Skip to content

Shop v0.6.16

Choose a tag to compare

View all tags
@BitcoinErrorLog BitcoinErrorLog released this 22 Sep 07:25
shop-v0.6.16
6780aa1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Shop v0.6.16

  • Date: 22 September 2026
  • Tag: shop-v0.6.16
  • SHA: 6780aa1e0751c9a0c216336561506239aa173c95 (release/shop-v0.6.8)
  • Production: dpl_4zJNARkAY1pSMBJYYfebsvNQQJzn https://shop.pubky.app
  • Rollback: dpl_7sZBA7PKRv3MyFpA4zDaGUaMU1fo (v0.6.15)

Headline

Inventory Studio W1: sellers list stock and set available quantity on an Inventory board that uses a marketplace-service grant separate from the purchase session.

User-visible

  • Inventory Studio board at /marketplace/dashboard/inventory with a marketplace-service step-up grant (/pub/pubky.app/marketplace-service/v1/:rw, never /:rw). (Shop PR #71)
  • Exclusive checkout hold: a second buyer sees that another payment is holding the item; unpaid holds restock. (marketplace #50, Shop PR #69)
  • Buyer order cards hydrate published-review status after a fresh sign-in instead of waiting on a wiped local row. (marketplace #15, Shop PR #66)
  • Sign-out and identity-switch Dexie cleanup is keyed to the captured pubky and AUTH_PERSIST_KEY inside the cross-tab lock, so a skipped Tab A restore cannot clobber Tab B. (Shop PR #67)
  • Marketplace photos keep their object URL while the image is on screen. (Shop PR #65)
  • Guest-to-signed-in session bridge waits on the iframe load event (3 s cap) instead of a 15 s timeout. (Shop PR #65)
  • Checkout and the listing form keep pickup hidden until the service answers. (Shop PR #65)
  • When a seller's shop names a different checkout origin, the buyer sees that this Shop cannot check out that listing. The seller-authored origin is not shown as verified provenance. (Shop PR #65)
  • Drop-hover VRT pins scroll at 0 so Playwright cannot crop the grid. (Shop PR #70)

Operator

  • Depends on marketplace-service aafc09ee41a89a0fac241bf5318e2f2cc2ccc52f (PR #21, migration 0038 orders.hold_source + payments.review_reason) already rolling-deployed to staging and production this train. Digest sha256:7b112f3782a62b076e5a6294af2a028635bb02896bfb164b9f8d1f6c755fed6e.
  • Production env inherits the v0.6.15 grant-flag-on set: SHOP_BFF_GRANT_FLOW_ENABLED, PUBKY_RUNTIME_MARKETPLACE_GRANT_FLOW_ENABLED, SHOP_BFF_CLI_GRANT_ENABLED, and the shop-bff-prod-* signing-seed env names (SHOP_GRANT_ASSERTION_SIGNING_KEY, MARKETPLACE_SERVICE_REQUEST_SIGNING_KEY, matching *_KEY_ID) were present on pubky-marketplace-production before promote.
  • Runtime proof must show marketplaceGrantFlowEnabled true and POST /api/marketplace/grant-flows answering (not 404).
  • Do not apply IaC from main railway.ts. Do not run expire-unbound-pending / zombie-cancel SQL.

Verification

  • Local gates on 6780aa1e: typecheck, lint, prettier (release diff vs shop-v0.6.15), 14683 unit tests passed / 2 skipped. Marketplace VRT recorded in this evidence folder.
  • changelog.d/next fragments added since shop-v0.6.15: 15.fixed.md, auth-cleanup-identity-lock.fixed.md, inventory-studio.added.md, ux-residuals-blob-url.fixed.md, ux-residuals-guest-bridge.fixed.md, ux-residuals-pickup-null.fixed.md, ux-residuals-seller-origin.fixed.md.
Assets 2
Loading