Changelog

What's new

Changes to the test stores, the console and the docs, newest first.

30 Oct 2026

0.10.0

NewEmbedded checkoutflowers-embedded.ucpsandbox.com adds UCP's Embedded transport (Embedded Checkout Protocol, 2026-08-25) to Northlight Flowers: its profile lists the embedded transport, every checkout carries an embedded binding with the delegations it allows, and its continue_url opened in an iframe with ec_version speaks ECP to the host page. A host can take over the payment credential, address changes, payment method changes and links. White Orchid is redirect-only, and test switches cover an unsupported version and a refused host.Protocol

0.9.0

NewCheckout over A2Aflowers-a2a.ucpsandbox.com adds UCP's A2A transport to Northlight Flowers: its profile lists an A2A service whose agent card is at /.well-known/agent-card.json, and checkout runs at /ucp/a2a over A2A 0.3 (message/send) or A2A 1.0 (SendMessage), with the UCP extension activated. Each reply carries the checkout in a2a.ucp.checkout. The action names (create_checkout, update_checkout, get_checkout, cancel_checkout, complete_checkout) are our interpretation: UCP's A2A binding shows add_to_checkout and complete_checkout only as examples and defines no list. Catalogue search stays on REST and MCP.Protocol

0.8.3

FixedA missing idempotency key over MCP is invalid paramsA complete_checkout or cancel_checkout call without meta["idempotency-key"] now answers JSON-RPC -32602 with code idempotency_key_required; -32000 stays for a key reused with a different payload, as the MCP binding's error table has it.Protocol

0.8.2

FixedStays warns totals_changed and waits for the new priceWhen a rate changes, the booking session warns totals_changed at $.totals as a disclosure, and complete is refused until the platform updates the session to the new totals, as the lodging draft requires.Protocol
ImprovedOrder webhooks are signed with ES256Webhooks are signed with a P-256 key, the algorithm every UCP verifier supports; each store's profile publishes it alongside the existing Ed25519 key.Protocol
FixedKettle Street's alcohol warning uses the policy type as its codeThe age disclosure's code is com.ucpsandbox.policy.age_restricted, as UCP 2026-08-25 requires of a warning that refers to a policy.Protocol

0.7.7

FixedLocation search refuses a filter it doesn't supportA location search or lookup with a filter other than hours, amenities or items is now refused with invalid_request, as the spec requires, instead of the filter being ignored and every shop returned.Protocol

0.7.6

NewReturn terms an agent can readEvery store has a -returns host, such as flowers-returns.ucpsandbox.com, on the draft Return Policy Extension (dev.ucp.shopping.policy.return, merged to the spec's main branch on 23 October, not yet in a release). Catalogue, cart, checkout and order responses carry the return window, refund types, return channels and fees; final-sale items come with a disclosure, and a delivered order states each return deadline. Responses in 2026-04-08 leave it out.Protocol

0.7.5

ImprovedThe Flowers sign-in servers read the resource parameterAn authorization or token request may name the store as its resource (RFC 8707). The store's own resource identifier, as its protected resource metadata gives it, is accepted; any other value is refused with invalid_target.Protocol

0.7.4

NewAccount linking with no client registrationflowers-account-noreg.ucpsandbox.com offers identity linking with no registration endpoint, as many sign-in servers do. Use the public client ucpsandbox-test with PKCE S256 and no secret; redirect to https://ucpplayground.com/oauth/callback or a 127.0.0.1 or localhost address.Protocol

0.7.3

NewLink a buyer account at Northlight FlowersThe store offers UCP identity linking (dev.ucp.common.identity_linking, 2026-08-25): OAuth 2.0 with PKCE, authorization server and protected resource metadata, client registration, a consent page with test buyers, and token revocation. It offers dev.ucp.shopping.order:manage; order reads stay open.Protocol
NewA store where reading an order needs a linked accountflowers-account.ucpsandbox.com offers dev.ucp.shopping.order:read and dev.ucp.shopping.order:manage: get_order without a linked buyer answers identity_required, and a token without the scope answers insufficient_scope.Protocol

0.5.0

NewNorthlight Flowers also speaks UCP 2026-04-08Agents built to the 2026-04-08 release get replies in that release. The store's profile lists it under supported_versions.Protocol
ImprovedCarts say when they expire, and orders carry their numberCarts include expires_at, and a completed checkout's order includes its label.Protocol

0.3.0

NewStores check request signaturesWeb Bot Auth and UCP request signatures are checked against the keys the agent publishes. Unsigned agents are still answered.Protocol

0.2.0

NewLocation search and lookupThe flowers store answers the UCP location calls over REST, MCP and WebMCP.Protocol

0.1.0 · Launch

NewStores speak UCP release 2026-08-25Over REST and MCP, with WebMCP tools in the storefront pages.Protocol