@visa/cli 4.1.0-rc.83 → 4.1.0-rc.85

package/dist/checkout-engine/hosted-approval.js

@@ -236,7 +236,13 @@ export async function runHostedApproval(opts) {
                 if (doc?.status === 'declined')
                     throw new HostedApprovalDeclinedError();
                 if (doc?.status === 'completed') {
-                    if (doc.assuranceData === undefined || doc.assuranceData === null) {
+                    // A passkey-exempt token ('otp' cardholder ID&V / 'none') runs no
+                    // ceremony and produces no assurance — the approval server marks the
+                    // claim explicitly (derived from the owner's verified card record at
+                    // complete-time). Only that marker excuses a null assuranceData; a
+                    // silently dropped payload still fails exactly as before.
+                    const assuranceExempt = doc.cardholderVerification === 'otp' || doc.cardholderVerification === 'none';
+                    if ((doc.assuranceData === undefined || doc.assuranceData === null) && !assuranceExempt) {
                         throw new Error('hosted approval completed but carried no assuranceData');
                     }
                     // The context the approval was COMPLETED against must be exactly this
@@ -304,9 +310,12 @@ export async function runHostedApproval(opts) {
                     else if (doc.validUntil !== undefined) {
                         throw new Error('hosted one-purchase approval unexpectedly carried a budget expiry');
                     }
-                    log('passkey approval received from the hosted page.');
+                    log(assuranceExempt
+                        ? 'approval received from the hosted page (code-verified card, no passkey).'
+                        : 'passkey approval received from the hosted page.');
                     return {
-                        ...assuranceFromCeremony(target, doc.assuranceData),
+                        ...assuranceFromCeremony(target, doc.assuranceData ?? null),
+                        ...(assuranceExempt ? { assuranceExempt: true } : {}),
                         ...(typeof doc.mintToken === 'string' && doc.mintToken
                             ? { mintToken: doc.mintToken }
                             : {}),

package/dist/checkout-engine/vgs-live-instrument.d.ts

@@ -42,6 +42,15 @@ export type PurchaseAssurance = {
     transactionAmount: string;
     /** ISO 4217 currency the ceremony was scoped to. */
     transactionCurrencyCode: string;
+    /**
+     * True iff the approval server marked this token passkey-exempt ('otp'
+     * cardholder ID&V / 'none' — verified against the owner's account card
+     * record at complete-time): no ceremony ran, `assuranceData` is null by
+     * design, and the intent is minted without it (the signed mint token
+     * carries the same exemption for the server's own check). Absent/false →
+     * assuranceData is REQUIRED, exactly the historical contract.
+     */
+    assuranceExempt?: boolean;
 };
 /**
  * Our fail-closed freshness bound, matching the runner's 15-minute checkout

package/dist/checkout-engine/vgs-live-instrument.js

@@ -106,7 +106,10 @@ export function validatePurchaseAssurance(value, target, now = new Date()) {
     if (value == null || typeof value !== 'object') {
         throw new Error(`purchase assurance is missing — ${remedy}`);
     }
-    if (value.assuranceData == null) {
+    // A passkey-exempt approval (marked by the approval SERVER, never assumed
+    // locally) carries no assurance by design — every scope/freshness check
+    // below still applies to it unchanged.
+    if (value.assuranceData == null && value.assuranceExempt !== true) {
         throw new Error(`purchase assurance requires assuranceData — ${remedy}`);
     }
     const mintedAtMs = typeof value.mintedAt === 'string' ? Date.parse(value.mintedAt) : NaN;