@integraledger/lcp-placement-visa-tap 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # @integraledger/lcp-placement-visa-tap
 
+## 0.11.0
+
+### Minor Changes
+
+- 822190a: Give the terms URL the write path the published set never had, and certify the composition that broke
+  without it (integra-protocol#8).
+
+  A third party assembling a seller from published parts emitted a 402 the published buyer refuses: every
+  published reader demanded `legalContextUrl` and no published writer placed it, and the schema
+  `placement-x402` inlined onto the wire (`required: ["type","value"]`, closed) contradicted the authority
+  document integraledger.com serves (`required: ["type","value","legalContextUrl"]`, closed) — two
+  definitions of one `info`, no document valid against both, each package self-consistent. Three structural
+  gaps let it ship: the manifest's `termsUrlField` was singular and read-only (declared, hygiene-checked,
+  never written — and x402's wire carries the URL in two slots, so one path could not even name the shape),
+  nothing compared the inlined schema to the authority document, and the corpus certified `place` and
+  `extract` separately but never fed one to the other.
+
+  `binding-core` — the placement seam now moves an ADVERTISEMENT, not a bare reference. `place` takes
+  `{ ref, termsUrl? }` and writes the URL at every slot the manifest's new `termsUrlFields` (plural,
+  replacing `termsUrlField`) declares; it REFUSES an integrity-bearing advertisement with no URL where slots
+  are declared (a hash no counterparty can resolve is unverifiable by construction), a URL where no slot
+  exists (silent dropping is fail-open), and a non-https URL on either side of the seam. `extract` returns
+  `{ ref, termsUrl }` with absence as a typed value — `no-field-declared` is a fact about the protocol,
+  `declared-fields-empty` a fact about the document, and the gate decides what an absence means — while two
+  slots that disagree, or a malformed value in either, refuse. The object-path writer learned to descend
+  into an EXISTING array element (never minting one, never extending a list, refusing an index segment it
+  would have to create), which is what lets x402's `accepts[0].extra` mirrors land.
+
+  `placement-x402` — the inlined wire schema now IS the authority document minus `$id` and `$defs`
+  (Bazaar forbids both on the wire), drift-gated in `lcp-conformance` where the two packages meet.
+  `termsUrlFields` declares both slots the wire carries; the bare-hash alias is written (`extra` stopped
+  being wholly scheme-private when x402 §6.1 reserved names inside it, and LCP v1.38 §C.4's own Tier A
+  illustration carries the pair there); the `url` carrier admission is withdrawn (`carrierTypes` is
+  `sha256` alone — the schema on the wire is `const: "sha256"`, and no shipped reader ever accepted a url
+  in this slot). The `place` override shrinks to composition: the kit performs the whole placement and the
+  override adds only the `{info, schema}` wrapper.
+
+  `placement-mpp` / `placement-acp` — the singular member becomes the one-entry `termsUrlFields`; the kit
+  now writes the slot their buyer parsers always demanded and refuses first at the seller.
+
+  `lcp-conformance` — the corpus grows 812 → 844: a `roundtrip` op (place then extract in one case, the
+  composition certification whose absence let two separately-conformant halves ship jointly broken),
+  advertisement-rule refusals for every manifest, and the authority↔wire drift gate. Extract expectations
+  across every placement area become the extracted advertisement.
+
+  `lcp-verify` — `referencePlacementStep` reads the advertisement (`extracted.ref.value`) and deliberately
+  ignores `termsUrl`: where the terms live is the gate's fetch concern, not a fact the record can
+  contradict.
+
+  `lcp-discovery` — the x402 authority document restates the atrHash pattern inline in both definitions
+  (no `$defs` indirection the wire copy would have to rewrite) and moves the two-definitions rationale into
+  `$defs.receipt`, so the challenge-time root is byte-derivable for the wire.
+
+### Patch Changes
+
+- Updated dependencies [b2ffecc]
+- Updated dependencies [822190a]
+  - @integraledger/lcp-binding-core@0.11.0
+
+## 0.10.1
+
+**0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus
+was re-sealed after 0.10.0 was staged — its root moved `32fa90a6…` → `28bbf4ef…` when the vector tree was
+brought inside the prose gates — so the staged `lcp-conformance` tarball carried a seal that no longer
+matched the repository. The seal is what proves corpus authenticity to an independent implementer, and a
+published version cannot be replaced, so the whole set was rejected and re-cut rather than shipping one
+package that disagreed with its own source. No version 0.10.0 exists on the registry.
+
+### Minor Changes
+
+- 3f2d2e3: **Breaking, two wire identities and one exported name.**
+
+  `LCP_CAPABILITY_NAME` is now `com.integraledger.legal_context` (was `com.integraledger.legal-context`), and
+  `LCP_TERMS_HASH_SUFFIX` is now `lcp_terms_hash` (was `lcp-terms-hash`). Both go on a counterparty's wire, and
+  both were hyphenated where the host they are written into spells its own vocabulary with underscores
+  throughout — UCP (`dev.ucp.shopping.checkout`, `com.example.policy.price_match`) and Verifiable Intent (all
+  eight registered constraint types). Our own UCP `policies[]` carrier already used underscores, so one
+  deployment identity was spelled two ways. No host forces either spelling, which is why the house had to rule
+  it: **follow the vocabulary you are writing into.** `LEGAL_CONTEXT_WELL_KNOWN_PATH` keeps its hyphen for the
+  same reason — RFC 8615 well-known names are hyphenated.
+
+  `VISA_TAP_PLACEMENT_TIER_A` is renamed `VISA_TAP_PLACEMENT`, matching every sibling placement. The tier is a
+  manifest field because it can move; an identifier carrying the answer could only be corrected by a breaking
+  rename, which is the hazard `placement-mastercard-vi` states as `tier: "B"` IS A LABEL, NOT A GATE.
+
+  The conformance corpus is re-sealed: root `32fa90a62eb83930…`, 812/812 across 44 areas, unchanged in size.
+  Twenty-two cases pinned the old spellings and were updated; the retired spelling survives deliberately in
+  `binding-core`'s kit fixtures, where it is sample input to container-validation cases cut against v1.37
+  §C.3's `extensions` shape and asserts nothing about this deployment's identity.
+
+  `minor` rather than `major` because these packages are pre-1.0, where minor is the breaking increment.
+
 ## 0.9.0
 
 First public release.

package/README.md

@@ -24,11 +24,11 @@ npm install @integraledger/lcp-placement-visa-tap
 ## Use
 
 ```ts
-import { VISA_TAP_PLACEMENT_TIER_A, visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
+import { VISA_TAP_PLACEMENT, visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
 
 declare const request: { headers: Record<string, string> }; // the TAP request, as received
 
-const placed = visaTapPlacement.place({ type: "sha256", value: "0x…" }, { headers: {} });
+const placed = visaTapPlacement.place({ ref: { type: "sha256", value: "0x…" } }, { headers: {} });
 const ref = visaTapPlacement.extract(request);
 ```
 
@@ -62,7 +62,10 @@ claims were put to the spec, and all three hold:
    silently replaceable while *looking* bound to a reader, which is strictly worse than an honestly
    advertised header.
 
-**Drift against LCP v1.37 §C.6: none material.** The appendix is an illustration; the host spec is binding
+**Drift against LCP §C.6: none material, and v1.38 closed the one wording gap.** v1.37 §C.6 did not name
+TAP's RFC 9421 signature parameters; v1.38 does — `created`, `expires`, `keyid`, `alg`, `nonce`, `tag`,
+noting `keyid` rather than `kid` and what `tag` distinguishes — which is the distinction this package draws
+below. The appendix is an illustration; the host spec is binding
 — the host's live specification is what binds. §C.6's description of the covered components, the body-object quartet and the nonce-match rule all
 survive the live read. Two notes for the record: the covered-component limitation is stated for the agent
 recognition signature in the specification and repeated for the reference implementation, so it is the
@@ -95,9 +98,9 @@ HTTP-Layer Advisory, which is exactly what an uncovered header is.
 
 ## The surface is deliberately two exports
 
-`visaTapPlacement` is `makePlacement(VISA_TAP_PLACEMENT_TIER_A)` — `makePlacement` comes from
+`visaTapPlacement` is `makePlacement(VISA_TAP_PLACEMENT)` — `makePlacement` comes from
 [`@integraledger/lcp-binding-core`](../binding-core#readme) — and nothing else — the manifest *is* the
-adapter (S7). Both members are total: a refusal is a returned value, never a thrown exception.
+adapter. Both members are total: a refusal is a returned value, never a thrown exception.
 
 **There is no helper here that builds an unsigned sibling body object, and a test pins the export set so
 there never is.** That helper is the single worst thing this package could ship: a body sibling carrying the
@@ -137,7 +140,7 @@ reach and reads with an honest `not-attempted` at settlement-enumeration.
 ## Provenance
 
 Cut against the Visa TAP specification at Visa Developer and RFC 9421, gate discharged **2026-07-30**, and
-reconciled against LCP v1.37 §C.6 the same day.
+reconciled against LCP v1.37 §C.6 the same day, and re-read against **v1.38 §C.6** on 2026-08-12.
 
 ---
 

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,3 +1,3 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/manifest.d.ts

@@ -47,6 +47,14 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export declare const VISA_TAP_PLACEMENT_TIER_A: PlacementManifest;
+export declare const VISA_TAP_PLACEMENT: PlacementManifest;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,yBAAyB,EAAE,iBAUvC,CAAC"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,kBAAkB,EAAE,iBAUhC,CAAC"}

package/dist/manifest.js

@@ -46,8 +46,16 @@
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export const VISA_TAP_PLACEMENT_TIER_A = {
+export const VISA_TAP_PLACEMENT = {
     protocol: "visa-tap",
     pattern: "http-advisory",
     tier: "A",

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IACjC,KAAK,EAAE,oBAAoB;IAC3B,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,OAAO,EACL,wJAAwJ;CAC3J,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;IACjC,KAAK,EAAE,oBAAoB;IAC3B,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,OAAO,EACL,wJAAwJ;CAC3J,CAAC"}

package/dist/placement.d.ts

@@ -1,6 +1,7 @@
 import { type ReferencePlacementAdapter } from "@integraledger/lcp-binding-core";
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the

package/dist/placement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,EAAE,yBAE9B,CAAC"}
+{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,iCAAiC,CAAC;AAGzC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,EAAE,yBACI,CAAC"}

package/dist/placement.js

@@ -1,7 +1,8 @@
 import { makePlacement, } from "@integraledger/lcp-binding-core";
-import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+import { VISA_TAP_PLACEMENT } from "./manifest.js";
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the
@@ -17,5 +18,5 @@ import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
  * would make the header any more bound than it is. The export set is pinned by a test for the related
  * reason — no helper here may build an unsigned sibling body object.
  */
-export const visaTapPlacement = makePlacement(VISA_TAP_PLACEMENT_TIER_A);
+export const visaTapPlacement = makePlacement(VISA_TAP_PLACEMENT);
 //# sourceMappingURL=placement.js.map

package/dist/placement.js.map

@@ -1 +1 @@
-{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA8B,aAAa,CACtE,yBAAyB,CAC1B,CAAC"}
+{"version":3,"file":"placement.js","sourceRoot":"","sources":["../src/placement.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAEd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,aAAa,CAAC,kBAAkB,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integraledger/lcp-placement-visa-tap",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Places an LCP reference into a Visa TAP request. The header sits outside TAP's signature.",
   "keywords": [
     "lcp",
@@ -41,7 +41,7 @@
   },
   "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/placement-visa-tap#readme",
   "dependencies": {
-    "@integraledger/lcp-binding-core": "0.9.0"
+    "@integraledger/lcp-binding-core": "0.11.0"
   },
   "devDependencies": {
     "@cfworker/json-schema": "4.1.1",

package/src/index.ts

@@ -1,2 +1,2 @@
-export { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+export { VISA_TAP_PLACEMENT } from "./manifest.js";
 export { visaTapPlacement } from "./placement.js";

package/src/manifest.ts

@@ -48,8 +48,16 @@ import type { PlacementManifest } from "@integraledger/lcp-binding-core";
  * The container is `header-map`, the only one in the placement set: RFC 9110 field names compare
  * case-insensitively, so the kit folds case on read and reuses an existing key's casing on write. Neither is
  * a heuristic — it is what reading and writing an HTTP field map correctly means.
+ *
+ * **THE TIER IS NOT IN THE NAME, AND THAT IS DELIBERATE.** This constant was `VISA_TAP_PLACEMENT_TIER_A`.
+ * The tier is a manifest FIELD precisely because it can move: Tier A here rests on a specific reading —
+ * that TAP's `Signature-Input` covers exactly `"@authority" "@path"`, so a custom header is uncovered and a
+ * stock verifier tolerates it. If TAP widens that coverage the field below changes, and an identifier
+ * carrying the old answer could only be corrected by a breaking rename. It is the same hazard
+ * `placement-mastercard-vi` states in capitals — `tier: "B"` IS A LABEL, NOT A GATE — one level up, at the
+ * API. Every sibling placement exports `<PROTOCOL>_PLACEMENT`; this one now does too.
  */
-export const VISA_TAP_PLACEMENT_TIER_A: PlacementManifest = {
+export const VISA_TAP_PLACEMENT: PlacementManifest = {
   protocol: "visa-tap",
   pattern: "http-advisory",
   tier: "A",

package/src/placement.ts

@@ -2,10 +2,11 @@ import {
   makePlacement,
   type ReferencePlacementAdapter,
 } from "@integraledger/lcp-binding-core";
-import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
+import { VISA_TAP_PLACEMENT } from "./manifest.js";
 
 /**
- * The Visa TAP reference placement. The manifest IS the adapter (S7) — there is nothing else here, and that
+ * The Visa TAP reference placement. The manifest IS the adapter — `binding-core`'s kit needs nothing else
+ * here, and that
  * is a claim about the protocol, not brevity for its own sake.
  *
  * `header-map` supplies every mechanic this placement needs: the RFC 9110 case fold on read, the
@@ -21,6 +22,5 @@ import { VISA_TAP_PLACEMENT_TIER_A } from "./manifest.js";
  * would make the header any more bound than it is. The export set is pinned by a test for the related
  * reason — no helper here may build an unsigned sibling body object.
  */
-export const visaTapPlacement: ReferencePlacementAdapter = makePlacement(
-  VISA_TAP_PLACEMENT_TIER_A,
-);
+export const visaTapPlacement: ReferencePlacementAdapter =
+  makePlacement(VISA_TAP_PLACEMENT);