@integraledger/lcp-placement-visa-tap 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @integraledger/lcp-placement-visa-tap
 
+## 0.10.1
+
+**0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus
+was re-sealed after 0.10.0 was staged — its root moved `32fa90a6…` → `28bbf4ef…` when the vector tree was
+brought inside the prose gates — so the staged `lcp-conformance` tarball carried a seal that no longer
+matched the repository. The seal is what proves corpus authenticity to an independent implementer, and a
+published version cannot be replaced, so the whole set was rejected and re-cut rather than shipping one
+package that disagreed with its own source. No version 0.10.0 exists on the registry.
+
+### Minor Changes
+
+- 3f2d2e3: **Breaking, two wire identities and one exported name.**
+
+  `LCP_CAPABILITY_NAME` is now `com.integraledger.legal_context` (was `com.integraledger.legal-context`), and
+  `LCP_TERMS_HASH_SUFFIX` is now `lcp_terms_hash` (was `lcp-terms-hash`). Both go on a counterparty's wire, and
+  both were hyphenated where the host they are written into spells its own vocabulary with underscores
+  throughout — UCP (`dev.ucp.shopping.checkout`, `com.example.policy.price_match`) and Verifiable Intent (all
+  eight registered constraint types). Our own UCP `policies[]` carrier already used underscores, so one
+  deployment identity was spelled two ways. No host forces either spelling, which is why the house had to rule
+  it: **follow the vocabulary you are writing into.** `LEGAL_CONTEXT_WELL_KNOWN_PATH` keeps its hyphen for the
+  same reason — RFC 8615 well-known names are hyphenated.
+
+  `VISA_TAP_PLACEMENT_TIER_A` is renamed `VISA_TAP_PLACEMENT`, matching every sibling placement. The tier is a
+  manifest field because it can move; an identifier carrying the answer could only be corrected by a breaking
+  rename, which is the hazard `placement-mastercard-vi` states as `tier: "B"` IS A LABEL, NOT A GATE.
+
+  The conformance corpus is re-sealed: root `32fa90a62eb83930…`, 812/812 across 44 areas, unchanged in size.
+  Twenty-two cases pinned the old spellings and were updated; the retired spelling survives deliberately in
+  `binding-core`'s kit fixtures, where it is sample input to container-validation cases cut against v1.37
+  §C.3's `extensions` shape and asserts nothing about this deployment's identity.
+
+  `minor` rather than `major` because these packages are pre-1.0, where minor is the breaking increment.
+
 ## 0.9.0
 
 First public release.

package/README.md

@@ -24,7 +24,7 @@ npm install @integraledger/lcp-placement-visa-tap
 ## Use
 
 ```ts
-import { VISA_TAP_PLACEMENT_TIER_A, visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
+import { VISA_TAP_PLACEMENT, visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
 
 declare const request: { headers: Record<string, string> }; // the TAP request, as received
 
@@ -62,7 +62,10 @@ claims were put to the spec, and all three hold:
    silently replaceable while *looking* bound to a reader, which is strictly worse than an honestly
    advertised header.
 
-**Drift against LCP v1.37 §C.6: none material.** The appendix is an illustration; the host spec is binding
+**Drift against LCP §C.6: none material, and v1.38 closed the one wording gap.** v1.37 §C.6 did not name
+TAP's RFC 9421 signature parameters; v1.38 does — `created`, `expires`, `keyid`, `alg`, `nonce`, `tag`,
+noting `keyid` rather than `kid` and what `tag` distinguishes — which is the distinction this package draws
+below. The appendix is an illustration; the host spec is binding
 — the host's live specification is what binds. §C.6's description of the covered components, the body-object quartet and the nonce-match rule all
 survive the live read. Two notes for the record: the covered-component limitation is stated for the agent
 recognition signature in the specification and repeated for the reference implementation, so it is the
@@ -95,9 +98,9 @@ HTTP-Layer Advisory, which is exactly what an uncovered header is.
 
 ## The surface is deliberately two exports
 
-`visaTapPlacement` is `makePlacement(VISA_TAP_PLACEMENT_TIER_A)` — `makePlacement` comes from
+`visaTapPlacement` is `makePlacement(VISA_TAP_PLACEMENT)` — `makePlacement` comes from
 [`@integraledger/lcp-binding-core`](../binding-core#readme) — and nothing else — the manifest *is* the
-adapter (S7). Both members are total: a refusal is a returned value, never a thrown exception.
+adapter. Both members are total: a refusal is a returned value, never a thrown exception.
 
 **There is no helper here that builds an unsigned sibling body object, and a test pins the export set so
 there never is.** That helper is the single worst thing this package could ship: a body sibling carrying the
@@ -137,7 +140,7 @@ reach and reads with an honest `not-attempted` at settlement-enumeration.
 ## Provenance
 
 Cut against the Visa TAP specification at Visa Developer and RFC 9421, gate discharged **2026-07-30**, and
-reconciled against LCP v1.37 §C.6 the same day.
+reconciled against LCP v1.37 §C.6 the same day, and re-read against **v1.38 §C.6** on 2026-08-12.
 
 ---
 

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/manifest.d.ts

@@ -47,6 +47,14 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export declare const VISA_TAP_PLACEMENT_TIER_A: PlacementManifest;
+export declare const VISA_TAP_PLACEMENT: PlacementManifest;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,yBAAyB,EAAE,iBAUvC,CAAC"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAUhC,CAAC"}

package/dist/manifest.js

@@ -46,8 +46,16 @@
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export const VISA_TAP_PLACEMENT_TIER_A = {
+export const VISA_TAP_PLACEMENT = {
     protocol: "visa-tap",
     pattern: "http-advisory",
     tier: "A",

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IACjC,KAAK,EAAE,oBAAoB;IAC3B,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,OAAO,EACL,wJAAwJ;CAC3J,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IACjC,KAAK,EAAE,oBAAoB;IAC3B,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,OAAO,EACL,wJAAwJ;CAC3J,CAAC"}

package/dist/placement.d.ts

@@ -1,6 +1,7 @@
 import { type ReferencePlacementAdapter } from "@integraledger/lcp-binding-core";
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the

package/dist/placement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,EAAE,yBAE9B,CAAC"}
+{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,EAAE,yBACI,CAAC"}

package/dist/placement.js

@@ -1,7 +1,8 @@
 import { makePlacement, } from "@integraledger/lcp-binding-core";
-import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+import { VISA_TAP_PLACEMENT } from "./manifest.js";
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the
@@ -17,5 +18,5 @@ import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
  * would make the header any more bound than it is. The export set is pinned by a test for the related
  * reason — no helper here may build an unsigned sibling body object.
  */
-export const visaTapPlacement = makePlacement(VISA_TAP_PLACEMENT_TIER_A);
+export const visaTapPlacement = makePlacement(VISA_TAP_PLACEMENT);
 //# sourceMappingURL=placement.js.map

package/dist/placement.js.map

@@ -1 +1 @@
-{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA8B,aAAa,CACtE,yBAAyB,CAC1B,CAAC"}
+{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,aAAa,CAAC,kBAAkB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-placement-visa-tap",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Places an LCP reference into a Visa TAP request. The header sits outside TAP's signature.",
   "keywords": [
     "lcp",
@@ -41,7 +41,7 @@
   },
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/placement-visa-tap#readme",
   "dependencies": {
-    "@integraledger/lcp-binding-core": "0.9.0"
+    "@integraledger/lcp-binding-core": "0.10.1"
   },
   "devDependencies": {
     "@cfworker/json-schema": "4.1.1",

package/src/index.ts

@@ -1,2 +1,2 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";

package/src/manifest.ts

@@ -48,8 +48,16 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export const VISA_TAP_PLACEMENT_TIER_A: PlacementManifest = {
+export const VISA_TAP_PLACEMENT: PlacementManifest = {
   protocol: "visa-tap",
   pattern: "http-advisory",
   tier: "A",

package/src/placement.ts

@@ -2,10 +2,11 @@ import {
   makePlacement,
   type ReferencePlacementAdapter,
 } from "@integraledger/lcp-binding-core";
-import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+import { VISA_TAP_PLACEMENT } from "./manifest.js";
 
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the
@@ -21,6 +22,5 @@ import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
  * would make the header any more bound than it is. The export set is pinned by a test for the related
  * reason — no helper here may build an unsigned sibling body object.
  */
-export const visaTapPlacement: ReferencePlacementAdapter = makePlacement(
-  VISA_TAP_PLACEMENT_TIER_A,
-);
+export const visaTapPlacement: ReferencePlacementAdapter =
+  makePlacement(VISA_TAP_PLACEMENT);