[armando-rodriguez-cko]

Summary

The API no longer documents the return-encrypted-cvv and Encryption-Key request headers on the update card operation, and the update card response does not include encrypted_cvv. The revoke and suspend request bodies are optional. This PR deprecates the headers parameter (it keeps working and is removed in the next major version) and lets revokeCard and suspendCard be called without a body.

Calling revokeCard(id) and suspendCard(id) with no body (the SDK sends no request body) was verified against the sandbox: both succeed.

Changes

• src/api/issuing/cards.js
  • Cards#updateCard: headers parameter documented as deprecated; the return JSDoc lists every update card response field, with revocation_date marked deprecated (use scheduled_revocation_date) and is_single_use noted as virtual cards only.
  • Cards#revokeCard, Cards#suspendCard: body is optional, reason values documented, response documented as _links.
• src/api/issuing/issuing.js: JSDoc for Issuing#updateCard with the deprecated headers parameter.
• types/dist/api/issuing/cards.d.ts, types/dist/api/issuing/issuing.d.ts
  • New overload updateCard(id: string, body: object).
  • Overload updateCard(id: string, body: object, headers?: object) marked @deprecated.
  • revokeCard(id: string, body?: object) and suspendCard(id: string, body?: object).
• test/issuing/cards/cards-unit.js: new tests for revoke and suspend without a body (asserting no body on the wire); existing header tests unchanged.
• test/issuing/cards/cards-unit.js, test/issuing/cards/cards-it.js: comment cleanups.

API Reference

• PATCH /issuing/cards/{cardId}: https://api-reference.checkout.com/tag/cards/PATCH/issuing/cards/%7BcardId%7D
• POST /issuing/cards/{cardId}/revoke: https://api-reference.checkout.com/tag/cards/POST/issuing/cards/%7BcardId%7D/revoke
• POST /issuing/cards/{cardId}/suspend: https://api-reference.checkout.com/tag/cards/POST/issuing/cards/%7BcardId%7D/suspend

Breaking changes

None. JSDoc and typings only; the headers are still sent when set, and existing calls with a body keep working.

README

No changes needed: the README does not document these methods or headers.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The PR only updates JSDoc comments, TypeScript overload signatures, and marks a parameter optional/deprecated without changing any runtime logic, endpoints, auth, data persistence, or external integrations.

Operational gates

• ✅ jira_ticket (INT-1713)
• ✅ independent_review

Files analysed: 6

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — The PR only updates JSDoc comments, TypeScript overload signatures, and marks a parameter optional/deprecated without changing any runtime logic, endpoints, auth, data persistence, or external integrations.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The diff contains only JSDoc comment updates, TypeScript declaration changes (adding an overload and making body optional), and no runtime logic changes, meaning it is a purely non-destructive, function-preserving documentation/typing extension of existing code paths with no new endpoints, auth changes, persisted data, or external integrations.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are JSDoc comments, TypeScript declaration files, and deprecation annotations only — no runtime logic, auth, persistence, new endpoints, or external integrations are added or modified.

Operational gates

• ✅ jira_ticket (INT-1713)
• ✅ independent_review

Files analysed: 6

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — All changes are JSDoc comments, TypeScript declaration files, and deprecation annotations only — no runtime logic, auth, persistence, new endpoints, or external integrations are added or modified.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The PR only updates JSDoc comments, TypeScript type declarations (making body optional, adding a deprecation overload), and adds tests — no runtime logic, new endpoints, new data persistence, or auth changes are introduced.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are JSDoc comments, TypeScript declaration overloads, and making existing parameters optional — no new code paths, endpoints, data persistence, auth changes, or external integrations are introduced.

Operational gates

• ✅ jira_ticket (INT-1713)
• ✅ independent_review

Files analysed: 6

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — All changes are JSDoc comments, TypeScript declaration overloads, and making existing parameters optional — no new code paths, endpoints, data persistence, auth changes, or external integrations are introduced.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The change is purely documentation/JSDoc/TypeScript type signature updates that deprecate existing parameters and make existing body parameters optional, with no new code paths, endpoints, auth changes, persisted data, or external integrations introduced.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}