@astrasyncai/verification-gateway 5.3.0 → 5.4.0

package/dist/git-trigger/git-hooks.d.mts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.mjs';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-1urxLCZv.mjs';
-import '../types-eSqHyFFH.mjs';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-z_RNjHWm.mjs';
+import '../types-CD1F9fmp.mjs';
 import '../metadata-capture.mjs';
 
 /**

package/dist/git-trigger/git-hooks.d.ts

@@ -1,6 +1,6 @@
 import { AstraSyncGateway } from '../gateway/gateway.js';
-import { V as VerificationDecision, P as PDLSSContext } from '../types-C1s1z0VD.js';
-import '../types-CA1ZhoaJ.js';
+import { V as VerificationDecision, P as PDLSSContext } from '../types-DGh2akuh.js';
+import '../types-76TB0fxW.js';
 import '../metadata-capture.js';
 
 /**

package/dist/{index-D6HQmsVV.d.mts → index-BVJkTyIF.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-eSqHyFFH.mjs';
+import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-CD1F9fmp.mjs';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-zD5AaJsO.d.mts → index-By021oSN.d.mts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-eSqHyFFH.mjs';
+import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CD1F9fmp.mjs';
 import { JWK } from 'jose';
 
 /**

package/dist/{index-CdF7L5E0.d.ts → index-DaMXZabg.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-CA1ZhoaJ.js';
+import { b as AstraSyncCredentials, l as ProtocolTransport, G as GatewayConfig } from './types-76TB0fxW.js';
 
 /**
  * AgentClient — Credential Presentation

package/dist/{index-BnrhTsp7.d.ts → index-iJ9_DdLk.d.ts}

@@ -1,4 +1,4 @@
-import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-CA1ZhoaJ.js';
+import { b as AstraSyncCredentials, l as ProtocolTransport } from './types-76TB0fxW.js';
 import { JWK } from 'jose';
 
 /**

package/dist/index.d.mts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-eSqHyFFH.mjs';
-export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-eSqHyFFH.mjs';
-export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-DbY7-3PJ.mjs';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CD1F9fmp.mjs';
+export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as SettlementOutcomeInfo, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-CD1F9fmp.mjs';
+export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-C6_-6D-9.mjs';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.mjs';
-export { e as express } from './express-PLYlCd5k.mjs';
-export { n as nextjs } from './nextjs-w60J62Wj.mjs';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-zD5AaJsO.mjs';
-export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-DDcGHRjo.mjs';
+export { e as express } from './express-BIAT2pe0.mjs';
+export { n as nextjs } from './nextjs-DGJXzWst.mjs';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-By021oSN.mjs';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-BqfTDZLh.mjs';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.mjs';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-D6HQmsVV.mjs';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-BVJkTyIF.mjs';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.mjs';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.mjs';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.mjs';
@@ -177,7 +177,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.3.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.4.0";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -198,6 +198,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.3.0";
+declare const SDK_VERSION = "5.4.0";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { G as GatewayConfig, r as StepUpApprovalInfo, t as StepUpOutcome, s as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-CA1ZhoaJ.js';
-export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as StablecoinSettlementBinding, T as TokenGuidance, u as TrustLevel, V as VerificationInterstitialProps, v as VerificationRequest, w as VerificationResult, x as VerifiedAgent, y as VerifiedDeveloper, z as VerifiedOrganization } from './types-CA1ZhoaJ.js';
-export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-uzuKDTRU.js';
+import { G as GatewayConfig, s as StepUpApprovalInfo, u as StepUpOutcome, t as StepUpApprovalStatus, E as EnhancedVerificationResult, A as AccessFailure } from './types-76TB0fxW.js';
+export { a as AgentCredentials, b as AstraSyncCredentials, c as AttemptOutcome, d as AttemptReport, C as CallerMetadata, e as CommerceArtifactsPayload, f as CommerceShieldProps, g as ConsiderationItem, h as ConsiderationSet, i as CounterpartyType, j as ExpressMiddlewareOptions, F as FiatSettlementBinding, k as GuidanceInfo, N as NextJsMiddlewareOptions, P as PDLSSInfo, l as ProtocolTransport, R as RouteAccessConfig, m as RuntimeChallengeResult, S as SDKOptions, n as SettlementArtifact, o as SettlementArtifactBinding, p as SettlementArtifactBindingBase, q as SettlementOutcomeInfo, r as StablecoinSettlementBinding, T as TokenGuidance, v as TrustLevel, V as VerificationInterstitialProps, w as VerificationRequest, x as VerificationResult, y as VerifiedAgent, z as VerifiedDeveloper, B as VerifiedOrganization } from './types-76TB0fxW.js';
+export { T as TRUST_LEVEL_RANGES, g as getTrustLevel, s as sdk } from './sdk-C1IOA5LE.js';
 export { VerifyOptions, clearCache, extractCredentials, fetchRoutes, hasCredentials, quickVerify, reportAttempt, reportUnregisteredAttempt, verify } from './verify.js';
-export { e as express } from './express-DHEz_6Rh.js';
-export { n as nextjs } from './nextjs-CX9X9okw.js';
-export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-BnrhTsp7.js';
-export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-BuKgYZsC.js';
+export { e as express } from './express-D3Tf-b23.js';
+export { n as nextjs } from './nextjs-xM-jdNrX.js';
+export { aR as extractMcpCredentials, bg as setMcpMeta, b1 as transport } from './index-iJ9_DdLk.js';
+export { M as MCP_VERIFIED_HOP_HEADER, a as MCP_VERIFIED_HOP_MAX_AGE_MS, b as McpMiddlewareOptions, T as ToolGate, c as ToolGateConfig, V as VerifiedHopMarker, d as createMcpMiddleware, i as isVerifiedHopValidFor, f as parseVerifiedHop, s as serializeVerifiedHop } from './mcp-OrVOrH-s.js';
 export { AgentProtocol, AgentRecord, AstraSync, AstraSyncConfig, AstraSyncError, AuthenticationError, BuildGuidanceParams, FrameworkConfig, GuidanceEnvelope, HealthResponse, KYDRequiredError, ModelConfig, PDLSSConfig, PDLSSDuration, PDLSSLimits, PDLSSPurpose, PDLSSScope, PDLSSSelfInstantiation, PendingRegistrationResponse, PollRegistrationResult, RegisterOptions, RegisterResult, RegistrationDeniedError, RegistrationExpiredError, RegistrationResponse, RegistrationTimeoutError, VerifyResponse, WaitForApprovalOptions, buildGuidance } from './registration/index.js';
-export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-CdF7L5E0.js';
+export { A as AgentClient, C as ChallengeHandler, i as agent, r as recordDecision } from './index-DaMXZabg.js';
 export { DEFAULT_EDGE_CONFIG, EdgeConfig, EdgeMode, EdgePathRule, EdgeVerificationDepth, FetchEdgeConfigResult, FetchEdgeConfigSuccess, _resetEdgeConfigCache, degradeToObserve, fetchEdgeConfig, getEdgeConfig, isEdgeConfig, matchEdgePathRule } from './edge-config.js';
 export { DynamicPlatformFingerprint, PLATFORM_AGENT_SIGNATURES, PlatformAgentVendor, PlatformDetectionInput, PlatformFingerprint, PlatformSignatureDef, detectPlatformFingerprint, matchPlatformSignature } from './platform-signatures.js';
 export { CAPTURE_SCHEMA_VERSION, MAX_HEADERS, MAX_HEADER_VALUE_BYTES, MAX_TOTAL_BYTES, ObservedMetadata, SanitizeHeadersResult, buildSdkObservedMetadata, deriveConnectionFromHeaders, extractApiKeyFormat, extractPlatformHeaders, sanitizeHeaders } from './metadata-capture.js';
@@ -177,7 +177,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.3.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.4.0";
 declare const sdkFetch: typeof fetch;
 
 /**
@@ -198,6 +198,6 @@ declare const sdkFetch: typeof fetch;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.3.0";
+declare const SDK_VERSION = "5.4.0";
 
 export { EnhancedVerificationResult, GatewayConfig, RUNTIME_SIGNATURES, type RuntimeSignature, SDK_USER_AGENT, type SettlementDecision, type SettlementRequest, StepUpApprovalInfo, StepUpApprovalStatus, StepUpOutcome, SDK_VERSION as VERSION, type WellKnownAgenticCommerce, authorizeSettlement, awaitStepUpApproval, detectRuntime, getCachedWellKnownUrls, getWellKnownUrls, pollStepUpStatus, prefetchWellKnown, sdkFetch };

package/dist/index.js

@@ -112,7 +112,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.3.0";
+var SDK_VERSION = "5.4.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -2707,6 +2707,45 @@ var VerificationGatewayClient = class {
       })
     );
   }
+  /**
+   * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
+   * first-party charge-at-redeem (server-side settlement on the owner's saved
+   * instrument). This is the supported public surface for the confirm leg;
+   * `verify()` deliberately does not expose the checkout fields, so settlement
+   * can never fire by accident from a generic verify.
+   *
+   * Sends `commercePhase: 'confirm'` plus the checkout session id (per-cart
+   * idempotency) and line items (order/receipt plane), and identifies the
+   * merchant via `counterpartyUrl`/`counterpartyType` (required — the backend
+   * only settles a merchant-mediated grant against a first-party storefront).
+   * `purpose`/`action` default to the canonical shopping pair.
+   *
+   * Returns the full `VerificationResult`: read `.settlementOutcome` for the
+   * settled/failed/requires_action/no_instrument outcome (+ `orderId`), and the
+   * identity/policy/`failures` fields for a denial. On any non-`confirm`/first-
+   * party path `settlementOutcome` is simply absent — no money moves.
+   */
+  async confirmCheckout(options) {
+    const credentials = {
+      astraId: options.astraId,
+      apiKey: options.apiKey,
+      jwt: options.jwt
+    };
+    return this.executeWithRetry(
+      () => verify(this.config, {
+        credentials,
+        purpose: options.purpose ?? "shopping",
+        action: options.action ?? "shopping.purchase",
+        transactionValue: options.transactionValue,
+        currency: options.currency,
+        commercePhase: "confirm",
+        checkoutSessionId: options.checkoutSessionId,
+        checkoutItems: options.checkoutItems,
+        counterpartyUrl: options.counterpartyUrl,
+        counterpartyType: options.counterpartyType
+      })
+    );
+  }
   /**
    * Quick verification — checks credentials and policy in one call.
    *