portage-ucp 0.7.1 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 826f590ea83ab80febf6e461f60d1eb580d7ebf460a419bafb81d0f713525e81
-  data.tar.gz: eb98a54978daf0904de0121101e98e597a67cd38dabd7440dd3813449b384635
+  metadata.gz: 7615fe9307cfc4a996c1f1842bcad557e4b2f67b336516d0dc767f5cbfb88c7b
+  data.tar.gz: b220392e3d403db32f750805fb18ec008b8c7c23a55f6f15ce0a6cddc71be8ff
 SHA512:
-  metadata.gz: fcb26f95ac6d46b622f3495b945f76549d4c7525c25fbe0552c3485659395e35e1e0330fe212052f253ba79680d498e9de0b179d91c9bee17a4f2796ec33c50c
-  data.tar.gz: 4726bf3de6e45993612ea7a2c4bfd57ef418ad1a7c1d1a17efdffa90d20991df0fe9f623548f81065383b31aa99fd7210c2512d7994f6521a4bb6cfcfc494c1c
+  metadata.gz: 9664fd1f78821b3afeac62b2fd9cd09971e9daa279aa65e4f1de44ebe7989ccc5d180e7efc0fe9b9ab6b4ca0320a851dd045aae5f736e44bcb64a237b4ac948e
+  data.tar.gz: 1f2bc7debcc1afb3f54fa4e6072391c76f3347df24e462488db69ab33e67c92fca6129dc6d1b18442e503a7d53f3b2ca2f5f284061e88cf9c4793e42f02ea6b9

data/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to this project are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/en/1.0.0/); this project is
 pre-1.0, so APIs may still shift between minor versions.
 
+## [0.8.0] - 2026-09-17
+
+- **Breaking:** `Manifest#to_h` now emits the shape live UCP stores actually
+  serve (confirmed against Shopify's `2026-08-25` rollout) instead of the
+  flat one this gem invented: everything nests under a top-level `ucp`
+  object, `ucp_version` becomes `version`, and `capabilities` is keyed by
+  capability name (`{"dev.ucp.shopping.catalog" => [{version: ...}]}`)
+  rather than an array of `{name:, version:}` hashes. When a signer is
+  configured the signature still covers the manifest body and rides inside
+  the `ucp` object. Anything reading a Portage-served manifest by the old
+  top-level keys needs updating — `Rack::ManifestEndpoint`'s own
+  advertised-payment check and `skills/serve-via-ucp`'s `verify.sh` both
+  did, and are fixed here.
+
 ## [0.7.1] - 2026-09-16
 
 - No behavior change — 0.7.0 was built and pushed with `gem build` run from

data/lib/portage/ucp/manifest.rb

@@ -31,24 +31,31 @@ module Portage
         @services = services
       end
 
+      # Nests everything under a "ucp" envelope, and keys `capabilities` by
+      # capability name (matching what live Shopify UCP rollouts — Casper,
+      # Allbirds, Glossier, and 34+ others — actually serve as of manifest
+      # "version": "2026-08-25"; see docs/well-known-ucp.md and
+      # portage-ucp-client's Client.discover, which this shape now matches).
       def to_h
-        payload = {
-          ucp_version: UCP_VERSION,
+        ucp = {
+          version: UCP_VERSION,
           business: @business,
           services: @services,
-          capabilities: @registry.advertised(@adapter).map do |capability|
-            { name: capability.name, version: capability.version }
-          end,
+          capabilities: capability_hash,
           payment_handlers: @payment_handlers,
           signing_keys: @signing_keys
         }
-        return payload unless @signer
+        ucp = ucp.merge(signature: sign(ucp)) if @signer
 
-        payload.merge(signature: sign(payload))
+        { ucp: ucp }
       end
 
       private
 
+      def capability_hash
+        @registry.advertised(@adapter).to_h { |capability| [capability.name, [{ version: capability.version }]] }
+      end
+
       def sign(payload)
         canonical = JSON.generate(payload)
         { kid: @signer.kid, value: Base64.strict_encode64(@signer.sign(canonical)) }

data/lib/portage/ucp/rack/manifest_endpoint.rb

@@ -32,7 +32,7 @@ module Portage
         def payment_handlers_over_plaintext?(payload, request)
           return false if @allow_insecure || request.ssl?
 
-          !Array(payload[:payment_handlers]).empty?
+          !Array(payload.dig(:ucp, :payment_handlers)).empty?
         end
 
         def not_found

data/lib/portage/ucp/version.rb

@@ -1,5 +1,5 @@
 module Portage
   module Ucp
-    VERSION = "0.7.1".freeze
+    VERSION = "0.8.0".freeze
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: portage-ucp
 version: !ruby/object:Gem::Version
-  version: 0.7.1
+  version: 0.8.0
 platform: ruby
 authors:
 - Tom Whitbread
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-16 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -138,7 +137,6 @@ dependencies:
         version: '0.9'
 description: 'Protocol-only core gem: Adapter contract, capability registry, manifest
   builder, and an MCP server wrapper. No commerce-backend deps.'
-email:
 executables:
 - portage-ucp-check
 extensions: []
@@ -293,7 +291,6 @@ metadata:
   source_code_uri: https://github.com/tomtom87/Portage/tree/main/portage-ucp
   changelog_uri: https://github.com/tomtom87/Portage/blob/main/portage-ucp/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -308,8 +305,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.21
 specification_version: 4
 summary: Expose a commerce backend to AI shopping agents over MCP and UCP
 test_files: []