@visa/cli 4.1.0-rc.145 → 4.1.0-rc.147

package/dist/checkout-engine/cli-engine.d.ts

@@ -16,6 +16,15 @@ import type { Contact, OtpResolver } from './types.js';
  * is classified by its underlying gateway error. Exported for tests.
  */
 export declare function isTransientDrawFailure(err: unknown): boolean;
+/**
+ * A verdict refusal may be wrapped by drawFromMandate after its local
+ * reservation is released. Walk the cause chain so the original auth status +
+ * reasons still decide whether the mandate is permanently disabled.
+ */
+export declare function classifyCardDrawVerdictFailure(err: unknown): {
+    transient: boolean;
+    reasons: string[];
+} | null;
 export type CliReviewInput = {
     url: string;
     amount: string;

package/dist/checkout-engine/cli-engine.js

@@ -33,6 +33,21 @@ export function isTransientDrawFailure(err) {
     const msgs = [];
     let e = err;
     for (let i = 0; i < 5 && e; i++) {
+        // A refusal that declared itself TERMINAL wins outright, before any message
+        // matching. Message text is not a safe carrier for this decision: the mint
+        // client interpolates provider-supplied `upstream_codes` into its message
+        // for diagnosability, and an identifier like `request_timeout` would match
+        // the unanchored `tim(e|ed)-out` alternative below and silently reclassify
+        // a permanent 422 as transient — skipping markUnhonored and stranding the
+        // mandate in the retry-forever loop this classifier exists to prevent.
+        // Duck-typed rather than instanceof so it survives bundling and any
+        // re-wrapping across package boundaries. Optional chaining rather than an
+        // explicit null guard: the loop condition already proved `e` truthy, so a
+        // `e !== null` test is dead code, and `?.` stays safe on a primitive or a
+        // nullish link if that guard ever changes.
+        if (e?.terminal === true) {
+            return false;
+        }
         if (e instanceof Error && typeof e.message === 'string')
             msgs.push(e.message);
         e = e.cause;
@@ -51,7 +66,12 @@ export function isTransientDrawFailure(err) {
  * reservation is released. Walk the cause chain so the original auth status +
  * reasons still decide whether the mandate is permanently disabled.
  */
-function classifyCardDrawVerdictFailure(err) {
+// Exported for the cross-package pin in test/cli-engine.test.ts: the CLI's
+// card-draw client decides the `status` this reads, so the two move together
+// and a test that spans the boundary is the only one that would catch a drift.
+// Not re-exported from index.ts — the public @visa/checkout-engine surface is
+// the explicit allowlist there, same as isTransientDrawFailure above.
+export function classifyCardDrawVerdictFailure(err) {
     const transientReasons = new Set(['challenge_failed', 'challenge_malformed', 'verdict_refused']);
     let current = err;
     for (let i = 0; i < 5 && current; i++) {

package/dist/checkout-engine/vgs-gateway/server-mint-client.d.ts

@@ -17,6 +17,25 @@ export type ServerMintDeps = {
  * — the mint must never throw here.
  */
 export declare function merchantOrigin(url: string): string;
+/**
+ * A definitive refusal from the cryptogram mint route — the request will not
+ * succeed if retried unchanged.
+ *
+ * `terminal` is the load-bearing field. Draw terminality used to be decided by
+ * regex over the error MESSAGE, which made it hostage to text nobody controls:
+ * this client now interpolates the provider's own `upstream_codes` into the
+ * message for diagnosability, and a provider identifier such as
+ * `request_timeout` would match the transient matcher's unanchored
+ * `tim(e|ed)-out` alternative — flipping a permanent 422 back to "transient",
+ * skipping markUnhonored, and stranding the mandate in the exact retry-forever
+ * loop this whole change exists to kill. Terminality is therefore carried
+ * structurally, and consumers must consult it BEFORE any message matching.
+ */
+export declare class ServerCryptogramRefusedError extends Error {
+    readonly status: number;
+    readonly terminal: true;
+    constructor(status: number, detail: string);
+}
 /**
  * Optional mandate override for serverCreateIntent. Absent → the historical
  * 1:1 fresh-tap shape is preserved byte-for-byte (cap = ceil(amount)+10 min 25,

package/dist/checkout-engine/vgs-gateway/server-mint-client.js

@@ -40,6 +40,29 @@ export function merchantOrigin(url) {
         return url;
     }
 }
+/**
+ * A definitive refusal from the cryptogram mint route — the request will not
+ * succeed if retried unchanged.
+ *
+ * `terminal` is the load-bearing field. Draw terminality used to be decided by
+ * regex over the error MESSAGE, which made it hostage to text nobody controls:
+ * this client now interpolates the provider's own `upstream_codes` into the
+ * message for diagnosability, and a provider identifier such as
+ * `request_timeout` would match the transient matcher's unanchored
+ * `tim(e|ed)-out` alternative — flipping a permanent 422 back to "transient",
+ * skipping markUnhonored, and stranding the mandate in the exact retry-forever
+ * loop this whole change exists to kill. Terminality is therefore carried
+ * structurally, and consumers must consult it BEFORE any message matching.
+ */
+export class ServerCryptogramRefusedError extends Error {
+    status;
+    terminal = true;
+    constructor(status, detail) {
+        super(`server cryptogram refused (${status}): ${detail}`);
+        this.name = 'ServerCryptogramRefusedError';
+        this.status = status;
+    }
+}
 /** Read a stable, non-secret error message from a route's JSON body. */
 async function routeError(res) {
     const doc = (await res.json().catch(() => null));
@@ -165,7 +188,7 @@ export async function serverFetchCryptogram(base, mintToken, input, deps = {}) {
         // healthy mandate. The route maps upstream rate limits to 503 today, so this
         // is a guard against a future emitter, not a live path.
         if (res.status >= 400 && res.status < 500 && res.status !== 429) {
-            throw new Error(`server cryptogram refused (${res.status}): ${await routeError(res)}`);
+            throw new ServerCryptogramRefusedError(res.status, await routeError(res));
         }
         lastError = `${res.status}: ${await routeError(res)}`;
         if (attempt < attempts)