v0.1.0-alpha.1

Security hardening update based on external review.

Fixes:

• Burns each approved proposal before contacting BigCommerce, preventing replay and concurrent duplicate writes
• Persists successful and failed-or-uncertain application evidence in a private .applied.json audit artifact
• Rejects literal, encoded, double-encoded and encoded-separator path traversal attempts
• Removes mutation application from MCP; approval and apply remain CLI-only so the approval secret stays outside the agent runtime
• Adds configurable request timeouts and HTTP 429 retry handling using BigCommerce rate-limit headers
• Reports remaining rate-limit state on responses and errors
• Tightens GraphQL mutation detection to inspect operation definitions instead of matching field text
• Handles multi-byte invalid approval codes cleanly
• Prevents caller headers from overriding the configured BigCommerce token

Verification:

• 23 tests pass on Node 20 and Node 22
• npm audit reports 0 vulnerabilities
• Package inspection contains no tests, credentials, operation artifacts or node_modules

v0.1.0-alpha

Public alpha of the read-first BigCommerce Agent Toolkit.

Highlights:

• Official BigCommerce documentation search and Markdown retrieval
• Fixed-origin authenticated REST and read-only GraphQL access
• First-class reads for product reviews, redirects, placements, widget templates, themes, and channels
• MCP server and deterministic CLI
• Path-confined, HMAC-approved mutation proposals with before-and-after snapshots
• Least-privilege OAuth scope guidance

This is an early alpha. Start with a dedicated read-only BigCommerce API account. Third-party embedded app access remains a separate control-panel permission boundary.