@astrasyncai/verification-gateway 5.22.0 → 5.22.1

package/CHANGELOG.md

@@ -8,6 +8,17 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 Full architectural context for each release lives in the platform spec at
 `docs/research/adapter-architecture-technical-requirements.md`.
 
+## [5.22.1] — 2026-11-02 — pricingContextFrom: provisional by design, opt-in strict; kit header
+
+### Added
+
+- `pricingContextFrom(headers, { verification })`: pass the result of your own verification (for example `req.agentVerification` from the Express or Next.js adapter). A result that isn't identity-verified, or that names a different agent, forces `verified: false`.
+- The agent-commerce kit (`createAgentCommerce`) sends `X-AstraSync-Kit: agent-commerce` when it fetches its rules. AstraSync uses it to tell your kit from any other client: only a kit fetch marks your endpoint as applying cardholder prices.
+
+### Documented
+
+- `verified` from `pricingContextFrom` is provisional. It decides what an agent is shown (member and cardholder prices), not what it may buy. A bare `x-astra-id` still counts, so your catalogue and your checkout kit price alike. The purchase is verified at confirm, and AstraSync refuses a cardholder-priced checkout for anyone who isn't that programme's verified cardholder. No change is needed to keep today's behaviour.
+
 ## [5.22.0] — 2026-10-26 — edge verdicts on beacons, WAF bot labels, Akamai and Imperva headers
 
 ### Added

package/dist/adapters/express.js

@@ -510,7 +510,7 @@ function routePolicyOf(route) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.22.0";
+var SDK_VERSION = "5.22.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;