@astrasyncai/verification-gateway 5.20.0 → 5.21.0

package/dist/index.mjs

@@ -30,7 +30,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.20.0";
+var SDK_VERSION = "5.21.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3801,37 +3801,23 @@ var VerificationGatewayClient = class {
     }
     return json4.data;
   }
-  /**
-   * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-   * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-   * endpoint's owner, or a personal key of an individual with an active seat
-   * in the owning organisation. Policy (rules, trust floor, challenge, edge
-   * config) stays dashboard-only. `null` clears a field. The owner is alerted
-   * when `eventsUrl` changes.
-   *
-   * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-   * @returns the endpoint as stored, plus `changed` (the fields that changed)
-   * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-   */
-  async updateEndpoint(endpointId, patch) {
-    return this.endpointCall("PATCH", endpointId, "", patch);
-  }
   /**
    * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
    * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
    * Delivered synchronously, outside the event outbox (random `eventId`, no
    * retries), signed with the endpoint's webhook secret like a real event.
-   * Without `approvalId` the payload is synthetic (a kit acknowledges and
-   * ignores it). With the id of a held kit approval at this endpoint the
-   * payload is the real one, so your resume path runs: `approved` makes the
-   * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-   * `lapsed` release the session.
+   * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+   * ignores it.
+   *
+   * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+   * payload (which releases or re-drives that checkout) is dashboard-only, so
+   * a leaked API key can't do it.
    *
    * Resolves even when your endpoint refused the event (`delivered: false`,
    * with `responseCode` / `error`).
    */
   async sendTestEvent(endpointId, options) {
-    return this.endpointCall("POST", endpointId, "/events/test", options);
+    return this.endpointCall("POST", endpointId, "/events/test", { type: options.type });
   }
   async endpointCall(method, endpointId, suffix, body) {
     const id = endpointId ?? this.config.counterpartyId;
@@ -9025,13 +9011,13 @@ function requireLoader() {
         throwError(state, "ill-formed argument of the YAML directive");
       }
       const major = parseInt(match[1], 10);
-      const minor = parseInt(match[2], 10);
+      const minor2 = parseInt(match[2], 10);
       if (major !== 1) {
         throwError(state, "unacceptable YAML version of the document");
       }
       state.version = args[0];
-      state.checkLineBreaks = minor < 2;
-      if (minor !== 1 && minor !== 2) {
+      state.checkLineBreaks = minor2 < 2;
+      if (minor2 !== 1 && minor2 !== 2) {
         throwWarning(state, "unsupported YAML version of the document");
       }
     },
@@ -11527,6 +11513,228 @@ async function sendUcpWebhook(opts) {
   return { ok: false, status: last, attempts };
 }
 
+// src/ucp/agent-commerce.ts
+var ISSUER_PROGRAM_HEADER = "X-Astra-Issuer-Program";
+function issuerOfferPrice(priceMinor, percentOff) {
+  if (!percentOff) return priceMinor;
+  const pct = Math.min(100, Math.max(0, percentOff));
+  return Math.max(0, Math.round(priceMinor * (1 - pct / 100)));
+}
+function priceForAgent(rules, sku, basePriceMinor, ctx) {
+  const rule = rules?.products?.[sku];
+  let price = rule?.priceMinor ?? basePriceMinor;
+  if (ctx.verified && rules?.verifiedPercentOff) {
+    price = issuerOfferPrice(price, rules.verifiedPercentOff);
+  }
+  const offer = ctx.verified && ctx.issuerProgram && rule?.issuerEligible !== false ? rules?.offers?.find((o) => o.program === ctx.issuerProgram) : void 0;
+  if (offer?.pricePercentOff) {
+    return {
+      priceMinor: issuerOfferPrice(price, offer.pricePercentOff),
+      regularMinor: price,
+      issuerProgram: offer.program
+    };
+  }
+  return { priceMinor: price };
+}
+function visibleToAgent(rules, sku, ctx) {
+  if (!ctx.verified && rules?.hideFromUnverified) return false;
+  return rules?.products?.[sku]?.visible !== false;
+}
+function createAgentCommerce(opts) {
+  const f = opts.fetch ?? sdkFetch;
+  let current = null;
+  let kitReport;
+  const refreshMs = opts.refreshMs ?? 5 * 6e4;
+  async function refresh() {
+    try {
+      const headers = {
+        Accept: "application/json",
+        Authorization: `Bearer ${opts.apiKey}`,
+        "X-AstraSync-SDK-Version": SDK_VERSION
+      };
+      if (kitReport) {
+        headers["X-AstraSync-Kit-Report"] = Buffer.from(JSON.stringify(kitReport)).toString(
+          "base64url"
+        );
+      }
+      const res = await f(
+        `${opts.apiBaseUrl.replace(/\/+$/, "")}/endpoints/${encodeURIComponent(
+          opts.counterpartyId
+        )}/agent-commerce`,
+        { method: "GET", headers }
+      );
+      if (!res.ok) return;
+      const body = await res.json();
+      if (body.data && typeof body.data.version === "number") current = body.data;
+    } catch {
+    }
+  }
+  const timer = refreshMs > 0 ? setInterval(() => {
+    void refresh();
+  }, refreshMs) : null;
+  timer?.unref?.();
+  void refresh();
+  return {
+    rules: () => current,
+    refresh,
+    price: (sku, base, ctx) => priceForAgent(current, sku, base, ctx),
+    visible: (sku, ctx) => visibleToAgent(current, sku, ctx),
+    report: (r) => {
+      kitReport = { ...kitReport, ...r };
+    },
+    stop: () => {
+      if (timer) clearInterval(timer);
+    }
+  };
+}
+function pricingContextFrom(headers) {
+  const astraId = headers.get("x-astra-id");
+  const hop = parseVerifiedHop(headers.get(MCP_VERIFIED_HOP_HEADER.toLowerCase()));
+  const verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  const program = headers.get(ISSUER_PROGRAM_HEADER.toLowerCase());
+  return {
+    verified,
+    ...verified && program && /^[a-z0-9-]{2,40}$/.test(program) && { issuerProgram: program }
+  };
+}
+function minor(value) {
+  const n = typeof value === "number" ? value : Number(String(value ?? "").replace(/[^\d.]/g, ""));
+  return Number.isFinite(n) && n >= 0 ? Math.round(n * 100) : null;
+}
+function fromFeed(url, options = {}) {
+  const f = options.fetch ?? fetch;
+  let cache4 = null;
+  return async () => {
+    if (cache4 && Date.now() - cache4.at < 6e4) return cache4.products;
+    const res = await f(url, {
+      headers: { Accept: "application/json, application/xml, text/csv" }
+    });
+    if (!res.ok) throw new Error(`Product feed ${url} answered ${res.status}`);
+    const text = await res.text();
+    const products = parseFeed(text, options.currency ?? "AUD");
+    cache4 = { at: Date.now(), products };
+    return products;
+  };
+}
+function parseFeed(text, currency) {
+  const trimmed = text.trimStart();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    const json4 = JSON.parse(trimmed);
+    const list = Array.isArray(json4) ? json4 : json4.products ?? json4.items ?? [];
+    return list.flatMap((p) => {
+      const variant = p.variants?.[0];
+      const price = minor(variant?.price ?? p.price);
+      const sku = String(variant?.sku || p.sku || p.id || "");
+      if (!sku || price === null) return [];
+      const images = Array.isArray(p.images) ? p.images.map(
+        (i) => typeof i === "string" ? i : i.src ?? ""
+      ) : [p.image_url, p.image].filter((x) => typeof x === "string");
+      return [
+        {
+          sku,
+          name: String(p.title ?? p.name ?? sku),
+          priceMinor: price,
+          currency: String(p.currency ?? currency),
+          ...typeof p.description === "string" && { description: p.description },
+          imageUrls: images.filter((u) => /^https:\/\//.test(u)),
+          inStock: variant ? variant.available !== false : p.in_stock !== false
+        }
+      ];
+    });
+  }
+  if (trimmed.startsWith("<")) {
+    const items = trimmed.split(/<item[\s>]|<entry[\s>]/).slice(1);
+    return items.flatMap((chunk) => {
+      const tag = (name) => {
+        const m = new RegExp(`<(?:g:)?${name}[^>]*>([\\s\\S]*?)</(?:g:)?${name}>`).exec(chunk);
+        return m ? m[1].replace(/<!\[CDATA\[|\]\]>/g, "").trim() : void 0;
+      };
+      const sku = tag("id");
+      const price = minor(tag("price"));
+      if (!sku || price === null) return [];
+      const extra = [...chunk.matchAll(/<g:additional_image_link>([^<]+)</g)].map(
+        (m) => m[1].trim()
+      );
+      return [
+        {
+          sku,
+          name: tag("title") ?? sku,
+          priceMinor: price,
+          currency: /[A-Z]{3}/.exec(tag("price") ?? "")?.[0] ?? currency,
+          imageUrls: [tag("image_link"), ...extra].filter(
+            (u) => !!u && /^https:\/\//.test(u)
+          ),
+          inStock: (tag("availability") ?? "in stock").replace(/_/g, " ") !== "out of stock"
+        }
+      ];
+    });
+  }
+  const [head, ...rows] = trimmed.split(/\r?\n/).filter(Boolean);
+  const cols = head.split(",").map((c) => c.trim().toLowerCase());
+  const at = (r, ...names) => {
+    const i = cols.findIndex((c) => names.includes(c));
+    return i >= 0 ? r[i]?.trim() : void 0;
+  };
+  return rows.flatMap((line) => {
+    const r = line.split(",");
+    const sku = at(r, "id", "sku");
+    const price = minor(at(r, "price"));
+    if (!sku || price === null) return [];
+    const image = at(r, "image_link", "image_url", "image");
+    return [
+      {
+        sku,
+        name: at(r, "title", "name") ?? sku,
+        priceMinor: price,
+        currency,
+        imageUrls: image && /^https:\/\//.test(image) ? [image] : [],
+        inStock: (at(r, "availability", "in_stock") ?? "in stock") !== "out of stock"
+      }
+    ];
+  });
+}
+function serveAgentCatalog(opts) {
+  return async (req, res) => {
+    const ctx = pricingContextFrom({
+      get: (name) => {
+        const v = req.headers[name.toLowerCase()];
+        return Array.isArray(v) ? v[0] ?? null : v ?? null;
+      }
+    });
+    let products;
+    try {
+      products = await opts.products();
+    } catch {
+      res.status(503).json({ error: "catalog_unavailable" });
+      return;
+    }
+    const rules = opts.commerce.rules();
+    res.setHeader?.("Cache-Control", ctx.verified ? "private, no-store" : "public, max-age=60");
+    res.json({
+      products: products.filter((p) => opts.commerce.visible(p.sku, ctx)).map((p) => {
+        const priced = opts.commerce.price(p.sku, p.priceMinor, ctx);
+        const image = rules?.products?.[p.sku]?.imageUrl ?? p.imageUrls?.[0];
+        return {
+          sku: p.sku,
+          name: p.name,
+          ...p.description && { description: p.description },
+          price: priced.priceMinor / 100,
+          currency: p.currency,
+          ...image && { image_url: image },
+          in_stock: p.inStock !== false,
+          ...p.url && { url: p.url },
+          ...priced.issuerProgram && {
+            issuer_offer: {
+              program: priced.issuerProgram,
+              regular_price: (priced.regularMinor ?? p.priceMinor) / 100
+            }
+          }
+        };
+      })
+    });
+  };
+}
+
 // src/ucp/checkout-kit.ts
 import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
 import { CompactSign as CompactSign2 } from "jose";
@@ -12350,6 +12558,7 @@ var clone = (v) => JSON.parse(JSON.stringify(v));
 var inFlight = (st) => st === "complete_in_progress" || st === "finishing";
 function createUcpCheckoutKit(opts) {
   const profile = buildUcpProfile(opts.profile);
+  opts.agentCommerce?.report({ checkoutUrl: opts.profile.endpoint, protocols: ["ucp"] });
   const store = opts.store ?? new MemoryCheckoutStore();
   const idem = {
     store: opts.idempotencyStore ?? new MemoryIdempotencyStore(),
@@ -12523,9 +12732,7 @@ function createUcpCheckoutKit(opts) {
     delete s._approvalId;
     if (settled.status === "failed") {
       s.status = "ready_for_complete";
-      s.messages = [
-        ucpError("payment_failed", "The payment did not go through.", "recoverable")
-      ];
+      s.messages = [ucpError("payment_failed", "The payment did not go through.", "recoverable")];
       await save(s);
       return;
     }
@@ -12559,9 +12766,10 @@ function createUcpCheckoutKit(opts) {
     const b = checkUcpAgentBinding(req.headers.get("ucp-agent"), identities);
     return b.ok ? null : b;
   }
-  async function priceLines(lines) {
+  async function priceLines(lines, pricing = { verified: false }) {
     const out = [];
     const messages = [];
+    let issuerProgram;
     for (const [i, l] of lines.entries()) {
       const q = Math.max(1, Math.floor(l.quantity ?? 1));
       const found = l.item?.id ? await opts.catalog(l.item.id, q) : null;
@@ -12577,6 +12785,22 @@ function createUcpCheckoutKit(opts) {
         );
         continue;
       }
+      if (opts.agentCommerce) {
+        if (!opts.agentCommerce.visible(item.id, pricing)) {
+          messages.push(
+            ucpError(
+              "item_unavailable",
+              `Item ${item.id} is unavailable.`,
+              "recoverable",
+              `$.line_items[${i}]`
+            )
+          );
+          continue;
+        }
+        const priced = opts.agentCommerce.price(item.id, item.price, pricing);
+        item.price = priced.priceMinor;
+        if (priced.issuerProgram) issuerProgram = priced.issuerProgram;
+      }
       const amount = item.price * q;
       out.push({
         id: `li_${i + 1}`,
@@ -12592,6 +12816,7 @@ function createUcpCheckoutKit(opts) {
     return {
       lines: out,
       messages,
+      issuerProgram,
       totals: [
         { type: "subtotal", amount: sum },
         { type: "total", amount: sum }
@@ -12761,7 +12986,11 @@ function createUcpCheckoutKit(opts) {
         ...checkoutJwt && { checkoutJwt },
         valueMajor: total(s) / 100,
         agentArtifacts,
-        metadata: { kitSessionId: s.id, protocol: "ucp" }
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "ucp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        }
       });
       const binding2 = await bindAgent(req, result);
       if (binding2) {
@@ -12900,7 +13129,11 @@ function createUcpCheckoutKit(opts) {
         attemptId: s._attemptId,
         ...checkoutJwt && { checkoutJwt },
         valueMajor: total(s) / 100,
-        metadata: { kitSessionId: s.id, protocol: "ucp" },
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "ucp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        },
         resumed: { ...s._approvalId && { approvalId: s._approvalId } }
       });
       if (isHeld(result)) {
@@ -13015,7 +13248,10 @@ function createUcpCheckoutKit(opts) {
     const caller = await resolveCallerScope(req, reqCtx, opts.resolveCallerId) ?? fallbackScope("ucp-profile", ctx.profileUrl);
     if (req.method === "POST" && path === "/checkout-sessions") {
       return withIdempotency2(req, body, path, caller, async () => {
-        const priced = await priceLines(parsed.line_items ?? []);
+        const priced = await priceLines(
+          parsed.line_items ?? [],
+          pricingContextFrom(req.headers)
+        );
         const webhookUrl = ctx.plat.ucp.capabilities?.[UCP_ORDER_CAPABILITY]?.[0]?.config?.webhook_url;
         const s2 = {
           id: `chk_${randomUUID2().replace(/-/g, "")}`,
@@ -13032,7 +13268,8 @@ function createUcpCheckoutKit(opts) {
           ...typeof webhookUrl === "string" && /^https:\/\//.test(webhookUrl) && { _webhookUrl: webhookUrl },
           ...req.headers.get("x-astra-checkout-session") && {
             _astraCheckoutSessionId: req.headers.get("x-astra-checkout-session").slice(0, 64)
-          }
+          },
+          ...priced.issuerProgram && { _issuerProgram: priced.issuerProgram }
         };
         if (!priced.lines.length) {
           return json2(
@@ -13077,8 +13314,13 @@ function createUcpCheckoutKit(opts) {
         if (inFlight(s.status)) return busy(s);
         if (s.status === "requires_escalation") return heldNoEdit(s);
         if (parsed.line_items) {
-          const priced = await priceLines(parsed.line_items);
+          const priced = await priceLines(
+            parsed.line_items,
+            pricingContextFrom(req.headers)
+          );
           s.line_items = priced.lines;
+          if (priced.issuerProgram) s._issuerProgram = priced.issuerProgram;
+          else delete s._issuerProgram;
           s.totals = priced.totals;
           s.messages = priced.messages;
           s.status = priced.lines.length && !priced.messages.length ? "ready_for_complete" : "incomplete";
@@ -13735,6 +13977,7 @@ function heldBody2(text) {
   }
 }
 function createAcpCheckoutKit(opts) {
+  opts.agentCommerce?.report({ protocols: ["acp"] });
   const mem = /* @__PURE__ */ new Map();
   const store = opts.store ?? {
     get: async (id) => mem.get(id) ?? null,
@@ -13787,9 +14030,10 @@ function createAcpCheckoutKit(opts) {
       ...s.order && { order: s.order }
     };
   }
-  async function price(items) {
+  async function price(items, pricing = { verified: false }) {
     const lines = [];
     const messages = [];
+    let issuerProgram;
     for (const [i, it] of items.entries()) {
       const q = Math.max(1, Math.floor(it.quantity ?? 1));
       const found = it.id ? await opts.catalog(it.id, q) : null;
@@ -13804,6 +14048,21 @@ function createAcpCheckoutKit(opts) {
         });
         continue;
       }
+      if (opts.agentCommerce) {
+        if (!opts.agentCommerce.visible(c.id, pricing)) {
+          messages.push({
+            type: "error",
+            code: "not_found",
+            content: `Item ${c.id} not found.`,
+            resolution: "recoverable",
+            param: `$.line_items[${i}]`
+          });
+          continue;
+        }
+        const priced = opts.agentCommerce.price(c.id, c.price, pricing);
+        c.price = priced.priceMinor;
+        if (priced.issuerProgram) issuerProgram = priced.issuerProgram;
+      }
       const amount = c.price * q;
       lines.push({
         id: `li_${i + 1}`,
@@ -13827,6 +14086,7 @@ function createAcpCheckoutKit(opts) {
     return {
       lines,
       messages,
+      issuerProgram,
       totals: [
         { type: "subtotal", amount: sum },
         { type: "total", amount: sum }
@@ -13978,7 +14238,11 @@ function createAcpCheckoutKit(opts) {
         attemptId,
         valueMajor: total2(s) / 100,
         agentArtifacts,
-        metadata: { kitSessionId: s.id, protocol: "acp" }
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "acp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        }
       });
       if (isHeld(result)) {
         s.status = "pending_approval";
@@ -14115,7 +14379,11 @@ function createAcpCheckoutKit(opts) {
         astraId: s._astraId,
         attemptId: s._attemptId,
         valueMajor: total2(s) / 100,
-        metadata: { kitSessionId: s.id, protocol: "acp" },
+        metadata: {
+          kitSessionId: s.id,
+          protocol: "acp",
+          ...s._issuerProgram && { issuerProgram: s._issuerProgram }
+        },
         resumed: { ...s._approvalId && { approvalId: s._approvalId } }
       });
       if (isHeld(result)) {
@@ -14233,7 +14501,7 @@ function createAcpCheckoutKit(opts) {
         const items = parsed.line_items ?? parsed.items;
         if (!items?.length)
           return apiError(400, "missing", "line_items is required.", "$.line_items");
-        const p = await price(items);
+        const p = await price(items, pricingContextFrom(req.headers));
         const s2 = {
           id: `cs_${randomUUID3().replace(/-/g, "")}`,
           status: p.lines.length && !p.messages.length ? "ready_for_payment" : "not_ready_for_payment",
@@ -14244,7 +14512,8 @@ function createAcpCheckoutKit(opts) {
           _caller: caller,
           ...req.headers.get("x-astra-checkout-session") && {
             _astraCheckoutSessionId: req.headers.get("x-astra-checkout-session").slice(0, 64)
-          }
+          },
+          ...p.issuerProgram && { _issuerProgram: p.issuerProgram }
         };
         if (s2.status === "ready_for_payment") {
           const v = await validate(s2);
@@ -14273,7 +14542,9 @@ function createAcpCheckoutKit(opts) {
           );
         const items = parsed.line_items ?? parsed.items;
         if (items) {
-          const p = await price(items);
+          const p = await price(items, pricingContextFrom(req.headers));
+          if (p.issuerProgram) s._issuerProgram = p.issuerProgram;
+          else delete s._issuerProgram;
           Object.assign(s, {
             line_items: p.lines,
             totals: p.totals,
@@ -14423,6 +14694,7 @@ export {
   DECLARED_SOURCE_MAX,
   DEFAULT_EDGE_CONFIG,
   DEFAULT_IDEMPOTENCY_TTL_MS,
+  ISSUER_PROGRAM_HEADER,
   KYDRequiredError,
   MAX_HEADERS,
   MAX_HEADER_VALUE_BYTES,
@@ -14481,6 +14753,7 @@ export {
   closedPaymentMandate,
   contentDigest,
   createAcpCheckoutKit,
+  createAgentCommerce,
   createKbHop,
   createMcpMiddleware,
   createUcpCheckoutKit,
@@ -14502,6 +14775,7 @@ export {
   fetchRoutes,
   fetchUcpProfile,
   finishIdempotent,
+  fromFeed,
   getCachedWellKnownUrls,
   getEdgeConfig,
   getTrustLevel,
@@ -14517,6 +14791,7 @@ export {
   isVerificationUnavailable,
   isVerifiedHopValidFor,
   issueDelegateSdJwt,
+  issuerOfferPrice,
   matchEdgePathRule,
   matchPlatformSignature,
   matchRoutePattern,
@@ -14527,6 +14802,7 @@ export {
   onVerificationResult,
   openCheckoutMandate,
   openPaymentMandate,
+  parseFeed,
   parseYaml as parseLocalPolicyYaml,
   parseMppCredential,
   parseUcpAgentHeader,
@@ -14535,6 +14811,7 @@ export {
   parseX402Payment,
   pollStepUpStatus,
   prefetchWellKnown,
+  priceForAgent,
   quickVerify,
   recordDecision2 as recordDecision,
   reportAttempt,
@@ -14548,6 +14825,7 @@ export {
   sdkFetch,
   sendUcpWebhook,
   serializeVerifiedHop,
+  serveAgentCatalog,
   setMcpMeta,
   signHttpRequest,
   signRootMandate,