@astrasyncai/verification-gateway 5.5.0 → 5.6.0

package/dist/{types-C-hPsi9M.d.mts → types-BCmHFdkJ.d.mts}

@@ -437,6 +437,18 @@ interface VerificationResult {
      * your report never arrives.
      */
     settlementToken?: MerchantSettlementToken;
+    /**
+     * 5.6.0 (astra-pay): fulfilment contact for first-party confirm legs.
+     * The platform always resolves an email for the merchant — the agent's
+     * `buyerEmail` when one was supplied, else the buyer's account email
+     * (`emailSource` says which). Present on every first-party confirm leg that
+     * progressed (settled, pending_merchant, held, requires_action) so it can be
+     * stored with a pending order; only FULFIL against it once the order is
+     * settled / pending_merchant. MERCHANT-ONLY lane like `settlementToken` —
+     * the bridge strips it from the agent plane. An explicit `buyerEmail` on the
+     * confirm handoff body wins over `fulfilment.email` (the platform default).
+     */
+    fulfilment?: FulfilmentInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
@@ -467,6 +479,18 @@ interface MerchantSettlementToken {
     /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
     expiresAt: string;
 }
+/**
+ * 5.6.0 (astra-pay): fulfilment contact block. `emailSource` is an OPEN union
+ * (same rule as settlement statuses): treat unknown sources like
+ * 'agent_provided' — the email is still the one to use.
+ */
+interface FulfilmentInfo {
+    /** Canonicalized (trimmed, lower-cased) receipt/delivery email. */
+    email: string;
+    /** 'agent_provided' = the agent passed buyerEmail on this confirm;
+     * 'account' = platform default — the buyer's account email. */
+    emailSource: 'agent_provided' | 'account' | (string & {});
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -576,6 +600,15 @@ interface VerificationRequest {
             currency: string;
         };
     }>;
+    /**
+     * 5.6.0 (astra-pay): buyer's receipt/delivery email, forwarded on the
+     * confirm leg only. TRANSIT-ONLY fulfilment PII — the platform echoes it
+     * back (canonicalized) in `VerificationResult.fulfilment` for first-party
+     * merchants and never persists it. When omitted, the platform defaults
+     * `fulfilment.email` to the buyer's account email, so supplying this is
+     * only needed for an alternate contact (gift delivery etc.).
+     */
+    buyerEmail?: string;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/{types-D8DDG-qK.d.mts → types-BK_pRNSs.d.mts}

@@ -487,6 +487,18 @@ interface VerificationResult {
      * your report never arrives.
      */
     settlementToken?: MerchantSettlementToken;
+    /**
+     * 5.6.0 (astra-pay): fulfilment contact for first-party confirm legs.
+     * The platform always resolves an email for the merchant — the agent's
+     * `buyerEmail` when one was supplied, else the buyer's account email
+     * (`emailSource` says which). Present on every first-party confirm leg that
+     * progressed (settled, pending_merchant, held, requires_action) so it can be
+     * stored with a pending order; only FULFIL against it once the order is
+     * settled / pending_merchant. MERCHANT-ONLY lane like `settlementToken` —
+     * the bridge strips it from the agent plane. An explicit `buyerEmail` on the
+     * confirm handoff body wins over `fulfilment.email` (the platform default).
+     */
+    fulfilment?: FulfilmentInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
@@ -517,6 +529,18 @@ interface MerchantSettlementToken {
     /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
     expiresAt: string;
 }
+/**
+ * 5.6.0 (astra-pay): fulfilment contact block. `emailSource` is an OPEN union
+ * (same rule as settlement statuses): treat unknown sources like
+ * 'agent_provided' — the email is still the one to use.
+ */
+interface FulfilmentInfo {
+    /** Canonicalized (trimmed, lower-cased) receipt/delivery email. */
+    email: string;
+    /** 'agent_provided' = the agent passed buyerEmail on this confirm;
+     * 'account' = platform default — the buyer's account email. */
+    emailSource: 'agent_provided' | 'account' | (string & {});
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -626,6 +650,15 @@ interface VerificationRequest {
             currency: string;
         };
     }>;
+    /**
+     * 5.6.0 (astra-pay): buyer's receipt/delivery email, forwarded on the
+     * confirm leg only. TRANSIT-ONLY fulfilment PII — the platform echoes it
+     * back (canonicalized) in `VerificationResult.fulfilment` for first-party
+     * merchants and never persists it. When omitted, the platform defaults
+     * `fulfilment.email` to the buyer's account email, so supplying this is
+     * only needed for an alternate contact (gift delivery etc.).
+     */
+    buyerEmail?: string;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/{types-D8DDG-qK.d.ts → types-BK_pRNSs.d.ts}

@@ -487,6 +487,18 @@ interface VerificationResult {
      * your report never arrives.
      */
     settlementToken?: MerchantSettlementToken;
+    /**
+     * 5.6.0 (astra-pay): fulfilment contact for first-party confirm legs.
+     * The platform always resolves an email for the merchant — the agent's
+     * `buyerEmail` when one was supplied, else the buyer's account email
+     * (`emailSource` says which). Present on every first-party confirm leg that
+     * progressed (settled, pending_merchant, held, requires_action) so it can be
+     * stored with a pending order; only FULFIL against it once the order is
+     * settled / pending_merchant. MERCHANT-ONLY lane like `settlementToken` —
+     * the bridge strips it from the agent plane. An explicit `buyerEmail` on the
+     * confirm handoff body wins over `fulfilment.email` (the platform default).
+     */
+    fulfilment?: FulfilmentInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
@@ -517,6 +529,18 @@ interface MerchantSettlementToken {
     /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
     expiresAt: string;
 }
+/**
+ * 5.6.0 (astra-pay): fulfilment contact block. `emailSource` is an OPEN union
+ * (same rule as settlement statuses): treat unknown sources like
+ * 'agent_provided' — the email is still the one to use.
+ */
+interface FulfilmentInfo {
+    /** Canonicalized (trimmed, lower-cased) receipt/delivery email. */
+    email: string;
+    /** 'agent_provided' = the agent passed buyerEmail on this confirm;
+     * 'account' = platform default — the buyer's account email. */
+    emailSource: 'agent_provided' | 'account' | (string & {});
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -626,6 +650,15 @@ interface VerificationRequest {
             currency: string;
         };
     }>;
+    /**
+     * 5.6.0 (astra-pay): buyer's receipt/delivery email, forwarded on the
+     * confirm leg only. TRANSIT-ONLY fulfilment PII — the platform echoes it
+     * back (canonicalized) in `VerificationResult.fulfilment` for first-party
+     * merchants and never persists it. When omitted, the platform defaults
+     * `fulfilment.email` to the buyer's account email, so supplying this is
+     * only needed for an alternate contact (gift delivery etc.).
+     */
+    buyerEmail?: string;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/{types-CKouL1Tv.d.ts → types-CwY5IY-0.d.ts}

@@ -437,6 +437,18 @@ interface VerificationResult {
      * your report never arrives.
      */
     settlementToken?: MerchantSettlementToken;
+    /**
+     * 5.6.0 (astra-pay): fulfilment contact for first-party confirm legs.
+     * The platform always resolves an email for the merchant — the agent's
+     * `buyerEmail` when one was supplied, else the buyer's account email
+     * (`emailSource` says which). Present on every first-party confirm leg that
+     * progressed (settled, pending_merchant, held, requires_action) so it can be
+     * stored with a pending order; only FULFIL against it once the order is
+     * settled / pending_merchant. MERCHANT-ONLY lane like `settlementToken` —
+     * the bridge strips it from the agent plane. An explicit `buyerEmail` on the
+     * confirm handoff body wins over `fulfilment.email` (the platform default).
+     */
+    fulfilment?: FulfilmentInfo;
     /** Timestamp of verification */
     verifiedAt: Date;
     /** TTL for this result (seconds) */
@@ -467,6 +479,18 @@ interface MerchantSettlementToken {
     /** Advisory charge-by bound (ISO); stuck orders are ops-swept after it. */
     expiresAt: string;
 }
+/**
+ * 5.6.0 (astra-pay): fulfilment contact block. `emailSource` is an OPEN union
+ * (same rule as settlement statuses): treat unknown sources like
+ * 'agent_provided' — the email is still the one to use.
+ */
+interface FulfilmentInfo {
+    /** Canonicalized (trimmed, lower-cased) receipt/delivery email. */
+    email: string;
+    /** 'agent_provided' = the agent passed buyerEmail on this confirm;
+     * 'account' = platform default — the buyer's account email. */
+    emailSource: 'agent_provided' | 'account' | (string & {});
+}
 /**
  * 5.3.0 (astra-pay): sanitized outcome of first-party charge-at-redeem
  * settlement. Carries NO voucher/instrument material — the settlement channel
@@ -576,6 +600,15 @@ interface VerificationRequest {
             currency: string;
         };
     }>;
+    /**
+     * 5.6.0 (astra-pay): buyer's receipt/delivery email, forwarded on the
+     * confirm leg only. TRANSIT-ONLY fulfilment PII — the platform echoes it
+     * back (canonicalized) in `VerificationResult.fulfilment` for first-party
+     * merchants and never persists it. When omitted, the platform defaults
+     * `fulfilment.email` to the buyer's account email, so supplying this is
+     * only needed for an alternate contact (gift delivery etc.).
+     */
+    buyerEmail?: string;
     /** Whether this is a sub-agent request */
     isSubAgentRequest?: boolean;
     /** Parent agent ID for sub-agent requests */

package/dist/ui/index.d.mts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-D8DDG-qK.mjs';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BK_pRNSs.mjs';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/ui/index.d.ts

@@ -1,4 +1,4 @@
-import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-D8DDG-qK.js';
+import { V as VerificationInterstitialProps, d as VerificationResult, A as AgentCredentials, b as GuidanceInfo, T as TrustLevel } from '../types-BK_pRNSs.js';
 
 /**
  * AstraSync Verification Interstitial Component

package/dist/verify.d.mts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-C-hPsi9M.mjs';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-BCmHFdkJ.mjs';
 import { ObservedMetadata } from './metadata-capture.mjs';
 
 /**

package/dist/verify.d.ts

@@ -1,4 +1,4 @@
-import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-CKouL1Tv.js';
+import { A as AgentCredentials, G as GatewayConfig, a as AttemptReport, V as VerificationRequest, c as VerificationResult } from './types-CwY5IY-0.js';
 import { ObservedMetadata } from './metadata-capture.js';
 
 /**

package/dist/verify.js

@@ -36,7 +36,7 @@ __export(verify_exports, {
 module.exports = __toCommonJS(verify_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.5.0";
+var SDK_VERSION = "5.6.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -358,6 +358,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
+  if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -533,7 +534,9 @@ async function verify(config, request, options) {
       settlementOutcome: apiResponse.settlementOutcome,
       // 5.5.0 self-settlement: merchant-only material — passes through to the
       // MERCHANT caller only (bridge callers strip it before the agent plane).
-      settlementToken: apiResponse.settlementToken
+      settlementToken: apiResponse.settlementToken,
+      // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+      fulfilment: apiResponse.fulfilment
     };
     return result2;
   }
@@ -592,7 +595,9 @@ async function verify(config, request, options) {
     stepUpApproval: apiResponse.stepUpApproval,
     settlement: apiResponse.settlement,
     settlementOutcome: apiResponse.settlementOutcome,
-    settlementToken: apiResponse.settlementToken
+    settlementToken: apiResponse.settlementToken,
+    // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+    fulfilment: apiResponse.fulfilment
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;