@astrasyncai/verification-gateway 5.20.0 → 5.21.0

package/CHANGELOG.md

@@ -8,6 +8,53 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 Full architectural context for each release lives in the platform spec at
 `docs/research/adapter-architecture-technical-requirements.md`.
 
+## [5.21.0] — 2026-10-26 — endpoint changes are dashboard-only, agent commerce studio rules
+
+### Removed (breaking, security — shops' item 48)
+
+- **`VerificationGatewayClient.updateEndpoint`** and the `EndpointOperationalPatch`
+  type. After registration, endpoint settings (checkout, catalogue, events,
+  skill and health check URLs) change in the dashboard only, behind the
+  owner's login and MFA; the platform now refuses API keys on
+  `PATCH /api/endpoints/:id` (403). Why: a merchant's API key lives in its
+  host's environment, and a host compromise must not let a leaked key point
+  agents at another checkout or catalogue under the merchant's verified
+  identity. Every dashboard change to one of these URLs alerts the owner.
+- **`sendTestEvent(id, { approvalId })`.** From code the test event is
+  synthetic only (an `approvalId` is no longer sent; the platform answers 403
+  `dashboard_only` to an API key that sends one). A real held approval's
+  payload releases or re-drives that checkout, so it is sent from the
+  endpoint page in the dashboard.
+
+### Changed
+
+- **The default AstraSync API base is `https://astrasync.ai/api`** (gateway
+  online mode, the transport's default verify URL, README examples), the same
+  as `verify()`'s documented base. `api.astrasync.ai` still answers; pass
+  `apiBaseUrl` explicitly as before if you set one.
+
+### Added — agent commerce studio rules
+
+- **`createAgentCommerce({ apiBaseUrl, apiKey, counterpartyId })`** fetches
+  the rules you set in the dashboard (endpoint → Agent commerce) every 5
+  minutes and keeps the last good copy when a fetch fails: product
+  visibility, agent price, the image agents get, a verified-agent discount,
+  and card issuer offers. AstraSync stores rules only; it hosts nothing.
+  `report({ catalogUrl, checkoutUrl, eventsUrl })` tells the dashboard where
+  your kit lives — shown as suggestions you confirm; it never sets a URL.
+- **`serveAgentCatalog({ commerce, products })`** serves your catalogue to
+  agents priced and filtered by those rules (`issuer_offer` marks a
+  cardholder-priced line). **`fromFeed(url)`** reads a Shopify
+  `products.json`, Google Merchant XML, CSV or JSON feed you already have.
+- **Kits: `agentCommerce`.** The UCP and ACP kits price lines with the same
+  rules, so the agent's price is the price you charge. A cardholder price
+  applies on `X-Astra-Issuer-Program` (sent by the AstraSync bridge) and the
+  confirm carries `metadata.issuerProgram`; AstraSync refuses the purchase
+  unless the buyer is that programme's cardholder. Pass `metadata` through
+  in your `verifyPurchase`.
+- `issuerOfferPrice` / `priceForAgent`: the shared price rule (percent off,
+  half up, clamped).
+
 ## [5.20.0] — 2026-10-19 — fewer backend calls, recoverable declined holds, endpoint ops from code
 
 ### Changed (behaviour)
@@ -48,12 +95,12 @@ Full architectural context for each release lives in the platform spec at
   in the verify-access body (honoured only from a first-party AstraSync
   service caller; a verify carrying it is never cached).
 - `VerificationGatewayClient.updateEndpoint(id, { eventsUrl, healthCheckUrl,
-  skillUrl, catalogUrl, checkoutUrl })` → `PATCH /api/endpoints/:id`
+skillUrl, catalogUrl, checkoutUrl })` → `PATCH /api/endpoints/:id`
   (operational URLs only, API key of the owner or an org member) and
   `sendTestEvent(id, { type, approvalId? })` → `POST
-  /api/endpoints/:id/events/test` (one signed step-up event delivered now;
+/api/endpoints/:id/events/test` (one signed step-up event delivered now;
   returns `{ delivered, status, responseCode, error, eventId, type,
-  approvalId }`). Types `EndpointOperationalPatch`, `TestEventType`,
+approvalId }`). Types `EndpointOperationalPatch`, `TestEventType`,
   `TestEventResult`.
 - Kits' `pollHeldSessions` releases a `lapsed` approval (UCP and ACP);
   `StepUpApprovalStatus` gains `'lapsed'`.

package/README.md

@@ -73,7 +73,7 @@ import { createMiddleware } from '@astrasyncai/verification-gateway/nextjs';
 // v2.3.7+ — per-route policy lives in the AstraSync dashboard.
 // The SDK fetches it on init via counterpartyId; do NOT pass routes here.
 export const middleware = createMiddleware({
-  apiBaseUrl: 'https://api.astrasync.ai',
+  apiBaseUrl: 'https://astrasync.ai/api', // always includes /api
   apiKey: process.env.ASTRASYNC_API_KEY,
   counterpartyId: 'ASTRAE-...',
   showInterstitial: true,
@@ -90,7 +90,7 @@ export const config = {
 import { createClient } from '@astrasyncai/verification-gateway/sdk';
 
 const gateway = createClient({
-  apiBaseUrl: 'https://api.astrasync.ai',
+  apiBaseUrl: 'https://astrasync.ai/api', // always includes /api
 });
 
 // Verify another agent before interacting

package/dist/adapters/express.d.mts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { e as VerificationResult, E as ExpressMiddlewareOptions, b as AstraSyncCredentials } from '../types-CxjqmPl-.mjs';
+import { e as VerificationResult, E as ExpressMiddlewareOptions, b as AstraSyncCredentials } from '../types-DHHyXtuZ.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { e as VerificationResult, E as ExpressMiddlewareOptions, b as AstraSyncCredentials } from '../types-CxjqmPl-.js';
+import { e as VerificationResult, E as ExpressMiddlewareOptions, b as AstraSyncCredentials } from '../types-DHHyXtuZ.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.js

@@ -479,7 +479,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.20.0";
+var SDK_VERSION = "5.21.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;