@astrasyncai/verification-gateway 5.20.0 → 5.21.1

package/dist/adapters/sdk.d.mts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-CxjqmPl-.mjs';
+import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-DHHyXtuZ.mjs';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -199,38 +199,23 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
-    /**
-     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-     * endpoint's owner, or a personal key of an individual with an active seat
-     * in the owning organisation. Policy (rules, trust floor, challenge, edge
-     * config) stays dashboard-only. `null` clears a field. The owner is alerted
-     * when `eventsUrl` changes.
-     *
-     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-     * @returns the endpoint as stored, plus `changed` (the fields that changed)
-     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-     */
-    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
-        changed: Array<keyof EndpointOperationalPatch>;
-    }>;
     /**
      * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
      * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
      * Delivered synchronously, outside the event outbox (random `eventId`, no
      * retries), signed with the endpoint's webhook secret like a real event.
-     * Without `approvalId` the payload is synthetic (a kit acknowledges and
-     * ignores it). With the id of a held kit approval at this endpoint the
-     * payload is the real one, so your resume path runs: `approved` makes the
-     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-     * `lapsed` release the session.
+     * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+     * ignores it.
+     *
+     * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+     * payload (which releases or re-drives that checkout) is dashboard-only, so
+     * a leaked API key can't do it.
      *
      * Resolves even when your endpoint refused the event (`delivered: false`,
      * with `responseCode` / `error`).
      */
     sendTestEvent(endpointId: string | undefined, options: {
         type: TestEventType;
-        approvalId?: string;
     }): Promise<TestEventResult>;
     private endpointCall;
     /**
@@ -272,14 +257,6 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
-/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
-interface EndpointOperationalPatch {
-    eventsUrl?: string | null;
-    healthCheckUrl?: string | null;
-    skillUrl?: string | null;
-    catalogUrl?: string | null;
-    checkoutUrl?: string | null;
-}
 /** 5.20.0: the step-up event types `sendTestEvent` can send. */
 type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
 /** 5.20.0: what `sendTestEvent` reports. */
@@ -309,4 +286,4 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-export { type EndpointOperationalPatch, type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };
+export { type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.d.ts

@@ -1,4 +1,4 @@
-import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-CxjqmPl-.js';
+import { T as TrustLevel, S as SDKOptions, e as VerificationResult, d as VerificationRequest, A as AgentArtifacts, C as CheckoutMetadata } from '../types-DHHyXtuZ.js';
 
 /**
  * AstraSync Universal Verification Gateway — Trust Level helpers.
@@ -199,38 +199,23 @@ declare class VerificationGatewayClient {
         status: string;
         alreadySettled?: boolean;
     }>;
-    /**
-     * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-     * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-     * endpoint's owner, or a personal key of an individual with an active seat
-     * in the owning organisation. Policy (rules, trust floor, challenge, edge
-     * config) stays dashboard-only. `null` clears a field. The owner is alerted
-     * when `eventsUrl` changes.
-     *
-     * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-     * @returns the endpoint as stored, plus `changed` (the fields that changed)
-     * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-     */
-    updateEndpoint(endpointId: string | undefined, patch: EndpointOperationalPatch): Promise<Record<string, unknown> & {
-        changed: Array<keyof EndpointOperationalPatch>;
-    }>;
     /**
      * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
      * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
      * Delivered synchronously, outside the event outbox (random `eventId`, no
      * retries), signed with the endpoint's webhook secret like a real event.
-     * Without `approvalId` the payload is synthetic (a kit acknowledges and
-     * ignores it). With the id of a held kit approval at this endpoint the
-     * payload is the real one, so your resume path runs: `approved` makes the
-     * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-     * `lapsed` release the session.
+     * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+     * ignores it.
+     *
+     * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+     * payload (which releases or re-drives that checkout) is dashboard-only, so
+     * a leaked API key can't do it.
      *
      * Resolves even when your endpoint refused the event (`delivered: false`,
      * with `responseCode` / `error`).
      */
     sendTestEvent(endpointId: string | undefined, options: {
         type: TestEventType;
-        approvalId?: string;
     }): Promise<TestEventResult>;
     private endpointCall;
     /**
@@ -272,14 +257,6 @@ declare class VerificationGatewayClient {
      */
     private executeWithRetry;
 }
-/** 5.20.0: the operational fields `updateEndpoint` may change (`null` clears). */
-interface EndpointOperationalPatch {
-    eventsUrl?: string | null;
-    healthCheckUrl?: string | null;
-    skillUrl?: string | null;
-    catalogUrl?: string | null;
-    checkoutUrl?: string | null;
-}
 /** 5.20.0: the step-up event types `sendTestEvent` can send. */
 type TestEventType = 'step_up.approved' | 'step_up.denied' | 'step_up.expired' | 'step_up.lapsed';
 /** 5.20.0: what `sendTestEvent` reports. */
@@ -309,4 +286,4 @@ declare function verifyOnce(options: SDKOptions & {
     action?: string;
 }): Promise<VerificationResult>;
 
-export { type EndpointOperationalPatch, type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };
+export { type TestEventResult, type TestEventType, VerificationGatewayClient, createClient, getTrustLevel, verifyOnce };

package/dist/adapters/sdk.js

@@ -28,7 +28,7 @@ __export(sdk_exports, {
 module.exports = __toCommonJS(sdk_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.20.0";
+var SDK_VERSION = "5.21.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -1027,37 +1027,23 @@ var VerificationGatewayClient = class {
     }
     return json.data;
   }
-  /**
-   * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-   * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-   * endpoint's owner, or a personal key of an individual with an active seat
-   * in the owning organisation. Policy (rules, trust floor, challenge, edge
-   * config) stays dashboard-only. `null` clears a field. The owner is alerted
-   * when `eventsUrl` changes.
-   *
-   * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-   * @returns the endpoint as stored, plus `changed` (the fields that changed)
-   * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-   */
-  async updateEndpoint(endpointId, patch) {
-    return this.endpointCall("PATCH", endpointId, "", patch);
-  }
   /**
    * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
    * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
    * Delivered synchronously, outside the event outbox (random `eventId`, no
    * retries), signed with the endpoint's webhook secret like a real event.
-   * Without `approvalId` the payload is synthetic (a kit acknowledges and
-   * ignores it). With the id of a held kit approval at this endpoint the
-   * payload is the real one, so your resume path runs: `approved` makes the
-   * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-   * `lapsed` release the session.
+   * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+   * ignores it.
+   *
+   * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+   * payload (which releases or re-drives that checkout) is dashboard-only, so
+   * a leaked API key can't do it.
    *
    * Resolves even when your endpoint refused the event (`delivered: false`,
    * with `responseCode` / `error`).
    */
   async sendTestEvent(endpointId, options) {
-    return this.endpointCall("POST", endpointId, "/events/test", options);
+    return this.endpointCall("POST", endpointId, "/events/test", { type: options.type });
   }
   async endpointCall(method, endpointId, suffix, body) {
     const id = endpointId ?? this.config.counterpartyId;