@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/README.md

@@ -530,24 +530,34 @@ Read `result.settlementOutcome.status` — never `success` alone:
 
 | status              | Meaning                                   | Your action                                                                                                                       |
 | ------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `settled`           | Charged; `orderId` present                | Fulfil / mark paid                                                                                                                |
+| `pending_merchant`  | 5.14.1: order recorded — YOU settle it    | Charge the `settlementToken` (card) or redeem the `settlement` voucher (stablecoin), then `reportSettlement()`                    |
+| `settled`           | Money moved (reported / webhook)          | Fulfil / mark paid                                                                                                                |
 | `requires_approval` | Held for human step-up — not a failure    | Record as pending; a re-drive follows approval                                                                                    |
-| `pending_merchant`  | 5.5.0 self-settle: YOU charge (see below) | Charge with the `settlementToken`, then report                                                                                    |
 | `failed`            | Charge declined (`failureCode`)           | Mark failed                                                                                                                       |
 | `requires_action`   | 3DS/SCA needed on the saved card          | Per your policy                                                                                                                   |
 | `no_instrument`     | Policy passed, no chargeable card on file | Terminal on autonomous; NON-terminal after approval — the human's approval survives; re-drive the same session once a card exists |
 | _anything else_     | A status newer than your SDK              | Treat as PENDING, never failed (open union, 5.5.0)                                                                                |
 
-**Self-settling merchants (5.5.0, `settlement_mode='self_settle'`):** the
-confirm result carries `settlementToken` (agent-blind
-`{ stripeCustomerId, stripePaymentMethodId, amountMinor, currency, sessionId,
-orderId, jti, statementSuffix, expiresAt }`) instead of a completed charge.
-Charge on your own integration with Stripe idempotency key
-`voucher:<token.jti>` and `metadata: { jti, sessionId }`, then call
-`client.reportSettlement({ sessionId, status, amountMinor, currency,
-processorRef })` so the buyer's dashboard and the agent's poll surface
-reconcile. Amounts must match the order exactly; replays are safe. Never
-expose the token to the agent plane or logs.
+**Every merchant settles (5.14.1 — AstraSync never charges):** a purchase
+grant records the order and returns `settlementOutcome: { status:
+'pending_merchant', orderId }` with what you settle:
+
+- **Card, first-party storefront (our Stripe tenant):** `settlementToken`
+  (agent-blind `{ stripeCustomerId, stripePaymentMethodId, amountMinor,
+currency, sessionId, orderId, jti, statementSuffix, expiresAt }`). Charge on
+  your own integration with Stripe idempotency key `voucher:<token.jti>` and
+  `metadata: { jti, sessionId }`, then `client.reportSettlement({ orderId,
+status, amountMinor, currency, processorRef })`.
+- **Stablecoin, any merchant:** the `settlement` voucher. Redeem it (the order
+  moves to `redeemed`), move the funds, then `client.reportSettlement({
+orderId, status: 'settled', amountMinor, currency, txHash, chainId })`.
+- **The request's protocol carried the payment** (ACP / MPP token, x402
+  payload, AP2 payment mandate): nothing is minted; settle with that
+  credential and report back.
+
+Amounts must match the order exactly; replays are safe. An order nobody
+settles expires 10 minutes after its artifact does; a late report still
+settles it. Never expose the token or voucher to the agent plane or logs.
 
 **Fulfilment PII (5.6.0):** first-party confirm results carry a
 `fulfilment: { email, emailSource }` block — you ALWAYS get a fulfilment
@@ -605,11 +615,11 @@ interface FiatSettlementBinding {
 
 ### Voucher lifecycle (server-to-server)
 
-| Endpoint                                         | Purpose                                                                                                                                                           |
-| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `POST /api/wallets/voucher/verify`               | Verify signature/issuer and return the decoded payload — proves authenticity only, no spend                                                                       |
-| `POST /api/wallets/voucher/redeem`               | Atomic single-use spend: first caller gets `200 redeemed`, replays get `409 already_redeemed` (with first-redeemer forensics), revoked vouchers get `409 revoked` |
-| `GET /api/wallets/voucher/.well-known/jwks.json` | Public JWKS for offline signature verification                                                                                                                    |
+| Endpoint                                         | Purpose                                                                                                                                                                                                                                                                           |
+| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `POST /api/wallets/voucher/verify`               | Verify signature/issuer and return the decoded payload — proves authenticity only, no spend                                                                                                                                                                                       |
+| `POST /api/wallets/voucher/redeem`               | Atomic single-use spend: first caller gets `200 redeemed` (plus `order: { status: 'redeemed' }` when the voucher funds a recorded order — 5.14.1, no charge happens here), replays get `409 already_redeemed` (with first-redeemer forensics), revoked vouchers get `409 revoked` |
+| `GET /api/wallets/voucher/.well-known/jwks.json` | Public JWKS for offline signature verification                                                                                                                                                                                                                                    |
 
 Redeem accepts optional `expectedAmountMinor` / `expectedCurrency` — mismatches are rejected (`400 amount_mismatch` / `currency_mismatch`) **before** the voucher is spent, so a mismatch never burns the voucher. Vouchers carry `aud` = your merchant id; declare `merchantId` on verify/redeem to have the audience check enforced (standard JWT libraries give you the same check free on offline verification).
 
@@ -826,7 +836,15 @@ The installer registers the `astrasync-claude-hook` binary in Claude Code's `set
 - **BREAKING type change:** `SettlementArtifact.binding` is now a union — `StablecoinSettlementBinding` (v2: `amountMinor` integer minor units + `assetDecimals`, pinned `chainId`/`tokenContract`/CAIP-19 `asset`) or `FiatSettlementBinding` (processor artifacts keep major-unit `amount`). The float `amount` field is gone from stablecoin bindings. Matches the server's `ver: 2` wire format, which redeems/verifies reject other versions of.
 - Settlement Artifacts docs rewritten: voucher lifecycle endpoints (verify / redeem / JWKS), expected-value gates on redeem, revocation semantics, and an explicit **guarantee boundary** — what a successful redeem proves and what it doesn't (redeem proves the authorization is live and single-use; it does not check or move funds).
 
-### v3.7.1 — ChallengeHandler auto-include
+### v5.16.0 — ChallengeHandler auto-include removed
+
+- `ChallengeHandler` answers only for counterparties registered as pending —
+  the 3.7.1 auto-include let anyone presenting an agent's ASTRA-id pass its
+  runtime challenge. Pass `challengeHandler` to `AgentClient` and `fetch()`
+  registers each call while it is in flight; otherwise call
+  `registerPending()` / `removePending()` around each interaction.
+
+### v3.7.1 — ChallengeHandler auto-include (removed in 5.16.0)
 
 - `ChallengeHandler` auto-includes the incoming `counterpartyId`/`counterpartyUrl` in the challenge response when no counterparties were pre-registered via `registerPending()` — the correct default for agents that never call it. Pre-registered whitelists behave exactly as before.
 - Runtime-challenge docs: auto-include default + double-appended-path warning.

package/dist/adapters/express.d.mts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-BCkwBA84.mjs';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Blz520bR.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-BCkwBA84.js';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-Blz520bR.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware