@astrasyncai/verification-gateway 5.21.0 → 5.21.2

package/CHANGELOG.md

@@ -8,6 +8,25 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 Full architectural context for each release lives in the platform spec at
 `docs/research/adapter-architecture-technical-requirements.md`.
 
+## [5.21.2] — 2026-10-25 — xAI Grok and Meta AI crawler signatures
+
+### Added
+
+- Platform signatures for xAI Grok (`GrokBot/1.0`, `xAI-Grok/1.0`, `Grok-DeepSearch/1.0`) and Meta AI (`Meta-WebIndexer`, `Meta-ExternalFetcher`), so these crawlers attribute as named platforms (`grok`, `meta-ai`) instead of unknown. Anchored, versioned tokens only: a stock browser UA never matches.
+- A note in the registry: Meta's Muse and OpenAI's Dots publish no user agent and browse through real Chromium sessions, so they can't be detected by UA. Verified identity is the only reliable signal for them.
+
+## [5.21.1] — 2026-10-24 — pricingContextFrom exported
+
+### Added
+
+- **`pricingContextFrom(headers)`** and the `PricingContext` type are exported
+  from the package root (they were internal to the kits). Use them when your
+  own catalogue route prices with `createAgentCommerce`:
+  `commerce.price(sku, priceMinor, pricingContextFrom(req.headers))`. Your
+  catalogue then applies exactly the kits' rule (a cardholder price only for a
+  verified agent with a valid `X-Astra-Issuer-Program`), so the price an agent
+  sees can't drift from the price your checkout charges.
+
 ## [5.21.0] — 2026-10-26 — endpoint changes are dashboard-only, agent commerce studio rules
 
 ### Removed (breaking, security — shops' item 48)

package/dist/adapters/express.js

@@ -479,7 +479,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.21.0";
+var SDK_VERSION = "5.21.2";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -1953,6 +1953,23 @@ var PLATFORM_AGENT_SIGNATURES = [
     agentCardPatterns: [/perplexity\.ai/i],
     apiKeyFormatPatterns: [/^pplx-/i]
   },
+  // Round 30.1: xAI's documented crawlers (GrokBot/1.0, xAI-Grok/1.0,
+  // Grok-DeepSearch/1.0). Anchored, versioned tokens — never in a stock UA.
+  {
+    vendor: "grok",
+    displayName: "xAI Grok",
+    uaPatterns: [/\bGrokBot\//i, /\bxAI-Grok\//i, /\bGrok-DeepSearch\//i],
+    agentCardPatterns: [/\bx\.ai\b/i, /grok\.com/i],
+    apiKeyFormatPatterns: [/^xai-/i]
+  },
+  // Round 30.1: Meta AI's index and fetch crawlers. facebookexternalhit
+  // (link previews) is deliberately NOT here — it stays a generic crawler.
+  {
+    vendor: "meta-ai",
+    displayName: "Meta AI",
+    uaPatterns: [/\bMeta-WebIndexer\b/i, /\bMeta-ExternalFetcher\b/i],
+    agentCardPatterns: [/meta\.ai/i]
+  },
   // Agentic browsers — versioned-token patterns ONLY (a stock Chrome UA must
   // never match). Distinct vendor keys (not 'chatgpt'/'perplexity'): the
   // browser product is a different surface than the assistant service, and