@astrasyncai/verification-gateway 5.20.0 → 5.21.1

package/dist/adapters/sdk.mjs

@@ -1,5 +1,5 @@
 // src/version.ts
-var SDK_VERSION = "5.20.0";
+var SDK_VERSION = "5.21.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -998,37 +998,23 @@ var VerificationGatewayClient = class {
     }
     return json.data;
   }
-  /**
-   * 5.20.0 (round 29.1): change an endpoint's OPERATIONAL URLs with this
-   * client's API key — `PATCH /api/endpoints/:id`. Accepts the key of the
-   * endpoint's owner, or a personal key of an individual with an active seat
-   * in the owning organisation. Policy (rules, trust floor, challenge, edge
-   * config) stays dashboard-only. `null` clears a field. The owner is alerted
-   * when `eventsUrl` changes.
-   *
-   * @param endpointId the ASTRAE id (defaults to the client's `counterpartyId`)
-   * @returns the endpoint as stored, plus `changed` (the fields that changed)
-   * @throws AstraSyncError — 400 `UNKNOWN_FIELDS` / validation, 401/403, 404
-   */
-  async updateEndpoint(endpointId, patch) {
-    return this.endpointCall("PATCH", endpointId, "", patch);
-  }
   /**
    * 5.20.0 (round 29.1): ask AstraSync to send ONE signed step-up event to the
    * endpoint's Events URL now — `POST /api/endpoints/:id/events/test`.
    * Delivered synchronously, outside the event outbox (random `eventId`, no
    * retries), signed with the endpoint's webhook secret like a real event.
-   * Without `approvalId` the payload is synthetic (a kit acknowledges and
-   * ignores it). With the id of a held kit approval at this endpoint the
-   * payload is the real one, so your resume path runs: `approved` makes the
-   * kit re-confirm (held again — nothing is charged); `denied` / `expired` /
-   * `lapsed` release the session.
+   * The payload is synthetic (`approvalId: "test_…"`); a kit acknowledges and
+   * ignores it.
+   *
+   * 5.21.0 (shops' item 48): synthetic only. Sending a real held approval's
+   * payload (which releases or re-drives that checkout) is dashboard-only, so
+   * a leaked API key can't do it.
    *
    * Resolves even when your endpoint refused the event (`delivered: false`,
    * with `responseCode` / `error`).
    */
   async sendTestEvent(endpointId, options) {
-    return this.endpointCall("POST", endpointId, "/events/test", options);
+    return this.endpointCall("POST", endpointId, "/events/test", { type: options.type });
   }
   async endpointCall(method, endpointId, suffix, body) {
     const id = endpointId ?? this.config.counterpartyId;