portage-ucp 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7888232b409966ef29fae287d17d6af418dd676e12ad53a7ef7d30d7178f6ae6
-  data.tar.gz: e967bbb103d6911ca4ed8d4fb1204687cd8a2c7a51e3ab7675db5420b7eb0623
+  metadata.gz: 37b246e100783b94c0de9a89bdf4093123a45ae87b397202d63fa845847366d1
+  data.tar.gz: bfb928d1fd3e5cebff958ecd38cc5c3076ead011b0931cfd497fb2bea70fb64e
 SHA512:
-  metadata.gz: 3f78f566ac2ee41da063ae9a96a658707bf481f8f9ee791e288fc2d78ce0325ed147c2423a137b06350b3ddb5f64f09c17a5ba6967894e7795ef72c90d6f1384
-  data.tar.gz: 61a0ec7f01125fb8da2e0eb74fdc03b50d4fc94e38a3863e8366b1932cc871ab3787253d3199845a4a18a1902245fb7b2d3ca336b2bd896a82c4ce011d187f5b
+  metadata.gz: fce92b2376dbbce4849a2bda592a3162096f5d472f5d4b222dfe5f8449bdea62bd6ed32ff32db451864080b883c5c50fb7c5165e524dbfe10a58ee04c17e33c5
+  data.tar.gz: 9fea9246766b51b2819564732f3af0b4ac0a933a2797c97ad5fe75af88122e7eaeb95681f47631cc1f71d9528876b5c68224fce6ee055474633238c48c0a97d4

data/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.0.0/); this project is
 pre-1.0, so APIs may still shift between minor versions.
 
+## [Unreleased]
+
+## [0.11.0] - 2026-09-29
+
+- `Portage::Ucp::Check` (and `portage-ucp-check`) now follows a `<link rel="ucp" href="...">`
+  manifest pointer in the homepage when `/.well-known/ucp` is missing, the same fallback
+  `portage buy` uses. The report adds `manifest_url` when the manifest came from that link.
+
+- Documentation only, no code change. Fixes two wrong comments. `Authenticator`
+  pointed at a `mutating_only:` option that `Mcp::Server.build` doesn't have:
+  it only authenticates tools whose adapter method takes `idempotency_key:`,
+  and no option changes that. `Manifest#to_h` read as if this manifest reports
+  `"version": "2026-08-25"`. That is what live Shopify stores serve. This
+  manifest reports `UCP_VERSION`, `"2026-04-08"`.
+
 ## [0.10.0] - 2026-09-25
 
 - **Proxy support** (`docs/plans/proxy-support.md` Phases 1 and 3).

data/README.md

@@ -19,7 +19,7 @@ in this gem.
 | `Portage::Ucp::Adapter` | The contract your backend implements — override only the catalog/cart/checkout/order/identity methods you support; the rest stay unadvertised. |
 | `Portage::Ucp::CapabilityRegistry` | Figures out which capabilities an `Adapter` actually backs. |
 | `Portage::Ucp::Dispatcher` | Routes a capability+action call to the right `Adapter` method. |
-| `Portage::Ucp::Mcp::Server` | Wraps an `Adapter` as an MCP server — one `MCP::Tool` per advertised action, stdio or Streamable HTTP. |
+| `Portage::Ucp::Mcp::Server` | Wraps an `Adapter` as an MCP server — one `MCP::Tool` per advertised action; serve it over stdio or Streamable HTTP with the `mcp` gem's transports. |
 | `Portage::Ucp::Manifest` | Builds the signed `/.well-known/ucp` discovery document. |
 | `Portage::Ucp::Rack::ManifestEndpoint` | Serves that manifest over Rack. |
 | `Portage::Ucp::Rack::WebhookEndpoint` | HMAC-verified inbound order-lifecycle webhooks. |
@@ -32,7 +32,7 @@ in this gem.
 | `Portage::Ucp::PolicyGuard` / `Portage::Ucp::Policy` | Per-transaction/rolling/velocity caps and a merchant allowlist, checked before `complete_checkout` dispatch; configured via `portage-cli`'s `portage policy show/set`. |
 | `Portage::Ucp::Support::OfferRanking` / `Portage::Ucp::Support::Escalation` | The offer-ranking rule (buyable, then priced, then cheapest, ties stable) and the escalation rule (`requires_escalation`, then a mismatch). `portage-ucp-decision` wraps both as typed verdicts; `portage-cli` calls them directly. |
 | `Portage::Ucp::PaymentEnrollmentGuard` | Validates every `create_payment_enrollment`/`get_payment_enrollment` result an `Adapter` returns — `status` must be `"pending"` (with a `setup_url`, no `payment_token`) or `"complete"` (with a `payment_token`, no `setup_url`). Runs automatically in `Dispatcher#call`. |
-| `Portage::Ucp::Ap2::PaymentMandate` / `Portage::Ucp::Ap2::MandateGuard` | A typed shape for an AP2 payment mandate, and shape-only validation (required fields + expiry — not cryptographic verification) run automatically on any `mandate:` argument passed through `Dispatcher#call`. |
+| `Portage::Ucp::Ap2::PaymentMandate` / `Portage::Ucp::Ap2::MandateGuard` | A typed shape for an AP2 payment mandate, and validation (required fields + expiry, plus signature verification when `mandate_trusted_keys` is configured) run automatically on any `mandate:` argument passed through `Dispatcher#call`. |
 
 Security defaults are all locked down, not permissive-by-omission —
 `UnconfiguredAuthenticator` rejects every mutating call until you configure a real

data/lib/portage/ucp/authenticator.rb

@@ -4,10 +4,11 @@ module Portage
     #   tool call, return an auth context (any truthy value) or raise
     #   Portage::Ucp::AuthenticationError. There is deliberately no default that
     #   allows anonymous mutation — an unconfigured server rejects every
-    #   mutating capability call (see UNCONFIGURED below). Read-only catalog
-    #   calls MAY be left open at the consumer's explicit choice by not
-    #   requiring authentication for those specific actions (see
-    #   Mcp::Server.build's `mutating_only:`).
+    #   mutating capability call (see UnconfiguredAuthenticator below).
+    #   Mcp::Server.build calls it only for mutating tools: those whose
+    #   adapter method takes `idempotency_key:`. Every other tool (catalog
+    #   search, product, cart, checkout and order lookups) never reaches it,
+    #   and Server.build has no option to change that.
     class Authenticator
       def call(_server_context)
         raise NotImplementedError, "#{self.class} must implement #call"

data/lib/portage/ucp/check.rb

@@ -8,7 +8,9 @@ module Portage
     # `portage-ucp-check <url>` — point it at any storefront and find out what
     # portage-ucp can do with it. Checks for a native `/.well-known/ucp`
     # manifest first (the store may already speak UCP without this gem, see
-    # README's "Why /.well-known/ucp?"); if there isn't one, detects the
+    # README's "Why /.well-known/ucp?"), then a `<link rel="ucp" href=...>`
+    # manifest pointer in the homepage (the same fallback `portage buy`
+    # follows); if there isn't one, detects the
     # commerce platform from the page itself (see Resolver) and names
     # the matching portage-ucp-<adapter> gem — probing it live when that
     # adapter's env vars are already set, so "best match" means a
@@ -30,6 +32,10 @@ module Portage
         return { url: @uri.to_s, native_ucp: manifest } if manifest
 
         body, headers = fetch_homepage
+        linked = manifest_link(body)
+        manifest = linked && fetch_json(linked)
+        return { url: @uri.to_s, native_ucp: manifest, manifest_url: linked.to_s } if manifest
+
         platform = Resolver.detect_platform(body, headers)
 
         report = { url: @uri.to_s, native_ucp: nil, platform: platform&.name, recommended_gem: platform&.gem }
@@ -42,7 +48,11 @@ module Portage
       def fetch_manifest
         manifest_uri = @uri.dup
         manifest_uri.path = MANIFEST_PATH
-        response = get(manifest_uri)
+        fetch_json(manifest_uri)
+      end
+
+      def fetch_json(uri)
+        response = get(uri)
         return nil unless response.is_a?(Net::HTTPSuccess)
 
         JSON.parse(response.body)
@@ -59,6 +69,18 @@ module Portage
         [nil, {}]
       end
 
+      # `<link rel="ucp" href="...">` in either attribute order, resolved
+      # against the store URL.
+      def manifest_link(body)
+        return nil unless body
+
+        match = body.match(/<link[^>]+rel=["']ucp["'][^>]+href=["']([^"']+)["']/i) ||
+                body.match(/<link[^>]+href=["']([^"']+)["'][^>]+rel=["']ucp["']/i)
+        match && URI.join(@uri, match[1])
+      rescue URI::Error
+        nil
+      end
+
       def probe(platform)
         env = Resolver.env_for(platform)
         missing = Resolver.missing_env(platform, env)

data/lib/portage/ucp/manifest.rb

@@ -32,10 +32,11 @@ module Portage
       end
 
       # Nests everything under a "ucp" envelope, and keys `capabilities` by
-      # capability name (matching what live Shopify UCP rollouts — Casper,
-      # Allbirds, Glossier, and 34+ others — actually serve as of manifest
-      # "version": "2026-08-25"; see docs/well-known-ucp.md and
-      # portage-ucp-client's Client.discover, which this shape now matches).
+      # capability name. That is the shape live Shopify UCP rollouts (Casper,
+      # Allbirds, Glossier, and 34+ others) serve under their own manifest
+      # "version": "2026-08-25", and the shape portage-ucp-client's
+      # Client.discover reads. Only the shape is borrowed: `version` here is
+      # still UCP_VERSION ("2026-04-08"), the spec revision this gem targets.
       def to_h
         ucp = {
           version: UCP_VERSION,

data/lib/portage/ucp/version.rb

@@ -1,5 +1,5 @@
 module Portage
   module Ucp
-    VERSION = "0.10.0".freeze
+    VERSION = "0.11.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: portage-ucp
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - Tom Whitbread
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-25 00:00:00.000000000 Z
+date: 2026-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64