@integraledger/lcp-mcp-server 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @integraledger/lcp-mcp-server
 
+## 0.10.1
+
+### Patch Changes
+
+- 5154cfb: Install one copy of the protocol packages, not two.
+
+  `lcp-mcp-server` pinned its `@integraledger/lcp-*` dependencies to an exact version while `agent-guard`
+  — which it depends on — declares the same packages as peers at a caret range. Those two declarations
+  cannot be satisfied by a single copy, so installing both packages resolved the protocol line **twice**:
+  once hoisted to satisfy the caret, and once nested under `lcp-mcp-server` to satisfy the exact pin. The
+  two halves of one install then read different protocol code, with `instanceof` failing across the seam
+  between them.
+
+  `lcp-mcp-server` now declares those dependencies as a caret at the minor line's zero patch, matching its
+  sibling. A tree holding both resolves a single copy, and `npx lcp-mcp` still installs standalone.
+
+  Nothing about either package's API, behaviour or guarantees changes. Both were correct in isolation; only
+  a tree holding both was affected.
+
+- Updated dependencies [5154cfb]
+- Updated dependencies [ccf4bb4]
+  - @integraledger/agent-guard@0.10.1
+
+## 0.10.0
+
+### Minor Changes
+
+- 06a25ac: Read the whole advertisement, and move to protocol 0.12.0.
+
+  The peer range was `^0.10.1`, which on a `0.x` version admits only patches — so this guard declared it did
+  not support the line every seller now writes, and a tree holding both resolved a second copy of the protocol
+  packages to satisfy it. The peers are `^0.12.0` and the build pins 0.12.0 exactly.
+
+  **The terms URL is no longer read by hand.** `PlacementManifest.termsUrlField` was singular and named one
+  path; it is now `termsUrlFields`, plural, and a slot that rides a container the placement owns is declared on
+  that container. Reading that by hand here would have been a second implementation of a manifest rule, so the
+  locator now comes from the placement's own `extract`, which reconciles every declared slot and refuses two
+  that disagree. The reference walk stays this package's own: "integrity carriers only" is a BUYER rule — a
+  discovery link locates a standing page and attests nothing — and the placement's reader does not apply it.
+
+  **`AdvertisedTermsUrl` loses a state, and could not keep it.** `undeclared-at-answering-carrier` existed
+  because the singular member could not reach the carrier a §C.4 challenge actually used: the hash answered
+  from `accepts[].extra` while the one declared path sat empty inside `extensions`, and reporting that as "no
+  terms advertised" would have asserted a silence this reader could not see. With every slot declared and
+  reconciled there is no such carrier, so the state is unreachable rather than merely unused, and the §C.4
+  challenge now simply reads its URL. `declared-field-empty` becomes `declared-fields-empty` and carries every
+  slot it looked at.
+
+  `lcp_place_reference` takes an optional `termsUrl` — required where the protocol declares a slot and the
+  reference is a digest, refused where it declares none — and `lcp_extract_reference` reports the locator
+  beside the reference, with its two absences distinguished: a protocol with no slot is not a seller who left
+  one empty.
+
+  Wire identities are unchanged apart from the protocol line itself.
+
+### Patch Changes
+
+- Updated dependencies [06a25ac]
+  - @integraledger/agent-guard@0.10.0
+
 ## 0.9.0
 
 **First public release** — Apache-2.0, free forever, no account and no token to install.

package/README.md

@@ -80,15 +80,17 @@ document for your agent to send with its own keys.
 
 ## One protocol line in the tree
 
-Every `@integraledger/*` package pins its own dependencies **exactly**, so a published version states the
-protocol line it was cut against and cannot be argued out of it. This server and `agent-guard` release
-against the same `@integraledger/lcp-*` line, so installing this puts **one** line of the protocol packages
-in `node_modules`. If a mixed install ever puts two lines in one tree — exact pinning makes that expected
-rather than pathological — the seam stays safe: what this package takes from `agent-guard` is the fetcher
-and nothing else — `makeCachingFetcher`, `nodeDnsLookup`, and the `TermsFetcher` type — whose entire
-vocabulary is `fetch(url: string)` in, `{ bytes, format, fetchedAt }` out, plus a `{ address, family }` DNS
-answer. Not one of those names an `lcp-kernel`, `lcp-binding-core` or `lcp-discovery` type in either
-direction, so two lines never exchange a value.
+This server declares the protocol line as a **caret at the minor's zero patch**, and `agent-guard` peers it
+the same way. That is what puts **one** line of the protocol packages in `node_modules` when you install
+both: the two ranges overlap, so a package manager resolves a single copy that satisfies each. An exact
+runtime pin would do the opposite — it cannot be satisfied by the sibling's range, so the resolver nests a
+second copy underneath this package, and the two halves of one install then read different protocol code.
+
+If a mixed install ever does put two lines in one tree, the seam stays safe: what this package takes from
+`agent-guard` is the fetcher and nothing else — `makeCachingFetcher`, `nodeDnsLookup`, and the
+`TermsFetcher` type — whose entire vocabulary is `fetch(url: string)` in, `{ bytes, format, fetchedAt }`
+out, plus a `{ address, family }` DNS answer. Not one of those names an `lcp-kernel`, `lcp-binding-core` or
+`lcp-discovery` type in either direction, so two lines never exchange a value.
 
 ## Checked against the live MCP specification — 2026-07-30
 

package/dist/tools/extract-reference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-reference.d.ts","sourceRoot":"","sources":["../../src/tools/extract-reference.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsB/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,WAAW,GACjB,IAAI,CAkCN"}
+{"version":3,"file":"extract-reference.d.ts","sourceRoot":"","sources":["../../src/tools/extract-reference.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkC/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,WAAW,GACjB,IAAI,CAuCN"}

package/dist/tools/extract-reference.js

@@ -17,6 +17,16 @@ const outputSchema = z.object({
         .describe("The LCP §8.1 carrier string recovered from the document."),
     type: z.string().describe("The §8.2 carrier type, e.g. `sha256`."),
     value: z.string().describe("The carrier value, e.g. the 0x ATR hash."),
+    termsUrl: z
+        .discriminatedUnion("kind", [
+        z.object({ kind: z.literal("read"), url: z.string() }),
+        z.object({ kind: z.literal("no-field-declared") }),
+        z.object({
+            kind: z.literal("declared-fields-empty"),
+            fields: z.array(z.string()),
+        }),
+    ])
+        .describe("Where the document says its terms live. The absences are DISTINCT and both are answers: `no-field-declared` is a fact about the PROTOCOL — it has no slot for a locator — while `declared-fields-empty` is a fact about this DOCUMENT, whose seller left every declared slot empty. Collapsing them would report a seller's silence as a protocol's."),
     placement: PLACEMENT_SUMMARY_SCHEMA,
 });
 /**
@@ -48,10 +58,15 @@ export function registerExtractReference(server, ports) {
         const outcome = adapter.extract(args.document);
         if (!("ok" in outcome))
             return refusalResult(outcome);
+        // `extract` answers with the whole advertisement — the reference, and what the document says about
+        // where its terms live. The locator's ABSENCE is typed, so the reader is told whether the protocol
+        // has no slot at all or the seller left a declared one empty.
+        const { ref, termsUrl } = outcome.value;
         const out = {
-            reference: encodeLegalContextString(outcome.value),
-            type: outcome.value.type,
-            value: outcome.value.value,
+            reference: encodeLegalContextString(ref),
+            type: ref.type,
+            value: ref.value,
+            termsUrl,
             placement: manifestSummary(adapter.manifest),
         };
         return {

package/dist/tools/extract-reference.js.map

@@ -1 +1 @@
-{"version":3,"file":"extract-reference.js","sourceRoot":"","sources":["../../src/tools/extract-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,CACP,mGAAmG,CACpG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,CAAC,4CAA4C,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,0DAA0D,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,SAAS,EAAE,wBAAwB;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,KAAkB;IAElB,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,WAAW,EACT,+FAA+F;YAC/F,wFAAwF;YACxF,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;YAClG,8FAA8F;QAChG,WAAW;QACX,YAAY;QACZ,WAAW,EAAE,uBAAuB,CAClC,0BAA0B,EAC1B,QAAQ,CACT;KACF,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG;YACV,SAAS,EAAE,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;YAC1B,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC9D;YACD,iBAAiB,EAAE,GAAG;SACvB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"extract-reference.js","sourceRoot":"","sources":["../../src/tools/extract-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,CACP,mGAAmG,CACpG;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,CAAC,4CAA4C,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CAAC,0DAA0D,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACtE,QAAQ,EAAE,CAAC;SACR,kBAAkB,CAAC,MAAM,EAAE;QAC1B,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;YACxC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC5B,CAAC;KACH,CAAC;SACD,QAAQ,CACP,sVAAsV,CACvV;IACH,SAAS,EAAE,wBAAwB;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,KAAkB;IAElB,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,WAAW,EACT,+FAA+F;YAC/F,wFAAwF;YACxF,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gEAAgE;YAClG,8FAA8F;QAChG,WAAW;QACX,YAAY;QACZ,WAAW,EAAE,uBAAuB,CAClC,0BAA0B,EAC1B,QAAQ,CACT;KACF,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,mGAAmG;QACnG,mGAAmG;QACnG,8DAA8D;QAC9D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACxC,MAAM,GAAG,GAAG;YACV,SAAS,EAAE,wBAAwB,CAAC,GAAG,CAAC;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ;YACR,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC9D;YACD,iBAAiB,EAAE,GAAG;SACvB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/place-reference.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"place-reference.d.ts","sourceRoot":"","sources":["../../src/tools/place-reference.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4B/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,WAAW,GACjB,IAAI,CAsCN"}
+{"version":3,"file":"place-reference.d.ts","sourceRoot":"","sources":["../../src/tools/place-reference.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAS9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAkC/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,WAAW,GACjB,IAAI,CA8CN"}

package/dist/tools/place-reference.js

@@ -12,6 +12,10 @@ const inputSchema = z.object({
     reference: z
         .string()
         .describe("The LCP §8.1 carrier string, `lcp:{type}:{value}` — exactly what `lcp_compute_atrhash` returns as `reference`."),
+    termsUrl: z
+        .string()
+        .optional()
+        .describe("Where the terms document the reference identifies can be fetched — `https://` only. REQUIRED where the protocol declares a slot for it and the reference is a digest: a hash no counterparty can resolve is unverifiable to anyone who does not already hold the terms, so the placement refuses one. Where the protocol declares no slot, supplying it is refused rather than silently dropped."),
     document: documentShape.describe("The host protocol's own document, as JSON. Returned unchanged with the reference added; the input is never mutated."),
 });
 const outputSchema = z.object({
@@ -48,7 +52,12 @@ export function registerPlaceReference(server, ports) {
         const ref = decodeLegalContextString(args.reference);
         if (ref === undefined)
             throw new Error(`"${args.reference}" is not a recognized LCP §8.1 carrier string — expected lcp:{type}:{value} with a registered type`);
-        const outcome = adapter.place(ref, args.document);
+        // An ADVERTISEMENT: the reference, and — where the protocol has room for one — the locator. Passed
+        // through by omission rather than as an explicit `undefined`, because the manifest decides which of
+        // the two refusals an incomplete one earns.
+        const outcome = adapter.place(args.termsUrl === undefined
+            ? { ref }
+            : { ref, termsUrl: args.termsUrl }, args.document);
         if (!("ok" in outcome))
             return refusalResult(outcome);
         // `place` is typed `Outcome<unknown>` because a host document is whatever the host protocol says it

package/dist/tools/place-reference.js.map

@@ -1 +1 @@
-{"version":3,"file":"place-reference.js","sourceRoot":"","sources":["../../src/tools/place-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,CACP,8HAA8H,CAC/H;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CACP,gHAAgH,CACjH;IACH,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAC9B,qHAAqH,CACtH;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAC9B,8CAA8C,CAC/C;IACD,SAAS,EAAE,wBAAwB;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,KAAkB;IAElB,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EACT,kGAAkG;YAClG,6EAA6E;YAC7E,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;YACjG,mGAAmG;YACnG,kFAAkF;QACpF,WAAW;QACX,YAAY;QACZ,WAAW,EAAE,uBAAuB,CAAC,wBAAwB,EAAE,QAAQ,CAAC;KACzE,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,CAAC,SAAS,oGAAoG,CACvH,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,oGAAoG;QACpG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,GAAG,GAAG;YACV,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC9D;YACD,iBAAiB,EAAE,GAAG;SACvB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"place-reference.js","sourceRoot":"","sources":["../../src/tools/place-reference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,CACP,8HAA8H,CAC/H;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,CACP,gHAAgH,CACjH;IACH,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,kYAAkY,CACnY;IACH,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAC9B,qHAAqH,CACtH;CACF,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAC9B,8CAA8C,CAC/C;IACD,SAAS,EAAE,wBAAwB;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,KAAkB;IAElB,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,WAAW,EACT,kGAAkG;YAClG,6EAA6E;YAC7E,GAAG,kBAAkB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D;YACjG,mGAAmG;YACnG,kFAAkF;QACpF,WAAW;QACX,YAAY;QACZ,WAAW,EAAE,uBAAuB,CAAC,wBAAwB,EAAE,QAAQ,CAAC;KACzE,EACD,CAAC,IAAI,EAAE,EAAE;QACP,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,SAAS;YACnB,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,CAAC,SAAS,oGAAoG,CACvH,CAAC;QACJ,mGAAmG;QACnG,oGAAoG;QACpG,4CAA4C;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAC3B,IAAI,CAAC,QAAQ,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE,GAAG,EAAE;YACT,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EACpC,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,oGAAoG;QACpG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,GAAG,GAAG;YACV,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC7C,CAAC;QACF,OAAO;YACL,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;aAC9D;YACD,iBAAiB,EAAE,GAAG;SACvB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-mcp-server",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "type": "module",
   "exports": {
     ".": {
@@ -28,18 +28,18 @@
     "directory": "packages/lcp-mcp-server"
   },
   "dependencies": {
-    "@integraledger/lcp-authority": "0.10.1",
-    "@integraledger/lcp-binding-core": "0.10.1",
-    "@integraledger/lcp-discovery": "0.10.1",
-    "@integraledger/lcp-evidence": "0.10.1",
-    "@integraledger/lcp-kernel": "0.10.1",
-    "@integraledger/lcp-placement-ack": "0.10.1",
-    "@integraledger/lcp-placement-ap2": "0.10.1",
-    "@integraledger/lcp-placements": "0.10.1",
-    "@integraledger/lcp-verify": "0.10.1",
+    "@integraledger/lcp-authority": "^0.12.0",
+    "@integraledger/lcp-binding-core": "^0.12.0",
+    "@integraledger/lcp-discovery": "^0.12.0",
+    "@integraledger/lcp-evidence": "^0.12.0",
+    "@integraledger/lcp-kernel": "^0.12.0",
+    "@integraledger/lcp-placement-ack": "^0.12.0",
+    "@integraledger/lcp-placement-ap2": "^0.12.0",
+    "@integraledger/lcp-placements": "^0.12.0",
+    "@integraledger/lcp-verify": "^0.12.0",
     "@modelcontextprotocol/server": "2.0.0",
     "zod": "4.4.3",
-    "@integraledger/agent-guard": "0.9.0"
+    "@integraledger/agent-guard": "0.10.1"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.0.0",

package/src/tools/extract-reference.ts

@@ -28,6 +28,18 @@ const outputSchema = z.object({
     .describe("The LCP §8.1 carrier string recovered from the document."),
   type: z.string().describe("The §8.2 carrier type, e.g. `sha256`."),
   value: z.string().describe("The carrier value, e.g. the 0x ATR hash."),
+  termsUrl: z
+    .discriminatedUnion("kind", [
+      z.object({ kind: z.literal("read"), url: z.string() }),
+      z.object({ kind: z.literal("no-field-declared") }),
+      z.object({
+        kind: z.literal("declared-fields-empty"),
+        fields: z.array(z.string()),
+      }),
+    ])
+    .describe(
+      "Where the document says its terms live. The absences are DISTINCT and both are answers: `no-field-declared` is a fact about the PROTOCOL — it has no slot for a locator — while `declared-fields-empty` is a fact about this DOCUMENT, whose seller left every declared slot empty. Collapsing them would report a seller's silence as a protocol's.",
+    ),
   placement: PLACEMENT_SUMMARY_SCHEMA,
 });
 
@@ -69,10 +81,15 @@ export function registerExtractReference(
       const adapter = resolveAdapter(args.protocol, ports);
       const outcome = adapter.extract(args.document);
       if (!("ok" in outcome)) return refusalResult(outcome);
+      // `extract` answers with the whole advertisement — the reference, and what the document says about
+      // where its terms live. The locator's ABSENCE is typed, so the reader is told whether the protocol
+      // has no slot at all or the seller left a declared one empty.
+      const { ref, termsUrl } = outcome.value;
       const out = {
-        reference: encodeLegalContextString(outcome.value),
-        type: outcome.value.type,
-        value: outcome.value.value,
+        reference: encodeLegalContextString(ref),
+        type: ref.type,
+        value: ref.value,
+        termsUrl,
         placement: manifestSummary(adapter.manifest),
       };
       return {

package/src/tools/place-reference.ts

@@ -25,6 +25,12 @@ const inputSchema = z.object({
     .describe(
       "The LCP §8.1 carrier string, `lcp:{type}:{value}` — exactly what `lcp_compute_atrhash` returns as `reference`.",
     ),
+  termsUrl: z
+    .string()
+    .optional()
+    .describe(
+      "Where the terms document the reference identifies can be fetched — `https://` only. REQUIRED where the protocol declares a slot for it and the reference is a digest: a hash no counterparty can resolve is unverifiable to anyone who does not already hold the terms, so the placement refuses one. Where the protocol declares no slot, supplying it is refused rather than silently dropped.",
+    ),
   document: documentShape.describe(
     "The host protocol's own document, as JSON. Returned unchanged with the reference added; the input is never mutated.",
   ),
@@ -76,7 +82,15 @@ export function registerPlaceReference(
         throw new Error(
           `"${args.reference}" is not a recognized LCP §8.1 carrier string — expected lcp:{type}:{value} with a registered type`,
         );
-      const outcome = adapter.place(ref, args.document);
+      // An ADVERTISEMENT: the reference, and — where the protocol has room for one — the locator. Passed
+      // through by omission rather than as an explicit `undefined`, because the manifest decides which of
+      // the two refusals an incomplete one earns.
+      const outcome = adapter.place(
+        args.termsUrl === undefined
+          ? { ref }
+          : { ref, termsUrl: args.termsUrl },
+        args.document,
+      );
       if (!("ok" in outcome)) return refusalResult(outcome);
       // `place` is typed `Outcome<unknown>` because a host document is whatever the host protocol says it
       // is. Parsing rather than casting keeps the widening honest: an adapter that somehow returned a