@astrasyncai/verification-gateway 5.5.0 → 5.7.0

package/dist/edge-core/index.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.5.0";
+var SDK_VERSION = "5.7.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -603,6 +603,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
+  if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -778,7 +779,9 @@ async function verify(config, request, options) {
       settlementOutcome: apiResponse.settlementOutcome,
       // 5.5.0 self-settlement: merchant-only material — passes through to the
       // MERCHANT caller only (bridge callers strip it before the agent plane).
-      settlementToken: apiResponse.settlementToken
+      settlementToken: apiResponse.settlementToken,
+      // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+      fulfilment: apiResponse.fulfilment
     };
     return result2;
   }
@@ -837,7 +840,9 @@ async function verify(config, request, options) {
     stepUpApproval: apiResponse.stepUpApproval,
     settlement: apiResponse.settlement,
     settlementOutcome: apiResponse.settlementOutcome,
-    settlementToken: apiResponse.settlementToken
+    settlementToken: apiResponse.settlementToken,
+    // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+    fulfilment: apiResponse.fulfilment
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;
@@ -1065,6 +1070,10 @@ var STATIC_EXTENSIONS = /\.(css|js|mjs|map|png|jpe?g|gif|webp|avif|svg|ico|woff2
 var SELF_UA_PATTERN = /^astrasync-sdk\//i;
 var BOT_UA_PATTERN = /curl|wget|python-requests|python-urllib|node-fetch|axios|got|okhttp|go-http-client|libwww|httpie|java\/|ruby|php|scrapy|headless|phantomjs|selenium|playwright|puppeteer|bot|crawler|spider|slurp/i;
 var BROWSER_UA_PATTERN = /mozilla\/\d/i;
+var ACCOUNT_API_KEY_PATTERN = /^kya_[A-Za-z0-9_-]+$/;
+function isAccountApiKey(value) {
+  return typeof value === "string" && ACCOUNT_API_KEY_PATTERN.test(value);
+}
 function resolvePolicy(config, path) {
   if (STATIC_EXTENSIONS.test(path)) {
     return { mode: config.mode, depth: config.depth, skip: true };
@@ -1083,6 +1092,9 @@ function classify(req, host, depth) {
     return { tier: "self" };
   }
   const credentials = extractCredentials(req.headers, {});
+  if (!credentials.astraId && (isAccountApiKey(credentials.jwt) || isAccountApiKey(credentials.apiKey))) {
+    return { tier: "self", evidence: { firstPartyApiKey: true } };
+  }
   if (credentials.astraId || credentials.apiKey || credentials.jwt) {
     return { tier: "verified", protocol: "x-astra" };
   }