@astrasyncai/verification-gateway 2.4.2 → 2.4.3

package/README.md

@@ -470,6 +470,17 @@ Why the split: the gateway derives multiple endpoints from `apiBaseUrl` (verify-
 
 As of **v2.4.2**, the registration SDK tolerates a trailing `/api` on `baseUrl` — it strips the suffix and emits a one-time console warning so you can fix the source. Pass `silent: true` in `AstraSyncConfig` to suppress the warning (e.g. in tests).
 
+### Staging vs production
+
+Both environments share the same URL shape (origin + `/api` for the verify gateway; bare origin for the registration SDK). Promotion is a single hostname swap:
+
+| Environment | Verify gateway (`apiBaseUrl`)      | Registration SDK (`baseUrl`)   |
+| ----------- | ---------------------------------- | ------------------------------ |
+| Staging     | `https://staging.astrasync.ai/api` | `https://staging.astrasync.ai` |
+| Production  | `https://astrasync.ai/api`         | `https://astrasync.ai`         |
+
+Path shape, request bodies, response schemas, error envelopes — all identical. Swap `staging.astrasync.ai` ↔ `astrasync.ai`, nothing else.
+
 ## Header semantics — `X-Astra-Gateway-Mode`
 
 The SDK sets `X-Astra-Gateway-Mode` on every response that's been through the gateway middleware. The value describes the GATE state — not whether the request succeeded end-to-end.
@@ -483,6 +494,12 @@ Pre-v2.4.2 used the value `pass-through` — renamed in v2.4.2 to disambiguate "
 
 ## Changelog
 
+### v2.4.3 — Round-11 partner integration testing
+
+- **`PollRegistrationResult.astraId`** — the polling response now surfaces the canonical `ASTRA-*` id once the registration request is approved. Pre-fix partners only got the owner-private UUID from the register flow and had no programmatic path to the canonical id (had to go to the dashboard). Backend changes that drive this: the `GET /api/agents/request-registration/{requestId}` handler looks up `kyaAgent.astrasyncIdLevel1` on approval and includes it in the response body.
+- No SDK code changes — pure type widening. Existing 2.4.2 callers see the same `state` / `agent` / `reason` shape plus the new optional `astraId` field. TypeScript surfaces the new field at every `sdk.pollRegistration(...)` call site.
+- Pairs with backend round-11 F2: the public verify-access surface now refuses UUID-form `agentId` with a `400 INVALID_AGENT_ID`. After F3 partners can discover the canonical `astraId` post-approval; F2 is what they pass to verify-access from there.
+
 ### v2.4.2 — Round-10 partner re-test alignment
 
 - **baseUrl normalization** (`AstraSyncConfig`): trailing `/api` is stripped + warned. Removes a class of NOT_FOUND bugs when partners pass the verify-gateway-style URL to the registration client.

package/dist/registration/index.d.mts

@@ -166,9 +166,21 @@ type RegisterResult = {
 /**
  * Response shape from `pollRegistration(requestId)` and the internal poll
  * loop. State `pending` means still awaiting owner; the others are terminal.
+ *
+ * Round-11 (F3): on `state: 'approved'`, the response also carries the
+ * canonical `astraId` — the partner-facing public agent identity that all
+ * verify-access / verify/{id} surfaces accept. The `agent` (UUID) field
+ * stays owner-private and is kept for backward compat.
  */
 interface PollRegistrationResult {
     state: 'pending' | 'approved' | 'denied' | 'expired';
+    /**
+     * Canonical `ASTRA-…` id. Populated when `state === 'approved'`; `null`
+     * (or absent) otherwise. This is the identifier to pass to public
+     * verification surfaces — UUIDs from the register response are owner-
+     * private request handles and are rejected by verify-access in v2.4.3+.
+     */
+    astraId?: string | null;
     agent?: AgentRecord;
     reason?: string;
 }

package/dist/registration/index.d.ts

@@ -166,9 +166,21 @@ type RegisterResult = {
 /**
  * Response shape from `pollRegistration(requestId)` and the internal poll
  * loop. State `pending` means still awaiting owner; the others are terminal.
+ *
+ * Round-11 (F3): on `state: 'approved'`, the response also carries the
+ * canonical `astraId` — the partner-facing public agent identity that all
+ * verify-access / verify/{id} surfaces accept. The `agent` (UUID) field
+ * stays owner-private and is kept for backward compat.
  */
 interface PollRegistrationResult {
     state: 'pending' | 'approved' | 'denied' | 'expired';
+    /**
+     * Canonical `ASTRA-…` id. Populated when `state === 'approved'`; `null`
+     * (or absent) otherwise. This is the identifier to pass to public
+     * verification surfaces — UUIDs from the register response are owner-
+     * private request handles and are rejected by verify-access in v2.4.3+.
+     */
+    astraId?: string | null;
     agent?: AgentRecord;
     reason?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrasyncai/verification-gateway",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "AstraSync KYA Platform SDK — counterparty verification gateway (verify incoming requests) + agent registration (register AI agents with the KYA backend).",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",