Release 3.1.2: keep the signing key out of the malformed-JWK error

[vvillait88]

Summary

Maintenance sweep for node-commerce, released as 3.1.2 because it carries one fix to shipped code.

Fix: the signing key no longer leaks into the malformed-JWK error. loadUCPSigningKeyFromEnv built its "is not valid JSON" error from JSON.parse's own message. V8 quotes an excerpt of the input in that message (Unexpected token 'S', ...""OKP","d":SECRETBYTE"... is not valid JSON), and the input here is the private JWK, so a malformed key put key characters into the thrown error and from there into whatever logs it. The error now names the variable only, and carries no cause. The other key-material rethrow already withheld its details; it keeps doing so, with a comment on why it has no cause.

Sweep:

• eslint 9 to 10 and @eslint/js 9 to 10, with eslint-plugin-import-x in place of eslint-plugin-import. import-x classifies the package's own name as internal when it resolves to a built dist/ and as external when it does not, so local lint and CI lint (which runs before the build) demanded opposite orders; a pathGroups entry pins @agent-score/** to external, the old plugin's classification, and lint passes both with and without dist/. The examples keep their order. The jose load failure now carries its cause. The dependabot eslint major ignore is removed, and CLAUDE.md and the hook comment no longer say eslint is held.
• tsup 8 to 9. tsup 9 depends on esbuild ^0.28.2 itself, so the esbuild override no longer changes resolution and is removed.
• Coupled set: mppx 0.13.5 and viem 2.57.7 (dev pins and override), matching pay 0.7.2. mppx is loaded at runtime from the merchant's own install, so the dev pins set what the suite runs against, not what ships.
• @solana/kit ^8.5.0, fastify ^5.12.7, vitest 5.0.5, dotenv 18.0.8, lefthook 2.2.2, typescript-eslint 8.71.2.
• The publish job runs on Node 26. npm 12, bundled with it, keeps --provenance and --access.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: TypeScript stays on 6, since typescript-eslint 8.71.2 still peers typescript <6.1.0. The peer ranges are unchanged; they already admit the new versions. The live all-rails settle that the coupled set owes runs once the FullEnrich store is on the new pins; the result is recorded on the pay release PR.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

The malformed-JWK error's message is now UCP_SIGNING_KEY_JWK_PRIVATE is not valid JSON. (or the configured variable name) without the parser's detail. The type and the variable name in the message are unchanged. No other change to exported types, signatures or wire formats.

Test plan

A new test feeds a malformed value and asserts the message carries no part of it and the error carries no cause. It fails against the previous ucp-jwks.ts (the message matched the value) and passes with the fix. Run locally under Node 24: lint, typecheck, knip, test (1637 passed, 4 skipped) and build, each exit 0. osv-scanner 2.7.0 over bun.lock reports no issues across 842 packages.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests