@integraledger/lcp-placement-visa-tap 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @integraledger/lcp-placement-visa-tap
 
+## 0.16.0
+
+### Patch Changes
+
+- @integraledger/lcp-binding-core@0.16.0
+
+## 0.15.1
+
+### Patch Changes
+
+- Updated dependencies [431b8ec]
+  - @integraledger/lcp-binding-core@0.15.1
+
 ## 0.15.0
 
 ### Patch Changes
@@ -73,7 +86,7 @@
   `placement-x402` — the inlined wire schema now IS the authority document minus `$id` and `$defs`
   (Bazaar forbids both on the wire), drift-gated in `lcp-conformance` where the two packages meet.
   `termsUrlFields` declares both slots the wire carries; the bare-hash alias is written (`extra` stopped
-  being wholly scheme-private when x402 §6.1 reserved names inside it, and LCP v1.38 §C.4's own Tier A
+  being wholly scheme-private when x402 §6.1 reserved names inside it, and LCP §C.4's own Tier A
   illustration carries the pair there); the `url` carrier admission is withdrawn (`carrierTypes` is
   `sha256` alone — the schema on the wire is `const: "sha256"`, and no shipped reader ever accepted a url
   in this slot). The `place` override shrinks to composition: the kit performs the whole placement and the
@@ -129,7 +142,7 @@ package that disagreed with its own source. No version 0.10.0 exists on the regi
 
   The conformance corpus is re-sealed: root `32fa90a62eb83930…`, 812/812 across 44 areas, unchanged in size.
   Twenty-two cases pinned the old spellings and were updated; the retired spelling survives deliberately in
-  `binding-core`'s kit fixtures, where it is sample input to container-validation cases cut against v1.37
+  `binding-core`'s kit fixtures, where it is sample input to container-validation cases cut against an earlier draft
   §C.3's `extensions` shape and asserts nothing about this deployment's identity.
 
   `minor` rather than `major` because these packages are pre-1.0, where minor is the breaking increment.
@@ -139,7 +152,7 @@ package that disagreed with its own source. No version 0.10.0 exists on the regi
 First public release.
 
 `0.9.0` is deliberate: this is a release candidate for 1.0, not a preview. The implementation is complete
-against LCP v1.38 and certified by the conformance corpus, and the remaining distance to 1.0 is the
+against the published LCP specification and certified by the conformance corpus, and the remaining distance to 1.0 is the
 specification's own — the standard is still moving through its steering committee, and this package will not
 claim a stability its protocol has not yet promised.
 

package/README.md

@@ -62,10 +62,12 @@ claims were put to the spec, and all three hold:
    silently replaceable while *looking* bound to a reader, which is strictly worse than an honestly
    advertised header.
 
-**Drift against LCP §C.6: none material, and v1.38 closed the one wording gap.** v1.37 §C.6 did not name TAP's
-RFC 9421 signature parameters; v1.38 does — `created`, `expires`, `keyid`, `alg`, `nonce`, `tag`, noting
-`keyid` rather than `kid` and what `tag` distinguishes — which is the distinction this package draws below.
-The appendix is an illustration; the host's live specification is what binds.
+**Drift against LCP §C.6: none material, and one wording gap still open.** LCP §C.6 does not enumerate TAP's
+RFC 9421 signature parameters — `created`, `expires`, `keyid`, `alg`, `nonce` and `tag` — and does not say
+what `tag` distinguishes; the enumeration above is read off the host, not off the appendix. §C.6 does carry
+the one spelling note, "`keyid`, not `kid`, per [RFC 9421]", but attaches it to the *body-object* quartet it
+proposes, where TAP itself spells the member `kid` — `keyid` is the message-signature parameter, and this
+package follows the host on both. The appendix is an illustration; the host's live specification is what binds.
 §C.6's description of the covered components, the body-object quartet and the nonce-match rule all survive the
 live read. Two notes for the record: the covered-component limitation is stated for the agent recognition
 signature in the specification and repeated for the reference implementation, so it is the protocol's shape
@@ -140,7 +142,7 @@ reach and reads with an honest `not-attempted` at settlement-enumeration.
 ## Provenance
 
 Cut against the Visa TAP specification at Visa Developer and RFC 9421, gate discharged **2026-07-30**, and
-reconciled against LCP v1.37 §C.6 the same day, and re-read against **v1.38 §C.6** on 2026-08-12.
+reconciled against LCP §C.6 the same day, and re-read against **LCP §C.6** on 2026-08-12.
 
 ---
 

package/dist/manifest.d.ts

@@ -5,7 +5,7 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * Cut against the LIVE TAP specification published at Visa Developer
  * (`developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications`), the
  * `visa/trusted-agent-protocol` reference implementation's RFC 9421 documentation, and RFC 9421 itself —
- * gate discharged 2026-07-30 against LCP v1.37 §C.6, re-checked against v1.38 §C.6 on 2026-08-08 — no
+ * gate discharged 2026-07-30 against LCP §C.6, re-checked against LCP §C.6 on 2026-08-08 — no
  * material drift either time.
  *
  * TAP is built on HTTP Message Signatures [RFC 9421] with a three-signature model establishing agent

package/dist/manifest.js

@@ -4,7 +4,7 @@
  * Cut against the LIVE TAP specification published at Visa Developer
  * (`developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications`), the
  * `visa/trusted-agent-protocol` reference implementation's RFC 9421 documentation, and RFC 9421 itself —
- * gate discharged 2026-07-30 against LCP v1.37 §C.6, re-checked against v1.38 §C.6 on 2026-08-08 — no
+ * gate discharged 2026-07-30 against LCP §C.6, re-checked against LCP §C.6 on 2026-08-08 — no
  * material drift either time.
  *
  * TAP is built on HTTP Message Signatures [RFC 9421] with a three-signature model establishing agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-placement-visa-tap",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Places an LCP reference into a Visa TAP request. The header sits outside TAP's signature.",
   "keywords": [
     "lcp",
@@ -41,7 +41,7 @@
   },
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/placement-visa-tap#readme",
   "dependencies": {
-    "@integraledger/lcp-binding-core": "0.15.0"
+    "@integraledger/lcp-binding-core": "0.16.0"
   },
   "devDependencies": {
     "@cfworker/json-schema": "4.1.1",

package/src/manifest.ts

@@ -6,7 +6,7 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * Cut against the LIVE TAP specification published at Visa Developer
  * (`developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications`), the
  * `visa/trusted-agent-protocol` reference implementation's RFC 9421 documentation, and RFC 9421 itself —
- * gate discharged 2026-07-30 against LCP v1.37 §C.6, re-checked against v1.38 §C.6 on 2026-08-08 — no
+ * gate discharged 2026-07-30 against LCP §C.6, re-checked against LCP §C.6 on 2026-08-08 — no
  * material drift either time.
  *
  * TAP is built on HTTP Message Signatures [RFC 9421] with a three-signature model establishing agent