@astrasyncai/verification-gateway 5.4.0 → 5.4.2

package/dist/gateway/gateway.d.mts

@@ -1,6 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-z_RNjHWm.mjs';
-import '../types-CD1F9fmp.mjs';
-import '../metadata-capture.mjs';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-CfBpm3w5.mjs';
+import '../types-BfILnheI.mjs';
 
 /**
  * Hybrid Mode — Local evaluation for speed, async API sync for trust scoring.

package/dist/gateway/gateway.d.ts

@@ -1,6 +1,5 @@
-import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-DGh2akuh.js';
-import '../types-76TB0fxW.js';
-import '../metadata-capture.js';
+import { a as AstraSyncGatewayConfig, P as PDLSSContext, V as VerificationDecision } from '../types-BRz2U0Pn.js';
+import '../types-BfILnheI.js';
 
 /**
  * Hybrid Mode — Local evaluation for speed, async API sync for trust scoring.

package/dist/gateway/gateway.js

@@ -3740,7 +3740,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -3869,7 +3869,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {