@fun-xyz/fiat-contract 0.11.1 → 0.12.0

package/README.md

@@ -78,6 +78,10 @@ this package is [ENG-5268](https://linear.app/funxyz/issue/ENG-5268).
 13. **Providerless is terminal-routing-only.** `FiatStepResponse.provider` may be absent only for
     `BLOCKED`, including `ALL_PROVIDERS_DECLINED` when routing selected no provider. Every other state
     remains provider-bound and requires `provider`; provider-specific blocked responses may keep it.
+14. **Path commitment is not a quote.** A response may carry `routingSessionRef` while pricing is
+    legitimately deferred for provider auth or activation. Transitions echo that opaque reference in
+    `params`; clients submit it unchanged. `Quote.quoteRef` remains required whenever a real `Quote`
+    is present, and PAY must never be exposed without real current economics.
 
 ## KYC SDK hints, results, and client delivery
 

package/dist/{chunk-TXI4KLBL.mjs → chunk-PHLBEDMK.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.11.1";
+var version = "0.12.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -102,7 +102,13 @@ var TRANSITION_TABLE = {
     docStatus: "SPECIFIED",
     allowedTransitions: [
       { id: "start", mode: "SUBMIT", endpoint: "POST /fiat/session" },
-      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" }
+      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" },
+      {
+        id: "report_auth_result",
+        mode: "CLIENT_SURFACE",
+        endpoint: "POST /fiat/session/verify",
+        note: "Reports a provider-owned authentication surface result; the backend alone reassesses and selects the next state."
+      }
     ],
     mayReturn: [
       "SESSION_AUTH",
@@ -116,7 +122,8 @@ var TRANSITION_TABLE = {
     notes: [
       "A bad code re-enters this same state with error {category: USER_ERROR, code: BAD_CODE} \u2014 banner, not a screen change.",
       "No resend affordance is specified in either doc (known gap, FE doc Screen 2).",
-      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only."
+      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only.",
+      "A provider-owned authentication surface reports through CLIENT_SURFACE; it is not a user-entered OTP submission."
     ]
   },
   "KYC/CAPTURE": {
@@ -507,4 +514,4 @@ export {
   tableEntry,
   isTerminal
 };
-//# sourceMappingURL=chunk-TXI4KLBL.mjs.map
+//# sourceMappingURL=chunk-PHLBEDMK.mjs.map

package/dist/index.js

@@ -874,19 +874,21 @@ var $providerBoundStepResponse = obj({
   state: $providerBoundFlowState,
   provider: $provider,
   transitions: import_zod.z.array($transition),
+  routingSessionRef: import_zod.z.string().optional(),
   orderId: import_zod.z.string().optional()
 });
 var $blockedStepResponse = obj({
   state: $blockedState,
   provider: $provider.optional(),
   transitions: import_zod.z.array($transition),
+  routingSessionRef: import_zod.z.string().optional(),
   orderId: import_zod.z.string().optional()
 });
 var $stepResponse = import_zod.z.union([$providerBoundStepResponse, $blockedStepResponse]);
 var FiatStepResponseSchema = $stepResponse;
 
 // package.json
-var version = "0.11.1";
+var version = "0.12.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -989,7 +991,13 @@ var TRANSITION_TABLE = {
     docStatus: "SPECIFIED",
     allowedTransitions: [
       { id: "start", mode: "SUBMIT", endpoint: "POST /fiat/session" },
-      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" }
+      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" },
+      {
+        id: "report_auth_result",
+        mode: "CLIENT_SURFACE",
+        endpoint: "POST /fiat/session/verify",
+        note: "Reports a provider-owned authentication surface result; the backend alone reassesses and selects the next state."
+      }
     ],
     mayReturn: [
       "SESSION_AUTH",
@@ -1003,7 +1011,8 @@ var TRANSITION_TABLE = {
     notes: [
       "A bad code re-enters this same state with error {category: USER_ERROR, code: BAD_CODE} \u2014 banner, not a screen change.",
       "No resend affordance is specified in either doc (known gap, FE doc Screen 2).",
-      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only."
+      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only.",
+      "A provider-owned authentication surface reports through CLIENT_SURFACE; it is not a user-entered OTP submission."
     ]
   },
   "KYC/CAPTURE": {

package/dist/index.mjs

@@ -12,7 +12,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-TXI4KLBL.mjs";
+} from "./chunk-PHLBEDMK.mjs";
 
 // src/codes.ts
 var COUNTRY_CURRENCY_LIST = [
@@ -773,12 +773,14 @@ var $providerBoundStepResponse = obj({
   state: $providerBoundFlowState,
   provider: $provider,
   transitions: z.array($transition),
+  routingSessionRef: z.string().optional(),
   orderId: z.string().optional()
 });
 var $blockedStepResponse = obj({
   state: $blockedState,
   provider: $provider.optional(),
   transitions: z.array($transition),
+  routingSessionRef: z.string().optional(),
   orderId: z.string().optional()
 });
 var $stepResponse = z.union([$providerBoundStepResponse, $blockedStepResponse]);

package/dist/table.js

@@ -36,7 +36,7 @@ __export(table_exports, {
 module.exports = __toCommonJS(table_exports);
 
 // package.json
-var version = "0.11.1";
+var version = "0.12.0";
 
 // src/table.ts
 var TABLE_VERSION = version;
@@ -139,7 +139,13 @@ var TRANSITION_TABLE = {
     docStatus: "SPECIFIED",
     allowedTransitions: [
       { id: "start", mode: "SUBMIT", endpoint: "POST /fiat/session" },
-      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" }
+      { id: "verify", mode: "SUBMIT", endpoint: "POST /fiat/session/verify" },
+      {
+        id: "report_auth_result",
+        mode: "CLIENT_SURFACE",
+        endpoint: "POST /fiat/session/verify",
+        note: "Reports a provider-owned authentication surface result; the backend alone reassesses and selects the next state."
+      }
     ],
     mayReturn: [
       "SESSION_AUTH",
@@ -153,7 +159,8 @@ var TRANSITION_TABLE = {
     notes: [
       "A bad code re-enters this same state with error {category: USER_ERROR, code: BAD_CODE} \u2014 banner, not a screen change.",
       "No resend affordance is specified in either doc (known gap, FE doc Screen 2).",
-      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only."
+      "A provider-owned surface may declare client-executed delivery from allowlisted CURRENT_SESSION_INPUTS only.",
+      "A provider-owned authentication surface reports through CLIENT_SURFACE; it is not a user-entered OTP submission."
     ]
   },
   "KYC/CAPTURE": {

package/dist/table.mjs

@@ -11,7 +11,7 @@ import {
   tableEntry,
   unofferedEndpoints,
   unreachableStates
-} from "./chunk-TXI4KLBL.mjs";
+} from "./chunk-PHLBEDMK.mjs";
 export {
   DOCUMENTED_ENDPOINTS,
   STATE_KEYS,

package/dist/types.d.ts

@@ -641,6 +641,14 @@ export type BlockedReason = 'REGION_UNSUPPORTED' | 'ASSET_UNSUPPORTED' | 'ALL_PR
  */
 type FiatStepResponseBase = {
     transitions: Transition[];
+    /**
+     * Stable identity for a routing continuation before provider pricing is observable.
+     *
+     * A quote-less CONTINUE/PENDING response carries this instead of fabricating a `Quote` or
+     * `quoteRef`. It may remain present after a real quote is promoted so the backend can preserve
+     * the committed provider path independently from the quote binding.
+     */
+    routingSessionRef?: string;
     /** TODO(open-decision): `orderId` placement — see `PAYMENT{INSTRUCT}.orderId` above. */
     orderId?: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fun-xyz/fiat-contract",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Published conformance contract for Fun's headless fiat onramp: FlowState/Transition types, zod schemas, the transition table as data, recorded fixtures, assertion helpers.",
   "license": "MIT",
   "repository": {