@integraledger/lcp-placement-ucp 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @integraledger/lcp-placement-ucp
 
+## 0.10.1
+
+**0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus
+was re-sealed after 0.10.0 was staged — its root moved `32fa90a6…` → `28bbf4ef…` when the vector tree was
+brought inside the prose gates — so the staged `lcp-conformance` tarball carried a seal that no longer
+matched the repository. The seal is what proves corpus authenticity to an independent implementer, and a
+published version cannot be replaced, so the whole set was rejected and re-cut rather than shipping one
+package that disagreed with its own source. No version 0.10.0 exists on the registry.
+
+Released as part of a flat `0.10.1` across the whole suite. One number describes the set that was built,
+tested and sealed together, so a consumer never has to work out which combination of versions was verified.
+
+This package has no source change of its own in this release. What moved across the suite: three exported
+names were corrected before anyone depends on them — `USDC_DECIMALS` became rail-qualified after it was
+found to mean 6 on three rails and 7 on Stellar under one name, `VISA_TAP_PLACEMENT_TIER_A` lost the tier
+it had baked into an identifier, and the memo codecs were named for the carrier they encode. Two wire
+identities were respelled to match the vocabulary they are written into. Five gates were added or widened,
+and a large number of documentation claims were corrected against the host specifications at HEAD.
+
 ## 0.9.0
 
 First public release.

package/README.md

@@ -47,15 +47,19 @@ Both members are total: a refusal is a returned value, never a thrown exception.
 
 Read against the live spec at ucp.dev, version `2026-04-08` (`overview#capabilities`,
 `overview#namespace-governance`, `overview#intersection-algorithm`, and the checkout capability page), the
-gate falsified the completion plan's P1 twice:
+gate falsified the design this package was specced from, twice:
 
-1. **Vendor capabilities are Tier A.** The plan specced a links-only placement on the premise that UCP's
+1. **Vendor capabilities are Tier A.** It specced a links-only placement on the premise that UCP's
    strict schema rejects unregistered keys, making the integrity path Tier B. The live spec says the
    opposite: "Vendors MUST use their own reverse-domain namespace for custom capabilities" — no central
-   registry, no maintainer approval. What replaces registration is **authority binding**: "the origin of
-   these URLs MUST match the namespace authority" and "Platform MUST validate this binding and SHOULD
-   reject capabilities where the spec origin does not match." Built as planned, this package would have
-   shipped a URL and no hash while a hash-bearing carrier was available the whole time.
+   registry, no maintainer approval. What replaces registration is **authority binding**, and it binds the
+   `schema` URL alone: "a declared `schema` URL's origin MUST match the namespace authority in its name",
+   with a platform obliged to "validate each business-declared `schema` URL before fetching it". The `spec`
+   URL is expressly outside the trust path. Built as planned, this package would have shipped a URL and no
+   hash while a hash-bearing carrier was available the whole time. (Verified verbatim at UCP HEAD
+   2026-08-11. An earlier release quoted the host as also saying platforms "SHOULD reject capabilities where
+   the spec origin does not match" — that sentence is nowhere in UCP, and it inverts the rule above;
+   `discovery/src/capability-identity.ts` records the search that established it.)
 2. **`links[].type` is an OPEN set** ("Businesses MAY define custom types"), not the closed enum the plan
    claimed — that enum is ACP's; an earlier reading conflated the two protocols. `links[]` is REQUIRED on checkout
    responses; entries are `{type (req), url (req), title (opt)}`; `terms_of_service` is a recommended
@@ -112,7 +116,9 @@ present, the `url` carrier type itself signalling discovery-not-integrity.
 
 ## Provenance
 
-Cut against UCP `2026-04-08` (ucp.dev) and reconciled against LCP v1.37 §C.3. A deployment advertises under
+Cut against UCP `2026-04-08` (ucp.dev) and reconciled against LCP v1.37 §C.3; re-read against **v1.38 §C.3**
+on 2026-08-12, which now records `policies[]` as a Tier A carrier in the negotiated baseline — the carrier
+this package moved to. A deployment advertises under
 its own reverse-domain namespace; `org.legalcontextprotocol.*` is reserved for a TSC-ratified capability.
 
 ---

package/dist/manifest.d.ts

@@ -68,7 +68,8 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  *
  * **`termsUrlField` is deliberately OMITTED.** The terms URL rides `links[type=terms_of_service].url` — a
  * tagged-array locator that a dotted-path parser cannot resolve. Declaring it as `termsUrlField` would
- * repeat the defect S7 fixed for `field`: a declared property that is not the declared thing. The discovery
+ * repeat the defect the `field` rule exists to prevent: a declared property that is not the declared thing.
+ * The discovery
  * alias states the same fact WITH its machine-readable container, and the `PlacementManifest` contract says
  * an absent `termsUrlField` means a parser must not demand one.
  *

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,eAAO,MAAM,aAAa,EAAE,iBAyC3B,CAAC"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,eAAO,MAAM,aAAa,EAAE,iBAyC3B,CAAC"}

package/dist/manifest.js

@@ -67,7 +67,8 @@
  *
  * **`termsUrlField` is deliberately OMITTED.** The terms URL rides `links[type=terms_of_service].url` — a
  * tagged-array locator that a dotted-path parser cannot resolve. Declaring it as `termsUrlField` would
- * repeat the defect S7 fixed for `field`: a declared property that is not the declared thing. The discovery
+ * repeat the defect the `field` rule exists to prevent: a declared property that is not the declared thing.
+ * The discovery
  * alias states the same fact WITH its machine-readable container, and the `PlacementManifest` contract says
  * an absent `termsUrlField` means a parser must not demand one.
  *

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE;QACT,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,wCAAwC;QAC7C,UAAU,EAAE,iCAAiC;QAC7C,mGAAmG;QACnG,iGAAiG;QACjG,yGAAyG;QACzG,uCAAuC;QACvC,SAAS,EAAE;YACT,WAAW,EAAE;gBACX,KAAK,EACH,gKAAgK;aACnK;SACF;KACF;IACD,KAAK,EAAE,uDAAuD;IAC9D,QAAQ,EAAE;QACR;YACE,IAAI,EAAE,kCAAkC;YACxC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc;gBACpB,EAAE,EAAE,OAAO;gBACX,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kBAAkB;gBACvB,UAAU,EAAE,KAAK;aAClB;SACF;KACF;IACD,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;IAC/B,OAAO,EACL,sWAAsW;CACzW,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE;QACT,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,MAAM;QAChB,GAAG,EAAE,wCAAwC;QAC7C,UAAU,EAAE,iCAAiC;QAC7C,mGAAmG;QACnG,iGAAiG;QACjG,yGAAyG;QACzG,uCAAuC;QACvC,SAAS,EAAE;YACT,WAAW,EAAE;gBACX,KAAK,EACH,gKAAgK;aACnK;SACF;KACF;IACD,KAAK,EAAE,uDAAuD;IAC9D,QAAQ,EAAE;QACR;YACE,IAAI,EAAE,kCAAkC;YACxC,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE;gBACT,IAAI,EAAE,cAAc;gBACpB,EAAE,EAAE,OAAO;gBACX,QAAQ,EAAE,MAAM;gBAChB,GAAG,EAAE,kBAAkB;gBACvB,UAAU,EAAE,KAAK;aAClB;SACF;KACF;IACD,YAAY,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;IAC/B,OAAO,EACL,sWAAsW;CACzW,CAAC"}

package/dist/placement.d.ts

@@ -2,14 +2,17 @@ import { type ReferencePlacementAdapter } from "@integraledger/lcp-binding-core"
 /**
  * The UCP reference placement — the kit plus ONE protocol rule the kit cannot know.
  *
- * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the dotted-key capability write (the
- * container's `segments` make `com.integraledger.legal-context` ONE key, not four), the tagged-array read of
- * the `links` discovery alias, strength-ordered extraction, purity, and every refusal the vectors pin. This
+ * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the tagged-array write into `policies[]`,
+ * the tagged-array read of the `links` discovery alias, strength-ordered extraction, purity, and every
+ * refusal the vectors pin. (An earlier revision described a dotted-key capability write through the
+ * container's `segments`; that carrier was retired when UCP turned out to define no `extensions` map, and
+ * `segments` now has no shipped declarer.) This
  * file adds only the rule that is UCP's semantics rather than any container's mechanics: **a terms link must
  * be HTTPS.** An `http:` URL is rewritable in transit, so accepting one would put an unauthenticated document
  * behind a reference the record cites.
  *
- * This is the composition S7 anticipates — generic mechanics, protocol-specific semantics layered on top —
+ * This is the composition the kit is shaped for — generic mechanics, protocol-specific semantics layered on
+ * top —
  * and it wraps `extract`, not `place`: `place` never writes the links alias (the terms URL is the
  * DEPLOYMENT's datum, not the reference — see the manifest), so the write side has no URL to police.
  *

package/dist/placement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAKzC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,yBAc1B,CAAC"}
+{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAKzC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,EAAE,yBAc1B,CAAC"}

package/dist/placement.js

@@ -4,14 +4,17 @@ const base = makePlacement(UCP_PLACEMENT);
 /**
  * The UCP reference placement — the kit plus ONE protocol rule the kit cannot know.
  *
- * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the dotted-key capability write (the
- * container's `segments` make `com.integraledger.legal-context` ONE key, not four), the tagged-array read of
- * the `links` discovery alias, strength-ordered extraction, purity, and every refusal the vectors pin. This
+ * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the tagged-array write into `policies[]`,
+ * the tagged-array read of the `links` discovery alias, strength-ordered extraction, purity, and every
+ * refusal the vectors pin. (An earlier revision described a dotted-key capability write through the
+ * container's `segments`; that carrier was retired when UCP turned out to define no `extensions` map, and
+ * `segments` now has no shipped declarer.) This
  * file adds only the rule that is UCP's semantics rather than any container's mechanics: **a terms link must
  * be HTTPS.** An `http:` URL is rewritable in transit, so accepting one would put an unauthenticated document
  * behind a reference the record cites.
  *
- * This is the composition S7 anticipates — generic mechanics, protocol-specific semantics layered on top —
+ * This is the composition the kit is shaped for — generic mechanics, protocol-specific semantics layered on
+ * top —
  * and it wraps `extract`, not `place`: `place` never writes the links alias (the terms URL is the
  * DEPLOYMENT's datum, not the reference — see the manifest), so the write side has no URL to police.
  *

package/dist/placement.js.map

@@ -1 +1 @@
-{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAA8B;IACrD,GAAG,IAAI;IACP,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACjC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,6EAA6E,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE;aACvG,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC"}
+{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,IAAI,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,YAAY,GAA8B;IACrD,GAAG,IAAI;IACP,OAAO,CAAC,GAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACjC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,sBAAsB;gBACjC,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,6EAA6E,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE;aACvG,CAAC;QACJ,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-placement-ucp",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Places an LCP reference into a UCP (Universal Commerce Protocol) checkout, and reads it back.",
   "keywords": [
     "lcp",
@@ -40,7 +40,7 @@
   },
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/placement-ucp#readme",
   "dependencies": {
-    "@integraledger/lcp-binding-core": "0.9.0"
+    "@integraledger/lcp-binding-core": "0.10.1"
   },
   "devDependencies": {
     "@cfworker/json-schema": "4.1.1",

package/src/manifest.ts

@@ -69,7 +69,8 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  *
  * **`termsUrlField` is deliberately OMITTED.** The terms URL rides `links[type=terms_of_service].url` — a
  * tagged-array locator that a dotted-path parser cannot resolve. Declaring it as `termsUrlField` would
- * repeat the defect S7 fixed for `field`: a declared property that is not the declared thing. The discovery
+ * repeat the defect the `field` rule exists to prevent: a declared property that is not the declared thing.
+ * The discovery
  * alias states the same fact WITH its machine-readable container, and the `PlacementManifest` contract says
  * an absent `termsUrlField` means a parser must not demand one.
  *

package/src/placement.ts

@@ -9,14 +9,17 @@ const base = makePlacement(UCP_PLACEMENT);
 /**
  * The UCP reference placement — the kit plus ONE protocol rule the kit cannot know.
  *
- * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the dotted-key capability write (the
- * container's `segments` make `com.integraledger.legal-context` ONE key, not four), the tagged-array read of
- * the `links` discovery alias, strength-ordered extraction, purity, and every refusal the vectors pin. This
+ * `makePlacement(UCP_PLACEMENT)` supplies everything structural: the tagged-array write into `policies[]`,
+ * the tagged-array read of the `links` discovery alias, strength-ordered extraction, purity, and every
+ * refusal the vectors pin. (An earlier revision described a dotted-key capability write through the
+ * container's `segments`; that carrier was retired when UCP turned out to define no `extensions` map, and
+ * `segments` now has no shipped declarer.) This
  * file adds only the rule that is UCP's semantics rather than any container's mechanics: **a terms link must
  * be HTTPS.** An `http:` URL is rewritable in transit, so accepting one would put an unauthenticated document
  * behind a reference the record cites.
  *
- * This is the composition S7 anticipates — generic mechanics, protocol-specific semantics layered on top —
+ * This is the composition the kit is shaped for — generic mechanics, protocol-specific semantics layered on
+ * top —
  * and it wraps `extract`, not `place`: `place` never writes the links alias (the terms URL is the
  * DEPLOYMENT's datum, not the reference — see the manifest), so the write side has no URL to police.
  *