@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/adapters/sdk.d.mts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BCkwBA84.mjs';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-Blz520bR.mjs';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -118,6 +118,8 @@ declare class VerificationGatewayClient {
         currency?: string;
         checkoutSessionId?: string;
         checkoutItems?: VerificationRequest['checkoutItems'];
+        /** 5.15.0: your signed checkout (AP2 checkout_jwt) — returns `mandates` at AP2 merchants. */
+        checkoutJwt?: string;
         /** 5.12.0: the `att_…` attempt-chain id from the bridge handoff body. */
         attemptId?: string;
         /** 5.6.0: alternate receipt/delivery email (transit-only) — omit to let
@@ -127,21 +129,27 @@ declare class VerificationGatewayClient {
         counterpartyType?: string;
     }): Promise<VerificationResult>;
     /**
-     * 5.5.0 (astra-pay): report a self-settled charge outcome back to the
-     * platform — the other half of the `settlementToken` contract. Call after
-     * your PaymentIntent reaches a terminal state so the buyer's dashboard,
-     * /orders and the agent's poll surface reconcile. Authenticated with this
-     * client's api key (must be the merchant's own). Amounts must match the
-     * order EXACTLY (integer minor units) or the report is rejected whole
-     * (409 amount_mismatch). Replays of the same terminal state are safe.
+     * Report a settlement outcome back to the platform. 5.14.1: AstraSync never
+     * charges — EVERY merchant settles the orders it is handed (card token,
+     * stablecoin voucher, or a protocol-native credential) and reports here, so
+     * the buyer's dashboard, /orders and the agent's poll surface reconcile.
+     * Identify the order by the confirm's `sessionId` or the `orderId` from
+     * `settlementOutcome`. A settled card charge carries `processorRef` (pi_…);
+     * a settled stablecoin transfer carries `txHash` (+ `chainId`). Amounts must
+     * match the order EXACTLY (integer minor units) or the report is rejected
+     * whole (409 amount_mismatch). Replays of the same terminal state are safe.
      */
     reportSettlement(options: {
-        sessionId: string;
+        sessionId?: string;
+        orderId?: string;
         status: 'settled' | 'declined' | 'failed';
         amountMinor: number;
         currency: string;
-        /** Stripe PaymentIntent id — REQUIRED when status is 'settled'. */
+        /** Stripe PaymentIntent id (card) — this or `txHash` is required when settled. */
         processorRef?: string;
+        /** Stablecoin transfer transaction hash (0x…, 32 bytes). */
+        txHash?: string;
+        chainId?: number;
         failureCode?: string;
     }): Promise<{
         orderId: string;

package/dist/adapters/sdk.d.ts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-BCkwBA84.js';
+import { T as TrustLevel, S as SDKOptions, d as VerificationResult, c as VerificationRequest } from '../types-Blz520bR.js';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -118,6 +118,8 @@ declare class VerificationGatewayClient {
         currency?: string;
         checkoutSessionId?: string;
         checkoutItems?: VerificationRequest['checkoutItems'];
+        /** 5.15.0: your signed checkout (AP2 checkout_jwt) — returns `mandates` at AP2 merchants. */
+        checkoutJwt?: string;
         /** 5.12.0: the `att_…` attempt-chain id from the bridge handoff body. */
         attemptId?: string;
         /** 5.6.0: alternate receipt/delivery email (transit-only) — omit to let
@@ -127,21 +129,27 @@ declare class VerificationGatewayClient {
         counterpartyType?: string;
     }): Promise<VerificationResult>;
     /**
-     * 5.5.0 (astra-pay): report a self-settled charge outcome back to the
-     * platform — the other half of the `settlementToken` contract. Call after
-     * your PaymentIntent reaches a terminal state so the buyer's dashboard,
-     * /orders and the agent's poll surface reconcile. Authenticated with this
-     * client's api key (must be the merchant's own). Amounts must match the
-     * order EXACTLY (integer minor units) or the report is rejected whole
-     * (409 amount_mismatch). Replays of the same terminal state are safe.
+     * Report a settlement outcome back to the platform. 5.14.1: AstraSync never
+     * charges — EVERY merchant settles the orders it is handed (card token,
+     * stablecoin voucher, or a protocol-native credential) and reports here, so
+     * the buyer's dashboard, /orders and the agent's poll surface reconcile.
+     * Identify the order by the confirm's `sessionId` or the `orderId` from
+     * `settlementOutcome`. A settled card charge carries `processorRef` (pi_…);
+     * a settled stablecoin transfer carries `txHash` (+ `chainId`). Amounts must
+     * match the order EXACTLY (integer minor units) or the report is rejected
+     * whole (409 amount_mismatch). Replays of the same terminal state are safe.
      */
     reportSettlement(options: {
-        sessionId: string;
+        sessionId?: string;
+        orderId?: string;
         status: 'settled' | 'declined' | 'failed';
         amountMinor: number;
         currency: string;
-        /** Stripe PaymentIntent id — REQUIRED when status is 'settled'. */
+        /** Stripe PaymentIntent id (card) — this or `txHash` is required when settled. */
         processorRef?: string;
+        /** Stablecoin transfer transaction hash (0x…, 32 bytes). */
+        txHash?: string;
+        chainId?: number;
         failureCode?: string;
     }): Promise<{
         orderId: string;

package/dist/adapters/sdk.js

@@ -28,7 +28,7 @@ __export(sdk_exports, {
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -188,6 +188,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -363,6 +365,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -373,6 +376,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -523,7 +527,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -604,7 +609,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -614,7 +622,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -665,7 +676,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -685,7 +700,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -705,6 +722,24 @@ async function quickVerify(config, credentials) {
   };
 }
 
+// src/registration/errors.ts
+var AstraSyncError = class extends Error {
+  constructor(message, statusCode, code) {
+    super(message);
+    this.name = "AstraSyncError";
+    this.statusCode = statusCode;
+    this.code = code;
+  }
+};
+var SettlementReportError = class extends AstraSyncError {
+  constructor(message, statusCode, code, issues) {
+    super(message, statusCode, code);
+    this.name = "SettlementReportError";
+    this.issues = issues;
+    this.retryable = statusCode === 0 || statusCode === 429 || statusCode >= 500;
+  }
+};
+
 // src/adapters/sdk.ts
 var VerificationGatewayClient = class {
   constructor(options) {
@@ -812,6 +847,7 @@ var VerificationGatewayClient = class {
           commercePhase: "confirm",
           checkoutSessionId: options.checkoutSessionId,
           checkoutItems: options.checkoutItems,
+          ...options.checkoutJwt && { checkoutJwt: options.checkoutJwt },
           ...options.attemptId && { attemptId: options.attemptId },
           buyerEmail: options.buyerEmail,
           counterpartyUrl: options.counterpartyUrl,
@@ -825,28 +861,52 @@ var VerificationGatewayClient = class {
     );
   }
   /**
-   * 5.5.0 (astra-pay): report a self-settled charge outcome back to the
-   * platform — the other half of the `settlementToken` contract. Call after
-   * your PaymentIntent reaches a terminal state so the buyer's dashboard,
-   * /orders and the agent's poll surface reconcile. Authenticated with this
-   * client's api key (must be the merchant's own). Amounts must match the
-   * order EXACTLY (integer minor units) or the report is rejected whole
-   * (409 amount_mismatch). Replays of the same terminal state are safe.
+   * Report a settlement outcome back to the platform. 5.14.1: AstraSync never
+   * charges — EVERY merchant settles the orders it is handed (card token,
+   * stablecoin voucher, or a protocol-native credential) and reports here, so
+   * the buyer's dashboard, /orders and the agent's poll surface reconcile.
+   * Identify the order by the confirm's `sessionId` or the `orderId` from
+   * `settlementOutcome`. A settled card charge carries `processorRef` (pi_…);
+   * a settled stablecoin transfer carries `txHash` (+ `chainId`). Amounts must
+   * match the order EXACTLY (integer minor units) or the report is rejected
+   * whole (409 amount_mismatch). Replays of the same terminal state are safe.
    */
   async reportSettlement(options) {
+    if (!options.sessionId && !options.orderId) {
+      throw new SettlementReportError(
+        "reportSettlement needs sessionId or orderId",
+        400,
+        "VALIDATION"
+      );
+    }
     const base = this.config.apiBaseUrl.replace(/\/+$/, "");
-    const res = await sdkFetch(`${base}/merchant/settlements/report`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        // Same auth pair as every backend call the SDK makes (verify.ts).
-        ...this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}`, "X-API-Key": this.config.apiKey } : {}
-      },
-      body: JSON.stringify(options)
-    });
+    let res;
+    try {
+      res = await sdkFetch(`${base}/merchant/settlements/report`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          // Same auth pair as every backend call the SDK makes (verify.ts).
+          ...this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}`, "X-API-Key": this.config.apiKey } : {}
+        },
+        body: JSON.stringify(options)
+      });
+    } catch (err) {
+      throw new SettlementReportError(
+        `reportSettlement failed: ${err instanceof Error ? err.message : String(err)}`,
+        0,
+        "network_error"
+      );
+    }
     const json = await res.json().catch(() => ({}));
     if (!res.ok || !json.success || !json.data) {
-      throw new Error(`reportSettlement failed (${res.status}): ${json.error ?? "unknown error"}`);
+      const code = json.code ?? json.error ?? "unknown_error";
+      throw new SettlementReportError(
+        `reportSettlement failed (${res.status}): ${code}`,
+        res.status,
+        code,
+        json.issues
+      );
     }
     return json.data;
   }