@astrasyncai/verification-gateway 5.22.0 → 5.22.1

package/dist/index.d.mts

@@ -5487,7 +5487,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.22.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.22.1";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5605,7 +5605,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.22.0";
+declare const SDK_VERSION = "5.22.1";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5947,9 +5947,32 @@ interface CreateAgentCommerceOptions {
     fetch?: typeof fetch;
 }
 declare function createAgentCommerce(opts: CreateAgentCommerceOptions): AgentCommerce;
-/** The pricing context of an inbound agent request (headers from the AstraSync bridge). */
+/**
+ * The pricing context of an inbound agent request (headers from the AstraSync
+ * bridge).
+ *
+ * `verified` is PROVISIONAL: it decides what an agent is shown (member and
+ * cardholder prices), not what it may buy. A bare `x-astra-id` counts so a
+ * merchant's catalogue and its checkout kit price alike; the purchase itself
+ * is verified at confirm (verify-access), and AstraSync refuses a
+ * cardholder-priced checkout for anyone who isn't that programme's verified
+ * cardholder (`issuer_offer_not_eligible`). A bridge request's
+ * `X-Astra-Verified-Hop` marker must match the id and be fresh.
+ *
+ * Opt-in strict (5.22.1): pass the result of your own verification (e.g.
+ * `req.agentVerification` from the Express/Next adapters). A result that
+ * isn't identity-verified, or names a different agent, forces
+ * `verified: false`.
+ */
 declare function pricingContextFrom(headers: {
     get(name: string): string | null;
+}, opts?: {
+    verification?: {
+        identityVerified: boolean;
+        agent?: {
+            astraId?: string | null;
+        } | null;
+    } | null;
 }): PricingContext;
 interface AgentProduct {
     sku: string;

package/dist/index.d.ts

@@ -5487,7 +5487,7 @@ declare function detectRuntime(userAgent: string | undefined | null): string | u
  * silently (never throwing), so this is a no-op there — which is correct:
  * in a browser the page's real UA is the honest identity.
  */
-declare const SDK_USER_AGENT = "astrasync-sdk/5.22.0";
+declare const SDK_USER_AGENT = "astrasync-sdk/5.22.1";
 declare const sdkFetch: typeof fetch;
 
 interface LocalPolicy {
@@ -5605,7 +5605,7 @@ declare function parseYaml(yamlContent: string): ParseResult;
  * is fine — bumping both in the release-ceremony commit keeps them
  * lockstep.
  */
-declare const SDK_VERSION = "5.22.0";
+declare const SDK_VERSION = "5.22.1";
 
 /**
  * 5.15.0 — the `UCP-Agent` request header (UCP 2026-08-25): an RFC 8941
@@ -5947,9 +5947,32 @@ interface CreateAgentCommerceOptions {
     fetch?: typeof fetch;
 }
 declare function createAgentCommerce(opts: CreateAgentCommerceOptions): AgentCommerce;
-/** The pricing context of an inbound agent request (headers from the AstraSync bridge). */
+/**
+ * The pricing context of an inbound agent request (headers from the AstraSync
+ * bridge).
+ *
+ * `verified` is PROVISIONAL: it decides what an agent is shown (member and
+ * cardholder prices), not what it may buy. A bare `x-astra-id` counts so a
+ * merchant's catalogue and its checkout kit price alike; the purchase itself
+ * is verified at confirm (verify-access), and AstraSync refuses a
+ * cardholder-priced checkout for anyone who isn't that programme's verified
+ * cardholder (`issuer_offer_not_eligible`). A bridge request's
+ * `X-Astra-Verified-Hop` marker must match the id and be fresh.
+ *
+ * Opt-in strict (5.22.1): pass the result of your own verification (e.g.
+ * `req.agentVerification` from the Express/Next adapters). A result that
+ * isn't identity-verified, or names a different agent, forces
+ * `verified: false`.
+ */
 declare function pricingContextFrom(headers: {
     get(name: string): string | null;
+}, opts?: {
+    verification?: {
+        identityVerified: boolean;
+        agent?: {
+            astraId?: string | null;
+        } | null;
+    } | null;
 }): PricingContext;
 interface AgentProduct {
     sku: string;

package/dist/index.js

@@ -229,7 +229,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.22.0";
+var SDK_VERSION = "5.22.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -11812,7 +11812,11 @@ function createAgentCommerce(opts) {
       const headers = {
         Accept: "application/json",
         Authorization: `Bearer ${opts.apiKey}`,
-        "X-AstraSync-SDK-Version": SDK_VERSION
+        "X-AstraSync-SDK-Version": SDK_VERSION,
+        // 5.22.1: identifies the agent-commerce kit, so only a kit fetching
+        // its rules marks the merchant as applying them (cardholder prices
+        // are then shown to agents). A curl or another client never does.
+        "X-AstraSync-Kit": "agent-commerce"
       };
       if (kitReport) {
         headers["X-AstraSync-Kit-Report"] = Buffer.from(JSON.stringify(kitReport)).toString(
@@ -11849,10 +11853,14 @@ function createAgentCommerce(opts) {
     }
   };
 }
-function pricingContextFrom(headers) {
+function pricingContextFrom(headers, opts = {}) {
   const astraId = headers.get("x-astra-id");
   const hop = parseVerifiedHop(headers.get(MCP_VERIFIED_HOP_HEADER.toLowerCase()));
-  const verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  let verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  const v = opts.verification;
+  if (verified && v) {
+    verified = v.identityVerified === true && (!v.agent?.astraId || v.agent.astraId === astraId);
+  }
   const program = headers.get(ISSUER_PROGRAM_HEADER.toLowerCase());
   return {
     verified,