@astrasyncai/verification-gateway 5.3.0 → 5.4.1

package/dist/index.js

@@ -112,7 +112,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.3.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -293,7 +293,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -2675,7 +2682,13 @@ var VerificationGatewayClient = class {
       debug: options.debug,
       customHeaders: options.customHeaders,
       counterpartyUrl: options.counterpartyUrl,
-      counterpartyType: options.counterpartyType
+      counterpartyType: options.counterpartyType,
+      // 5.4.1 (UAT2): previously dropped here despite being a typed, documented
+      // GatewayConfig field — a client-driven confirmCheckout() could never
+      // identify its endpoint by ASTRAE id, so merchants with multiple
+      // endpoints on one origin (or a stale row sharing the URL) resolved
+      // non-deterministically by URL and could miss the first-party gate.
+      counterpartyId: options.counterpartyId
     };
     this.timeout = options.timeout || 1e4;
     this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1e3 };
@@ -2707,6 +2720,52 @@ var VerificationGatewayClient = class {
       })
     );
   }
+  /**
+   * 5.4.0 (astra-pay): confirm-leg of a checkout — the ONLY call that may fire
+   * first-party charge-at-redeem (server-side settlement on the owner's saved
+   * instrument). This is the supported public surface for the confirm leg;
+   * `verify()` deliberately does not expose the checkout fields, so settlement
+   * can never fire by accident from a generic verify.
+   *
+   * Sends `commercePhase: 'confirm'` plus the checkout session id (per-cart
+   * idempotency) and line items (order/receipt plane), and identifies the
+   * merchant via `counterpartyUrl`/`counterpartyType` (required — the backend
+   * only settles a merchant-mediated grant against a first-party storefront).
+   * `purpose`/`action` default to the canonical shopping pair.
+   *
+   * Returns the full `VerificationResult`: read `.settlementOutcome` for the
+   * settled/failed/requires_action/no_instrument outcome (+ `orderId`), and the
+   * identity/policy/`failures` fields for a denial. On any non-`confirm`/first-
+   * party path `settlementOutcome` is simply absent — no money moves.
+   */
+  async confirmCheckout(options) {
+    const credentials = {
+      astraId: options.astraId,
+      apiKey: options.apiKey,
+      jwt: options.jwt
+    };
+    return this.executeWithRetry(
+      () => verify(
+        this.config,
+        {
+          credentials,
+          purpose: options.purpose ?? "shopping",
+          action: options.action ?? "shopping.purchase",
+          transactionValue: options.transactionValue,
+          currency: options.currency,
+          commercePhase: "confirm",
+          checkoutSessionId: options.checkoutSessionId,
+          checkoutItems: options.checkoutItems,
+          counterpartyUrl: options.counterpartyUrl,
+          counterpartyType: options.counterpartyType
+        },
+        // 5.4.1 (UAT2 Bug B): the confirm leg must always reach the backend —
+        // a cached quote-leg grant carries no settlementOutcome and would
+        // silently skip settlement.
+        { bypassCache: true }
+      )
+    );
+  }
   /**
    * Quick verification — checks credentials and policy in one call.
    *