sylius-ucp — both readings instead of half the reach.
The bundle provides the discovery profile at /.well-known/ucp. It deliberately serves a superset: once nested the way the specification requires, and once flat the way discovery scanners look for it. Any compliant parser ignores the additional fields.
Both interpretations occur in real clients — so the profile serves both.
The specification nests everything under ucp and requires signing_keys. Discovery scanners, by contrast, look flat for protocol_version and endpoints at the top level. This is not an academic distinction: both readings occur in real clients, and anyone who serves only one is simply invisible to the other half.
That is why the bundle writes both into the same document. The nested version is complete and spec-compliant, the flat fields next to it are duplicates of the same values. A compliant parser ignores what it does not know — so the superset costs nothing but a few hundred bytes, and those bytes buy visibility with clients you do not control.
The alternative would be to settle on one interpretation and wait for the other side to follow. For a discovery document that is the most expensive option, because the failure case is silent: you do not notice that you are not being found.
Source code & documentation
Composer package
MIT · Sylius 2.0+ · PHP 8.2+
composer require koh/sylius-ucp
Built, tested and published under MIT. Public distribution via Packagist is being prepared (coming soon).
Part of the family
MIT
This package belongs to koh/sylius-agent-ready — seventeen bundles that make a Sylius shop usable for AI agents. Each one can be deployed on its own.