@astrasyncai/verification-gateway 5.2.0 → 5.4.0

package/dist/{types-CNBaZKxY.d.ts → types-76TB0fxW.d.ts}

@@ -471,11 +471,34 @@ interface VerificationResult {
     stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
+    /**
+     * 5.3.0 (astra-pay): sanitized first-party settlement outcome. Present
+     * INSTEAD of `settlement` when the counterparty is an AstraSync-operated
+     * storefront and the request carried `commercePhase: 'confirm'` — the
+     * backend redeemed the voucher and executed the charge server-side
+     * (charge-at-redeem), so there is no artifact to deliver, only the result.
+     * `no_instrument` = policy passed but the owner has no chargeable
+     * instrument on file (steer the user to add one via onboarding).
+     */
+    settlementOutcome?: SettlementOutcomeInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
+ * settlement. Carries NO voucher/instrument material — the settlement channel
+ * stays merchant-only; this is the result the agent plane is allowed to see.
+ */
+interface SettlementOutcomeInfo {
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument';
+    /** First-party order id — the buyer sees the purchase in their AstraSync
+     * dashboard orders view (no public receipt page). */
+    orderId?: string;
+    /** Decline/failure taxonomy code (card_declined, insufficient_funds, …). */
+    failureCode?: string;
+}
 /**
  * Request context for verification
  */
@@ -531,6 +554,34 @@ interface VerificationRequest {
     transactionValue?: number;
     /** ISO-4217 currency code for transactionValue (e.g. 'USD', 'AUD', 'ETH'). Falls back to 'USD' server-side when unset. */
     currency?: string;
+    /**
+     * 5.3.0 (astra-pay): checkout-leg discriminator. `'confirm'` marks the
+     * completing call of a checkout; first-party settlement (charge-at-redeem
+     * on the owner's saved instrument) fires ONLY on this leg. Quote/browse
+     * legs omit it (or send `'quote'`) — they must never move money.
+     */
+    commercePhase?: 'quote' | 'confirm';
+    /**
+     * 5.3.0 (astra-pay): per-cart idempotency key (the checkout session id),
+     * forwarded on the confirm leg. Two concurrent confirms carrying the same
+     * key charge the owner's card at most once. Omit for raw one-shot confirms.
+     */
+    checkoutSessionId?: string;
+    /**
+     * 5.3.0 (astra-pay): the checkout's authoritative line items, forwarded on
+     * the confirm leg for the ORDER plane (receipts + digital-goods fulfillment
+     * email). Informational — never the money authority (that remains
+     * `transactionValue` bound into the settlement voucher).
+     */
+    checkoutItems?: Array<{
+        sku: string;
+        quantity: number;
+        title?: string;
+        unitPrice?: {
+            amount: string;
+            currency: string;
+        };
+    }>;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */
@@ -1068,4 +1119,4 @@ interface VerificationInterstitialProps {
 /** @deprecated Renamed VerificationInterstitialProps in 4.1.0; alias removed next major. */
 type CommerceShieldProps = VerificationInterstitialProps;
 
-export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, AttemptOutcome as c, AttemptReport as d, CommerceArtifactsPayload as e, CommerceShieldProps as f, ConsiderationItem as g, ConsiderationSet as h, CounterpartyType as i, ExpressMiddlewareOptions as j, GuidanceInfo as k, ProtocolTransport as l, RuntimeChallengeResult as m, SettlementArtifact as n, SettlementArtifactBinding as o, SettlementArtifactBindingBase as p, StablecoinSettlementBinding as q, StepUpApprovalInfo as r, StepUpApprovalStatus as s, StepUpOutcome as t, TrustLevel as u, VerificationRequest as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };
+export type { AccessFailure as A, VerifiedOrganization as B, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, AttemptOutcome as c, AttemptReport as d, CommerceArtifactsPayload as e, CommerceShieldProps as f, ConsiderationItem as g, ConsiderationSet as h, CounterpartyType as i, ExpressMiddlewareOptions as j, GuidanceInfo as k, ProtocolTransport as l, RuntimeChallengeResult as m, SettlementArtifact as n, SettlementArtifactBinding as o, SettlementArtifactBindingBase as p, SettlementOutcomeInfo as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationRequest as w, VerificationResult as x, VerifiedAgent as y, VerifiedDeveloper as z };

package/dist/{types-CSHcByFX.d.mts → types-CD1F9fmp.d.mts}

@@ -471,11 +471,34 @@ interface VerificationResult {
     stepUpOutcome?: StepUpOutcome;
     /** Settlement voucher (present on clean merchant-mediated grants with a verified wallet). */
     settlement?: SettlementArtifact;
+    /**
+     * 5.3.0 (astra-pay): sanitized first-party settlement outcome. Present
+     * INSTEAD of `settlement` when the counterparty is an AstraSync-operated
+     * storefront and the request carried `commercePhase: 'confirm'` — the
+     * backend redeemed the voucher and executed the charge server-side
+     * (charge-at-redeem), so there is no artifact to deliver, only the result.
+     * `no_instrument` = policy passed but the owner has no chargeable
+     * instrument on file (steer the user to add one via onboarding).
+     */
+    settlementOutcome?: SettlementOutcomeInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
+ * settlement. Carries NO voucher/instrument material — the settlement channel
+ * stays merchant-only; this is the result the agent plane is allowed to see.
+ */
+interface SettlementOutcomeInfo {
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument';
+    /** First-party order id — the buyer sees the purchase in their AstraSync
+     * dashboard orders view (no public receipt page). */
+    orderId?: string;
+    /** Decline/failure taxonomy code (card_declined, insufficient_funds, …). */
+    failureCode?: string;
+}
 /**
  * Request context for verification
  */
@@ -531,6 +554,34 @@ interface VerificationRequest {
     transactionValue?: number;
     /** ISO-4217 currency code for transactionValue (e.g. 'USD', 'AUD', 'ETH'). Falls back to 'USD' server-side when unset. */
     currency?: string;
+    /**
+     * 5.3.0 (astra-pay): checkout-leg discriminator. `'confirm'` marks the
+     * completing call of a checkout; first-party settlement (charge-at-redeem
+     * on the owner's saved instrument) fires ONLY on this leg. Quote/browse
+     * legs omit it (or send `'quote'`) — they must never move money.
+     */
+    commercePhase?: 'quote' | 'confirm';
+    /**
+     * 5.3.0 (astra-pay): per-cart idempotency key (the checkout session id),
+     * forwarded on the confirm leg. Two concurrent confirms carrying the same
+     * key charge the owner's card at most once. Omit for raw one-shot confirms.
+     */
+    checkoutSessionId?: string;
+    /**
+     * 5.3.0 (astra-pay): the checkout's authoritative line items, forwarded on
+     * the confirm leg for the ORDER plane (receipts + digital-goods fulfillment
+     * email). Informational — never the money authority (that remains
+     * `transactionValue` bound into the settlement voucher).
+     */
+    checkoutItems?: Array<{
+        sku: string;
+        quantity: number;
+        title?: string;
+        unitPrice?: {
+            amount: string;
+            currency: string;
+        };
+    }>;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */
@@ -1068,4 +1119,4 @@ interface VerificationInterstitialProps {
 /** @deprecated Renamed VerificationInterstitialProps in 4.1.0; alias removed next major. */
 type CommerceShieldProps = VerificationInterstitialProps;
 
-export type { AccessFailure as A, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, AttemptOutcome as c, AttemptReport as d, CommerceArtifactsPayload as e, CommerceShieldProps as f, ConsiderationItem as g, ConsiderationSet as h, CounterpartyType as i, ExpressMiddlewareOptions as j, GuidanceInfo as k, ProtocolTransport as l, RuntimeChallengeResult as m, SettlementArtifact as n, SettlementArtifactBinding as o, SettlementArtifactBindingBase as p, StablecoinSettlementBinding as q, StepUpApprovalInfo as r, StepUpApprovalStatus as s, StepUpOutcome as t, TrustLevel as u, VerificationRequest as v, VerificationResult as w, VerifiedAgent as x, VerifiedDeveloper as y, VerifiedOrganization as z };
+export type { AccessFailure as A, VerifiedOrganization as B, CallerMetadata as C, EnhancedVerificationResult as E, FiatSettlementBinding as F, GatewayConfig as G, NextJsMiddlewareOptions as N, PDLSSInfo as P, RouteAccessConfig as R, SDKOptions as S, TokenGuidance as T, VerificationInterstitialProps as V, AgentCredentials as a, AstraSyncCredentials as b, AttemptOutcome as c, AttemptReport as d, CommerceArtifactsPayload as e, CommerceShieldProps as f, ConsiderationItem as g, ConsiderationSet as h, CounterpartyType as i, ExpressMiddlewareOptions as j, GuidanceInfo as k, ProtocolTransport as l, RuntimeChallengeResult as m, SettlementArtifact as n, SettlementArtifactBinding as o, SettlementArtifactBindingBase as p, SettlementOutcomeInfo as q, StablecoinSettlementBinding as r, StepUpApprovalInfo as s, StepUpApprovalStatus as t, StepUpOutcome as u, TrustLevel as v, VerificationRequest as w, VerificationResult as x, VerifiedAgent as y, VerifiedDeveloper as z };

package/dist/{types-3UV7IZx7.d.ts → types-DGh2akuh.d.ts}

@@ -1,4 +1,4 @@
-import { i as CounterpartyType, T as TokenGuidance } from './types-CNBaZKxY.js';
+import { i as CounterpartyType, T as TokenGuidance } from './types-76TB0fxW.js';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/{types-CoDjpbVY.d.mts → types-z_RNjHWm.d.mts}

@@ -1,4 +1,4 @@
-import { i as CounterpartyType, T as TokenGuidance } from './types-CSHcByFX.mjs';
+import { i as CounterpartyType, T as TokenGuidance } from './types-CD1F9fmp.mjs';
 
 /**
  * AstraSync Gateway - Types for gateway modes, local evaluation, and adapter interface.

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-CSHcByFX.mjs';
+import { V as VerificationInterstitialProps, x as VerificationResult, a as AgentCredentials, k as GuidanceInfo, v as TrustLevel } from '../types-CD1F9fmp.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, w as VerificationResult, a as AgentCredentials, k as GuidanceInfo, u as TrustLevel } from '../types-CNBaZKxY.js';
+import { V as VerificationInterstitialProps, x as VerificationResult, a as AgentCredentials, k as GuidanceInfo, v as TrustLevel } from '../types-76TB0fxW.js';
 import '../metadata-capture.js';
 
 /**

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-CSHcByFX.mjs';
+import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-CD1F9fmp.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, v as VerificationRequest, w as VerificationResult } from './types-CNBaZKxY.js';
+import { a as AgentCredentials, G as GatewayConfig, d as AttemptReport, w as VerificationRequest, x as VerificationResult } from './types-76TB0fxW.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -36,7 +36,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.2.0";
+var SDK_VERSION = "5.4.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -348,6 +348,9 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.runtimeChallengeOptions)
     body.runtimeChallengeOptions = requestData.runtimeChallengeOptions;
   if (requestData.invocationProtocol) body.invocationProtocol = requestData.invocationProtocol;
+  if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
+  if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
+  if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -519,7 +522,8 @@ async function verify(config, request, options) {
       recommendation: apiResponse.recommendation,
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
-      settlement: apiResponse.settlement
+      settlement: apiResponse.settlement,
+      settlementOutcome: apiResponse.settlementOutcome
     };
     return result2;
   }
@@ -576,7 +580,8 @@ async function verify(config, request, options) {
     recommendationReasons: apiResponse.recommendationReasons,
     warningHeader: apiResponse.warningHeader,
     stepUpApproval: apiResponse.stepUpApproval,
-    settlement: apiResponse.settlement
+    settlement: apiResponse.settlement,
+    settlementOutcome: apiResponse.settlementOutcome
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;