@astrasyncai/verification-gateway 5.14.0 → 5.16.0

package/dist/adapters/sdk.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.14.0";
+var SDK_VERSION = "5.16.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -159,6 +159,8 @@ function getCacheKey(request, counterpartyId) {
     request.durationRequired ?? "",
     request.invocationProtocol || "",
     request.enableRuntimeChallenge ? "1" : "0",
+    // 5.16.0: route policy changes the verdict (owners / challenge).
+    request.routePolicy ? JSON.stringify(request.routePolicy) : "",
     // callerMetadata fields contribute to risk model; include the ones
     // backend reads. sourceIp/userAgent/forwardedFor change per-request
     // so their inclusion effectively forces a re-check for any varying
@@ -334,6 +336,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.subAgentDepth !== void 0) body.subAgentDepth = requestData.subAgentDepth;
   if (requestData.enableRuntimeChallenge)
     body.enableRuntimeChallenge = requestData.enableRuntimeChallenge;
+  if (requestData.routePolicy) body.routePolicy = requestData.routePolicy;
   if (requestData.createSession) body.createSession = requestData.createSession;
   if (requestData.durationRequired) body.durationRequired = requestData.durationRequired;
   if (requestData.counterpartyType) body.counterpartyType = requestData.counterpartyType;
@@ -344,6 +347,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutJwt) body.checkoutJwt = requestData.checkoutJwt;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
@@ -494,7 +498,8 @@ async function verify(config, request, options) {
       "[VerificationGateway] minTrustScore / minTrustScoreForFull are deprecated in v2.3.0 and have no effect. Server is now the single source of truth for access decisions (verified ID + runtime challenge + PDLSS + trust score). To gate access to an endpoint, configure the endpoint's trust_score_requirement server-side."
     );
   }
-  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache) {
+  const uncacheable = Boolean(request.commerceArtifacts);
+  if (mergedConfig.cacheTtl !== 0 && !options?.bypassCache && !uncacheable) {
     const cached = getCachedResult(request, mergedConfig.counterpartyId);
     if (cached) {
       if (mergedConfig.debug) {
@@ -575,7 +580,10 @@ async function verify(config, request, options) {
       // MERCHANT caller only (bridge callers strip it before the agent plane).
       settlementToken: apiResponse.settlementToken,
       // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-      fulfilment: apiResponse.fulfilment
+      fulfilment: apiResponse.fulfilment,
+      mandates: apiResponse.mandates,
+      kyaToken: apiResponse.kyaToken,
+      aep: apiResponse.aep
     };
     return result2;
   }
@@ -585,7 +593,10 @@ async function verify(config, request, options) {
     trustScore: apiResponse.agent.trustScore,
     trustLevel: getTrustLevel(apiResponse.agent.trustScore),
     blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
-    status: apiResponse.agent.agentStatus
+    status: apiResponse.agent.agentStatus,
+    ...apiResponse.agent.protocolIdentities && {
+      protocolIdentities: apiResponse.agent.protocolIdentities
+    }
   } : void 0;
   const developer = apiResponse.developer ? {
     astradId: apiResponse.developer.kyaOwnerId,
@@ -636,7 +647,11 @@ async function verify(config, request, options) {
     settlementOutcome: apiResponse.settlementOutcome,
     settlementToken: apiResponse.settlementToken,
     // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
-    fulfilment: apiResponse.fulfilment
+    fulfilment: apiResponse.fulfilment,
+    // 5.15.0: merchant-lane AP2 mandates + KYAPay identity token.
+    mandates: apiResponse.mandates,
+    kyaToken: apiResponse.kyaToken,
+    aep: apiResponse.aep
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -656,7 +671,9 @@ async function verify(config, request, options) {
   }
   const escalates = result.requiresStepUp === true || result.requiresApproval === true || result.recommendation === "step_up_required";
   if (mergedConfig.cacheTtl !== 0 && result.recommendation !== "deny" && !escalates) {
-    cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    if (!uncacheable) {
+      cacheResult(request, result, mergedConfig.cacheTtl, mergedConfig.counterpartyId);
+    }
   }
   return result;
 }
@@ -676,6 +693,24 @@ async function quickVerify(config, credentials) {
   };
 }
 
+// src/registration/errors.ts
+var AstraSyncError = class extends Error {
+  constructor(message, statusCode, code) {
+    super(message);
+    this.name = "AstraSyncError";
+    this.statusCode = statusCode;
+    this.code = code;
+  }
+};
+var SettlementReportError = class extends AstraSyncError {
+  constructor(message, statusCode, code, issues) {
+    super(message, statusCode, code);
+    this.name = "SettlementReportError";
+    this.issues = issues;
+    this.retryable = statusCode === 0 || statusCode === 429 || statusCode >= 500;
+  }
+};
+
 // src/adapters/sdk.ts
 var VerificationGatewayClient = class {
   constructor(options) {
@@ -783,6 +818,7 @@ var VerificationGatewayClient = class {
           commercePhase: "confirm",
           checkoutSessionId: options.checkoutSessionId,
           checkoutItems: options.checkoutItems,
+          ...options.checkoutJwt && { checkoutJwt: options.checkoutJwt },
           ...options.attemptId && { attemptId: options.attemptId },
           buyerEmail: options.buyerEmail,
           counterpartyUrl: options.counterpartyUrl,
@@ -796,28 +832,52 @@ var VerificationGatewayClient = class {
     );
   }
   /**
-   * 5.5.0 (astra-pay): report a self-settled charge outcome back to the
-   * platform — the other half of the `settlementToken` contract. Call after
-   * your PaymentIntent reaches a terminal state so the buyer's dashboard,
-   * /orders and the agent's poll surface reconcile. Authenticated with this
-   * client's api key (must be the merchant's own). Amounts must match the
-   * order EXACTLY (integer minor units) or the report is rejected whole
-   * (409 amount_mismatch). Replays of the same terminal state are safe.
+   * Report a settlement outcome back to the platform. 5.14.1: AstraSync never
+   * charges — EVERY merchant settles the orders it is handed (card token,
+   * stablecoin voucher, or a protocol-native credential) and reports here, so
+   * the buyer's dashboard, /orders and the agent's poll surface reconcile.
+   * Identify the order by the confirm's `sessionId` or the `orderId` from
+   * `settlementOutcome`. A settled card charge carries `processorRef` (pi_…);
+   * a settled stablecoin transfer carries `txHash` (+ `chainId`). Amounts must
+   * match the order EXACTLY (integer minor units) or the report is rejected
+   * whole (409 amount_mismatch). Replays of the same terminal state are safe.
    */
   async reportSettlement(options) {
+    if (!options.sessionId && !options.orderId) {
+      throw new SettlementReportError(
+        "reportSettlement needs sessionId or orderId",
+        400,
+        "VALIDATION"
+      );
+    }
     const base = this.config.apiBaseUrl.replace(/\/+$/, "");
-    const res = await sdkFetch(`${base}/merchant/settlements/report`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        // Same auth pair as every backend call the SDK makes (verify.ts).
-        ...this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}`, "X-API-Key": this.config.apiKey } : {}
-      },
-      body: JSON.stringify(options)
-    });
+    let res;
+    try {
+      res = await sdkFetch(`${base}/merchant/settlements/report`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          // Same auth pair as every backend call the SDK makes (verify.ts).
+          ...this.config.apiKey ? { Authorization: `Bearer ${this.config.apiKey}`, "X-API-Key": this.config.apiKey } : {}
+        },
+        body: JSON.stringify(options)
+      });
+    } catch (err) {
+      throw new SettlementReportError(
+        `reportSettlement failed: ${err instanceof Error ? err.message : String(err)}`,
+        0,
+        "network_error"
+      );
+    }
     const json = await res.json().catch(() => ({}));
     if (!res.ok || !json.success || !json.data) {
-      throw new Error(`reportSettlement failed (${res.status}): ${json.error ?? "unknown error"}`);
+      const code = json.code ?? json.error ?? "unknown_error";
+      throw new SettlementReportError(
+        `reportSettlement failed (${res.status}): ${code}`,
+        res.status,
+        code,
+        json.issues
+      );
     }
     return json.data;
   }