@astrasyncai/verification-gateway 5.2.0 → 5.3.0

package/dist/{types-CoDjpbVY.d.mts → types-1urxLCZv.d.mts}

@@ -1,4 +1,4 @@
-import { i as CounterpartyType, T as TokenGuidance } from './types-CSHcByFX.mjs';
+import { i as CounterpartyType, T as TokenGuidance } from './types-eSqHyFFH.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-3UV7IZx7.d.ts → types-C1s1z0VD.d.ts}

@@ -1,4 +1,4 @@
-import { i as CounterpartyType, T as TokenGuidance } from './types-CNBaZKxY.js';
+import { i as CounterpartyType, T as TokenGuidance } from './types-CA1ZhoaJ.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-CNBaZKxY.d.ts → types-CA1ZhoaJ.d.ts}

@@ -471,11 +471,34 @@ interface VerificationResult {
     stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
+    /**
+     * 5.3.0 (astra-pay): sanitized first-party settlement outcome. Present
+     * INSTEAD of `settlement` when the counterparty is an AstraSync-operated
+     * storefront and the request carried `commercePhase: 'confirm'` — the
+     * backend redeemed the voucher and executed the charge server-side
+     * (charge-at-redeem), so there is no artifact to deliver, only the result.
+     * `no_instrument` = policy passed but the owner has no chargeable
+     * instrument on file (steer the user to add one via onboarding).
+     */
+    settlementOutcome?: SettlementOutcomeInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
+ * settlement. Carries NO voucher/instrument material — the settlement channel
+ * stays merchant-only; this is the result the agent plane is allowed to see.
+ */
+interface SettlementOutcomeInfo {
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument';
+    /** First-party order id — the buyer sees the purchase in their AstraSync
+     * dashboard orders view (no public receipt page). */
+    orderId?: string;
+    /** Decline/failure taxonomy code (card_declined, insufficient_funds, …). */
+    failureCode?: string;
+}
 /**
  * Request context for verification
  */
@@ -531,6 +554,34 @@ interface VerificationRequest {
     transactionValue?: number;
     /** ISO-4217 currency code for transactionValue (e.g. 'USD', 'AUD', 'ETH'). Falls back to 'USD' server-side when unset. */
     currency?: string;
+    /**
+     * 5.3.0 (astra-pay): checkout-leg discriminator. `'confirm'` marks the
+     * completing call of a checkout; first-party settlement (charge-at-redeem
+     * on the owner's saved instrument) fires ONLY on this leg. Quote/browse
+     * legs omit it (or send `'quote'`) — they must never move money.
+     */
+    commercePhase?: 'quote' | 'confirm';
+    /**
+     * 5.3.0 (astra-pay): per-cart idempotency key (the checkout session id),
+     * forwarded on the confirm leg. Two concurrent confirms carrying the same
+     * key charge the owner's card at most once. Omit for raw one-shot confirms.
+     */
+    checkoutSessionId?: string;
+    /**
+     * 5.3.0 (astra-pay): the checkout's authoritative line items, forwarded on
+     * the confirm leg for the ORDER plane (receipts + digital-goods fulfillment
+     * email). Informational — never the money authority (that remains
+     * `transactionValue` bound into the settlement voucher).
+     */
+    checkoutItems?: Array<{
+        sku: string;
+        quantity: number;
+        title?: string;
+        unitPrice?: {
+            amount: string;
+            currency: string;
+        };
+    }>;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/{types-CSHcByFX.d.mts → types-eSqHyFFH.d.mts}

@@ -471,11 +471,34 @@ interface VerificationResult {
     stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
+    /**
+     * 5.3.0 (astra-pay): sanitized first-party settlement outcome. Present
+     * INSTEAD of `settlement` when the counterparty is an AstraSync-operated
+     * storefront and the request carried `commercePhase: 'confirm'` — the
+     * backend redeemed the voucher and executed the charge server-side
+     * (charge-at-redeem), so there is no artifact to deliver, only the result.
+     * `no_instrument` = policy passed but the owner has no chargeable
+     * instrument on file (steer the user to add one via onboarding).
+     */
+    settlementOutcome?: SettlementOutcomeInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
+ * settlement. Carries NO voucher/instrument material — the settlement channel
+ * stays merchant-only; this is the result the agent plane is allowed to see.
+ */
+interface SettlementOutcomeInfo {
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument';
+    /** First-party order id — the buyer sees the purchase in their AstraSync
+     * dashboard orders view (no public receipt page). */
+    orderId?: string;
+    /** Decline/failure taxonomy code (card_declined, insufficient_funds, …). */
+    failureCode?: string;
+}
 /**
  * Request context for verification
  */
@@ -531,6 +554,34 @@ interface VerificationRequest {
     transactionValue?: number;
     /** ISO-4217 currency code for transactionValue (e.g. 'USD', 'AUD', 'ETH'). Falls back to 'USD' server-side when unset. */
     currency?: string;
+    /**
+     * 5.3.0 (astra-pay): checkout-leg discriminator. `'confirm'` marks the
+     * completing call of a checkout; first-party settlement (charge-at-redeem
+     * on the owner's saved instrument) fires ONLY on this leg. Quote/browse
+     * legs omit it (or send `'quote'`) — they must never move money.
+     */
+    commercePhase?: 'quote' | 'confirm';
+    /**
+     * 5.3.0 (astra-pay): per-cart idempotency key (the checkout session id),
+     * forwarded on the confirm leg. Two concurrent confirms carrying the same
+     * key charge the owner's card at most once. Omit for raw one-shot confirms.
+     */
+    checkoutSessionId?: string;
+    /**
+     * 5.3.0 (astra-pay): the checkout's authoritative line items, forwarded on
+     * the confirm leg for the ORDER plane (receipts + digital-goods fulfillment
+     * email). Informational — never the money authority (that remains
+     * `transactionValue` bound into the settlement voucher).
+     */
+    checkoutItems?: Array<{
+        sku: string;
+        quantity: number;
+        title?: string;
+        unitPrice?: {
+            amount: string;
+            currency: string;
+        };
+    }>;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-CSHcByFX.mjs';
+import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-eSqHyFFH.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-CNBaZKxY.js';
+import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-CA1ZhoaJ.js';
 import '../metadata-capture.js';
 
 /**

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-CSHcByFX.mjs';
+import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-eSqHyFFH.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-CNBaZKxY.js';
+import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-CA1ZhoaJ.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -36,7 +36,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.2.0";
+var SDK_VERSION = "5.3.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -348,6 +348,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
+  if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -519,7 +522,8 @@ async function verify(config, request, options) {
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
-      settlement: apiResponse.settlement
+      settlement: apiResponse.settlement,
+      settlementOutcome: apiResponse.settlementOutcome
     };
     return result2;
   }
@@ -576,7 +580,8 @@ async function verify(config, request, options) {
     recommendationReasons: apiResponse.recommendationReasons,
     warningHeader: apiResponse.warningHeader,
     stepUpApproval: apiResponse.stepUpApproval,
-    settlement: apiResponse.settlement
+    settlement: apiResponse.settlement,
+    settlementOutcome: apiResponse.settlementOutcome
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;