Release 0.3.0 — orders, webhooks, grants - #115
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6092cb5f3b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "@modelcontextprotocol/ext-apps": "^1.0.0", | ||
| "@modelcontextprotocol/sdk": "^1.29.0", | ||
| "@openmobilehub/credentagent-gate": "^0.2.0", | ||
| "@openmobilehub/credentagent-gate": "^0.3.0", |
There was a problem hiding this comment.
Regenerate and commit package-lock.json with this dependency/version bump. The lockfile still records gate 0.2.0, storefront 0.2.1, and this dependency as ^0.2.0 at package-lock.json:5311-5348; running npm install --package-lock-only changes those entries, so release/SBOM tooling that reads the committed lock reports the previous packages and routine installs leave an unexpected lockfile diff.
Useful? React with 👍 / 👎.
| const g = await credentagent.grants.retrieve(grant.id); | ||
| if (g.status === "authorized") { |
There was a problem hiding this comment.
Use a null-safe check such as if (g?.status === "authorized"). Grants.retrieve() returns Promise<Grant | null>, so TypeScript users copying this new published example receive a strict-null-check error on g.status even though this particular in-memory happy path normally finds the freshly created grant.
Useful? React with 👍 / 👎.
| direct use: | ||
|
|
||
| ```ts | ||
| const gate = new DelegatedGate({ catalog: { coffee: 18 } }); |
There was a problem hiding this comment.
Add an import for DelegatedGate to this direct-use snippet. The earlier import was removed when the Grants example was introduced, and neither the Grants block nor this block now defines the symbol, so copying the documented low-level example fails with Cannot find name 'DelegatedGate' or a runtime ReferenceError.
Useful? React with 👍 / 👎.
Version bump for both packages (gate dep → ^0.3.0 in the storefront). Since 0.2.0: - credentagent.orders.* + orders.serve(app) — the checkout in one call (#98) - credentagent.webhooks — signed HTTP order.settled + constructEvent (#102) - credentagent.grants.* + grants.serve(app) — approve once, spend while away; allow bounds, typed GrantDoorCode, immutable sealed bounds, refusal replay (#112) - OrderDoorCode typed union (#111); demo hub + guarantees (#112) README: adds the missing Grants section (published docs must match the surface); honesty labels unchanged (presence-only-demo / delegated-demo / server-issued-demo). The quickstart's dep bump to ^0.3.0 follows AFTER publish (its CI smoke installs from the registry, so bumping first would 404). Signed-off-by: Diego Zuluaga <dfzuluaga@gmail.com>
* chore(quickstart): pick up the published 0.3.0 packages Follows the 0.3.0 npm publish (#115): the quickstart — and the Vercel demo built from it — now installs the release that carries orders.serve, webhooks, and grants. This is the step that makes the deployed demo reflect the shipped product. Signed-off-by: Diego Zuluaga <dfzuluaga@gmail.com> * chore(quickstart): regenerate the lockfile for 0.3.0 (npm ci sync) Signed-off-by: Diego Zuluaga <dfzuluaga@gmail.com> --------- Signed-off-by: Diego Zuluaga <dfzuluaga@gmail.com>
1 participant
In plain terms
Everything shipped since June — the one-call checkout, the signed webhook, and grants ("approve a spending limit once, the agent buys while you're away") — is merged to the repo but never published to npm, so no one outside can use it and the deployed demo still runs the old version. This bumps both packages to 0.3.0 so we can publish.
What you're approving
^0.3.0).presence-only-demo/delegated-demo— no overclaim).How to test
For reviewers — the detail
Release contents since 0.2.0:
credentagent.orders.*+orders.serve(#98),credentagent.webhooks+constructEvent(#102),credentagent.grants.*+grants.serve(#112, incl. the #95 review'sallowbounds and all Codex hardening),OrderDoorCode(#111), the demo hub. Pre-flight done perdocs/PUBLISHING.md: tarball audit (gate ships grants/orders/webhooks dists; storefront shipsdist/ui/mcp-app.html; LICENSE+README in both), no demo deps leaked, full suite + lint green. The quickstart's dep bump to^0.3.0deliberately FOLLOWS the npm publish (its CI smoke installs from the registry — bumping first would 404). Publish order after merge: gate first, then storefront.🤖 Generated with Claude Code
https://claude.ai/code/session_01Harfquzhqg5SCCURyYRbHD