@astrasyncai/verification-gateway 5.11.0 → 5.12.0

package/dist/adapters/sdk.d.mts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-CTmUpNpS.mjs';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BCkwBA84.mjs';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -101,6 +101,12 @@ declare class VerificationGatewayClient {
      * fulfil against it only once the order is settled / pending_merchant. An
      * explicit `buyerEmail` (here or on the bridge handoff body) wins over the
      * account default.
+     *
+     * 5.12.0 approval binding: pass the bridge handoff body's `attemptId` (and
+     * the same `checkoutSessionId`) so a step-up approval minted for this cart
+     * is matched to — and only to — this confirm. A held cart's approval is
+     * bound to its checkout session and exact value; a confirm for any other
+     * cart is held for its own approval.
      */
     confirmCheckout(options: {
         astraId?: string;
@@ -112,6 +118,8 @@ declare class VerificationGatewayClient {
         currency?: string;
         checkoutSessionId?: string;
         checkoutItems?: VerificationRequest['checkoutItems'];
+        /** 5.12.0: the `att_…` attempt-chain id from the bridge handoff body. */
+        attemptId?: string;
         /** 5.6.0: alternate receipt/delivery email (transit-only) — omit to let
          * the platform default `fulfilment.email` to the buyer's account email. */
         buyerEmail?: string;

package/dist/adapters/sdk.d.ts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-CTmUpNpS.js';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BCkwBA84.js';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -101,6 +101,12 @@ declare class VerificationGatewayClient {
      * fulfil against it only once the order is settled / pending_merchant. An
      * explicit `buyerEmail` (here or on the bridge handoff body) wins over the
      * account default.
+     *
+     * 5.12.0 approval binding: pass the bridge handoff body's `attemptId` (and
+     * the same `checkoutSessionId`) so a step-up approval minted for this cart
+     * is matched to — and only to — this confirm. A held cart's approval is
+     * bound to its checkout session and exact value; a confirm for any other
+     * cart is held for its own approval.
      */
     confirmCheckout(options: {
         astraId?: string;
@@ -112,6 +118,8 @@ declare class VerificationGatewayClient {
         currency?: string;
         checkoutSessionId?: string;
         checkoutItems?: VerificationRequest['checkoutItems'];
+        /** 5.12.0: the `att_…` attempt-chain id from the bridge handoff body. */
+        attemptId?: string;
         /** 5.6.0: alternate receipt/delivery email (transit-only) — omit to let
          * the platform default `fulfilment.email` to the buyer's account email. */
         buyerEmail?: string;

package/dist/adapters/sdk.js

@@ -28,7 +28,7 @@ __export(sdk_exports, {
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.11.0";
+var SDK_VERSION = "5.12.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -63,6 +63,29 @@ function getCachedWellKnownUrls(apiBaseUrl) {
   return cache.get(apiBaseUrl)?.data;
 }
 
+// src/failure-posture.ts
+var DEFAULT_UNAVAILABLE_RETRY_AFTER_S = 30;
+var REJECTED_IDENTITY_DIMENSIONS = /* @__PURE__ */ new Set([
+  "identity.invalid_agent_id",
+  "identity.unknown_agent",
+  "agent.lookup"
+]);
+var UNKNOWN_AGENT_GUIDANCE = "Register your agent with AstraSync (or, inside an MCP host, add the AstraSync MCP connector for keyless, human-approved registration), then present the canonical ASTRA-* id issued after owner approval.";
+var UNAVAILABLE_DIMENSIONS = /* @__PURE__ */ new Set([
+  "verify_access.api_error",
+  "middleware.internal_error"
+]);
+function isVerificationUnavailable(result) {
+  if (result.misconfigured) return false;
+  return (result.failures ?? []).some((f) => UNAVAILABLE_DIMENSIONS.has(f.dimension));
+}
+function unavailableRetryAfterSeconds(result) {
+  if (typeof result.retryAfterMs === "number" && Number.isFinite(result.retryAfterMs)) {
+    return Math.max(1, Math.ceil(result.retryAfterMs / 1e3));
+  }
+  return DEFAULT_UNAVAILABLE_RETRY_AFTER_S;
+}
+
 // src/verify.ts
 var DEFAULT_CONFIG = {
   apiBaseUrl: "https://astrasync.ai/api",
@@ -277,11 +300,44 @@ function createGuidanceResponse(_config, reason, options = {}) {
     // coercing the absent recommendation to a policy 'deny'. Misconfig is
     // deterministic and intentionally NOT marked retryable.
     ...isApiError && { retryable: true },
+    ...options.httpStatus !== void 0 && { httpStatus: options.httpStatus },
+    ...options.retryAfterMs !== void 0 && { retryAfterMs: options.retryAfterMs },
     correlationId: options.correlationId,
     attemptId: options.attemptId,
     verifiedAt: /* @__PURE__ */ new Date()
   };
 }
+async function readJsonSafe(response) {
+  try {
+    const parsed = await response.json();
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function rejectedIdentityGuidance(failures) {
+  const f = failures?.find((x) => REJECTED_IDENTITY_DIMENSIONS.has(x.dimension));
+  if (!f) return void 0;
+  if (f.dimension === "agent.lookup") {
+    return `The presented agent identifier is not registered with AstraSync. ${UNKNOWN_AGENT_GUIDANCE}`;
+  }
+  return f.guidance ? `${f.message} ${f.guidance}` : f.message;
+}
+var MAX_RETRY_AFTER_MS = 15 * 60 * 1e3;
+function parseRetryAfterMs(response) {
+  const raw = response.headers?.get?.("retry-after");
+  if (!raw) return void 0;
+  const trimmed = raw.trim();
+  let ms;
+  if (/^\d+(\.\d+)?$/.test(trimmed)) {
+    ms = Number(trimmed) * 1e3;
+  } else {
+    const at = Date.parse(trimmed);
+    if (Number.isNaN(at)) return void 0;
+    ms = at - Date.now();
+  }
+  return Math.min(MAX_RETRY_AFTER_MS, Math.max(0, Math.round(ms)));
+}
 async function callVerifyAccessAPI(config, request) {
   const { credentials, ...requestData } = request;
   const body = {
@@ -338,7 +394,8 @@ async function callVerifyAccessAPI(config, request) {
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(config.verifyTimeoutMs ?? 1e4)
     });
-    const data = await response.json();
+    const data = await readJsonSafe(response);
+    const retryAfterMs = parseRetryAfterMs(response);
     if (response.status === 410) {
       return {
         success: true,
@@ -376,6 +433,23 @@ async function callVerifyAccessAPI(config, request) {
         }
       };
     }
+    if (response.status === 404 && credentials.astraId && (data?.error === "AGENT_NOT_FOUND" || typeof data?.message === "string" && /agent/i.test(data.message))) {
+      return {
+        success: true,
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        access: {
+          allowed: false,
+          reason: "unknown_agent",
+          failures: [
+            {
+              dimension: "identity.unknown_agent",
+              message: "The presented agent identifier is not registered with AstraSync.",
+              guidance: UNKNOWN_AGENT_GUIDANCE
+            }
+          ]
+        }
+      };
+    }
     if (!response.ok) {
       if (response.status === 401) {
         return {
@@ -390,9 +464,11 @@ async function callVerifyAccessAPI(config, request) {
       }
       return {
         success: false,
-        error: data.message || data.error || `API returned ${response.status}`,
+        error: typeof data?.message === "string" && data.message || typeof data?.error === "string" && data.error || `API returned ${response.status}`,
         correlationId: typeof data?.correlationId === "string" ? data.correlationId : void 0,
-        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0
+        attemptId: typeof data?.attemptId === "string" ? data.attemptId : void 0,
+        httpStatus: response.status,
+        ...retryAfterMs !== void 0 && { retryAfterMs }
       };
     }
     return data;
@@ -464,12 +540,14 @@ async function verify(config, request, options) {
       correlationId: apiResponse.correlationId,
       attemptId: apiResponse.attemptId,
       remediation: apiResponse.remediation,
+      httpStatus: apiResponse.httpStatus,
+      retryAfterMs: apiResponse.retryAfterMs,
       urls
     });
   }
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
-    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true;
+    const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
@@ -481,7 +559,10 @@ async function verify(config, request, options) {
       requiresStepUp: apiResponse.access?.requiresStepUp,
       requiresApproval: apiResponse.access?.requiresApproval,
       guidance: {
-        message: apiResponse.access?.reason || "Access denied by PDLSS policy",
+        // 5.12.0: a presented-but-rejected id (malformed / unknown) carries
+        // actionable registration guidance on its failure — surface it
+        // instead of the bare machine reason ('unknown_agent').
+        message: rejectedIdentityGuidance(aggregatedFailures) ?? (apiResponse.access?.reason || "Access denied by PDLSS policy"),
         registrationUrl: urls?.registrationUrl ?? "",
         documentationUrl: urls?.documentationUrl ?? "",
         // 5.1.0: anonymous callers land on this branch — steer MCP-hosted
@@ -581,7 +662,7 @@ async function verify(config, request, options) {
       registrationUrl: urls?.registrationUrl ?? "",
       documentationUrl: urls?.documentationUrl ?? ""
     };
-  } else if (result.recommendation === "step_up_required") {
+  } else if (result.recommendation === "step_up_required" && result.identityVerified) {
     result.requiresStepUp = true;
     result.denialReasons = serverDenialReasons ?? result.recommendationReasons ?? ["Step-up verification required"];
   }
@@ -599,7 +680,11 @@ async function quickVerify(config, credentials) {
   return {
     identityVerified: result.identityVerified,
     policyAllowed: result.policyAllowed,
-    reason: result.denialReasons?.[0]
+    reason: result.denialReasons?.[0],
+    ...isVerificationUnavailable(result) && {
+      unavailable: true,
+      retryAfterMs: unavailableRetryAfterSeconds(result) * 1e3
+    }
   };
 }
 
@@ -685,6 +770,12 @@ var VerificationGatewayClient = class {
    * fulfil against it only once the order is settled / pending_merchant. An
    * explicit `buyerEmail` (here or on the bridge handoff body) wins over the
    * account default.
+   *
+   * 5.12.0 approval binding: pass the bridge handoff body's `attemptId` (and
+   * the same `checkoutSessionId`) so a step-up approval minted for this cart
+   * is matched to — and only to — this confirm. A held cart's approval is
+   * bound to its checkout session and exact value; a confirm for any other
+   * cart is held for its own approval.
    */
   async confirmCheckout(options) {
     const credentials = {
@@ -704,6 +795,7 @@ var VerificationGatewayClient = class {
           commercePhase: "confirm",
           checkoutSessionId: options.checkoutSessionId,
           checkoutItems: options.checkoutItems,
+          ...options.attemptId && { attemptId: options.attemptId },
           buyerEmail: options.buyerEmail,
           counterpartyUrl: options.counterpartyUrl,
           counterpartyType: options.counterpartyType