[yummybomb]

Summary

#309 (pr i merged and created this breakage) widened the --spec card-data check in vaultSpecFromFlags from KERNEL specs to every provider. vaultSpecHasCardData matches key names at any depth, so it now also scans Link metadata. That metadata is a free-form string map that the API forwards to Link unchanged, so a harmless key like number, cvc or expiry (for example an order number) makes Link cards create, cards update and payment-requests create/update fail before the request with a KERNEL/VGS-specific card-details error. On main before #309 these specs were sent as normal.

This change keeps the all-provider check but leaves metadata out of the scan for link. It is the only open-ended map in a Link spec; the other objects (line_items, totals, recurring) have closed schemas. Other providers are unchanged: AgentCard, Shop Pay, KERNEL and VGS specs are still scanned in full. AgentCard specs have no metadata field, and the API rejects unknown spec fields. KERNEL metadata is still covered by TestKernelSpecRejectsCardDetails.

The regression is on main but not in a release yet (latest is v0.50.0).

Tests

• New TestVaultLinkSpecsPreserveMetadataCardKeys: Link cards create/update and payment-requests create/update send metadata with number, cvc and expiry keys unchanged. All 4 subtests fail without the fix.
• New TestVaultLinkSpecRejectsCardDetailsOutsideMetadata: top-level and line_items card fields on a Link spec are still rejected before any API call.
• go build ./..., go vet ./... and go test ./... pass locally. I didn't run against the production API.

---

Note

Medium Risk
Tightens validation scope for Link specs only; KERNEL/VGS paths unchanged. Slight mismatch with PR text if AgentCard metadata skip was intended—it is not in the diff (only link skips metadata).

Overview
Fixes a regression where vaultSpecHasCardData scanned the whole --spec JSON for every provider, so harmless metadata keys on Link (e.g. order number, cvc, expiry) tripped the card-details guard before the API.

For --provider link, the CLI now clones the spec, drops metadata, and runs the card-data check on the remainder so opaque Link metadata is not scanned. KERNEL and VGS behavior is unchanged (full spec still checked; protected single_use_card / card paths unchanged).

Tests assert Link cards / payment-requests preserve metadata with card-like key names, and that real card fields outside metadata (top-level PAN, line_items CVC) are still rejected before any request.

^{Reviewed by Cursor Bugbot for commit 335f950. Bugbot is set up for automated code reviews on this repo. Configure here.}