@astrasyncai/verification-gateway 5.5.0 → 5.7.0

package/README.md

@@ -509,11 +509,20 @@ processorRef })` so the buyer's dashboard and the agent's poll surface
 reconcile. Amounts must match the order exactly; replays are safe. Never
 expose the token to the agent plane or logs.
 
-**Fulfilment PII:** the bridge checkout handoff may carry an optional
-`buyerEmail` (transit-only — use for receipts/digital delivery after
-`settled`; AstraSync stores nothing). Shipping addresses never transit
-AstraSync: take them agent → your fulfilment endpoint directly, joined by
-`sessionId`.
+**Fulfilment PII (5.6.0):** first-party confirm results carry a
+`fulfilment: { email, emailSource }` block — you ALWAYS get a fulfilment
+email for a first-party order. `emailSource: 'agent_provided'` means the
+agent passed a `buyerEmail` (on the bridge handoff body, the verify-access
+request, or your `confirmCheckout({ buyerEmail })` call);
+`emailSource: 'account'` means the platform defaulted to the buyer's account
+email. Emails arrive canonicalized (trimmed, lower-cased). Precedence: an
+explicit handoff-body `buyerEmail` wins over `fulfilment.email`'s account
+default. Store the email with the pending order and fulfil against it only
+once the order reaches `settled` / `pending_merchant`. All of it is
+transit-only — AstraSync stores nothing; treat `fulfilment` as merchant-only
+material (the bridge strips it from the agent plane). Shipping addresses
+never transit AstraSync: take them agent → your fulfilment endpoint
+directly, joined by `sessionId`.
 
 ## Settlement Artifacts
 
@@ -936,7 +945,9 @@ invariant. Pre-mint owner edits flow through
 `POST /agents/request-registration/:requestId/approve` (dashboard-only,
 accepts a full edit body). Post-mint, the only allowed transition is
 `agentStatus` (e.g. dashboard retire button). For configuration changes,
-use the upgrade flow (coming soon) or retire-and-re-register.
+use the upgrade flow (Agent dashboard -> Upgrade, or
+`POST /agents/:id/upgrade` from a dashboard session) — it mints a successor
+version with a new ASTRA-id and retires the current one.
 
 **Other round-13 items**:
 

package/dist/adapters/express.d.mts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-D8DDG-qK.mjs';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-BK_pRNSs.mjs';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.d.ts

@@ -1,5 +1,5 @@
 import { RequestHandler, Request } from 'express';
-import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-D8DDG-qK.js';
+import { d as VerificationResult, E as ExpressMiddlewareOptions, a as AstraSyncCredentials } from '../types-BK_pRNSs.js';
 
 /**
  * AstraSync Universal Verification Gateway - Express Middleware

package/dist/adapters/express.js

@@ -26,7 +26,7 @@ __export(express_exports, {
 module.exports = __toCommonJS(express_exports);
 
 // src/version.ts
-var SDK_VERSION = "5.5.0";
+var SDK_VERSION = "5.7.0";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -449,6 +449,7 @@ async function callVerifyAccessAPI(config, request) {
   if (requestData.commercePhase) body.commercePhase = requestData.commercePhase;
   if (requestData.checkoutSessionId) body.checkoutSessionId = requestData.checkoutSessionId;
   if (requestData.checkoutItems) body.checkoutItems = requestData.checkoutItems;
+  if (requestData.buyerEmail) body.buyerEmail = requestData.buyerEmail;
   if (requestData.commerceArtifacts) body.commerceArtifacts = requestData.commerceArtifacts;
   if (requestData.attemptId) body.attemptId = requestData.attemptId;
   if (requestData.considerationSet) body.considerationSet = requestData.considerationSet;
@@ -624,7 +625,9 @@ async function verify(config, request, options) {
       settlementOutcome: apiResponse.settlementOutcome,
       // 5.5.0 self-settlement: merchant-only material — passes through to the
       // MERCHANT caller only (bridge callers strip it before the agent plane).
-      settlementToken: apiResponse.settlementToken
+      settlementToken: apiResponse.settlementToken,
+      // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+      fulfilment: apiResponse.fulfilment
     };
     return result2;
   }
@@ -683,7 +686,9 @@ async function verify(config, request, options) {
     stepUpApproval: apiResponse.stepUpApproval,
     settlement: apiResponse.settlement,
     settlementOutcome: apiResponse.settlementOutcome,
-    settlementToken: apiResponse.settlementToken
+    settlementToken: apiResponse.settlementToken,
+    // 5.6.0: fulfilment contact — merchant-only lane, same strip rule.
+    fulfilment: apiResponse.fulfilment
   };
   if (result.recommendation === "deny") {
     result.policyAllowed = false;