@astrasyncai/verification-gateway 5.2.0 → 5.4.0

package/dist/index.mjs

@@ -19,7 +19,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.2.0";
+var SDK_VERSION = "5.4.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -372,6 +372,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
+  if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -543,7 +546,8 @@ async function verify(config, request, options) {
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
-      settlement: apiResponse.settlement
+      settlement: apiResponse.settlement,
+      settlementOutcome: apiResponse.settlementOutcome
     };
     return result2;
   }
@@ -600,7 +604,8 @@ async function verify(config, request, options) {
     recommendationReasons: apiResponse.recommendationReasons,
     warningHeader: apiResponse.warningHeader,
     stepUpApproval: apiResponse.stepUpApproval,
-    settlement: apiResponse.settlement
+    settlement: apiResponse.settlement,
+    settlementOutcome: apiResponse.settlementOutcome
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -2609,6 +2614,45 @@ var VerificationGatewayClient = class {
       })
     );
   }
+  /**
+   * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
+   * first-party charge-at-redeem (server-side settlement on the owner's saved
+   * instrument). This is the supported public surface for the confirm leg;
+   * `verify()` deliberately does not expose the checkout fields, so settlement
+   * can never fire by accident from a generic verify.
+   *
+   * Sends `commercePhase: 'confirm'` plus the checkout session id (per-cart
+   * idempotency) and line items (order/receipt plane), and identifies the
+   * merchant via `counterpartyUrl`/`counterpartyType` (required — the backend
+   * only settles a merchant-mediated grant against a first-party storefront).
+   * `purpose`/`action` default to the canonical shopping pair.
+   *
+   * Returns the full `VerificationResult`: read `.settlementOutcome` for the
+   * settled/failed/requires_action/no_instrument outcome (+ `orderId`), and the
+   * identity/policy/`failures` fields for a denial. On any non-`confirm`/first-
+   * party path `settlementOutcome` is simply absent — no money moves.
+   */
+  async confirmCheckout(options) {
+    const credentials = {
+      astraId: options.astraId,
+      apiKey: options.apiKey,
+      jwt: options.jwt
+    };
+    return this.executeWithRetry(
+      () => verify(this.config, {
+        credentials,
+        purpose: options.purpose ?? "shopping",
+        action: options.action ?? "shopping.purchase",
+        transactionValue: options.transactionValue,
+        currency: options.currency,
+        commercePhase: "confirm",
+        checkoutSessionId: options.checkoutSessionId,
+        checkoutItems: options.checkoutItems,
+        counterpartyUrl: options.counterpartyUrl,
+        counterpartyType: options.counterpartyType
+      })
+    );
+  }
   /**
    * Quick verification — checks credentials and policy in one call.
    *