@vaam-apps/vpay-sdk 0.14.1 → 0.14.2

package/README.md

@@ -764,7 +764,8 @@ been checked against the real OP verifier by hand.** An assertion minted by
 this SDK was fed directly to
 `authkestra_op::client_assertion::verify_client_assertion` at the pinned
 `authkestra-op = "=0.7.1"`, against a `ClientRegistration` holding the
-corresponding public JWK, and was accepted. `just sdk-conformance-node`
+corresponding public JWK, and was accepted — and again at `=0.13.1` on
+2026-10-26, when the pin moved. `just sdk-conformance-node`
 reproduces it: the recipe mints an assertion via `scripts/mint-assertion.mjs`
 and pipes it into `cargo run -p vpay-sdk --example verify_assertion`. It is a
 manual check, run on demand — it needs a Rust toolchain, it is not part of

package/dist/version.d.ts

@@ -9,4 +9,4 @@
  * releases. A hand-written constant has no such landmine — it just needs to
  * be bumped alongside `package.json`'s own `version` field.
  */
-export declare const SDK_VERSION = "0.14.1";
+export declare const SDK_VERSION = "0.14.2";

package/dist/version.js

@@ -9,4 +9,4 @@
  * releases. A hand-written constant has no such landmine — it just needs to
  * be bumped alongside `package.json`'s own `version` field.
  */
-export const SDK_VERSION = "0.14.1"; // x-release-please-version
+export const SDK_VERSION = "0.14.2"; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaam-apps/vpay-sdk",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "The Node.js merchant SDK for vpay's /v1 API: OAuth2 private_key_jwt, payment intents, checkout sessions, refunds, events and webhook verification.",
   "license": "Apache-2.0",
   "publishConfig": {