -500,7 +515,7 @@ export class AccelerateClient {
       if (!response.ok) throw new AccelerateError(ERROR_CODES.has(value?.error?.code) ? value.error.code : 'request_failed', response.status,
         response.headers.get('x-accelerate-support-reference'));
       return connection ? connectionResponse(value, this.#merchantId) : suffix === '/browser' ? browserResponse(value) :
-        suffix === '/verify-quote' ? verifiedQuoteResponse(value, id, body) : suffix === '/final-click/arm' ? finalClickArmResponse(value, body) : suffix === '/inspect-creation' ? creationInspectionResponse(value, body) : suffix === '/inspect-retirement' ? retirementInspectionResponse(value, id, body) : statusResponse(value, id, {
+        suffix === '/verify-quote' ? verifiedQuoteResponse(value, id, body) : suffix === '/final-click/arm' ? finalClickArmResponse(value, body) : suffix === '/inspect-creation' ? creationInspectionResponse(value, body) : suffix === '/inspect-retirement' ? retirementInspectionResponse(value, id, body) : suffix === '/erase' ? erasureResponse(value) : statusResponse(value, id, {
         create: id === null, origin: this.#origin, loopback: this.#loopback });
     } catch (error) {
       Promise.resolve(response?.body?.cancel()).catch(() => {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weaccelerateinc/agent-sdk",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Server-only payment SDK, existing-browser connectors and private host adapters for agent platforms",
   "type": "module",
   "main": "./index.js",

package/partner-starter/README.md

@@ -1,15 +1,15 @@
 # Existing-browser payment starter
 
-SDK 0.12.0, explicit `managed_review_v2`, `customer_backend_trusted`. Newly generated existing-browser apps default to `purpose:'purchase'` with the submit tool enabled. The matching service must support this profile; publishing the SDK does not deploy the service or qualify a merchant layout. Your platform creates its browser and installs the approved extension. This starter attaches that same browser at payment; it never creates a replacement. The older `accelerate-agent init <dir>` starter still selects Accelerate-managed Kernel custody and its fill-only default.
+SDK 0.14.0, explicit `managed_review_v2`, `customer_backend_trusted`. Newly generated existing-browser apps default to `purpose:'purchase'` with the submit tool enabled. The matching service must support this profile; publishing the SDK does not deploy the service or qualify a merchant layout. Your platform creates its browser and installs the approved extension. This starter attaches that same browser at payment; it never creates a replacement. The older `accelerate-agent init <dir>` starter still selects Accelerate-managed Kernel custody and its fill-only default.
 
 ## Run without credentials
 
-Once Accelerate supplies the matching verified 0.12.0 archive, install it, then:
+Once Accelerate supplies the matching verified 0.14.0 archive, install it, then:
 
 ```sh
 npx --no-install accelerate-agent init ./partner-demo --browser existing
 cd partner-demo
-npm install /secure/downloads/weaccelerateinc-agent-sdk-0.12.0.tgz
+npm install /secure/downloads/weaccelerateinc-agent-sdk-0.14.0.tgz
 npm test
 npm run smoke
 ```

package/partner-starter/package.json

@@ -12,7 +12,7 @@
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@weaccelerateinc/agent-sdk": "0.12.0",
+    "@weaccelerateinc/agent-sdk": "0.14.0",
     "@modelcontextprotocol/server": "2.3.1"
   },
   "devDependencies": {

package/partner-starter/synthetic.mjs

@@ -225,7 +225,7 @@ export function createSyntheticDependencies({ purpose = 'sandbox_fill_only', pro
     artifact: { format: 'zip', sha256: 'a'.repeat(64), bytes: 1234 },
     bridge: { protocol: 'accelerate_extension_bridge_v1', sha256: 'b'.repeat(64) },
     capabilities: { manual_card_fill: true, document_bound_single_use: true, autosave_disabled: true, automatic_submit: false, maximum_retention_ms: 480000 },
-    compatibility: { sdk_versions: ['0.10.1', '0.10.2', '0.10.3', '0.10.4', '0.11.0', '0.12.0'], executor_contract: 'accelerate_manual_checkout_v1' },
+    compatibility: { sdk_versions: ['0.10.1', '0.10.2', '0.10.3', '0.10.4', '0.11.0', '0.12.0', '0.13.0', '0.14.0'], executor_contract: 'accelerate_manual_checkout_v1' },
     qualifications: [{ provider: 'connector', scope: 'synthetic_only', evidence: 'docs/evidence/synthetic-starter.json' }],
   }; // Fake metadata for this in-process fixture only; never load it in live mode.
   const browser = { owner: context, browser: { provider: 'connector', connector_id: 'synthetic_cdp', browser_id: 'existing:browser:1', custody_mode: 'customer_backend_trusted' },

package/private-chat.d.ts

@@ -22,7 +22,11 @@ export interface PrivateChatState {
   handled: boolean;
   /** Provider message ID was previously processed. No external operation was repeated. */
   duplicate: boolean;
-  cards: Array<{ choice: number; last4: string | null; brand: string | null }>;
+  cards: Array<{ choice: number; last4: string | null; brand: string | null;
+    /** Customer number entry is known to be required. The customer adds it in their Accelerate wallet, then replies refresh.
+     * A false or omitted flag does not establish readiness. Saved-card verification may require CVV alone or full card details.
+     * Present only when true; older services never send it. */
+    number_required?: boolean }>;
   addresses: Array<{ choice: number; label: string | null; city?: string | null; state?: string | null; postal_code_mask?: string | null }>;
   identity_field?: 'first_name' | 'last_name' | 'email';
   /** Fixed feedback for an incomplete wallet selection; never contains the customer's reply. */

package/private-chat.js

@@ -58,8 +58,9 @@ function state(value, expectedId) {
   if (checkout.card !== undefined) card(checkout.card); if (checkout.address !== undefined) address(checkout.address); if (checkout.quote !== undefined) quote(checkout.quote);
   check(stages.has(value.stage) && typeof value.handled === 'boolean' && typeof value.duplicate === 'boolean' &&
     Array.isArray(value.cards) && value.cards.length <= 100 && Array.isArray(value.addresses) && value.addresses.length <= 100, 'invalid_response');
-  for (const [index, choice] of value.cards.entries()) { keys(choice, ['choice', 'last4', 'brand'], undefined, 'invalid_response');
-    check(choice.choice === index + 1, 'invalid_response'); card({ last4: choice.last4, brand: choice.brand }); }
+  for (const [index, choice] of value.cards.entries()) { keys(choice, ['choice', 'last4', 'brand', 'number_required'], ['choice', 'last4', 'brand'], 'invalid_response');
+    check(choice.choice === index + 1 && (choice.number_required === undefined || typeof choice.number_required === 'boolean'), 'invalid_response');
+    card({ last4: choice.last4, brand: choice.brand }); }
   for (const [index, choice] of value.addresses.entries()) { keys(choice, ['choice', 'label', 'city', 'state', 'postal_code_mask'], ['choice', 'label'], 'invalid_response');
     check(choice.choice === index + 1, 'invalid_response'); const { choice: _, ...mask } = choice; address(mask); }
   check(value.stage === 'selection_required' || value.cards.length === 0 && value.addresses.length === 0, 'invalid_response');
@@ -138,7 +139,7 @@ export function renderPrivateChatState(value, options) {
         response.selection_error
           ? addressRequired ? 'Choose which saved address to use with your card. Include both choice numbers.' : 'That card or address choice is unavailable. Choose from the previous list.'
           : multiple ? 'Choose your Accelerate wallet details:' : 'Choose your Accelerate wallet card:',
-        ...(!response.selection_error ? response.cards.map(choice => `Card ${choice.choice}: ${choice.brand ?? 'Card'} •••• ${choice.last4 ?? 'unavailable'}`) : []),
+        ...(!response.selection_error ? response.cards.map(choice => `Card ${choice.choice}: ${choice.brand ?? 'Card'} •••• ${choice.last4 ?? 'unavailable'}${choice.number_required ? ' (add its card number in your Accelerate wallet first, then reply refresh)' : ''}`) : []),
         ...(!response.selection_error || addressRequired ? addressChoices : []), instructions,
         'Reply cancel to stop. Do not send card numbers or expiration dates.',
       ].join('\n'); break;
@@ -279,7 +280,8 @@ export class AcceleratePrivateChatClient {
     try {
       signal.throwIfAborted();
       response = await bounded(this.#fetch(url, { method: 'POST', redirect: 'error', cache: 'no-store', credentials: 'omit', referrerPolicy: 'no-referrer', signal,
-        headers: { Authorization: `Bearer ${this.#apiKey}`, 'X-Accelerate-Merchant-Id': this.#merchantId, Accept: 'application/json', 'Content-Type': 'application/json' }, body }));
+        headers: { Authorization: `Bearer ${this.#apiKey}`, 'X-Accelerate-Merchant-Id': this.#merchantId, 'X-Accelerate-Card-Requirements': 'v1',
+          Accept: 'application/json', 'Content-Type': 'application/json' }, body }));
       body = '';
       if (action === 'review' && response.ok) {
         check(!response.redirected && response.status === 200 && (!response.url || response.url === url) && /^image\/png(?:\s*;|$)/i.test(response.headers.get('content-type') ?? ''), 'invalid_response');

package/starter/README.md

@@ -6,12 +6,12 @@ The default runnable mode is **synthetic**. It uses the real SDK, managed MCP ad
 
 ## Install and run
 
-Requires Node.js 22 or newer. Install the exact SDK 0.9.0 archive and checksum supplied by Accelerate; [release distribution](https://github.com/weaccelerateinc/accelerate-agent-sdk/blob/main/docs/releases.md) records verified availability. Do not assume npm publication.
+Requires Node.js 22 or newer. Install the exact SDK 0.14.0 archive and checksum supplied by Accelerate; [release distribution](https://github.com/weaccelerateinc/accelerate/blob/main/products/agent-sdk/docs/releases.md) records verified availability. Do not assume npm publication.
 
 ```sh
 npx --no-install accelerate-agent init ./accelerate-demo
 cd accelerate-demo
-npm install /absolute/path/to/accelerate-agent-sdk-0.9.0.tgz
+npm install /absolute/path/to/weaccelerateinc-agent-sdk-0.14.0.tgz
 npm test
 npm run smoke
 ```

package/starter/package.json

@@ -12,7 +12,7 @@
     "test": "node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@weaccelerateinc/agent-sdk": "0.12.0",
+    "@weaccelerateinc/agent-sdk": "0.14.0",
     "@modelcontextprotocol/server": "2.3.1"
   },
   "devDependencies": {