@astrasyncai/verification-gateway 5.18.1 → 5.19.0

package/dist/adapters/sdk.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.18.1";
+var SDK_VERSION = "5.19.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -177,7 +177,12 @@ function getCacheKey(request, counterpartyId) {
     // its start_checkout quote was served the cached quote-leg grant (no
     // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
     request.commercePhase || "",
-    request.checkoutSessionId || ""
+    request.checkoutSessionId || "",
+    // 5.19.0: a route_config purpose claim is checked server-side against
+    // the stored rule for this method + path, so it changes the verdict.
+    request.purposeSource || "",
+    request.requestMethod || "",
+    request.requestPath || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -354,6 +359,11 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
+  if (requestData.purposeSource) body.purposeSource = requestData.purposeSource;
+  if (requestData.agentArtifacts) body.agentArtifacts = requestData.agentArtifacts;
+  if (requestData.metadata) body.metadata = requestData.metadata;
+  if (requestData.requestMethod) body.requestMethod = requestData.requestMethod;
+  if (requestData.requestPath) body.requestPath = requestData.requestPath;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
   body.sdkVersion = SDK_VERSION;
   if (requestData.callerMetadata || requestData.clientIp || requestData.userAgent) {
@@ -543,9 +553,18 @@ async function verify(config, request, options) {
   if (!apiResponse.access?.allowed) {
     const aggregatedFailures = apiResponse.access?.failures;
     const idVerifiedFromBackend = apiResponse.verificationContext?.idVerified === true && !aggregatedFailures?.some((f) => REJECTED_IDENTITY_DIMENSIONS.has(f.dimension));
+    const denyAgent = idVerifiedFromBackend && apiResponse.agent ? {
+      astraId: apiResponse.agent.astraId,
+      name: apiResponse.agent.name,
+      trustScore: apiResponse.agent.trustScore,
+      trustLevel: getTrustLevel(apiResponse.agent.trustScore),
+      blockchainAnchored: apiResponse.agent.blockchainStatus === "anchored",
+      status: apiResponse.agent.agentStatus
+    } : void 0;
     const result2 = {
       identityVerified: idVerifiedFromBackend,
       policyAllowed: false,
+      ...denyAgent && { agent: denyAgent },
       // 3.6.0: the server now emits top-level denialReasons on every deny
       // path — prefer it verbatim; the failure-message reconstruction remains
       // as the fallback for older backends.
@@ -716,6 +735,7 @@ var SettlementReportError = class extends AstraSyncError {
 };
 
 // src/adapters/sdk.ts
+var warnedPhaselessValue = false;
 var VerificationGatewayClient = class {
   constructor(options) {
     this.config = {
@@ -747,9 +767,16 @@ var VerificationGatewayClient = class {
       apiKey: options.apiKey,
       jwt: options.jwt
     };
+    if (options.transactionValue && !options.commercePhase && !warnedPhaselessValue) {
+      warnedPhaselessValue = true;
+      console.warn(
+        "[astrasync] verify() with a transactionValue and no commercePhase is a purchase leg: it records a pending order and redeems a matching owner approval. Use quoteCheckout() for a price / limit check (commercePhase 'quote') and confirmCheckout() for the purchase. The default becomes 'quote' in 6.0."
+      );
+    }
     return this.executeWithRetry(
       () => verify(this.config, {
         credentials,
+        ...options.commercePhase && { commercePhase: options.commercePhase },
         purpose: options.purpose,
         action: options.action,
         resourceType: options.resourceType,
@@ -765,6 +792,43 @@ var VerificationGatewayClient = class {
       })
     );
   }
+  /**
+   * 5.19.0: the QUOTE leg of a checkout — a price / limit check before the
+   * purchase. Sends `commercePhase: 'quote'`: verify-access evaluates the
+   * agent's policy at this value and tells you whether a purchase would be
+   * granted, held for the owner's approval, or denied, but records no order,
+   * moves no money and never redeems an approval. Always reaches the backend
+   * (no verdict cache).
+   *
+   * Quotes count toward limit-probing detection: a run of rising quotes is
+   * how an agent (or a merchant) maps a spending limit. Quote what the buyer
+   * asked for, not a ladder of values.
+   */
+  async quoteCheckout(options) {
+    const credentials = {
+      astraId: options.astraId,
+      apiKey: options.apiKey,
+      jwt: options.jwt
+    };
+    return this.executeWithRetry(
+      () => verify(
+        this.config,
+        {
+          credentials,
+          purpose: options.purpose ?? "shopping",
+          action: options.action ?? "shopping.purchase",
+          transactionValue: options.transactionValue,
+          currency: options.currency,
+          commercePhase: "quote",
+          ...options.checkoutSessionId && { checkoutSessionId: options.checkoutSessionId },
+          ...options.attemptId && { attemptId: options.attemptId },
+          counterpartyUrl: options.counterpartyUrl,
+          counterpartyType: options.counterpartyType
+        },
+        { bypassCache: true }
+      )
+    );
+  }
   /**
    * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
    * first-party charge-at-redeem (server-side settlement on the owner's saved
@@ -803,6 +867,14 @@ var VerificationGatewayClient = class {
    * is matched to — and only to — this confirm. A held cart's approval is
    * bound to its checkout session and exact value; a confirm for any other
    * cart is held for its own approval.
+   *
+   * 5.19.0 checkout kits: pass the kit's `agentArtifacts` (the inbound agent
+   * request — signed RFC 9421 headers with the public URL and raw-body
+   * digest, or `{ unsigned: true }`) and `metadata` (`{ kitSessionId,
+   * protocol }`) from the `verifyPurchase` context. The platform attributes
+   * the confirm to the agent from the artifacts, and stores the metadata on
+   * any approval this confirm creates so the approval event
+   * (`handleApprovalEvents`) can find the kit session.
    */
   async confirmCheckout(options) {
     const credentials = {
@@ -825,6 +897,8 @@ var VerificationGatewayClient = class {
           ...options.checkoutJwt && { checkoutJwt: options.checkoutJwt },
           ...options.attemptId && { attemptId: options.attemptId },
           buyerEmail: options.buyerEmail,
+          ...options.agentArtifacts && { agentArtifacts: options.agentArtifacts },
+          ...options.metadata && { metadata: options.metadata },
           counterpartyUrl: options.counterpartyUrl,
           counterpartyType: options.counterpartyType
         },