@astrasyncai/verification-gateway 5.4.0 → 5.4.2

package/dist/bin/astrasync-codex-hook.js

@@ -3742,7 +3742,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3871,7 +3871,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {

package/dist/bin/astrasync-guard.js

@@ -3705,7 +3705,7 @@ Policy saved to ${outputPath}`);
 };
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4780,7 +4780,14 @@ function getCacheKey(request2, counterpartyId) {
     request2.callerMetadata?.sourceIp || "",
     request2.callerMetadata?.userAgent || "",
     request2.callerMetadata?.forwardedFor || "",
-    request2.callerMetadata?.agentCardUrl || ""
+    request2.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request2.commercePhase || "",
+    request2.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request2, counterpartyId) {

package/dist/bin/astrasync.js

@@ -36,7 +36,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    SDK_VERSION = "5.4.0";
+    SDK_VERSION = "5.4.1";
   }
 });
 
@@ -5182,7 +5182,14 @@ function getCacheKey(request2, counterpartyId) {
     request2.callerMetadata?.sourceIp || "",
     request2.callerMetadata?.userAgent || "",
     request2.callerMetadata?.forwardedFor || "",
-    request2.callerMetadata?.agentCardUrl || ""
+    request2.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request2.commercePhase || "",
+    request2.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request2, counterpartyId) {

package/dist/browser/background.js

@@ -3980,7 +3980,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -4109,7 +4109,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {