@astrasyncai/verification-gateway 5.4.2 → 5.5.0

package/dist/{types-Bd2O3eX1.d.mts → types-C-hPsi9M.d.mts}

@@ -425,11 +425,48 @@ interface VerificationResult {
      * instrument on file (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.5.0 (astra-pay): interim merchant self-settlement token. Present ONLY
+     * for firstParty merchants opted into settlement_mode='self_settle' on the
+     * confirm leg — YOUR server charges with this material on the shared Stripe
+     * account and reports the outcome via `client.reportSettlement()`.
+     * MERCHANT-ONLY lane: never expose it to the agent plane, never log it,
+     * never echo it back over the bridge handoff (the bridge strips it
+     * defensively). Charge with idempotency key `voucher:<jti>` and
+     * `metadata.jti` — that lets the platform webhook auto-reconcile even if
+     * your report never arrives.
+     */
+    settlementToken?: MerchantSettlementToken;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.5.0 (astra-pay): agent-blind settlement token for self-settling
+ * first-party merchants. Self-describing via `type`, so a Stripe Shared
+ * Payment Token can replace the raw customer/payment-method pair without a
+ * contract change.
+ */
+interface MerchantSettlementToken {
+    type: 'stripe_delegated_charge';
+    stripeCustomerId: string;
+    stripePaymentMethodId: string;
+    /** Integer minor units — money is never a float on the wire. */
+    amountMinor: number;
+    /** Upper-case ISO-4217. */
+    currency: string;
+    /** Verification session id — the report-back key. */
+    sessionId: string | null;
+    /** The pending kya_shop_order row your report resolves. */
+    orderId: string;
+    /** Settlement spine: charge with Stripe idempotency key `voucher:<jti>`
+     * and set `metadata.jti` on the PaymentIntent. */
+    jti: string;
+    statementSuffix: string | null;
+    /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
+    expiresAt: string;
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -440,9 +477,16 @@ interface VerificationResult {
  * approves, the platform re-drives the confirm with the SAME
  * checkoutSessionId and that re-drive carries the settling outcome
  * (one order row per session — the re-drive claims the same row).
+ *
+ * 5.5.0: OPEN union — the platform may introduce statuses (e.g.
+ * `pending_merchant` for self-settling merchants) ahead of your SDK version.
+ * Rule: treat any status you don't recognize as PENDING, never as failed.
+ * Also 5.5.0: `no_instrument` on a held/approved session is NON-terminal —
+ * the human's approval is NOT consumed; a re-drive with the same
+ * checkoutSessionId settles once a card is on file.
  */
 interface SettlementOutcomeInfo {
-    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval';
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval' | 'pending_merchant' | (string & {});
     /** First-party order id — the buyer sees the purchase in their AstraSync
      * dashboard orders view (no public receipt page). */
     orderId?: string;

package/dist/{types-DMChboN_.d.ts → types-CKouL1Tv.d.ts}

@@ -425,11 +425,48 @@ interface VerificationResult {
      * instrument on file (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.5.0 (astra-pay): interim merchant self-settlement token. Present ONLY
+     * for firstParty merchants opted into settlement_mode='self_settle' on the
+     * confirm leg — YOUR server charges with this material on the shared Stripe
+     * account and reports the outcome via `client.reportSettlement()`.
+     * MERCHANT-ONLY lane: never expose it to the agent plane, never log it,
+     * never echo it back over the bridge handoff (the bridge strips it
+     * defensively). Charge with idempotency key `voucher:<jti>` and
+     * `metadata.jti` — that lets the platform webhook auto-reconcile even if
+     * your report never arrives.
+     */
+    settlementToken?: MerchantSettlementToken;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.5.0 (astra-pay): agent-blind settlement token for self-settling
+ * first-party merchants. Self-describing via `type`, so a Stripe Shared
+ * Payment Token can replace the raw customer/payment-method pair without a
+ * contract change.
+ */
+interface MerchantSettlementToken {
+    type: 'stripe_delegated_charge';
+    stripeCustomerId: string;
+    stripePaymentMethodId: string;
+    /** Integer minor units — money is never a float on the wire. */
+    amountMinor: number;
+    /** Upper-case ISO-4217. */
+    currency: string;
+    /** Verification session id — the report-back key. */
+    sessionId: string | null;
+    /** The pending kya_shop_order row your report resolves. */
+    orderId: string;
+    /** Settlement spine: charge with Stripe idempotency key `voucher:<jti>`
+     * and set `metadata.jti` on the PaymentIntent. */
+    jti: string;
+    statementSuffix: string | null;
+    /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
+    expiresAt: string;
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -440,9 +477,16 @@ interface VerificationResult {
  * approves, the platform re-drives the confirm with the SAME
  * checkoutSessionId and that re-drive carries the settling outcome
  * (one order row per session — the re-drive claims the same row).
+ *
+ * 5.5.0: OPEN union — the platform may introduce statuses (e.g.
+ * `pending_merchant` for self-settling merchants) ahead of your SDK version.
+ * Rule: treat any status you don't recognize as PENDING, never as failed.
+ * Also 5.5.0: `no_instrument` on a held/approved session is NON-terminal —
+ * the human's approval is NOT consumed; a re-drive with the same
+ * checkoutSessionId settles once a card is on file.
  */
 interface SettlementOutcomeInfo {
-    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval';
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval' | 'pending_merchant' | (string & {});
     /** First-party order id — the buyer sees the purchase in their AstraSync
      * dashboard orders view (no public receipt page). */
     orderId?: string;

package/dist/{types-BU04qAAR.d.mts → types-D8DDG-qK.d.mts}

@@ -475,11 +475,48 @@ interface VerificationResult {
      * instrument on file (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.5.0 (astra-pay): interim merchant self-settlement token. Present ONLY
+     * for firstParty merchants opted into settlement_mode='self_settle' on the
+     * confirm leg — YOUR server charges with this material on the shared Stripe
+     * account and reports the outcome via `client.reportSettlement()`.
+     * MERCHANT-ONLY lane: never expose it to the agent plane, never log it,
+     * never echo it back over the bridge handoff (the bridge strips it
+     * defensively). Charge with idempotency key `voucher:<jti>` and
+     * `metadata.jti` — that lets the platform webhook auto-reconcile even if
+     * your report never arrives.
+     */
+    settlementToken?: MerchantSettlementToken;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.5.0 (astra-pay): agent-blind settlement token for self-settling
+ * first-party merchants. Self-describing via `type`, so a Stripe Shared
+ * Payment Token can replace the raw customer/payment-method pair without a
+ * contract change.
+ */
+interface MerchantSettlementToken {
+    type: 'stripe_delegated_charge';
+    stripeCustomerId: string;
+    stripePaymentMethodId: string;
+    /** Integer minor units — money is never a float on the wire. */
+    amountMinor: number;
+    /** Upper-case ISO-4217. */
+    currency: string;
+    /** Verification session id — the report-back key. */
+    sessionId: string | null;
+    /** The pending kya_shop_order row your report resolves. */
+    orderId: string;
+    /** Settlement spine: charge with Stripe idempotency key `voucher:<jti>`
+     * and set `metadata.jti` on the PaymentIntent. */
+    jti: string;
+    statementSuffix: string | null;
+    /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
+    expiresAt: string;
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -490,9 +527,16 @@ interface VerificationResult {
  * approves, the platform re-drives the confirm with the SAME
  * checkoutSessionId and that re-drive carries the settling outcome
  * (one order row per session — the re-drive claims the same row).
+ *
+ * 5.5.0: OPEN union — the platform may introduce statuses (e.g.
+ * `pending_merchant` for self-settling merchants) ahead of your SDK version.
+ * Rule: treat any status you don't recognize as PENDING, never as failed.
+ * Also 5.5.0: `no_instrument` on a held/approved session is NON-terminal —
+ * the human's approval is NOT consumed; a re-drive with the same
+ * checkoutSessionId settles once a card is on file.
  */
 interface SettlementOutcomeInfo {
-    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval';
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval' | 'pending_merchant' | (string & {});
     /** First-party order id — the buyer sees the purchase in their AstraSync
      * dashboard orders view (no public receipt page). */
     orderId?: string;

package/dist/{types-BU04qAAR.d.ts → types-D8DDG-qK.d.ts}

@@ -475,11 +475,48 @@ interface VerificationResult {
      * instrument on file (steer the user to add one via onboarding).
      */
     settlementOutcome?: SettlementOutcomeInfo;
+    /**
+     * 5.5.0 (astra-pay): interim merchant self-settlement token. Present ONLY
+     * for firstParty merchants opted into settlement_mode='self_settle' on the
+     * confirm leg — YOUR server charges with this material on the shared Stripe
+     * account and reports the outcome via `client.reportSettlement()`.
+     * MERCHANT-ONLY lane: never expose it to the agent plane, never log it,
+     * never echo it back over the bridge handoff (the bridge strips it
+     * defensively). Charge with idempotency key `voucher:<jti>` and
+     * `metadata.jti` — that lets the platform webhook auto-reconcile even if
+     * your report never arrives.
+     */
+    settlementToken?: MerchantSettlementToken;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
     cacheTtl?: number;
 }
+/**
+ * 5.5.0 (astra-pay): agent-blind settlement token for self-settling
+ * first-party merchants. Self-describing via `type`, so a Stripe Shared
+ * Payment Token can replace the raw customer/payment-method pair without a
+ * contract change.
+ */
+interface MerchantSettlementToken {
+    type: 'stripe_delegated_charge';
+    stripeCustomerId: string;
+    stripePaymentMethodId: string;
+    /** Integer minor units — money is never a float on the wire. */
+    amountMinor: number;
+    /** Upper-case ISO-4217. */
+    currency: string;
+    /** Verification session id — the report-back key. */
+    sessionId: string | null;
+    /** The pending kya_shop_order row your report resolves. */
+    orderId: string;
+    /** Settlement spine: charge with Stripe idempotency key `voucher:<jti>`
+     * and set `metadata.jti` on the PaymentIntent. */
+    jti: string;
+    statementSuffix: string | null;
+    /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
+    expiresAt: string;
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -490,9 +527,16 @@ interface VerificationResult {
  * approves, the platform re-drives the confirm with the SAME
  * checkoutSessionId and that re-drive carries the settling outcome
  * (one order row per session — the re-drive claims the same row).
+ *
+ * 5.5.0: OPEN union — the platform may introduce statuses (e.g.
+ * `pending_merchant` for self-settling merchants) ahead of your SDK version.
+ * Rule: treat any status you don't recognize as PENDING, never as failed.
+ * Also 5.5.0: `no_instrument` on a held/approved session is NON-terminal —
+ * the human's approval is NOT consumed; a re-drive with the same
+ * checkoutSessionId settles once a card is on file.
  */
 interface SettlementOutcomeInfo {
-    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval';
+    status: 'settled' | 'failed' | 'requires_action' | 'no_instrument' | 'requires_approval' | 'pending_merchant' | (string & {});
     /** First-party order id — the buyer sees the purchase in their AstraSync
      * dashboard orders view (no public receipt page). */
     orderId?: string;

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BU04qAAR.mjs';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-D8DDG-qK.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BU04qAAR.js';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-D8DDG-qK.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-Bd2O3eX1.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-C-hPsi9M.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-DMChboN_.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-CKouL1Tv.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -36,7 +36,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.4.1";
+var SDK_VERSION = "5.5.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -530,7 +530,10 @@ async function verify(config, request, options) {
       recommendationReasons: apiResponse.recommendationReasons,
       stepUpApproval: apiResponse.stepUpApproval,
       settlement: apiResponse.settlement,
-      settlementOutcome: apiResponse.settlementOutcome
+      settlementOutcome: apiResponse.settlementOutcome,
+      // 5.5.0 self-settlement: merchant-only material — passes through to the
+      // MERCHANT caller only (bridge callers strip it before the agent plane).
+      settlementToken: apiResponse.settlementToken
     };
     return result2;
   }
@@ -588,7 +591,8 @@ async function verify(config, request, options) {
     warningHeader: apiResponse.warningHeader,
     stepUpApproval: apiResponse.stepUpApproval,
     settlement: apiResponse.settlement,
-    settlementOutcome: apiResponse.settlementOutcome
+    settlementOutcome: apiResponse.settlementOutcome,
+    settlementToken: apiResponse.settlementToken
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;