@astrasyncai/verification-gateway 5.22.0 → 5.22.1

package/dist/index.mjs

@@ -30,7 +30,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.22.0";
+var SDK_VERSION = "5.22.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -11616,7 +11616,11 @@ function createAgentCommerce(opts) {
       const headers = {
         Accept: "application/json",
         Authorization: `Bearer ${opts.apiKey}`,
-        "X-AstraSync-SDK-Version": SDK_VERSION
+        "X-AstraSync-SDK-Version": SDK_VERSION,
+        // 5.22.1: identifies the agent-commerce kit, so only a kit fetching
+        // its rules marks the merchant as applying them (cardholder prices
+        // are then shown to agents). A curl or another client never does.
+        "X-AstraSync-Kit": "agent-commerce"
       };
       if (kitReport) {
         headers["X-AstraSync-Kit-Report"] = Buffer.from(JSON.stringify(kitReport)).toString(
@@ -11653,10 +11657,14 @@ function createAgentCommerce(opts) {
     }
   };
 }
-function pricingContextFrom(headers) {
+function pricingContextFrom(headers, opts = {}) {
   const astraId = headers.get("x-astra-id");
   const hop = parseVerifiedHop(headers.get(MCP_VERIFIED_HOP_HEADER.toLowerCase()));
-  const verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  let verified = !!astraId && (!hop || hop.astraId === astraId && Date.now() - hop.checkedAt <= MCP_VERIFIED_HOP_MAX_AGE_MS);
+  const v = opts.verification;
+  if (verified && v) {
+    verified = v.identityVerified === true && (!v.agent?.astraId || v.agent.astraId === astraId);
+  }
   const program = headers.get(ISSUER_PROGRAM_HEADER.toLowerCase());
   return {
     verified,