@integraledger/lcp-mcp-server 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @integraledger/lcp-mcp-server
 
+## 0.10.1
+
+### Patch Changes
+
+- 5154cfb: Install one copy of the protocol packages, not two.
+
+  `lcp-mcp-server` pinned its `@integraledger/lcp-*` dependencies to an exact version while `agent-guard`
+  — which it depends on — declares the same packages as peers at a caret range. Those two declarations
+  cannot be satisfied by a single copy, so installing both packages resolved the protocol line **twice**:
+  once hoisted to satisfy the caret, and once nested under `lcp-mcp-server` to satisfy the exact pin. The
+  two halves of one install then read different protocol code, with `instanceof` failing across the seam
+  between them.
+
+  `lcp-mcp-server` now declares those dependencies as a caret at the minor line's zero patch, matching its
+  sibling. A tree holding both resolves a single copy, and `npx lcp-mcp` still installs standalone.
+
+  Nothing about either package's API, behaviour or guarantees changes. Both were correct in isolation; only
+  a tree holding both was affected.
+
+- Updated dependencies [5154cfb]
+- Updated dependencies [ccf4bb4]
+  - @integraledger/agent-guard@0.10.1
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -80,15 +80,17 @@ document for your agent to send with its own keys.
 
 ## One protocol line in the tree
 
-Every `@integraledger/*` package pins its own dependencies **exactly**, so a published version states the
-protocol line it was cut against and cannot be argued out of it. This server and `agent-guard` release
-against the same `@integraledger/lcp-*` line, so installing this puts **one** line of the protocol packages
-in `node_modules`. If a mixed install ever puts two lines in one tree — exact pinning makes that expected
-rather than pathological — the seam stays safe: what this package takes from `agent-guard` is the fetcher
-and nothing else — `makeCachingFetcher`, `nodeDnsLookup`, and the `TermsFetcher` type — whose entire
-vocabulary is `fetch(url: string)` in, `{ bytes, format, fetchedAt }` out, plus a `{ address, family }` DNS
-answer. Not one of those names an `lcp-kernel`, `lcp-binding-core` or `lcp-discovery` type in either
-direction, so two lines never exchange a value.
+This server declares the protocol line as a **caret at the minor's zero patch**, and `agent-guard` peers it
+the same way. That is what puts **one** line of the protocol packages in `node_modules` when you install
+both: the two ranges overlap, so a package manager resolves a single copy that satisfies each. An exact
+runtime pin would do the opposite — it cannot be satisfied by the sibling's range, so the resolver nests a
+second copy underneath this package, and the two halves of one install then read different protocol code.
+
+If a mixed install ever does put two lines in one tree, the seam stays safe: what this package takes from
+`agent-guard` is the fetcher and nothing else — `makeCachingFetcher`, `nodeDnsLookup`, and the
+`TermsFetcher` type — whose entire vocabulary is `fetch(url: string)` in, `{ bytes, format, fetchedAt }`
+out, plus a `{ address, family }` DNS answer. Not one of those names an `lcp-kernel`, `lcp-binding-core` or
+`lcp-discovery` type in either direction, so two lines never exchange a value.
 
 ## Checked against the live MCP specification — 2026-07-30
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-mcp-server",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "type": "module",
   "exports": {
     ".": {
@@ -28,18 +28,18 @@
     "directory": "packages/lcp-mcp-server"
   },
   "dependencies": {
-    "@integraledger/lcp-authority": "0.12.0",
-    "@integraledger/lcp-binding-core": "0.12.0",
-    "@integraledger/lcp-discovery": "0.12.0",
-    "@integraledger/lcp-evidence": "0.12.0",
-    "@integraledger/lcp-kernel": "0.12.0",
-    "@integraledger/lcp-placement-ack": "0.12.0",
-    "@integraledger/lcp-placement-ap2": "0.12.0",
-    "@integraledger/lcp-placements": "0.12.0",
-    "@integraledger/lcp-verify": "0.12.0",
+    "@integraledger/lcp-authority": "^0.12.0",
+    "@integraledger/lcp-binding-core": "^0.12.0",
+    "@integraledger/lcp-discovery": "^0.12.0",
+    "@integraledger/lcp-evidence": "^0.12.0",
+    "@integraledger/lcp-kernel": "^0.12.0",
+    "@integraledger/lcp-placement-ack": "^0.12.0",
+    "@integraledger/lcp-placement-ap2": "^0.12.0",
+    "@integraledger/lcp-placements": "^0.12.0",
+    "@integraledger/lcp-verify": "^0.12.0",
     "@modelcontextprotocol/server": "2.0.0",
     "zod": "4.4.3",
-    "@integraledger/agent-guard": "0.10.0"
+    "@integraledger/agent-guard": "0.10.1"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.0.0",