fix(discovery): allow root UCP profile route

src/Resources/config/services.php

@@ -127,6 +127,7 @@
 use Swag\AgenticCommerce\Ucp\Mcp\Tool\UcpOrderGetTool;
 use Swag\AgenticCommerce\Ucp\Negotiation\VersionNegotiationCounter;
 use Swag\AgenticCommerce\Ucp\Payment\ShopwareInvoicePaymentHandler;
+use Swag\AgenticCommerce\Ucp\Profile\UcpProfileRouteScopeWhitelist;
 use Swag\AgenticCommerce\Ucp\SalesChannel\SalesChannelDomainResolver;
 use Swag\AgenticCommerce\Ucp\SalesChannel\SalesChannelDomainResolverCacheInvalidator;
 use Swag\AgenticCommerce\Ucp\SalesChannel\SalesChannelViewProvider;
@@ -357,6 +358,9 @@
     $services->set(StoreApiMcpRouteScopeWhitelist::class)
         ->tag('shopware.route_scope_whitelist');
 
+    $services->set(UcpProfileRouteScopeWhitelist::class)
+        ->tag('shopware.route_scope_whitelist');
+
     // Public controllers.
 
     $services->set(UcpMcpProxyController::class)

src/Ucp/Profile/UcpProfileRouteScopeWhitelist.php

@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Swag\AgenticCommerce\Ucp\Profile;
+
+use Shopware\Core\Framework\Log\Package;
+use Shopware\Core\Framework\Routing\RouteScopeWhitelistInterface;
+use Ucp\Sdk\Symfony\Controller\ProfileController;
+
+/**
+ * Lets discovery resolve the sales-channel domain from the request URI when Shopware has not
+ * marked a root `/.well-known/ucp` request as a storefront request yet.
+ *
+ * @internal
+ */
+#[Package('discovery')]
+final class UcpProfileRouteScopeWhitelist implements RouteScopeWhitelistInterface
+{
+    public function applies(string $controllerClass): bool
+    {
+        return ProfileController::class === $controllerClass;
+    }
+}

tests/Functional/AgenticFiles/ApiCatalog/ApiCatalogControllerTest.php

@@ -58,6 +58,24 @@ public function testItServesTheLinksetForAnExposedSalesChannel(): void
         ], $payload);
     }
 
+    public function testItServesTheUcpProfileOnTheRootStorefrontDomain(): void
+    {
+        $this->setUcpActive(true);
+
+        $browser = KernelLifecycleManager::createBrowser($this->getKernel());
+        $browser->request('GET', $this->baseUrl().'/.well-known/ucp');
+        $response = $browser->getResponse();
+
+        static::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        static::assertSame('application/json', $response->headers->get('Content-Type'));
+
+        $payload = json_decode((string) $response->getContent(), true, 512, \JSON_THROW_ON_ERROR);
+
+        static::assertArrayHasKey('ucp', $payload);
+        static::assertIsArray($payload['ucp']);
+        static::assertArrayHasKey('capabilities', $payload['ucp']);
+    }
+
     public function testItReturns404ForAnUnexposedSalesChannel(): void
     {
         // The sales channel is not exposed for agentic commerce (UCP config inactive).

tests/Unit/UcpProfileRouteScopeWhitelistTest.php

@@ -0,0 +1,93 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Swag\AgenticCommerce\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Shopware\Core\Framework\Routing\RouteScopeListener;
+use Shopware\Core\Framework\Routing\RouteScopeRegistry;
+use Shopware\Core\PlatformRequest;
+use Shopware\Storefront\Framework\Routing\StorefrontRouteScope;
+use Swag\AgenticCommerce\Ucp\Profile\UcpProfileRouteScopeWhitelist;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Ucp\Sdk\Service\ProfileBuilderInterface;
+use Ucp\Sdk\Service\RuntimeConfigurationResolverInterface;
+use Ucp\Sdk\Symfony\Controller\ProfileController;
+use Ucp\Sdk\Symfony\UcpSdkConfiguration;
+
+/** @internal */
+#[CoversClass(UcpProfileRouteScopeWhitelist::class)]
+final class UcpProfileRouteScopeWhitelistTest extends TestCase
+{
+    #[Test]
+    public function itAllowsTheRootProfileBeforeStorefrontScopeValidation(): void
+    {
+        $requestStack = new RequestStack();
+        $mainRequest = Request::create('https://shop.example/.well-known/ucp');
+        $requestStack->push($mainRequest);
+
+        $whitelist = new UcpProfileRouteScopeWhitelist();
+        $listener = new RouteScopeListener(
+            new RouteScopeRegistry([new StorefrontRouteScope()]),
+            $requestStack,
+            [$whitelist],
+        );
+
+        $listener->checkScope($this->controllerEvent());
+
+        static::assertTrue($whitelist->applies(ProfileController::class));
+        static::assertFalse($whitelist->applies(self::class));
+    }
+
+    private function controllerEvent(): ControllerEvent
+    {
+        $request = Request::create('https://shop.example/.well-known/ucp');
+        $request->attributes->set('_route', 'ucp_sdk_symfony_profile__invoke');
+        $request->attributes->set(PlatformRequest::ATTRIBUTE_ROUTE_SCOPE, [StorefrontRouteScope::ID]);
+
+        return new ControllerEvent(
+            $this->createStub(HttpKernelInterface::class),
+            \Closure::fromCallable($this->profileController()),
+            $request,
+            HttpKernelInterface::MAIN_REQUEST,
+        );
+    }
+
+    private function profileController(): ProfileController
+    {
+        return new ProfileController(
+            $this->createStub(ProfileBuilderInterface::class),
+            new UcpSdkConfiguration(
+                '2026-08-25',
+                null,
+                [],
+                'strict',
+                [],
+                true,
+                86400,
+                1048576,
+                300,
+                86400,
+                300,
+                300,
+                [],
+                true,
+                'default',
+                'ES256',
+                '+30 days',
+                '+30 days',
+                1048576,
+                5,
+                false,
+                'sqlite:///:memory:',
+            ),
+            $this->createStub(RuntimeConfigurationResolverInterface::class),
+        );
+    }
+}