@astrasyncai/verification-gateway 5.4.0 → 5.4.2

package/dist/index.js

@@ -112,7 +112,7 @@ function getTrustLevel(score) {
 }
 
 // src/version.ts
-var SDK_VERSION = "5.4.0";
+var SDK_VERSION = "5.4.1";
 
 // src/http.ts
 var SDK_USER_AGENT = `astrasync-sdk/${SDK_VERSION}`;
@@ -293,7 +293,14 @@ function getCacheKey(request, counterpartyId) {
     request.callerMetadata?.sourceIp || "",
     request.callerMetadata?.userAgent || "",
     request.callerMetadata?.forwardedFor || "",
-    request.callerMetadata?.agentCardUrl || ""
+    request.callerMetadata?.agentCardUrl || "",
+    // UAT2 Bug B (5.4.1): the commerce phase and cart identity DO affect the
+    // backend verdict — the confirm leg is the ONLY leg that may execute
+    // first-party settlement. Without these, a confirm within the cache TTL of
+    // its start_checkout quote was served the cached quote-leg grant (no
+    // settlementOutcome) and never reached the backend. Same F-A1-07 bug class.
+    request.commercePhase || "",
+    request.checkoutSessionId || ""
   ].join("|");
 }
 function getCachedResult(request, counterpartyId) {
@@ -2675,7 +2682,13 @@ var VerificationGatewayClient = class {
       debug: options.debug,
       customHeaders: options.customHeaders,
       counterpartyUrl: options.counterpartyUrl,
-      counterpartyType: options.counterpartyType
+      counterpartyType: options.counterpartyType,
+      // 5.4.1 (UAT2): previously dropped here despite being a typed, documented
+      // GatewayConfig field — a client-driven confirmCheckout() could never
+      // identify its endpoint by ASTRAE id, so merchants with multiple
+      // endpoints on one origin (or a stale row sharing the URL) resolved
+      // non-deterministically by URL and could miss the first-party gate.
+      counterpartyId: options.counterpartyId
     };
     this.timeout = options.timeout || 1e4;
     this.retryConfig = options.retry || { maxRetries: 3, backoffMs: 1e3 };
@@ -2732,18 +2745,25 @@ var VerificationGatewayClient = class {
       jwt: options.jwt
     };
     return this.executeWithRetry(
-      () => verify(this.config, {
-        credentials,
-        purpose: options.purpose ?? "shopping",
-        action: options.action ?? "shopping.purchase",
-        transactionValue: options.transactionValue,
-        currency: options.currency,
-        commercePhase: "confirm",
-        checkoutSessionId: options.checkoutSessionId,
-        checkoutItems: options.checkoutItems,
-        counterpartyUrl: options.counterpartyUrl,
-        counterpartyType: options.counterpartyType
-      })
+      () => verify(
+        this.config,
+        {
+          credentials,
+          purpose: options.purpose ?? "shopping",
+          action: options.action ?? "shopping.purchase",
+          transactionValue: options.transactionValue,
+          currency: options.currency,
+          commercePhase: "confirm",
+          checkoutSessionId: options.checkoutSessionId,
+          checkoutItems: options.checkoutItems,
+          counterpartyUrl: options.counterpartyUrl,
+          counterpartyType: options.counterpartyType
+        },
+        // 5.4.1 (UAT2 Bug B): the confirm leg must always reach the backend —
+        // a cached quote-leg grant carries no settlementOutcome and would
+        // silently skip settlement.
+        { bypassCache: true }
+      )
     );
   }
   /**