@astrasyncai/verification-gateway 2.5.0 → 3.0.0

package/dist/index.js

@@ -192,7 +192,7 @@ function getCapabilities(accessLevel) {
 }
 
 // src/version.ts
-var SDK_VERSION = "2.4.13";
+var SDK_VERSION = "3.0.0";
 
 // src/well-known.ts
 var CACHE_TTL_MS = 60 * 60 * 1e3;
@@ -1337,7 +1337,7 @@ function generateCommerceShieldHtml(result, options) {
   );
   const registrationUrl = sanitizeUrl(
     result.guidance?.registrationUrl,
-    "https://astrasync.ai/register"
+    "https://astrasync.ai/agents/register"
   );
   const docsUrl = sanitizeUrl(
     result.guidance?.documentationUrl,
@@ -5130,15 +5130,18 @@ function buildGuidance(params) {
     status: "credentials_required",
     message,
     guidance: {
-      message: "AstraSync registration requires credentials. Get an account + API key, then call register_agent again.",
-      registrationUrl: `${origin}/register`,
+      message: "Register either with an agent-scoped API key (the recommended credentialed path) OR, if you hold no credentials, via the owner's email using request_registration. Never send a password or private key over the wire.",
+      // 3.0.0: registrationUrl is the agent-actionable KEYLESS endpoint, not the
+      // human dashboard `/agents/register` (an auth-walled page an agent can't
+      // use). documentationUrl carries the machine-readable contract.
+      registrationUrl: `${origin}/api/agents/request-registration`,
       documentationUrl: `${origin}${docsPath.startsWith("/") ? docsPath : `/${docsPath}`}`,
       steps: [
-        "Visit registrationUrl and create an AstraSync account (or log in if you have one).",
-        "Generate an API key from Settings \u2192 API Keys.",
-        "Re-call register_agent with the apiKey populated.",
-        "After registration returns status: pending_approval, the owner approves via email.",
-        "Use poll_registration({ requestId }) to retrieve the astraId once approved."
+        "Credentialed path (recommended): have your human mint an agent-scoped API key at Settings \u2192 API Keys, then re-call register_agent with apiKey set. An agent holding its own scoped kya_ key is fine and intended.",
+        "No-credentials path: call request_registration({ name, ownerEmail, ... }) with the human owner's email \u2014 the only bootstrap credential. No API key is involved.",
+        "The owner approves via an emailed link (first time, they create an account and complete a quick verification).",
+        "Use poll_registration({ requestId }) once the owner confirms approval to retrieve the astraId.",
+        "Never transmit a password or private key over the MCP wire \u2014 those are never required."
       ]
     }
   };