Release 1.11.0 - ChallengeIndicator/SessionChallengeIndicator enum alignment

[david-ruiz-cko]

This release updates the Sessions API model to align with the latest Checkout.com API specification, adds missing fields, corrects value sets, and introduces comprehensive spec-conformance tests to prevent regressions. The changes improve the accuracy and maintainability of the SDK by ensuring all wire values and model fields match the API exactly, and by removing fields that are not part of the spec.

API Model Corrections and Additions

• Added missing fields to SessionRequest, including google_spa (with new GoogleSpa model), preferred_experiences (with new Experience value module), and device_information. Removed the undocumented prior_transaction_reference field. [1] [2] [3] [4] [5]
• Added the SessionChallengeIndicator value module to support the full set of challenge indicator values required by the Sessions API, and updated references from the shared payments challenge indicator. [1] [2] [3] [4]
• Added missing fields to BrowserSession for Google SPA support: iframe_payment_allowed and user_agent_client_hint. [1] [2]
• Added new schemes to SessionScheme: DISCOVER and UPI.

Value Corrections

• Corrected wire values to match the API spec: fixed non_payment to snake_case in Category, fixed QUASI_CARD_TRANSACTION spelling in TransactionType, updated ThreeDsMethodCompletion to use uppercase codes, and replaced visa with the correct set in ShippingIndicator. [1] [2] [3] [4]

Field Removals

• Removed the store_for_future_use field from CardSource, which is not present in the Sessions API model.

Spec-Conformance Tests

• Added a comprehensive RSpec suite to verify that all value modules and model fields exactly match the Checkout.com API spec, catch casing errors, and prevent future regressions.

---

References:
[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18]

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud