@integraledger/lcp-placement-x402 0.10.1 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,111 @@
 # @integraledger/lcp-placement-x402
 
+## 0.12.0
+
+### Patch Changes
+
+- @integraledger/lcp-binding-core@0.12.0
+
+## 0.11.0
+
+### Minor Changes
+
+- 822190a: Give the terms URL the write path the published set never had, and certify the composition that broke
+  without it (integra-protocol#8).
+
+  A third party assembling a seller from published parts emitted a 402 the published buyer refuses: every
+  published reader demanded `legalContextUrl` and no published writer placed it, and the schema
+  `placement-x402` inlined onto the wire (`required: ["type","value"]`, closed) contradicted the authority
+  document integraledger.com serves (`required: ["type","value","legalContextUrl"]`, closed) — two
+  definitions of one `info`, no document valid against both, each package self-consistent. Three structural
+  gaps let it ship: the manifest's `termsUrlField` was singular and read-only (declared, hygiene-checked,
+  never written — and x402's wire carries the URL in two slots, so one path could not even name the shape),
+  nothing compared the inlined schema to the authority document, and the corpus certified `place` and
+  `extract` separately but never fed one to the other.
+
+  `binding-core` — the placement seam now moves an ADVERTISEMENT, not a bare reference. `place` takes
+  `{ ref, termsUrl? }` and writes the URL at every slot the manifest's new `termsUrlFields` (plural,
+  replacing `termsUrlField`) declares; it REFUSES an integrity-bearing advertisement with no URL where slots
+  are declared (a hash no counterparty can resolve is unverifiable by construction), a URL where no slot
+  exists (silent dropping is fail-open), and a non-https URL on either side of the seam. `extract` returns
+  `{ ref, termsUrl }` with absence as a typed value — `no-field-declared` is a fact about the protocol,
+  `declared-fields-empty` a fact about the document, and the gate decides what an absence means — while two
+  slots that disagree, or a malformed value in either, refuse. The object-path writer learned to descend
+  into an EXISTING array element (never minting one, never extending a list, refusing an index segment it
+  would have to create), which is what lets x402's `accepts[0].extra` mirrors land.
+
+  `placement-x402` — the inlined wire schema now IS the authority document minus `$id` and `$defs`
+  (Bazaar forbids both on the wire), drift-gated in `lcp-conformance` where the two packages meet.
+  `termsUrlFields` declares both slots the wire carries; the bare-hash alias is written (`extra` stopped
+  being wholly scheme-private when x402 §6.1 reserved names inside it, and LCP v1.38 §C.4's own Tier A
+  illustration carries the pair there); the `url` carrier admission is withdrawn (`carrierTypes` is
+  `sha256` alone — the schema on the wire is `const: "sha256"`, and no shipped reader ever accepted a url
+  in this slot). The `place` override shrinks to composition: the kit performs the whole placement and the
+  override adds only the `{info, schema}` wrapper.
+
+  `placement-mpp` / `placement-acp` — the singular member becomes the one-entry `termsUrlFields`; the kit
+  now writes the slot their buyer parsers always demanded and refuses first at the seller.
+
+  `lcp-conformance` — the corpus grows 812 → 844: a `roundtrip` op (place then extract in one case, the
+  composition certification whose absence let two separately-conformant halves ship jointly broken),
+  advertisement-rule refusals for every manifest, and the authority↔wire drift gate. Extract expectations
+  across every placement area become the extracted advertisement.
+
+  `lcp-verify` — `referencePlacementStep` reads the advertisement (`extracted.ref.value`) and deliberately
+  ignores `termsUrl`: where the terms live is the gate's fetch concern, not a fact the record can
+  contradict.
+
+  `lcp-discovery` — the x402 authority document restates the atrHash pattern inline in both definitions
+  (no `$defs` indirection the wire copy would have to rewrite) and moves the two-definitions rationale into
+  `$defs.receipt`, so the challenge-time root is byte-derivable for the wire.
+
+### Patch Changes
+
+- b2ffecc: Report the class a record actually supports, place a terms URL on UCP, and stop refusing a conformant UCP
+  profile — the remediation of the 2026-08-19 conformance re-audit.
+
+  **`verify` now computes `supportedClass` instead of echoing the claim.** It was `anyFailed ? "TC-0" :
+claimedClass`, so a record proving nothing — no settlement, no acceptance, no authority chain — reported
+  whatever class the caller named, while the field's own published docblock promised "what the record
+  honestly supports, not what the caller asked for". It is now the highest class every one of whose required
+  steps is `proved`, `TC-0` on any failure, computed from the steps alone: neither capped by the claim (rungs
+  that reach TC-3 read TC-3 where the caller claimed TC-2) nor lifted by it. White paper #4 §5 defines the
+  class of a transaction as "the highest class whose criteria it fully meets", and this is that.
+
+  The claim is not discarded — the report gains **`claimedClass`**, a required member, because `verified`
+  answers "did the record reach the class it claimed?" and cannot be read without it. The two fields are the
+  report's two halves: an input echoed, and a finding computed. Where they differ, the record did not reach
+  its own shape. An out-of-taxonomy claim now lands only in the echo and can no longer masquerade as a
+  finding.
+
+  **UCP can advertise a terms URL.** Its policy object declares `url` — "Optional link to the full policy
+  document", `format: uri` — on the very entry this placement writes, and §C.3's illustration carries `url`
+  and `atrHash` side by side there. The manifest previously said the protocol had no slot, citing `links[]`,
+  which §C.3 separates as "a standing page, not a per-transaction record". The obstacle was mechanical:
+  `termsUrlFields` addresses document paths, and a tagged-array entry's index is chosen at write time. The
+  `tagged-array` container therefore gains `termsUrlField`, written onto the same entry in the same write, and
+  read back through the same first-match rule. UCP was the last shipped protocol that refused an
+  advertisement carrying its own locator (integra-protocol#8).
+
+  **`readUcpProfile` no longer refuses a conformant business profile.** `requireHttps` mapped an ABSENT `spec`
+  to the same branch as a malformed one, and the live host requires `spec` only of a platform declaration —
+  as this repository's own README already said. It is now `requireHttpsIfDeclared`: absence is absence, and a
+  declared value is still held to the host's https MUST.
+
+  Also: `requireWritten` replaces an unchecked cast in the x402 override, so a broken postcondition throws
+  instead of returning a success carrying no document; six x402 citations move to the revision that actually
+  touches the file they name, and a new gate refuses any `owner/repo@sha` in source that `spec-pins.json` does
+  not record; four spec citations move from line anchors to section anchors; the escrow binding states why it
+  declares no §8.3.1 off-canonical variant, and asserts it; and §C.3's `policies[]` illustration is recorded as
+  invalid against the live UCP schema, which shows `description` as a bare string where the host requires an
+  object — owed upstream, not a defect here.
+
+  Corpus 844 → 847, root `ec4ad1b02a81538b…`.
+
+- Updated dependencies [b2ffecc]
+- Updated dependencies [822190a]
+  - @integraledger/lcp-binding-core@0.11.0
+
 ## 0.10.1
 
 **0.10.0 was staged and withdrawn before approval; this is that release, re-cut.** The conformance corpus

package/README.md

@@ -19,10 +19,10 @@ npm install @integraledger/lcp-placement-x402
 | **Chain** | none here — settlement is `binding-evm-x402`'s, on whichever EVM rail the scheme selects |
 | **Pattern** | `http-advisory` (LCP §8.3.7, Tier A) |
 | **Field** | `extensions.legalContext.info` — the top-level extensions map, the carrier x402 protects |
-| **Read also** | `accepts.0.extra.atrHash` — a **bare** hash, its own encoding (integrity) |
-| **Terms URL** | `extensions.legalContext.info.legalContextUrl` — declared, never written by `place` |
-| **Carrier types** | `sha256`, `url` |
-| **Spec** | x402 v2 (`x402-foundation/x402@1fec3aa04e41`, `specs/x402-specification-v2.md`), gate discharged **2026-07-30** |
+| **Read also** | `accepts.0.extra.atrHash` — a **bare** hash, its own encoding (integrity), **written** by `place` |
+| **Terms URL** | `extensions.legalContext.info.legalContextUrl` and `accepts.0.extra.legalContextUrl` — both written by `place` |
+| **Carrier types** | `sha256` |
+| **Spec** | x402 v2 (`x402-foundation/x402@db5da2e65952`, `specs/x402-specification-v2.md`, read **2026-08-11**), gate discharged **2026-07-30** |
 
 ## Use
 
@@ -31,7 +31,9 @@ import { X402_PLACEMENT, x402Placement } from "@integraledger/lcp-placement-x402
 
 declare const challenge: unknown; // the x402 402 challenge document, as received
 
-const placed = x402Placement.place({ type: "sha256", value: "0x…" }, challenge);
+const placed = x402Placement.place(
+  { ref: { type: "sha256", value: "0x…" }, termsUrl: "https://seller.example/.well-known/legal-context.json" },
+  challenge);
 const ref = x402Placement.extract(challenge); // reads either carrier, canonical first
 ```
 
@@ -55,8 +57,9 @@ and the PaymentRequirements table), four facts were confirmed and each one decid
    cannot delete or overwrite existing info." This is the carrier the **protocol itself protects**, which is
    why it is canonical here rather than the per-requirement object.
 4. **`extra` is "Scheme-specific additional information"** on a `PaymentRequirements` entry — the payment
-   scheme's object, whose contents that scheme defines. So `place` **never writes there**; the alias is
-   read-only, and that is a decision about whose namespace it is, not an omission.
+   scheme's object, whose contents that scheme defines. `place` writes the §C.4 mirror and the terms URL
+   there because §6.1 reserves those names for exactly this use, and writing only the extensions map left
+   a challenge the published buyer parsers refuse (integra-protocol#8).
 
 Extension identifiers are implementation-defined strings — no registry, no reverse-domain rule — so the
 `legalContext` key is available today and this placement is Tier A on the wire.
@@ -150,55 +153,48 @@ canonical non-negative integer segment only, so `length` and every other array p
 That relaxation lives in the kit rather than in a private loop here, because a read rule nobody can find is
 the same defect as a carrier nobody can find.
 
-## Known limitations
-
-- **`place` writes the hash, never the terms URL.** `place(ref, doc)` holds one reference; the terms URL is a
-  second datum. `termsUrlField` is declared so a parser can find the URL our seller does emit, the same
-  division `placement-acp` draws with `metadata.legal_context_url`.
-- **The shipped carrier repeats the URL at `accepts[0].extra.legalContextUrl`.** A single `termsUrlField`
-  cannot express two spellings, so that one is recorded here rather than half-declared in the manifest.
-- **A `url` carrier is placeable here and no shipped x402 reader accepts one.** `carrierTypes` permits
-  `sha256` and `url` — the §8.1 integrity form and the §8.1 discovery form, the same pair `placement-acp` and
-  `placement-ucp` permit — while a strict buyer gate refuses any `info.type` but `sha256`. The permission is not
-  narrowed away here because narrowing the reference field to one type is a statement about what the slot may
-  hold across the whole set, not a fact about x402. **Related and not ours to fix in this package:**
-  `readDeclaredPaths` labels a canonical-field hit `carrierClass: "integrity"` unconditionally, so a `url`
-  read from `extensions.legalContext.info` is labelled `integrity` and passes `requireIntegrity()` (from
-  [`@integraledger/lcp-binding-core`](../binding-core#readme), like `makePlacement`). That is
-  `binding-core` behaviour that `placement-acp` and `placement-ucp` already share on `main`; this manifest
-  only adds a third reference field with the same property, and `requireIntegrity` has no production caller
-  yet.
-- **Our own `legalContext` entry is replaced whole, not merged — and the key that loses is `legalContextUrl`,
-  the one `termsUrlField` points at.** `place` writes `{info, schema}`, so nothing previously inside our entry
-  survives, and on the document sellers actually emit that is concretely the terms-URL half: measured on
-  the vector case for the long-standing shipped carrier, `termsUrlField` reads
-  `https://seller.example/.well-known/legal-context.json` before `place` and `undefined` after. This is the
-  kit's leaf-write semantics, not an override defect — `makePlacement(X402_PLACEMENT).place` drops it
-  identically — and it is why the previous bullet says `place` holds one reference: a caller that needs both
-  halves on the wire writes the URL itself.
-  **Consequence for a buyer.** Do not build a `PaymentPayload` echo with `place`. x402's rule is that the
-  client "cannot delete or overwrite existing `info`", and re-placing over a server-sent entry deletes the
-  URL the server put there. Echo the received entry verbatim and place only where no entry exists yet; the
-  reconciled read/echo path belongs to a universal buyer parser, not this package.
-  x402 defines only `info` and `schema` for an entry and the `legalContext` key is ours, so owning the entry is
-  the point for the *seller* direction; entries *beside* ours in the `extensions` map are preserved
-  unconditionally.
-- **`LEGAL_CONTEXT_SCHEMA` is INLINED, not a reference.** It was a `$ref` at
-  `https://legalcontextprotocol.org/schemas/lcp-extension.json`, which returns 404 — re-measured
-  2026-08-11 — and x402 makes `schema` a REQUIRED member of every extension entry, so that shipped a
-  required member no counterparty could resolve. All nine extensions published in the x402 repository inline
-  a complete JSON Schema, and one of them, Bazaar, forbids an external `$ref` outright. The exported value is
-  now a frozen literal that is byte-identical to what the placement emits. Changing it is a **wire change**:
-  it appears in every challenge.
+## Limitations, and the three this version resolved
+
+The predecessor recorded four limitations here. Three were one defect wearing different clothes —
+integra-protocol#8, a seller built on this package emitting a challenge the published buyer refuses — and
+are resolved rather than recorded:
+
+- **`place` now writes the whole advertisement.** `place({ ref, termsUrl }, doc)` puts the reference and
+  the terms URL on the wire together, at every slot `termsUrlFields` declares — the `info` member the
+  authority schema requires and the `accepts[0].extra` mirror §C.4's illustration carries — and REFUSES an
+  integrity-bearing advertisement with no URL, because a hash no counterparty can resolve is unverifiable
+  by construction. The predecessor's "place writes the hash, never the terms URL" division put the URL in
+  no published writer at all while every published reader demanded it.
+- **Both URL spellings are declared, and both are written.** `termsUrlFields` is plural; the singular
+  member could not express the second spelling and the shipped carrier's `extra`-side URL lived only in
+  this README.
+- **Our own entry is still replaced whole — and no longer costs the URL.** `place` rebuilds
+  `{info, schema}` wholesale (junk a counterparty parked inside our entry does not ride our wire), and the
+  URL survives because the rebuild happens after the kit has written it into `info`. The predecessor
+  measured the opposite: the leaf-write dropped `legalContextUrl` on the very document sellers emit.
+
+One limitation is withdrawn rather than resolved: **the `url` carrier admission is gone.**
+`carrierTypes` is `sha256` alone. A `url` here was well-formed against the manifest and refused by every
+shipped reader — a permission no reader accepts is a claim about the ecosystem, not a description of it —
+and the schema this package itself puts on the wire (the authority document's shape, drift-gated in
+`@integraledger/lcp-conformance`) is `const: "sha256"`, so a `url` reference would emit a challenge that
+violates its own adjacent schema.
+
+What remains, and is a fact rather than a defect: **`readDeclaredPaths` labels a canonical-field hit
+`carrierClass: "integrity"` unconditionally.** That is `binding-core` behaviour shared by every placement,
+and `requireIntegrity()` (from
+[`@integraledger/lcp-binding-core`](../binding-core#readme), like `makePlacement`) is where a caller that
+needs a content-addressed value says so — it checks the decoded type as well as the slot's label.
 
 ## Provenance
 
-Cut against x402 v2 (`x402-foundation/x402@1fec3aa04e41`, `specs/x402-specification-v2.md`, read 2026-07-30) and reconciled
-against LCP v1.37 §C.4 the same day, and re-read against **v1.38 §C.4** on 2026-08-12 — which adopted the
-drift items below and added §6.1's reserved keys. The **paths and shapes** are matched field-for-field against the
-shipped seller carrier and the buyer parsers that read it; the **resolution semantics diverge from a strict
-buyer gate in three recorded ways**, and *Drift from a strict buyer-side reader*
-above states each one and who closes it. Both drift sections are the disclosure, not a to-do list — a
+Cut against x402 v2 and reconciled against LCP v1.37 §C.4 on 2026-07-30, and re-read against **v1.38 §C.4**
+on 2026-08-12 — which adopted the drift items below and added §6.1's reserved keys. The host revision is
+`x402-foundation/x402@db5da2e65952` (`specs/x402-specification-v2.md`), which is what `spec-pins.json`
+records this tree read on 2026-08-11 and what `pnpm spec-drift` watches. The **paths and shapes** are
+matched field-for-field against the shipped seller carrier and the buyer parsers that read it; the
+**resolution semantics diverge from a strict buyer gate in three recorded ways**, and *Drift from a strict
+buyer-side reader* above states each one and who closes it. Both drift sections are the disclosure, not a to-do list — a
 divergence written down is governed; the same divergence unwritten is the undisclosed-drift defect wearing
 a new name.
 

package/dist/manifest.d.ts

@@ -1,40 +1,44 @@
 import type { PlacementManifest } from "@integraledger/lcp-binding-core";
 /**
- * The carrier's JSON Schema, INLINED rather than referenced.
- *
- * x402 makes `schema` a REQUIRED member of an extension entry — "JSON Schema defining the expected
- * structure of info" — so whatever goes here is on the wire of every challenge. A `$ref` to a URL nobody
- * serves would be a required member no counterparty can resolve, and "x402 never fetches it" is a reason
- * that does not break, not a reason to ship it. (`https://legalcontextprotocol.org/schemas/lcp-extension.json`
- * returns **404**, measured 2026-08-08 — the schema is inlined instead.)
- *
- * **All nine extensions published in the x402 repository inline a complete JSON Schema** rather than
- * referencing an external document — `bazaar`, `builder-code`, `eip2612GasSponsoring`,
- * `erc20ApprovalGasSponsoring`, `auth-hints`, `offer-receipt`, `http-message-signatures`,
- * `payment-identifier`, `sign-in-with-x`, read at `x402-foundation/x402` HEAD 2026-08-11. Note that two of
- * the nine are camelCase, so this package's `legalContext` key follows an established minority spelling
- * rather than diverging from a unanimous one. LCP v1.38 §C.4 says to do one or the other — "Because
- * `schema` is a REQUIRED member, publish a resolvable schema or inline it" — and adds that inlining is the
- * safer of the two. Inlining also removes a hosting
- * dependency the deployment does not currently meet — the same dependency the UCP capability still owes.
- *
- * **One of the nine makes it a rule, which settles the question.** The Bazaar extension requires a
- * `schema`'s `$ref`/`$id` values to be "same-document JSON Pointer fragments (starting with `#`); external
- * references (`http(s)://`, `file://`, or any other absolute/relative URI) are not allowed", and says a
- * facilitator "must not resolve external `$ref`/`$id` values … when validating an untrusted `schema`". So a
- * `$ref` here would not merely be unresolvable to a counterparty — it would be rejected outright by any
- * facilitator cataloguing this extension.
- *
- * The shape is the §8.1 reference object this placement writes into `info`, and nothing more: it describes
- * the carrier, not the terms behind it.
+ * The carrier's JSON Schema, INLINED rather than referenced — and equal, member for member, to the
+ * AUTHORITY document at `https://integraledger.com/lcp/x402/legal-context/v1.schema.json` minus its `$id`
+ * and `$defs`. That equality is load-bearing and drift-gated (the conformance suite compares this literal
+ * to `@integraledger/lcp-discovery`'s shipped copy of the authority file), because its absence was a
+ * published defect: from 0.10.1's release until this version, this schema said `required: ["type",
+ * "value"]` while the authority document said `required: ["type", "value", "legalContextUrl"]` — two
+ * definitions of the same `info` in the published ecosystem, self-consistent halves, no document valid
+ * against both (integra-protocol#8). Both being conformant to the schema each carried is exactly why no
+ * package's own tests could catch it; only comparing the two could, and now something does.
+ *
+ * WHY INLINE AT ALL: x402 makes `schema` a REQUIRED member of an extension entry — "JSON Schema defining
+ * the expected structure of info" — so whatever goes here is on the wire of every challenge. **All nine
+ * extensions published in the x402 repository inline a complete JSON Schema** rather than referencing an
+ * external document (`x402-foundation/x402` HEAD, read 2026-08-11), and one of the nine makes it a rule:
+ * the Bazaar extension requires a `schema`'s `$ref`/`$id` values to be "same-document JSON Pointer
+ * fragments (starting with `#`); external references … are not allowed", and says a facilitator "must not
+ * resolve external `$ref`/`$id` values … when validating an untrusted `schema`". So an external `$ref`
+ * here would not merely be unresolvable to a counterparty that declines to fetch — wherever Bazaar
+ * governs, it is rejected outright. LCP v1.38 §C.4 draws the same conclusion ("publish a resolvable
+ * schema or inline it — and inlining is the safer of the two"). Dropping `$id` and `$defs` from the
+ * inlined form is that rule applied: the authority document's `$id` is an absolute URL, and its `$defs`
+ * carries the RECEIPT-time definition, which is not this challenge-time `info` and would bloat every 402.
+ *
+ * The shape is the §8.1 reference object PLUS the locator the reference is verified through:
+ * `legalContextUrl` is REQUIRED here because `value` is a digest — a buyer verifies the terms by fetching
+ * the document and hashing it, so a challenge advertising the hash without the locator advertises
+ * something no counterparty who lacks the document can check. Every shipped buyer parser already refuses
+ * such a challenge; the schema now says on the wire what the readers always demanded. It describes the
+ * carrier, not the terms behind it, and asserts nothing about any agreement's lawfulness — the
+ * description says so in as many words because the schema travels alone.
  *
  * Changing this is a WIRE change — it appears in every challenge — so it is a frozen literal rather than a
- * value assembled at call time.
+ * value assembled at call time, and the drift gate is what keeps the frozen copy honest.
  */
 export declare const LEGAL_CONTEXT_SCHEMA: Readonly<Record<string, unknown>>;
 /**
  * x402 reference placement — the HTTP-layer carrier, cut against the live x402 v2 specification
- * (`x402-foundation/x402@1fec3aa04e41`, `specs/x402-specification-v2.md`; gate discharged in the README).
+ * (`x402-foundation/x402@db5da2e65952`, `specs/x402-specification-v2.md`, read 2026-08-11; gate discharged
+ * in the README).
  *
  * **THE CANONICAL REPOSITORY IS THE FOUNDATION'S, and the citation moved on 2026-08-08.** Every
  * reference here named `coinbase/x402`, which the GitHub API reports as `"fork": true`;
@@ -77,39 +81,47 @@ export declare const LEGAL_CONTEXT_SCHEMA: Readonly<Record<string, unknown>>;
  * would emit something no x402 counterparty parses. This is the reason an alias declares its own `encoding`
  * at all.
  *
- * **The alias declares no `write`, and the live spec is the reason.** `extra` is "Scheme-specific additional
- * information" — the payment scheme's object, whose contents that scheme defines. An `atrHash` is READ there
- * because sellers put one there; writing into another party's namespace is not the same act. The
- * `extensions` map is the protocol's own declared extension point and is where `place` writes.
+ * **The alias IS WRITTEN, and this reverses a recorded stance — deliberately, on three grounds.** The
+ * predecessor declared no `write` on the reasoning that `extra` is "Scheme-specific additional information"
+ * and writing into another party's namespace is not our act. That reasoning has been overtaken. First, the
+ * host itself no longer treats `extra` as wholly scheme-private: §6.1 reserves `assetTransferMethod` and
+ * `paymentFlow` inside it as protocol-governed names, so `extra` is a host-managed extension surface with
+ * scheme-specific residue, not a foreign namespace. Second, LCP v1.38 §C.4's own Tier A illustration puts
+ * `atrHash` AND `legalContextUrl` in `accepts[].extra` — a third-party reader built from the spec's example
+ * reads `extra` first, and a challenge that leaves it empty is invisible to that reader. Third, the shipped
+ * buyer parser reads BOTH carriers and reconciles, refusing disagreement — so the mirror cannot drift
+ * silently: two slots either agree or the document refuses at the counterparty. The write lands only in
+ * `accepts[0]`, the requirement buyer parsers read (see the index-0 rule below), and never touches the
+ * reserved names.
  *
  * **The alias is index 0 only.** A locator names one path. `accepts[0]` is what buyer parsers read, and the
  * reason is substantive: the reference must bind to the requirement actually being paid, and searching every
  * requirement would let a seller park a second set of terms on an alternative it never expects to be chosen.
  *
- * **`termsUrlField` is DECLARED — this is the protocol whose wire carries both halves.** `binding-core`'s own
- * contract cites x402 for exactly that: a buyer-side parser may demand the URL because x402 carries it, and
- * emitters put `legalContextUrl` inside `info` beside `type`/`value`. Declaring the path
- * makes that half machine-readable instead of a second private convention; `place` never writes it, because
- * `place(ref, doc)` holds one reference and the terms URL is a different datum (the same division ACP draws
- * with `metadata.legal_context_url`). The shipped carrier repeats the URL at `accepts[0].extra.legalContextUrl`
- * too, which a single `termsUrlField` cannot express — recorded in the README as a known limitation rather
- * than half-declared here.
- *
- * **`carrierTypes` permits `sha256` and `url`, and the two are admitted on DIFFERENT grounds** — one reason
- * cannot cover both. `sha256` is the integrity carrier: §C.4's illustration carries one, emitters carry one,
- * and the bare alias is fixed to it. `url` is the §8.1 discovery form, admitted because the canonical
- * slot is a general reference-object slot and the kit puts the integrity-versus-discovery decision at the
- * READER — `carrierClass` plus `requireIntegrity` — not in the permission list; ACP and UCP permit it for the
- * same reason. `ipfs`/`ar` are excluded on a ground that does NOT apply to `url`: they are ALTERNATIVE
- * integrity carriers, so admitting one adds no capability `sha256` does not already discharge while
- * advertising a content-addressed transport no x402 counterparty resolves — a claim about the ecosystem
- * rather than a description of it.
- *
- * The `url` permission is nonetheless WIDER than any shipped x402 reader: a buyer parser that requires an
- * integrity carrier refuses `info.type !== "sha256"` outright, so a `url` placed in this slot is well-formed
- * against this manifest and would still be rejected at read time. Recorded in the README as a limitation
- * rather than narrowed away here, because narrowing the reference field to one type is a change to what the
- * SLOT may hold across the set, not a fact about x402.
+ * **`termsUrlFields` declares BOTH slots the wire carries, and both are written.** The predecessor member
+ * (`termsUrlField`, singular) named only the `extensions` slot, and it was read-only in every published
+ * package — the write path did not exist anywhere, so a seller assembling from published parts emitted a
+ * challenge advertising a hash with no locator, which the published buyer refuses
+ * (integra-protocol#8). Declaring both slots makes the manifest state what actually lands on the wire:
+ * `place` writes the URL beside the reference in `info` (where the authority schema requires it) and
+ * mirrors it at `accepts[0].extra.legalContextUrl` (where §C.4's illustration carries it), and `extract`
+ * reconciles the two, refusing disagreement. The kit REQUIRES the URL of any integrity-bearing
+ * advertisement on this manifest — a hash no counterparty can resolve is unverifiable by construction,
+ * which is the defect the readers always guarded against and the emitters never did.
+ *
+ * **`carrierTypes` is `sha256` alone, and the `url` admission is WITHDRAWN — a defect resolved, not a
+ * preference.** The predecessor admitted `url` as the §8.1 discovery form and recorded, in the same
+ * docblock, that the permission was "WIDER than any shipped x402 reader": a buyer parser that requires an
+ * integrity carrier refuses `info.type !== "sha256"` outright, so a `url` placed in this slot was
+ * well-formed against the manifest and rejected at read time — a permission no reader accepts, which is a
+ * claim about the ecosystem rather than a description of it. The withdrawal ground is now structural: the
+ * `schema` member this package puts on the wire is the AUTHORITY document's shape, whose `type` is
+ * `const: "sha256"`, so a `url` reference would emit a challenge that violates its own adjacent schema.
+ * The predecessor declined to narrow because "narrowing the reference field to one type is a change to
+ * what the SLOT may hold across the set" — that set-wide decision has since been made, by the authority
+ * document. `ipfs`/`ar` remain excluded on the original ground: alternative integrity carriers add no
+ * capability `sha256` does not already discharge while advertising a content-addressed transport no x402
+ * counterparty resolves.
  */
 export declare const X402_PLACEMENT: PlacementManifest;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuB/D,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,eAAO,MAAM,cAAc,EAAE,iBAkB5B,CAAC"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6B/D,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;AACH,eAAO,MAAM,cAAc,EAAE,iBAsB5B,CAAC"}