Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: agentscore/python-commerce
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v2.5.10
Choose a base ref
...
head repository: agentscore/python-commerce
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v2.5.11
Choose a head ref
  • 1 commit
  • 4 files changed
  • 2 contributors

Commits on Jul 18, 2026

  1. fix(x402): derive WWW-Authenticate realm from host, not full endpoint… 

    … URL (#93)

Surfaced by `npx mppx@latest validate` against store: the challenge
realm was `https://agents.agentscore.com/purchase` (full URL with path)
while martin/sayer (Node) emit the bare host.

Root cause: the Python Checkout auto-derived the MPP realm from the full
endpoint `url`. The Node SDK passes `new URL(APP_URL).host`; the
WWW-Authenticate realm should be the bare protection-space host.
`_realm_from_url` normalizes the derived realm to the host, restoring
parity. Falls back to the input unchanged when it has no parseable host
(already-bare host, relative path).

Advisory-only (the challenge was fully valid and settles); this clears
the validator warning and aligns the two SDKs.

Unit test covers full-URL, host:port, bare-host, and relative-path
cases. Full suite green (1841 passed, 95.36% coverage), ruff + ty clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
    @vvillait88 @claude
    vvillait88 and claude authored Jul 18, 2026
    Configuration menu
    Copy the full SHA
    8f30d45 View commit details
    Browse the repository at this point in the history
Loading