@integraledger/lcp-binding-evm-mpp 0.10.1 → 0.10.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +51 -0
- package/dist/id-reuse.d.ts +4 -3
- package/dist/id-reuse.d.ts.map +1 -1
- package/dist/id-reuse.js +4 -3
- package/dist/id-reuse.js.map +1 -1
- package/package.json +4 -4
- package/src/id-reuse.ts +4 -3
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,56 @@
|
|
|
1
1
|
# @integraledger/lcp-binding-evm-mpp
|
|
2
2
|
|
|
3
|
+
## 0.10.2
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- b2ffecc: Report the class a record actually supports, place a terms URL on UCP, and stop refusing a conformant UCP
|
|
8
|
+
profile — the remediation of the 2026-08-19 conformance re-audit.
|
|
9
|
+
|
|
10
|
+
**`verify` now computes `supportedClass` instead of echoing the claim.** It was `anyFailed ? "TC-0" :
|
|
11
|
+
claimedClass`, so a record proving nothing — no settlement, no acceptance, no authority chain — reported
|
|
12
|
+
whatever class the caller named, while the field's own published docblock promised "what the record
|
|
13
|
+
honestly supports, not what the caller asked for". It is now the highest class every one of whose required
|
|
14
|
+
steps is `proved`, `TC-0` on any failure, computed from the steps alone: neither capped by the claim (rungs
|
|
15
|
+
that reach TC-3 read TC-3 where the caller claimed TC-2) nor lifted by it. White paper #4 §5 defines the
|
|
16
|
+
class of a transaction as "the highest class whose criteria it fully meets", and this is that.
|
|
17
|
+
|
|
18
|
+
The claim is not discarded — the report gains **`claimedClass`**, a required member, because `verified`
|
|
19
|
+
answers "did the record reach the class it claimed?" and cannot be read without it. The two fields are the
|
|
20
|
+
report's two halves: an input echoed, and a finding computed. Where they differ, the record did not reach
|
|
21
|
+
its own shape. An out-of-taxonomy claim now lands only in the echo and can no longer masquerade as a
|
|
22
|
+
finding.
|
|
23
|
+
|
|
24
|
+
**UCP can advertise a terms URL.** Its policy object declares `url` — "Optional link to the full policy
|
|
25
|
+
document", `format: uri` — on the very entry this placement writes, and §C.3's illustration carries `url`
|
|
26
|
+
and `atrHash` side by side there. The manifest previously said the protocol had no slot, citing `links[]`,
|
|
27
|
+
which §C.3 separates as "a standing page, not a per-transaction record". The obstacle was mechanical:
|
|
28
|
+
`termsUrlFields` addresses document paths, and a tagged-array entry's index is chosen at write time. The
|
|
29
|
+
`tagged-array` container therefore gains `termsUrlField`, written onto the same entry in the same write, and
|
|
30
|
+
read back through the same first-match rule. UCP was the last shipped protocol that refused an
|
|
31
|
+
advertisement carrying its own locator (integra-protocol#8).
|
|
32
|
+
|
|
33
|
+
**`readUcpProfile` no longer refuses a conformant business profile.** `requireHttps` mapped an ABSENT `spec`
|
|
34
|
+
to the same branch as a malformed one, and the live host requires `spec` only of a platform declaration —
|
|
35
|
+
as this repository's own README already said. It is now `requireHttpsIfDeclared`: absence is absence, and a
|
|
36
|
+
declared value is still held to the host's https MUST.
|
|
37
|
+
|
|
38
|
+
Also: `requireWritten` replaces an unchecked cast in the x402 override, so a broken postcondition throws
|
|
39
|
+
instead of returning a success carrying no document; six x402 citations move to the revision that actually
|
|
40
|
+
touches the file they name, and a new gate refuses any `owner/repo@sha` in source that `spec-pins.json` does
|
|
41
|
+
not record; four spec citations move from line anchors to section anchors; the escrow binding states why it
|
|
42
|
+
declares no §8.3.1 off-canonical variant, and asserts it; and §C.3's `policies[]` illustration is recorded as
|
|
43
|
+
invalid against the live UCP schema, which shows `description` as a bare string where the host requires an
|
|
44
|
+
object — owed upstream, not a defect here.
|
|
45
|
+
|
|
46
|
+
Corpus 844 → 847, root `ec4ad1b02a81538b…`.
|
|
47
|
+
|
|
48
|
+
- Updated dependencies [b2ffecc]
|
|
49
|
+
- Updated dependencies [822190a]
|
|
50
|
+
- @integraledger/lcp-binding-core@0.11.0
|
|
51
|
+
- @integraledger/lcp-binding-evm-common@0.10.2
|
|
52
|
+
- @integraledger/lcp-kernel@0.11.0
|
|
53
|
+
|
|
3
54
|
## 0.10.1
|
|
4
55
|
|
|
5
56
|
**0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus
|
package/dist/id-reuse.d.ts
CHANGED
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
*
|
|
14
14
|
* **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
|
|
15
15
|
* "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
|
|
16
|
-
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
|
|
17
|
-
*
|
|
16
|
+
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
|
|
17
|
+
* under "Id-Reuse on MPP-EVM, and its limit":
|
|
18
18
|
*
|
|
19
19
|
* > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
|
|
20
20
|
* > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
|
|
@@ -37,7 +37,8 @@
|
|
|
37
37
|
* its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
|
|
38
38
|
*
|
|
39
39
|
* **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
|
|
40
|
-
* (§C.1
|
|
40
|
+
* (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
|
|
41
|
+
* atrHash, and nothing may be added that does — see the closing note.
|
|
41
42
|
*
|
|
42
43
|
* **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
|
|
43
44
|
* confirmed against Foundry's own encoder rather than assumed, and every oracle in
|
package/dist/id-reuse.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"id-reuse.d.ts","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"id-reuse.d.ts","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EAAU,KAAK,GAAG,EAA4B,MAAM,MAAM,CAAC;AAKlE,oGAAoG;AACpG,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mGAAmG;IACnG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED,yGAAyG;AACzG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAU3E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,sBAAsB,CAOxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAsCtC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CAQtD"}
|
package/dist/id-reuse.js
CHANGED
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
*
|
|
14
14
|
* **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
|
|
15
15
|
* "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
|
|
16
|
-
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
|
|
17
|
-
*
|
|
16
|
+
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
|
|
17
|
+
* under "Id-Reuse on MPP-EVM, and its limit":
|
|
18
18
|
*
|
|
19
19
|
* > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
|
|
20
20
|
* > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
|
|
@@ -37,7 +37,8 @@
|
|
|
37
37
|
* its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
|
|
38
38
|
*
|
|
39
39
|
* **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
|
|
40
|
-
* (§C.1
|
|
40
|
+
* (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
|
|
41
|
+
* atrHash, and nothing may be added that does — see the closing note.
|
|
41
42
|
*
|
|
42
43
|
* **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
|
|
43
44
|
* confirmed against Foundry's own encoder rather than assumed, and every oracle in
|
package/dist/id-reuse.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"id-reuse.js","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"id-reuse.js","sourceRoot":"","sources":["../src/id-reuse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAY,SAAS,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAElE,iGAAiG;AACjG,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAuBtC;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,KAAa;IACpE,IAAI,WAAW,KAAK,EAAE;QACpB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,IAAI,KAAK,KAAK,EAAE;QACd,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,gBAAgB,CAClC,OAAO,EACP,aAAa,EACb,iIAAiI,CAC3H,CAAC;IACT,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,KAAa,EACb,cAAiC;IAEjC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,gGAAgG,OAAO,GAAG;SACnH,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,cAAc;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,wEAAwE,QAAQ,GAAG;aAC5F,CAAC;IACN,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,2GAA2G;SAC9G,CAAC;IACJ,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAQ,CAAC;IACrE,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,SAAS;QACvB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,sBAAsB;YACjC,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,8CAA8C,SAAS,OAAO,KAAK,SAAS,KAAK,EAAE;SAC5F,CAAC;IACJ,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EACJ,8NAA8N;KACjO,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@integraledger/lcp-binding-evm-mpp",
|
|
3
|
-
"version": "0.10.
|
|
3
|
+
"version": "0.10.2",
|
|
4
4
|
"description": "Welds an LCP record into an MPP settlement on EVM by Id-Reuse (LCP §8.3.5).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"lcp",
|
|
@@ -43,9 +43,9 @@
|
|
|
43
43
|
"homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/binding-evm-mpp#readme",
|
|
44
44
|
"dependencies": {
|
|
45
45
|
"viem": "2.55.11",
|
|
46
|
-
"@integraledger/lcp-binding-core": "0.
|
|
47
|
-
"@integraledger/lcp-
|
|
48
|
-
"@integraledger/lcp-
|
|
46
|
+
"@integraledger/lcp-binding-core": "0.11.0",
|
|
47
|
+
"@integraledger/lcp-binding-evm-common": "0.10.2",
|
|
48
|
+
"@integraledger/lcp-kernel": "0.11.0"
|
|
49
49
|
},
|
|
50
50
|
"devDependencies": {
|
|
51
51
|
"@types/node": "24.13.3",
|
package/src/id-reuse.ts
CHANGED
|
@@ -13,8 +13,8 @@
|
|
|
13
13
|
*
|
|
14
14
|
* **WHAT MAKES THAT SOUND IS NOT UNIQUENESS, AND AN EARLIER DOCBLOCK SAID IT WAS.** It argued that MPP's
|
|
15
15
|
* "Unique challenge identifier" requirement (`draft-httpauth-payment` §5.1.1) was satisfied by making each
|
|
16
|
-
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1
|
|
17
|
-
*
|
|
16
|
+
* ATR unique per transaction. Every citation in it was exact; the sufficiency was not. LCP v1.38 §C.1,
|
|
17
|
+
* under "Id-Reuse on MPP-EVM, and its limit":
|
|
18
18
|
*
|
|
19
19
|
* > **It is not simply available, and §8.3.5's uniqueness advice is not sufficient for it.** MPP requires
|
|
20
20
|
* > the server to bind the challenge `id` *to the challenge parameters* … expressly to prevent a client
|
|
@@ -37,7 +37,8 @@
|
|
|
37
37
|
* its challenge-binding section. §C.1 names that inconsistency rather than resolving it, and so does this.
|
|
38
38
|
*
|
|
39
39
|
* **Zero-party-recoverable on-chain binding on this rail still requires an Overlay Contract per §8.3.2**
|
|
40
|
-
* (§C.1
|
|
40
|
+
* (§C.1's own closing sentence under "Id-Reuse on MPP-EVM, and its limit"). Nothing here recovers an
|
|
41
|
+
* atrHash, and nothing may be added that does — see the closing note.
|
|
41
42
|
*
|
|
42
43
|
* **`abi.encodePacked` over two strings is raw UTF-8 concatenation** — no length prefix, no padding. That was
|
|
43
44
|
* confirmed against Foundry's own encoder rather than assumed, and every oracle in
|