agentscore-commerce 3.2.0__tar.gz → 3.2.2__tar.gz

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/.github/workflows/ci.yml

@@ -22,12 +22,12 @@ jobs:
       - uses: useblacksmith/checkout@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.2.0
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.12.23"
+          version: "0.13.1"
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install 3.15
 
       - uses: actions/cache@v6
         with:
@@ -38,7 +38,7 @@ jobs:
           restore-keys: ${{ runner.os }}-uv-
 
       - name: Install dependencies
-        run: uv sync --frozen --all-extras
+        run: uv sync --frozen --all-extras --python 3.15
 
       - name: Ruff check
         run: uv run ruff check .
@@ -69,9 +69,9 @@ jobs:
       - uses: useblacksmith/checkout@v1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.2.0
+        uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.12.23"
+          version: "0.13.1"
 
       - name: Set up Python
         run: uv python install ${{ matrix.python }}

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/.github/workflows/publish.yml

@@ -19,9 +19,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.12.23"
+          version: "0.13.1"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/.github/workflows/security.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.7.0/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies
@@ -39,12 +39,12 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: useblacksmith/checkout@v1
-      - uses: astral-sh/setup-uv@v10.2.0
+      - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.12.23"
+          version: "0.13.1"
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.13"
+          python-version: "3.15"
 
       - name: Install pip-audit
         run: pip install pip-audit

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentscore-commerce
-Version: 3.2.0
+Version: 3.2.2
 Summary: Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce.
 Project-URL: Homepage, https://www.agentscore.com
 Project-URL: Repository, https://github.com/agentscore/python-commerce
@@ -23,7 +23,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.11
-Requires-Dist: agentscore-py>=2.8.0
+Requires-Dist: agentscore-py>=2.8.1
 Requires-Dist: httpx<1.0.0,>=0.25.0
 Provides-Extra: aiohttp
 Requires-Dist: aiohttp>=3.8.0; extra == 'aiohttp'

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/agentscore_commerce/identity/ucp_jwks.py

@@ -2,7 +2,7 @@
 
 UCP §6 (https://ucp.dev/latest/specification/signatures/) requires that profiles
 published at ``/.well-known/ucp`` carry a JWKS-backed signature for trust-mode clients
-(Google AI Mode, Gemini commerce, future ChatGPT app shells). Without a signature,
+(Google Search AI Mode, Gemini commerce, future ChatGPT app shells). Without a signature,
 trust-mode clients reject the profile.
 
 This module provides:
@@ -583,9 +583,11 @@ def _build_env_signing_key(
 
         try:
             jwk_dict = json.loads(env_jwk)
-        except json.JSONDecodeError as exc:
-            msg = f"{env_jwk_var} is not valid JSON: {exc}"
-            raise ValueError(msg) from exc
+        except json.JSONDecodeError:
+            # The decode error holds the whole value in ``.doc``, which here is
+            # private key material, so it is not chained onto what is raised.
+            msg = f"{env_jwk_var} is not valid JSON."
+            raise ValueError(msg) from None
 
         if not isinstance(jwk_dict, dict) or not jwk_dict:
             msg = f"{env_jwk_var} must be a non-empty JWK object; got {type(jwk_dict).__name__}."

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "3.2.0"
+version = "3.2.2"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
@@ -12,7 +12,7 @@ requires-python = ">=3.11"
 keywords = ["agentscore", "agentic-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.8.0",
+    "agentscore-py>=2.8.1",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",

{agentscore_commerce-3.2.0 → agentscore_commerce-3.2.2}/tests/test_load_ucp_signing_key_from_env.py

@@ -191,6 +191,15 @@ def test_malformed_json_raises_naming_env_var(monkeypatch) -> None:
         load_ucp_signing_key_from_env()
 
 
+def test_malformed_json_keeps_env_value_out_of_the_error(monkeypatch) -> None:
+    monkeypatch.setenv("UCP_SIGNING_KEY_JWK_PRIVATE", '{"secret":SENSITIVEBYTES}')
+    with pytest.raises(ValueError) as info:
+        load_ucp_signing_key_from_env()
+    assert "SENSITIVE" not in str(info.value)
+    assert info.value.__cause__ is None
+    assert info.value.__suppress_context__ is True
+
+
 def test_unsupported_kty_crv_raises_naming_actual(monkeypatch) -> None:
     monkeypatch.setenv(
         "UCP_SIGNING_KEY_JWK_PRIVATE",