portage-ucp-bigcommerce 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d4f9361bb29e57f06919220ed2a975c5c36ab6a1777cb0e664dafb9b67c45587
-  data.tar.gz: a0af7c70e6319a3e153ab7e978bad7b19de828c0c764b0376f993df256aecb3e
+  metadata.gz: abe1a96bd9cf583809c3dfd5eb83f1a17bfea79e2b59a56d3b12591f83376bc5
+  data.tar.gz: 1e8596629873156558901b60333919ea1f17a9405471f11d3e36ed6beac05692
 SHA512:
-  metadata.gz: 3d191617b9d74d7d1026b6dfa9999d17dae90dae35ea745e20ba96801a973e787b38a51b7bae03c7fa5689aaf42206e3e94466d92578b7957ecaf76b78113c67
-  data.tar.gz: df8a085c93246e691314ba9c0eef253f6f8c2232bc15a27bdef112b28096a16830c7c9156f2704f516ecaa7dee98d106b615b854f27e9536ad960e97d00c7301
+  metadata.gz: 1746834fbc6c6ebbad41e8f21b62f4036f6c302786cea915b3a1073cd6e3794cc24b9c3ff5c69f3c8b67935a52722e9f633b0fd7113656c7101a649c6ca1da22
+  data.tar.gz: 32bc784dd25432905e9ceaadac0f8a8d436a5f2a94b4422f6fb59b85f4972b3967ddeabca0f8d9c787f287fd8015db99b4e19025bfa3829dc51cf7636e656626

data/CHANGELOG.md

@@ -1,203 +1,46 @@
 # Changelog
 
-Repo-level changes — the workspace, its shared docs, and anything spanning more
-than one gem. Each gem keeps its own `CHANGELOG.md` for its own API; look there
-for changes to `portage-ucp`, an adapter, the client, or the CLI.
-
-Format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/);
-this project is pre-1.0, so APIs may still shift between minor versions.
-
-## [0.7.0] - 2026-09-16
-
-- `portage-ucp` bumps to 0.7.0: cryptographic AP2 mandate signature
-  verification (`Ap2::MandateSignature`, real ECDSA against a JWK trust-anchor
-  set, plus a `require_signature:` fail-closed option on `MandateGuard`,
-  closing the gap 0.6.0's shape-only mandate validation left open), a
-  cross-process idempotency race fix (`FileStore#fetch_or_store`, atomic
-  temp-file-plus-rename persistence, a poisoned-file rescue, reaped per-key/
-  per-session locks, and a new `Configuration#idempotency_provider`), a
-  `Rails::Railtie` + `rails g portage:ucp:install` generator, opt-in
-  OpenTelemetry span emission alongside the existing JSON logging, and
-  `Mcp::Server.build(journal:)` — naming the seam `portage-cli` now wires a
-  real journal through (see below) — plus `#each_record`/`#all` on
-  `TransactionLog`/`OrderLedger`. See `portage-ucp`'s own `CHANGELOG.md`.
-- `portage-cli` bumps to 0.5.0 for `portage-console` (a read-only IRB REPL
-  over the local transaction/order/journal stores), `portage generate
-  adapter` (scaffolds a new adapter gem), `portage doctor` (sanity-checks a
-  seller's `Portage::Ucp.configuration`), and wiring a real
-  `PurchaseJournal` into `portage buy`'s own-store loopback path — that path
-  previously left the journal empty even though `portage-console` above
-  could read one. New runtime dependency on `portage-ucp-journal` (`~> 0.1`,
-  still unpublished — see 0.6.0's entry below).
-- `portage-ucp-shopify` bumps to 0.4.2 for a fix to `GraphqlError` crashing
-  instead of surfacing Shopify's real message when `errors` comes back as a
-  bare string, plus a new live-store buyer-journey spec.
-- `portage-ucp-client`, `portage-ucp-wix`, `portage-ucp-bigcommerce`,
-  `-woocommerce`, `-etsy`, `-magento`, and `-instagram` all take pin-only
-  patch releases (no behavior change) so each can install alongside
-  `portage-ucp` 0.7.0: their previously-published `~> 0.6` pin is
-  pessimistic and excludes 0.7.x. `portage-ucp-journal`'s `portage-ucp`
-  dependency (development-only, not a runtime dependency) also widens to
-  `~> 0.7` in its gemspec, with no release of its own needed since it
-  remains unpublished.
-
-## [0.6.0] - 2026-09-15
-
-- **Fix:** `portage-ucp-woocommerce`, `-bigcommerce`, `-magento`, `-etsy`, and
-  `-instagram` all bump to 0.1.1 for a standing bug, unrelated to the
-  `portage-ucp` work below and predating it: each `Mapper.product` built a
-  `Portage::Ucp::Product`/`Variant` with keywords (`price:`, `available:`)
-  `dev.ucp.shopping.catalog`'s schema-conformance work removed in favor of
-  `price_range:`/a real `variants:` array (see that work's own changelog
-  entries, back when only `portage-ucp-shopify` and `-wix` got their mappers
-  migrated) — every real `search_catalog`/`get_product` call against these
-  five adapters raised `ArgumentError: missing keyword: :price_range`. Each
-  adapter's `#search_catalog`/`#get_product` also returned a bare
-  `Array<Product>`/`Product` instead of the `CatalogSearchResult`/
-  `ProductDetail` wrapper the `Adapter` contract documents, which would have
-  failed UCP schema validation even once the first bug was fixed. Caught by
-  running the core gem's schema-validation conformance examples (added
-  earlier for the payment-enrollment slice below) against every adapter,
-  not just Shopify/Wix's specs, which asserted the same wrong shape their
-  mappers produced.
-
-- `portage-ucp` bumps to 0.6.0 for the §22/§33-§35 payment-enrollment and
-  signature-verification slice: `PaymentEnrollmentGuard` (validates every
-  `create_payment_enrollment`/`get_payment_enrollment` response — breaking,
-  raises `InvalidPaymentEnrollmentError` on a malformed one), an AP2 mandate
-  shape (`Ap2::PaymentMandate`/`Ap2::MandateGuard`, shape-only — no
-  cryptographic verification), a `Store`/`FileStore` extraction under
-  `Support::TransactionLog`/`Support::OrderLedger` so either can be backed
-  by something other than a file, `app.portage-ucp.payment_method` /
-  `saved_address` / `shopper_data` extensions, `Dispatcher.new(journal:)`
-  wiring for the new `portage-ucp-journal` gem, RFC 9421 HTTP Message
-  Signature verification (`Security::Signature`,
-  `Rack::SignatureVerification`) for inbound requests, and
-  `Confirmer::Webhook` — an out-of-band approval path for the confirmation
-  gate (POST + poll, or a caller-supplied `wait:` callback), alongside the
-  existing `Terminal`/`AutoApprove` confirmers. See `portage-ucp`'s own
-  `CHANGELOG.md`.
-- `portage-ucp-journal` is a new gem (0.1.0, not yet published to
-  RubyGems): a buyer-side purchase journal plus the injectable `Store`
-  abstraction `portage-ucp`'s own `Store`/`FileStore` split now mirrors.
-- `portage-cli` bumps to 0.4.1, `portage-ucp-client` to 0.3.1,
-  `portage-ucp-shopify` to 0.4.1, and `portage-ucp-wix` to 0.1.1 — pin-only
-  releases (no behavior change) so each can install alongside `portage-ucp`
-  0.6.0: their previously-published `~> 0.5` (`~> 0.5` for `-wix`'s 0.1.0)
-  pin is pessimistic and excludes 0.6.x. Every other gem's `portage-ucp` pin
-  also widens to `~> 0.6` in its gemspec, with no release of its own needed
-  beyond what's already covered above.
-
-## [0.5.0] - 2026-09-14
-
-- `portage-ucp` bumps to 0.5.0 for the agentic-payments work (docs/plans/agentic-payments.md):
-  `Adapter#create_payment_enrollment`/`#get_payment_enrollment` (card-on-file
-  enrollment without the card touching this process), a durable
-  `Support::TransactionLog` wired into `complete_checkout` dispatch,
-  `PolicyGuard`/`Policy` (per-transaction/rolling caps, velocity, merchant
-  allowlist, per-token enrollment scopes), a `Confirmer` gate
-  (`Terminal`/`AutoApprove`) run just before dispatch, a durable
-  `Support::OrderLedger` snapshot written after settlement, `_meta`
-  `ucp-agent.profile` threading alongside the existing `traceparent`
-  correlation id, and `Adapter#lookup_catalog(ids:)` for batch product
-  fetch by id — see `portage-ucp`'s own `CHANGELOG.md`.
-- `portage-cli` bumps to 0.4.0 for `portage payment list/enroll/set-default/
-  remove/freeze/revoke` (Keychain / Secret Service / env-var-only storage)
-  and `portage policy show/set`, both driving the new `portage-ucp` policy
-  and enrollment capabilities.
-- `portage-ucp-client` bumps to 0.3.0 for `Session#create_payment_enrollment`/
-  `#get_payment_enrollment` and an optional `meta:` kwarg threaded through
-  every transport.
-- `portage-ucp-shopify` bumps to 0.4.0 for `Adapter#lookup_catalog(ids:)`,
-  fetching several known product ids in one round trip via the Admin API's
-  `nodes(ids:)` field.
-- Every adapter gemspec and `portage-cli` widen their `portage-ucp` pin to
-  `~> 0.5` (and `portage-cli`'s `portage-ucp-client` pin to `~> 0.3`) for the
-  capabilities above; only `portage-ucp`, `portage-ucp-shopify`,
-  `portage-ucp-client`, and `portage-cli` have ever been published to
-  RubyGems.
-
-## [0.4.0] - 2026-08-28
-
-- `portage-cli` bumps to 0.3.0 for `portage compare` (§22's "find this same
-  item elsewhere" mode) and `portage history` (local purchase/search log),
-  plus a fix for a `search_catalog` envelope-unwrapping bug that had been
-  producing malformed offers against every real store since 0.2.0 — see
-  `portage-cli`'s own `CHANGELOG.md`.
-- `portage-ucp` bumps to 0.4.0 for the `app.portage-ucp.reorder` capability,
-  per-request correlation ids threaded through `Dispatcher`/`Mcp::Server`/
-  `CheckoutState` for observability, and a widened `Observability::REDACTED_KEYS`
-  covering the PII fields that actually flow through logged events — see
-  `portage-ucp`'s own `CHANGELOG.md`.
-- `portage-ucp-shopify` bumps to 0.3.1 to widen its `portage-ucp` dependency
-  pin from `~> 0.3` to `~> 0.4` — no code change of its own. Every other
-  adapter gemspec and `portage-ucp-client` got the same pin widened, but
-  none has published a version yet, so there's no install-breakage to fix
-  for them beyond keeping the constraint correct ahead of their first
-  release.
-- `portage-cli` and `portage-ucp` are the only two gems in this release with
-  behavior changes; `portage-ucp` and `portage-ucp-shopify` remain the only
-  two gems ever published to RubyGems.
-
-## [0.3.0] - 2026-08-27
-
-- All seven adapter gems now run the core gem's conformance kit against their
-  real `Adapter` through a real `Dispatcher`
-  (`spec/portage/ucp/<platform>/conformance_spec.rb`), closing the follow-up
-  design-log §17 left open when the kit shipped. No adapter needed
-  body-matching stubs: the kit's reachable surface stops at `create_checkout`.
-- Core gem's `~> 0.2` dependency pin widened to `~> 0.3` in every adapter,
-  `portage-cli`, and `portage-ucp-client` gemspec.
-- `portage-ucp` and `portage-ucp-shopify` both bump to 0.3.0 — see each
-  gem's own `CHANGELOG.md` for `Support::Retry`, `Support::SessionLock`, the
-  Shopify metadata_field config DSL, and the Shopify GraphQL shape fixes
-  driving the bump. `portage-cli` and `portage-ucp-client` are unchanged and
-  stay at 0.2.0.
-
-## [0.2.0] - 2026-08-21
-
-### Added
-
-- `~/.portage/` — the first state anything here keeps outside the project
-  directory. `stores.yml` is the store allowlist you curate; the CLI writes
-  `discovery-cache.json` to remember which origins answered
-  `/.well-known/ucp`, so a URL-less search doesn't re-probe the same hosts on
-  every run. Both are the CLI's, and both are documented in
-  [`portage-cli`](portage-cli/README.md).
-- Search-backend credentials as configuration that belongs to no adapter:
-  `BRAVE_SEARCH_API_KEY`, `GOOGLE_CSE_KEY` / `GOOGLE_CSE_CX`, and
-  `PORTAGE_STORES`. The per-adapter variables in the root README's
-  Requirements table decide which platforms the CLI can buy from; these decide
-  which stores it can propose in the first place, so they sit outside that
-  table.
-- Root `CHANGELOG.md` (this file) — every gem already had one, the workspace
-  itself didn't.
-- `docs/walkthrough.md` and `docs/well-known-ucp.md`: the agent-buys-a-snowboard
-  walkthrough and the `/.well-known/ucp` rationale, moved out of the root README
-  so it opens on how to install and run the thing.
-- A `## License` section in every adapter gem's README — all seven shipped a
-  `LICENSE` file without pointing at it.
-- `docs/design-log.md` §15: how the CLI finds a store when the user has no URL,
-  and why the search step uses documented APIs rather than a scraped results
-  page. Ships alongside `portage find` in `portage-cli`.
-
-### Changed
-
-- Root README's gem table describes both ways into the CLI — `portage buy
-  <url>` when you know the shop, and `portage find --query "..."` when you
-  don't.
-- Root README follows the `bundle gem` section order: Installation and Usage
-  come first, then the gem table, then everything else. The table of contents
-  now matches the rendered order (Requirements had been listed last and rendered
-  second).
-- Root README's Requirements section is a per-adapter env-var table linking each
-  adapter's own README, instead of restating credential setup those READMEs
-  already own.
-- Every README names its how-to-run section `## Usage`, replacing the mix of
-  `Quickstart` (core, client) and `Using the adapter directly` (adapters).
-
-## [0.1.0] - 2026-08-14
-
-- Initial release: ten gems, published to RubyGems. See each gem's own
-  `CHANGELOG.md` for what it ships, and the [design log](docs/design-log.md)
-  for the rationale behind the split.
+All notable changes to this project are documented here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/en/1.0.0/); this project is
+pre-1.0, so APIs may still shift between minor versions.
+
+## [0.1.4] - 2026-09-17
+
+- No behavior change — widens the `portage-ucp` dependency pin to `~> 0.8`
+  so this gem can install alongside `portage-ucp` 0.8.0 (the `~> 0.7` pin
+  published with 0.1.3 is pessimistic and excludes it).
+
+## [0.1.3] - 2026-09-16
+
+- No behavior change — 0.1.2 was built and pushed with `gem build` run from
+  the workspace root instead of this gem's own directory, so `spec.files =
+  Dir[...]` resolved against the wrong working directory and packaged an
+  empty gem. 0.1.2 has been yanked; 0.1.3 repackages the exact same 0.1.2
+  code correctly.
+
+## [0.1.2] - 2026-09-16
+
+- No behavior change — widens the `portage-ucp` dependency pin to `~> 0.7`
+  so this gem can install alongside `portage-ucp` 0.7.0 (the pessimistic
+  `~> 0.6` pin published with 0.1.1 excludes it).
+
+## [0.1.1] - 2026-09-15
+
+- **Fix:** `Mapper.product`/`.variants` built `Portage::Ucp::Product`/`Variant`
+  with the pre-schema `price:`/`available:` keywords core dropped when
+  `dev.ucp.shopping.catalog` became schema-conformant — every real
+  `search_catalog`/`get_product` call raised `ArgumentError: missing keyword:
+  :price_range`. Now builds `Description`/`Price`/`PriceRange` objects and a
+  real `Variant` array, matching `Shopify`/`Wix`'s mappers.
+- **Fix:** `Adapter#search_catalog` returned a bare `Array<Product>` instead
+  of the `CatalogSearchResult` the `Adapter` contract documents — its wire
+  form has no `products` wrapper, so it never validated against UCP's
+  `catalog_search.json` response schema.
+- **Fix:** `Adapter#get_product` returned a bare `Product` instead of
+  `ProductDetail`, so its wire form had no `product` wrapper either, for the
+  same reason as `search_catalog` above.
+
+## [0.1.0] - Unreleased
+
+- Initial pre-release. BigCommerce adapter against the v3 Catalog/Carts/
+  Checkouts APIs and v2 Orders API.