@integraledger/agent-guard 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @integraledger/agent-guard
 
+## 0.10.1
+
+### Patch Changes
+
+- 5154cfb: Install one copy of the protocol packages, not two.
+
+  `lcp-mcp-server` pinned its `@integraledger/lcp-*` dependencies to an exact version while `agent-guard`
+  — which it depends on — declares the same packages as peers at a caret range. Those two declarations
+  cannot be satisfied by a single copy, so installing both packages resolved the protocol line **twice**:
+  once hoisted to satisfy the caret, and once nested under `lcp-mcp-server` to satisfy the exact pin. The
+  two halves of one install then read different protocol code, with `instanceof` failing across the seam
+  between them.
+
+  `lcp-mcp-server` now declares those dependencies as a caret at the minor line's zero patch, matching its
+  sibling. A tree holding both resolves a single copy, and `npx lcp-mcp` still installs standalone.
+
+  Nothing about either package's API, behaviour or guarantees changes. Both were correct in isolation; only
+  a tree holding both was affected.
+
+- ccf4bb4: The runtime table is measured now, not argued.
+
+  It used to assert that this package works on Bun and Deno because of what the import graph implies — the
+  one Node built-in that arrives, `node:crypto`, is polyfilled on both. That was a sound argument and it was
+  only ever an argument; nothing ran.
+
+  Every release now drives the guard's whole decision on Node, Bun and Deno, against the packed tarball
+  installed the way you would install it, with the protocol line resolved from npmjs. Both halves are
+  asserted on each runtime, because a runtime where the guard refused everything would pass a check that only
+  looked for the halt: tampered terms must halt with the signer never reached, and matching terms must sign
+  with the signer reached exactly once.
+
+  Measured on this release: Node 24.19.0, Bun 1.4.0, Deno 2.9.5.
+
+  The table now separates what is measured from what is reasoned. Workers with `nodejs_compat` and the
+  bundler row remain arguments from the import graph and say so, rather than sitting in the same column as
+  the rows that ran.
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -59,12 +59,20 @@ no DNS module at all. That much is enforced by the code and is the part worth re
 ours: `@integraledger/lcp-evidence` re-exports its CAR support from its index, which pulls `multiformats`'
 Node SHA-2 build, which statically imports `node:crypto`. So:
 
-| Target | Works |
-|---|---|
-| Node | yes |
-| Deno, Bun, Workers with `nodejs_compat` | yes — `node:crypto` is polyfilled |
-| A bundler honouring `multiformats`' `browser` export condition | yes — it maps to the browser SHA-2 build |
-| A plain unbundled ESM import in a browser or service worker | **no** |
+| Target | Works | How we know |
+|---|---|---|
+| Node | yes | **measured** — every release runs the guard's whole decision here |
+| Bun | yes | **measured** — same run, same assertions |
+| Deno | yes | **measured** — same run, same assertions |
+| Workers with `nodejs_compat` | yes — `node:crypto` is polyfilled | reasoned from the import graph, not measured |
+| A bundler honouring `multiformats`' `browser` export condition | yes — it maps to the browser SHA-2 build | reasoned from the export conditions, not measured |
+| A plain unbundled ESM import in a browser or service worker | **no** | reasoned — `node:crypto` has nothing to resolve to |
+
+The measured rows run against **the packed tarball**, installed the way you would install it, with the
+protocol line resolved from npmjs — not against this repository's own tree. Both halves of the guarantee are
+asserted on each runtime, because a runtime where the guard refused everything would pass a check that only
+looked for the halt: tampered terms must halt with the signer never reached, and matching terms must sign
+with the signer reached exactly once.
 
 The guard needs `fetch` and Web Crypto and nothing else of its own. Removing the last hop is an upstream
 change — a subpath export on `lcp-evidence` so importing one predicate does not drag CAR and `multiformats`
@@ -132,12 +140,20 @@ Four answers are worth stating plainly, because each is a place a friendlier lib
   ACP/UCP one is contingent on the document, while `ap2`'s rule is a strict subset of `a2a`'s, so **every**
   AP2 envelope matches both and none is reachable through `parseProposalUniversal`. AP2 is a detect-and-name
   protocol here; `parseProposalFromAp2Envelope` exists and is called by name.
-- **An unlocatable terms URL is reported, not answered.** `legalContextUrl` is a union — `read`,
-  `no-field-declared`, `declared-field-empty`, or `undeclared-at-answering-carrier` — because
-  `PlacementManifest.termsUrlField` is singular and x402's names a path inside one of its two carriers. A
-  §C.4-illustrated challenge advertising in `accepts[].extra` really does carry a terms URL, and a bare
-  `undefined` there would contradict `parseProposalFromChallenge` reading the same bytes. The fix is a
-  per-alias declaration on the manifest; until it lands the shortfall is named.
+- **An absent terms URL says WHICH absence it is.** `legalContextUrl` is a union — `read`,
+  `no-field-declared`, or `declared-fields-empty` — because a bare `undefined` conflates two different
+  facts. `no-field-declared` is a fact about the PROTOCOL: it has nowhere to put a locator, and no document
+  of that protocol can be faulted for lacking one. `declared-fields-empty` is a fact about THIS DOCUMENT:
+  the protocol has room and this seller left every declared slot empty. Reporting the second as the first
+  would blame a protocol for a seller's silence.
+
+  It used to carry a fourth state, `undeclared-at-answering-carrier`, and that state is gone because the
+  defect requiring it is fixed. The manifest's terms-URL member was singular, so x402 could declare only one
+  of its two slots: a §C.4-illustrated challenge advertising in `accepts[].extra` really does carry a terms
+  URL, while the single declared path sat empty inside `extensions` — and calling that "no terms advertised"
+  would have asserted a silence this reader could not see. The member is plural now, every declared slot is
+  read and reconciled, and a slot riding a container the placement owns is declared on that container. There
+  is no carrier a declaration fails to reach, so the state is unreachable rather than merely unused.
 - **Carrier disagreement refuses.** Where a protocol declares more than one carrier, all of them are read
   and compared. Two different hashes on one document would let a seller advertise different terms to
   different readers of it, so this is deliberately stricter than the placement adapter's own `extract`,

package/dist/proposal-acp.d.ts

@@ -6,7 +6,7 @@ import type { GateProposal, ProposalContext } from "./proposal.js";
  * non-integer minor-unit amount.
  *
  * `legal_context_url` is required, and the ACP placement manifest DECLARES it as
- * `termsUrlField: "metadata.legal_context_url"` — the field this parser demands is a field the placement
+ * `termsUrlFields: ["metadata.legal_context_url"]` — the field this parser demands is a field the placement
  * names, which is what makes the round-trip compose. It is deliberately NOT read from ACP's native
  * `links[type=terms_of_use]`: that link is the merchant's standing policy page, while this names the ATR
  * terms document for this transaction, and falling back to it would substitute one for the other.

package/dist/proposal-acp.js

@@ -20,7 +20,7 @@ const AcpSessionSchema = z.object({
  * non-integer minor-unit amount.
  *
  * `legal_context_url` is required, and the ACP placement manifest DECLARES it as
- * `termsUrlField: "metadata.legal_context_url"` — the field this parser demands is a field the placement
+ * `termsUrlFields: ["metadata.legal_context_url"]` — the field this parser demands is a field the placement
  * names, which is what makes the round-trip compose. It is deliberately NOT read from ACP's native
  * `links[type=terms_of_use]`: that link is the merchant's standing policy page, while this names the ATR
  * terms document for this transaction, and falling back to it would substitute one for the other.

package/dist/proposal-ap2.d.ts

@@ -81,7 +81,7 @@ export interface Ap2ProposalContext extends ProposalContext {
     /**
      * The terms document's locator.
      *
-     * AP2's placement is INTEGRITY-ONLY: `AP2_PLACEMENT` declares no `termsUrlField`, because the A2A
+     * AP2's placement is INTEGRITY-ONLY: `AP2_PLACEMENT` declares no `termsUrlFields`, because the A2A
      * `Message.metadata` map holds the reference and AP2 models no terms-URL field anywhere. So unlike ACP
      * (`metadata.legal_context_url`) and x402 (`extra.legalContextUrl`), the locator cannot come off the wire.
      * It comes from LCP §2 discovery — the seller's `/.well-known/legal-context.json` — resolved by the

package/dist/proposal-mpp.d.ts

@@ -24,7 +24,7 @@ import type { GateProposal, ProposalContext } from "./proposal.js";
  * restating its regex keeps one definition of what an ATR hash is.
  *
  * **`legalContextUrl` is the field the placement names.** `placement-mpp` declares
- * `termsUrlField: "methodDetails.legalContextUrl"`, so the field this parser demands is the field the
+ * `termsUrlFields: ["methodDetails.legalContextUrl"]`, so the field this parser demands is the field the
  * manifest names — which is what makes the seller's write and this buyer's read compose. There is no
  * fallback to any other member: MPP defines none that means "these terms", and inventing one would gate the
  * buyer against a document nobody pointed at.

package/dist/proposal-mpp.js

@@ -53,7 +53,7 @@ const BASE_UNIT_INT = /^[0-9]+$/;
  * restating its regex keeps one definition of what an ATR hash is.
  *
  * **`legalContextUrl` is the field the placement names.** `placement-mpp` declares
- * `termsUrlField: "methodDetails.legalContextUrl"`, so the field this parser demands is the field the
+ * `termsUrlFields: ["methodDetails.legalContextUrl"]`, so the field this parser demands is the field the
  * manifest names — which is what makes the seller's write and this buyer's read compose. There is no
  * fallback to any other member: MPP defines none that means "these terms", and inventing one would gate the
  * buyer against a document nobody pointed at.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/agent-guard",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "type": "module",
   "exports": {
     ".": {
@@ -39,17 +39,18 @@
     "@integraledger/lcp-verify": "^0.12.0"
   },
   "devDependencies": {
-    "@integraledger/lcp-authority": "0.12.0",
-    "@integraledger/lcp-binding-core": "0.12.0",
-    "@integraledger/lcp-discovery": "0.12.0",
-    "@integraledger/lcp-evidence": "0.12.0",
-    "@integraledger/lcp-kernel": "0.12.0",
-    "@integraledger/lcp-placement-ack": "0.12.0",
-    "@integraledger/lcp-placement-acp": "0.12.0",
-    "@integraledger/lcp-placement-ap2": "0.12.0",
-    "@integraledger/lcp-placements": "0.12.0",
-    "@integraledger/lcp-verify": "0.12.0",
+    "@integraledger/lcp-authority": "0.12.2",
+    "@integraledger/lcp-binding-core": "0.12.2",
+    "@integraledger/lcp-discovery": "0.12.2",
+    "@integraledger/lcp-evidence": "0.12.2",
+    "@integraledger/lcp-kernel": "0.12.2",
+    "@integraledger/lcp-placement-ack": "0.12.2",
+    "@integraledger/lcp-placement-acp": "0.12.2",
+    "@integraledger/lcp-placement-ap2": "0.12.2",
+    "@integraledger/lcp-placements": "0.12.2",
+    "@integraledger/lcp-verify": "0.12.2",
     "@types/node": "24.13.3",
+    "fast-check": "4.9.0",
     "vitest": "4.1.10"
   },
   "license": "Apache-2.0",

package/src/proposal-acp.ts

@@ -23,7 +23,7 @@ const AcpSessionSchema = z.object({
  * non-integer minor-unit amount.
  *
  * `legal_context_url` is required, and the ACP placement manifest DECLARES it as
- * `termsUrlField: "metadata.legal_context_url"` — the field this parser demands is a field the placement
+ * `termsUrlFields: ["metadata.legal_context_url"]` — the field this parser demands is a field the placement
  * names, which is what makes the round-trip compose. It is deliberately NOT read from ACP's native
  * `links[type=terms_of_use]`: that link is the merchant's standing policy page, while this names the ATR
  * terms document for this transaction, and falling back to it would substitute one for the other.

package/src/proposal-ap2.ts

@@ -114,7 +114,7 @@ export interface Ap2ProposalContext extends ProposalContext {
   /**
    * The terms document's locator.
    *
-   * AP2's placement is INTEGRITY-ONLY: `AP2_PLACEMENT` declares no `termsUrlField`, because the A2A
+   * AP2's placement is INTEGRITY-ONLY: `AP2_PLACEMENT` declares no `termsUrlFields`, because the A2A
    * `Message.metadata` map holds the reference and AP2 models no terms-URL field anywhere. So unlike ACP
    * (`metadata.legal_context_url`) and x402 (`extra.legalContextUrl`), the locator cannot come off the wire.
    * It comes from LCP §2 discovery — the seller's `/.well-known/legal-context.json` — resolved by the

package/src/proposal-mpp.ts

@@ -57,7 +57,7 @@ const BASE_UNIT_INT = /^[0-9]+$/;
  * restating its regex keeps one definition of what an ATR hash is.
  *
  * **`legalContextUrl` is the field the placement names.** `placement-mpp` declares
- * `termsUrlField: "methodDetails.legalContextUrl"`, so the field this parser demands is the field the
+ * `termsUrlFields: ["methodDetails.legalContextUrl"]`, so the field this parser demands is the field the
  * manifest names — which is what makes the seller's write and this buyer's read compose. There is no
  * fallback to any other member: MPP defines none that means "these terms", and inventing one would gate the
  * buyer against a document nobody pointed at.