@integraledger/lcp-placements 0.9.0

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# @integraledger/lcp-placements
+
+## 0.9.0
+
+First public release.
+
+`0.9.0` is deliberate: this is a release candidate for 1.0, not a preview. The implementation is complete
+against LCP v1.38 and certified by the conformance corpus, and the remaining distance to 1.0 is the
+specification's own — the standard is still moving through its steering committee, and this package will not
+claim a stability its protocol has not yet promised.
+
+Development before this release happened in a private repository and is not reproduced here; no earlier
+version was ever available to install.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,14 @@
+Integra Protocol
+Copyright 2026 Integra Ledger
+
+This product includes software developed by Integra Ledger (https://integraledger.com).
+
+"Integra", "Integra Ledger", and the Integra logo are trademarks of Integra Ledger.
+Trademark use is not granted by the Apache License 2.0 (see Section 6).
+
+The Legal Context Protocol is co-stewarded by Integra Ledger and AAA-ICDR. This repository is a
+reference implementation of the standard's open layer; the specification itself is published at
+https://legalcontextprotocol.org/standard and is not part of this distribution.
+
+The vendored submodule under lib/commerce-payments is Coinbase's AuthCaptureEscrow and carries its own
+MIT licence at lib/commerce-payments/LICENSE.md. It is not covered by the Apache License above.

package/README.md

@@ -0,0 +1,150 @@
+# @integraledger/lcp-placements
+
+**The one place a protocol is registered.** Nine placement packages describe where an LCP reference rides in
+nine protocol documents; this package is the map from a protocol id to the adapter that does it. A caller that
+imports this stops hand-picking protocol packages, and adding a tenth protocol becomes a data edit here rather
+than a change at every call site.
+
+```bash
+npm install @integraledger/lcp-placements
+```
+
+| | |
+|---|---|
+| **Registered** | `x402`, `mpp`, `ap2`, `ack`, `acp`, `ucp`, `visa-tap`, `mastercard-vi`, `a2a` |
+| **Not registered** | `mcp` — a known protocol id that is **not a field placement at all** (see below) |
+| **Tier A** | eight of the nine |
+| **Tier B** | `mastercard-vi` — declared and inert (LCP §8.3, and see that package's README) |
+| **Chain** | none, by rule — `depcruise` holds this package to the same chain-free invariant as the placements it aggregates |
+| **Depends on** | [`@integraledger/lcp-binding-core`](../binding-core#readme) for `ReferencePlacementAdapter`, plus the nine `placement-*` packages |
+
+## The four exports
+
+```ts
+import { placementFor, placementsByTier, PLACEMENTS, supportedProtocols } from "@integraledger/lcp-placements";
+
+const acp = placementFor("acp"); //  ReferencePlacementAdapter | undefined
+placementFor("mcp"); //             undefined — a fact, not a hole to fill with a throwing stub
+
+const vi = placementFor("mastercard-vi", { reverseDomain: "com.example" });
+placementFor("mastercard-vi"); //   THROWS — see below
+
+const { adapters, unconfigured } = placementsByTier("A", { reverseDomain: "com.example" });
+```
+
+`placementFor` is total over the closed `ProtocolId` set and returns `undefined` only where this build
+genuinely has no placement. It consults **own properties only**: `PLACEMENTS` is an object, so a bare index
+would read `PLACEMENTS["toString"]` off `Object.prototype` — a value that is neither `undefined` nor a
+singleton, and so reaches the namespaced arm and asserts a namespace requirement about a protocol that does
+not exist. `ProtocolId` is a compile-time set and this is the dispatch point a counterparty's wire token and
+an MCP tool argument arrive at, so the guard is a runtime one. `supportedProtocols()` enumerates in
+`KNOWN_PROTOCOL_IDS` order — the schema enum's own order, so the list is stable rather than an accident of
+which unit landed first.
+
+## `mcp` is absent because MCP has no field carrier
+
+Not a pending `placement-mcp`. LCP v1.37 §C.9 and §10 describe an LCP-aware MCP **server** — tools,
+resources and prompts, plus a `capabilities.extensions` negotiation map keyed by a reverse domain — and no
+document field for a reference to ride in. MCP is a delivery surface, not a placement, so `mcp`'s absence
+from this registry is the correct terminal state. The corpus pins it: `placement.dispatch` asserts that a
+known protocol id with no placement answers the same `unknown-placement-protocol:<id>` port error as a token
+that is not a protocol id at all, and never a throw.
+
+## Two registration shapes, because there are two
+
+Eight placements are singletons: the host protocol fixes the carrier completely, so the package exports one
+adapter and the registry holds it. Mastercard VI's carrier is a custom Layer-2 constraint type named under the
+**deployment's own reverse-DNS namespace**, which has no default — so it ships as a factory, and the registry
+holds the factory rather than a pre-built adapter.
+
+```ts
+import type { ReferencePlacementAdapter } from "@integraledger/lcp-binding-core";
+
+export type PlacementRegistration =
+  | { kind: "singleton"; adapter: ReferencePlacementAdapter }
+  | { kind: "namespaced"; build: (reverseDomain: string) => ReferencePlacementAdapter };
+```
+
+Three consequences, each deliberate:
+
+1. **The registry never defaults a namespace.** LCP §8 canonizes no per-protocol integration profile, and a
+   default would write *our* reverse domain into a counterparty's signed mandate in every deployment that
+   forgot to pass one. `placementFor("mastercard-vi")` with no deployment **throws**, naming what the caller
+   owes. It does not answer `undefined`, because `undefined` means "this protocol has no placement" and would
+   turn a caller's omission into a fact about the protocol.
+
+2. **The factory's own guards are not bypassed.** The namespace is passed through unexamined: the empty,
+   non-reverse-DNS and reserved-`org.legalcontextprotocol` cases are refused by the factory that owns them, and
+   a second copy of those rules here could disagree with the first.
+
+3. **One keyed union, not a singleton map beside a factory map.** Two maps admit the same protocol id in both,
+   where two callers reach two different adapters for one protocol and neither is wrong. A single key cannot —
+   *in the source*. `PLACEMENTS` is also `Readonly` and `Object.freeze`d, because the keyed union says nothing
+   about a consumer adding, replacing or deleting a registration after import and changing what `placementFor`
+   and `supportedProtocols` answer for everyone else in the process. The type stops that in TypeScript
+   (TS2540 on assignment, TS2704 on `delete`); the freeze stops it in plain JavaScript, which is what a
+   published package is consumed as. What the freeze guarantees is that the write does not **land** —
+   whether it *throws* is the caller's strict-mode setting (an ESM importer gets a `TypeError`, a
+   sloppy-mode CommonJS caller gets a silent no-op), and either way the next lookup reads the same registry.
+
+## `placementsByTier` reports what it could not classify
+
+A tier is a property of a *built* manifest, so a namespaced registration cannot be classified until its
+namespace arrives. Dropping it would answer "no Tier B placements exist" while one sits registered a namespace
+away — a hole read as a fact. So the selector returns both halves:
+
+```ts
+import { placementsByTier } from "@integraledger/lcp-placements";
+
+placementsByTier("B");                                  // { adapters: [], unconfigured: ["mastercard-vi"] }
+placementsByTier("B", { reverseDomain: "com.example" }); // { adapters: [viAdapter], unconfigured: [] }
+```
+
+Reporting rather than throwing is the point: a caller with no namespace still gets the eight Tier A adapters,
+and is never pushed into inventing a namespace to satisfy a signature.
+
+## The tier selector is what makes "the host governs" operational
+
+The host protocol's live rules bind, and LCP's Appendix C is an illustration. A deployment that will only
+ship what works against stock, unmodified implementations asks for `"A"` and gets exactly that — rather than
+reading tiers out of documentation and hoping. Tier B adapters stay constructible; they are simply never
+returned to a Tier-A caller.
+
+## Where the registry sits in the dependency graph
+
+Up-tier from every placement package and down-tier from every consumer. `depcruise` enforces both directions,
+and both rules had to be widened to see this package at all — `placement-` does not match `placements/` on the
+hyphen, so the registry escaped the tier discipline and the chain-free invariant until the protocol-surface
+work named it. Both
+widened rules were canary-proven to exit non-zero: a planted `@integraledger/lcp-conformance` import fired
+`domain-tier-no-upward` (exit 1) and a planted `viem` import fired `placement-packages-are-chain-free`
+(exit 2 — `depcruise` exits with the error count).
+
+**Re-running those canaries requires a RESOLVABLE import**, and this is the whole recipe. Both rules match on
+`to.path`, which only exists once enhanced-resolve has resolved the specifier; an undeclared bare import is
+reported `couldNotResolve: true, valid: true` and the run exits **0**, and there is no `not-to-unresolvable`
+rule to catch it. Measured both ways: the bare plant exits 0, and the same plant with
+`packages/placements/node_modules/@integraledger/lcp-conformance` symlinked in exits 1 naming the rule. An
+undeclared import is not a hole in the gate — it fails `pnpm -r typecheck` with TS2307 instead — but a canary
+planted without the symlink proves nothing.
+
+The conformance harness consumes this package rather than keeping its own map: `InProcessSubject` resolves the
+`placement` class through `placementFor`, so a placement that is registered here is reachable on all three
+conformance doors by construction, and one that is not is unreachable everywhere. The harness supplies
+`com.integraledger` as its own deployment namespace — the value the `mastercard-vi` vectors are written in.
+
+## What this package is not
+
+It is not a second place a protocol id is spelled: the keys are `ProtocolId` tokens, hyphens included. It is
+not a settlement registry — a protocol can be registered here *and* carry a settlement binding elsewhere
+(x402 does both), and the two answer different questions. And it holds no protocol logic of its own: every
+rule about a carrier lives in the placement package that owns it, or in `binding-core`'s placement kit.
+
+---
+
+**Requires Node >= 24.** Part of the
+[Legal Context Protocol open layer](https://github.com/IntegraLedger/integra-protocol) — see the
+[documentation](https://github.com/IntegraLedger/integra-protocol/blob/main/docs/developer/index.md)
+and the
+[package index](https://github.com/IntegraLedger/integra-protocol/blob/main/docs/developer/reference.md).
+Apache-2.0.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export type { PlacementDeployment, PlacementRegistration, TierSelection, } from "./registry.js";
+export { PLACEMENTS, placementFor, placementsByTier, supportedProtocols, } from "./registry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { PLACEMENTS, placementFor, placementsByTier, supportedProtocols, } from "./registry.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,eAAe,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,116 @@
+import type { PlacementTier, ProtocolId, ReferencePlacementAdapter } from "@integraledger/lcp-binding-core";
+/**
+ * What a deployment supplies before the parameterized placements can be built.
+ *
+ * Config a deployment OWNS, never a constructed adapter: the moment a caller hands the registry an adapter,
+ * the registry has stopped being the one place a protocol is registered.
+ */
+export type PlacementDeployment = {
+    /**
+     * The deployment's own reverse-domain namespace.
+     *
+     * REQUIRED by every `namespaced` registration and defaulted by none. LCP §8 canonizes no per-protocol
+     * integration profile, so a default would write OUR domain into a counterparty's signed document in every
+     * deployment that forgot to pass one. The receiving factory validates it; the registry does not
+     * pre-validate, so its guards are never bypassed or duplicated here.
+     */
+    readonly reverseDomain: string;
+};
+/**
+ * How one protocol's placement is obtained.
+ *
+ * TWO shapes because the registered placements genuinely have two shapes, and flattening them would cost
+ * either correctness or honesty. Eight are singletons whose carrier the host protocol fixes completely.
+ * Mastercard VI's carrier is a custom Layer-2 constraint type under the deployment's own reverse-DNS
+ * namespace, which has no default — so it ships as a factory, and a map of adapters could only hold it by
+ * inventing the namespace.
+ *
+ * ONE keyed union rather than a singleton map beside a factory map: two maps admit an id in both, where two
+ * callers reach two different adapters for one protocol and neither is wrong. A single key cannot.
+ */
+export type PlacementRegistration = {
+    readonly kind: "singleton";
+    readonly adapter: ReferencePlacementAdapter;
+} | {
+    readonly kind: "namespaced";
+    readonly build: (reverseDomain: string) => ReferencePlacementAdapter;
+};
+/**
+ * Every reference placement this build can perform, keyed by `ProtocolId`.
+ *
+ * THE registry — the one place a protocol is registered, so that adding one is a data edit plus an import and
+ * never a change to a caller. The conformance subject, the universal buyer parser and the universal seller
+ * surface all dispatch through here rather than each keeping a map that can drift.
+ *
+ * A `Partial` record on purpose: `mcp` is a known protocol id that is **not a field placement at all**. LCP
+ * v1.38 §C.9 and §10 describe an LCP-aware MCP *server* — tools, resources and prompts, plus a
+ * `capabilities.extensions` negotiation map — with no document field for a reference to ride in. So its
+ * absence is the correct terminal state, not a gap awaiting a `placement-mcp`, and certainly not a hole to
+ * fill with a stub that throws. Note that a protocol can be registered here AND carry a settlement binding
+ * elsewhere — x402 does both, and the two registrations answer different questions (where the reference
+ * rides vs. how the settlement is welded).
+ *
+ * ORDERED as `KNOWN_PROTOCOL_IDS` orders the closed set, which is the schema enum's order. Registration
+ * order is enumeration order, so keeping the two aligned makes `supportedProtocols()` a filter of the closed
+ * set rather than an accident of which unit landed first.
+ *
+ * `Readonly` AND `Object.freeze`, because "the one place a protocol is registered" is the whole argument for
+ * the keyed union and an exported mutable object does not make it true. The keyed union rules out a *second*
+ * registration in the source; only immutability rules out a consumer adding, replacing or deleting one at
+ * runtime and changing what `placementFor` and `supportedProtocols` answer thereafter. The type stops it in
+ * TypeScript (assignment TS2540, `delete` TS2704); the freeze stops it in plain JavaScript, which is what a
+ * published package is consumed as. Stated precisely, because it was measured both ways: the freeze
+ * guarantees the write does not LAND. Whether it throws is the caller's strict-mode setting — ESM importers
+ * get a `TypeError`, a sloppy-mode CommonJS caller gets a silent no-op — so the registry the next lookup
+ * reads is unchanged either way, which is the property that matters.
+ */
+export declare const PLACEMENTS: Readonly<Partial<Record<ProtocolId, PlacementRegistration>>>;
+/**
+ * The adapter for a protocol, or `undefined` when this build has no placement for it.
+ *
+ * TOTAL over the closed protocol set — a caller decides what an absence means, and gets an absence only for a
+ * protocol that genuinely has no placement. `deployment` is optional because most protocols need nothing from
+ * it; omitting it against a `namespaced` registration throws rather than silently answering `undefined`.
+ *
+ * OWN properties only. `PLACEMENTS` is an object, so a bare index reads through the prototype chain and
+ * `PLACEMENTS["toString"]` answers `Object.prototype.toString` — a value that is not `undefined`, is not
+ * `kind: "singleton"`, and therefore reaches the `namespaced` arm, where the registry either asserts a
+ * namespace requirement about a protocol that does not exist or throws a raw `TypeError` on
+ * `registration.build`. `protocol` is typed `ProtocolId`, but this is the dispatch point a wire token and an
+ * MCP tool argument arrive at, and a cast at one caller would be enough. Same guard, same reason, as
+ * `binding-core`'s `readAtPath` (the repository's read-path tests — "does not walk prototype keys").
+ *
+ * ONE guard, not two. `Object.hasOwn` as a separate early return would leave the `=== undefined` check that
+ * follows it unreachable — `Partial` admits `undefined` in the value type, but no key here is written with
+ * one, so an own key always has a registration. Mutation testing is what says so out loud: with two guards,
+ * neutering the second to `if (false)` SURVIVES, which is the instrument reporting a branch no input can take.
+ * Folding the own-property test into the lookup leaves exactly one reachable absence and both mutants die.
+ */
+export declare function placementFor(protocol: ProtocolId, deployment?: PlacementDeployment): ReferencePlacementAdapter | undefined;
+/** Every protocol this build can place a reference into, in the closed set's own order. */
+export declare function supportedProtocols(): readonly ProtocolId[];
+/**
+ * The answer to a tier query: what this deployment can build at that tier, and what it could not classify.
+ *
+ * `unconfigured` is the load-bearing half. A tier query is a question about a WHOLE set ("everything I can
+ * ship against stock implementations"), and a namespaced registration cannot be classified at all until its
+ * namespace arrives — the tier is a property of the built manifest. Dropping it would answer "no Tier B
+ * placements exist" while one sits registered a namespace away, which is a hole read as a fact. Reporting it
+ * instead of throwing keeps the caller from inventing a namespace to satisfy a signature, which is the one
+ * outcome worse than the hole.
+ */
+export type TierSelection = {
+    /** The placements at the requested tier, in registration order. */
+    readonly adapters: readonly ReferencePlacementAdapter[];
+    /** Registered protocols whose tier is unknown because the deployment supplied nothing they require. */
+    readonly unconfigured: readonly ProtocolId[];
+};
+/**
+ * The placements at one §8.3 wire-compatibility tier.
+ *
+ * The selector that makes the host-governs rule operational: a deployment that will only ship what works against stock
+ * implementations asks for `"A"` and gets exactly that, rather than reading tiers out of documentation and
+ * hoping. Tier B adapters remain constructible — they are simply never returned to a Tier-A caller.
+ */
+export declare function placementsByTier(tier: PlacementTier, deployment?: PlacementDeployment): TierSelection;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,yBAAyB,EAC1B,MAAM,iCAAiC,CAAC;AAWzC;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,GAC3E;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,yBAAyB,CAAC;CACtE,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,UAAU,EAAE,QAAQ,CAC/B,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAgBlD,CAAC;AAyCH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,UAAU,EACpB,UAAU,CAAC,EAAE,mBAAmB,GAC/B,yBAAyB,GAAG,SAAS,CAMvC;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,IAAI,SAAS,UAAU,EAAE,CAE1D;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,uGAAuG;IACvG,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;CAC9C,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,EACnB,UAAU,CAAC,EAAE,mBAAmB,GAC/B,aAAa,CAYf"}

package/dist/registry.js

@@ -0,0 +1,135 @@
+import { a2aPlacement } from "@integraledger/lcp-placement-a2a";
+import { ackPlacement } from "@integraledger/lcp-placement-ack";
+import { acpPlacement } from "@integraledger/lcp-placement-acp";
+import { ap2Placement } from "@integraledger/lcp-placement-ap2";
+import { makeMastercardViPlacement } from "@integraledger/lcp-placement-mastercard-vi";
+import { mppPlacement } from "@integraledger/lcp-placement-mpp";
+import { ucpPlacement } from "@integraledger/lcp-placement-ucp";
+import { visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
+import { x402Placement } from "@integraledger/lcp-placement-x402";
+/**
+ * Every reference placement this build can perform, keyed by `ProtocolId`.
+ *
+ * THE registry — the one place a protocol is registered, so that adding one is a data edit plus an import and
+ * never a change to a caller. The conformance subject, the universal buyer parser and the universal seller
+ * surface all dispatch through here rather than each keeping a map that can drift.
+ *
+ * A `Partial` record on purpose: `mcp` is a known protocol id that is **not a field placement at all**. LCP
+ * v1.38 §C.9 and §10 describe an LCP-aware MCP *server* — tools, resources and prompts, plus a
+ * `capabilities.extensions` negotiation map — with no document field for a reference to ride in. So its
+ * absence is the correct terminal state, not a gap awaiting a `placement-mcp`, and certainly not a hole to
+ * fill with a stub that throws. Note that a protocol can be registered here AND carry a settlement binding
+ * elsewhere — x402 does both, and the two registrations answer different questions (where the reference
+ * rides vs. how the settlement is welded).
+ *
+ * ORDERED as `KNOWN_PROTOCOL_IDS` orders the closed set, which is the schema enum's order. Registration
+ * order is enumeration order, so keeping the two aligned makes `supportedProtocols()` a filter of the closed
+ * set rather than an accident of which unit landed first.
+ *
+ * `Readonly` AND `Object.freeze`, because "the one place a protocol is registered" is the whole argument for
+ * the keyed union and an exported mutable object does not make it true. The keyed union rules out a *second*
+ * registration in the source; only immutability rules out a consumer adding, replacing or deleting one at
+ * runtime and changing what `placementFor` and `supportedProtocols` answer thereafter. The type stops it in
+ * TypeScript (assignment TS2540, `delete` TS2704); the freeze stops it in plain JavaScript, which is what a
+ * published package is consumed as. Stated precisely, because it was measured both ways: the freeze
+ * guarantees the write does not LAND. Whether it throws is the caller's strict-mode setting — ESM importers
+ * get a `TypeError`, a sloppy-mode CommonJS caller gets a silent no-op — so the registry the next lookup
+ * reads is unchanged either way, which is the property that matters.
+ */
+export const PLACEMENTS = Object.freeze({
+    x402: { kind: "singleton", adapter: x402Placement },
+    mpp: { kind: "singleton", adapter: mppPlacement },
+    ap2: { kind: "singleton", adapter: ap2Placement },
+    ack: { kind: "singleton", adapter: ackPlacement },
+    acp: { kind: "singleton", adapter: acpPlacement },
+    ucp: { kind: "singleton", adapter: ucpPlacement },
+    // The key is the LCP protocol id, hyphen included — a camelCased key would be a second spelling of a
+    // protocol whose id is closed, and every wire that says `visa-tap` would miss it.
+    "visa-tap": { kind: "singleton", adapter: visaTapPlacement },
+    // BUILT, not imported: the constraint namespace is the deployment's and has no default. The factory
+    // validates it (empty, non-reverse-DNS and the reserved `org.legalcontextprotocol` are all refused), so it
+    // is passed through unexamined — a second copy of those rules here could disagree with the first.
+    "mastercard-vi": { kind: "namespaced", build: makeMastercardViPlacement },
+    a2a: { kind: "singleton", adapter: a2aPlacement },
+});
+/**
+ * The registrations as entries, with the key and value narrowed once.
+ *
+ * `Object.entries` widens the key to `string` and, over an optional-property record, the value to
+ * `PlacementRegistration | undefined`. Both are artefacts of the index type rather than shapes that can
+ * occur: every key present in `PLACEMENTS` was written with a value. Narrowed here, with the reason, instead
+ * of at each use — and never with a `!`, which would say nothing about why.
+ */
+function registrations() {
+    return Object.entries(PLACEMENTS);
+}
+/**
+ * Turn one registration into an adapter, or THROW naming what the caller owes.
+ *
+ * A namespaced registration with no deployment is a caller defect, not an absence: the placement exists and
+ * is reachable the moment a namespace is supplied. Answering `undefined` would report it as "this protocol
+ * has no placement", which is the silent hole this package exists to close, and defaulting the namespace
+ * would be worse — a signed document carrying a domain nobody chose.
+ */
+function buildRegistration(protocol, registration, deployment) {
+    if (registration.kind === "singleton")
+        return registration.adapter;
+    if (deployment === undefined)
+        throw new Error(`${protocol} is a namespaced placement: its carrier sits under the deployment's own reverse-domain namespace, which has no default — supply { reverseDomain }`);
+    return registration.build(deployment.reverseDomain);
+}
+/**
+ * The adapter for a protocol, or `undefined` when this build has no placement for it.
+ *
+ * TOTAL over the closed protocol set — a caller decides what an absence means, and gets an absence only for a
+ * protocol that genuinely has no placement. `deployment` is optional because most protocols need nothing from
+ * it; omitting it against a `namespaced` registration throws rather than silently answering `undefined`.
+ *
+ * OWN properties only. `PLACEMENTS` is an object, so a bare index reads through the prototype chain and
+ * `PLACEMENTS["toString"]` answers `Object.prototype.toString` — a value that is not `undefined`, is not
+ * `kind: "singleton"`, and therefore reaches the `namespaced` arm, where the registry either asserts a
+ * namespace requirement about a protocol that does not exist or throws a raw `TypeError` on
+ * `registration.build`. `protocol` is typed `ProtocolId`, but this is the dispatch point a wire token and an
+ * MCP tool argument arrive at, and a cast at one caller would be enough. Same guard, same reason, as
+ * `binding-core`'s `readAtPath` (the repository's read-path tests — "does not walk prototype keys").
+ *
+ * ONE guard, not two. `Object.hasOwn` as a separate early return would leave the `=== undefined` check that
+ * follows it unreachable — `Partial` admits `undefined` in the value type, but no key here is written with
+ * one, so an own key always has a registration. Mutation testing is what says so out loud: with two guards,
+ * neutering the second to `if (false)` SURVIVES, which is the instrument reporting a branch no input can take.
+ * Folding the own-property test into the lookup leaves exactly one reachable absence and both mutants die.
+ */
+export function placementFor(protocol, deployment) {
+    const registration = Object.hasOwn(PLACEMENTS, protocol)
+        ? PLACEMENTS[protocol]
+        : undefined;
+    if (registration === undefined)
+        return undefined;
+    return buildRegistration(protocol, registration, deployment);
+}
+/** Every protocol this build can place a reference into, in the closed set's own order. */
+export function supportedProtocols() {
+    return registrations().map(([protocol]) => protocol);
+}
+/**
+ * The placements at one §8.3 wire-compatibility tier.
+ *
+ * The selector that makes the host-governs rule operational: a deployment that will only ship what works against stock
+ * implementations asks for `"A"` and gets exactly that, rather than reading tiers out of documentation and
+ * hoping. Tier B adapters remain constructible — they are simply never returned to a Tier-A caller.
+ */
+export function placementsByTier(tier, deployment) {
+    const adapters = [];
+    const unconfigured = [];
+    for (const [protocol, registration] of registrations()) {
+        if (registration.kind === "namespaced" && deployment === undefined) {
+            unconfigured.push(protocol);
+            continue;
+        }
+        const adapter = buildRegistration(protocol, registration, deployment);
+        if (adapter.manifest.tier === tier)
+            adapters.push(adapter);
+    }
+    return { adapters, unconfigured };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAuClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,UAAU,GAEnB,MAAM,CAAC,MAAM,CAAC;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE;IACnD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;IACjD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;IACjD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;IACjD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;IACjD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;IACjD,qGAAqG;IACrG,kFAAkF;IAClF,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE;IAC5D,oGAAoG;IACpG,2GAA2G;IAC3G,kGAAkG;IAClG,eAAe,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,yBAAyB,EAAE;IACzE,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE;CAClD,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAS,aAAa;IAIpB,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAG5B,CAAC;AACP,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,QAAoB,EACpB,YAAmC,EACnC,UAA2C;IAE3C,IAAI,YAAY,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC;IACnE,IAAI,UAAU,KAAK,SAAS;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,mJAAmJ,CAC/J,CAAC;IACJ,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAC1B,QAAoB,EACpB,UAAgC;IAEhC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtD,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QACtB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;AAC/D,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;AACvD,CAAC;AAmBD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAmB,EACnB,UAAgC;IAEhC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,YAAY,GAAiB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC;QACvD,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACnE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC"}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@integraledger/lcp-placements",
+  "version": "0.9.0",
+  "description": "The LCP placement registry — the one place a protocol is registered.",
+  "keywords": [
+    "lcp",
+    "legal-context-protocol",
+    "legal-terms",
+    "agentic-commerce",
+    "placement",
+    "registry"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "CHANGELOG.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/IntegraLedger/integra-protocol.git",
+    "directory": "packages/placements"
+  },
+  "bugs": {
+    "url": "https://github.com/IntegraLedger/integra-protocol/issues"
+  },
+  "homepage": "https://github.com/IntegraLedger/integra-protocol/tree/main/packages/placements#readme",
+  "dependencies": {
+    "@integraledger/lcp-binding-core": "0.9.0",
+    "@integraledger/lcp-placement-a2a": "0.9.0",
+    "@integraledger/lcp-placement-ack": "0.9.0",
+    "@integraledger/lcp-placement-acp": "0.9.0",
+    "@integraledger/lcp-placement-ap2": "0.9.0",
+    "@integraledger/lcp-placement-mastercard-vi": "0.9.0",
+    "@integraledger/lcp-placement-mpp": "0.9.0",
+    "@integraledger/lcp-placement-ucp": "0.9.0",
+    "@integraledger/lcp-placement-visa-tap": "0.9.0",
+    "@integraledger/lcp-placement-x402": "0.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.3",
+    "vitest": "4.1.10"
+  },
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+export type {
+  PlacementDeployment,
+  PlacementRegistration,
+  TierSelection,
+} from "./registry.js";
+export {
+  PLACEMENTS,
+  placementFor,
+  placementsByTier,
+  supportedProtocols,
+} from "./registry.js";

package/src/registry.ts

@@ -0,0 +1,216 @@
+import type {
+  PlacementTier,
+  ProtocolId,
+  ReferencePlacementAdapter,
+} from "@integraledger/lcp-binding-core";
+import { a2aPlacement } from "@integraledger/lcp-placement-a2a";
+import { ackPlacement } from "@integraledger/lcp-placement-ack";
+import { acpPlacement } from "@integraledger/lcp-placement-acp";
+import { ap2Placement } from "@integraledger/lcp-placement-ap2";
+import { makeMastercardViPlacement } from "@integraledger/lcp-placement-mastercard-vi";
+import { mppPlacement } from "@integraledger/lcp-placement-mpp";
+import { ucpPlacement } from "@integraledger/lcp-placement-ucp";
+import { visaTapPlacement } from "@integraledger/lcp-placement-visa-tap";
+import { x402Placement } from "@integraledger/lcp-placement-x402";
+
+/**
+ * What a deployment supplies before the parameterized placements can be built.
+ *
+ * Config a deployment OWNS, never a constructed adapter: the moment a caller hands the registry an adapter,
+ * the registry has stopped being the one place a protocol is registered.
+ */
+export type PlacementDeployment = {
+  /**
+   * The deployment's own reverse-domain namespace.
+   *
+   * REQUIRED by every `namespaced` registration and defaulted by none. LCP §8 canonizes no per-protocol
+   * integration profile, so a default would write OUR domain into a counterparty's signed document in every
+   * deployment that forgot to pass one. The receiving factory validates it; the registry does not
+   * pre-validate, so its guards are never bypassed or duplicated here.
+   */
+  readonly reverseDomain: string;
+};
+
+/**
+ * How one protocol's placement is obtained.
+ *
+ * TWO shapes because the registered placements genuinely have two shapes, and flattening them would cost
+ * either correctness or honesty. Eight are singletons whose carrier the host protocol fixes completely.
+ * Mastercard VI's carrier is a custom Layer-2 constraint type under the deployment's own reverse-DNS
+ * namespace, which has no default — so it ships as a factory, and a map of adapters could only hold it by
+ * inventing the namespace.
+ *
+ * ONE keyed union rather than a singleton map beside a factory map: two maps admit an id in both, where two
+ * callers reach two different adapters for one protocol and neither is wrong. A single key cannot.
+ */
+export type PlacementRegistration =
+  | { readonly kind: "singleton"; readonly adapter: ReferencePlacementAdapter }
+  | {
+      readonly kind: "namespaced";
+      readonly build: (reverseDomain: string) => ReferencePlacementAdapter;
+    };
+
+/**
+ * Every reference placement this build can perform, keyed by `ProtocolId`.
+ *
+ * THE registry — the one place a protocol is registered, so that adding one is a data edit plus an import and
+ * never a change to a caller. The conformance subject, the universal buyer parser and the universal seller
+ * surface all dispatch through here rather than each keeping a map that can drift.
+ *
+ * A `Partial` record on purpose: `mcp` is a known protocol id that is **not a field placement at all**. LCP
+ * v1.38 §C.9 and §10 describe an LCP-aware MCP *server* — tools, resources and prompts, plus a
+ * `capabilities.extensions` negotiation map — with no document field for a reference to ride in. So its
+ * absence is the correct terminal state, not a gap awaiting a `placement-mcp`, and certainly not a hole to
+ * fill with a stub that throws. Note that a protocol can be registered here AND carry a settlement binding
+ * elsewhere — x402 does both, and the two registrations answer different questions (where the reference
+ * rides vs. how the settlement is welded).
+ *
+ * ORDERED as `KNOWN_PROTOCOL_IDS` orders the closed set, which is the schema enum's order. Registration
+ * order is enumeration order, so keeping the two aligned makes `supportedProtocols()` a filter of the closed
+ * set rather than an accident of which unit landed first.
+ *
+ * `Readonly` AND `Object.freeze`, because "the one place a protocol is registered" is the whole argument for
+ * the keyed union and an exported mutable object does not make it true. The keyed union rules out a *second*
+ * registration in the source; only immutability rules out a consumer adding, replacing or deleting one at
+ * runtime and changing what `placementFor` and `supportedProtocols` answer thereafter. The type stops it in
+ * TypeScript (assignment TS2540, `delete` TS2704); the freeze stops it in plain JavaScript, which is what a
+ * published package is consumed as. Stated precisely, because it was measured both ways: the freeze
+ * guarantees the write does not LAND. Whether it throws is the caller's strict-mode setting — ESM importers
+ * get a `TypeError`, a sloppy-mode CommonJS caller gets a silent no-op — so the registry the next lookup
+ * reads is unchanged either way, which is the property that matters.
+ */
+export const PLACEMENTS: Readonly<
+  Partial<Record<ProtocolId, PlacementRegistration>>
+> = Object.freeze({
+  x402: { kind: "singleton", adapter: x402Placement },
+  mpp: { kind: "singleton", adapter: mppPlacement },
+  ap2: { kind: "singleton", adapter: ap2Placement },
+  ack: { kind: "singleton", adapter: ackPlacement },
+  acp: { kind: "singleton", adapter: acpPlacement },
+  ucp: { kind: "singleton", adapter: ucpPlacement },
+  // The key is the LCP protocol id, hyphen included — a camelCased key would be a second spelling of a
+  // protocol whose id is closed, and every wire that says `visa-tap` would miss it.
+  "visa-tap": { kind: "singleton", adapter: visaTapPlacement },
+  // BUILT, not imported: the constraint namespace is the deployment's and has no default. The factory
+  // validates it (empty, non-reverse-DNS and the reserved `org.legalcontextprotocol` are all refused), so it
+  // is passed through unexamined — a second copy of those rules here could disagree with the first.
+  "mastercard-vi": { kind: "namespaced", build: makeMastercardViPlacement },
+  a2a: { kind: "singleton", adapter: a2aPlacement },
+});
+
+/**
+ * The registrations as entries, with the key and value narrowed once.
+ *
+ * `Object.entries` widens the key to `string` and, over an optional-property record, the value to
+ * `PlacementRegistration | undefined`. Both are artefacts of the index type rather than shapes that can
+ * occur: every key present in `PLACEMENTS` was written with a value. Narrowed here, with the reason, instead
+ * of at each use — and never with a `!`, which would say nothing about why.
+ */
+function registrations(): readonly (readonly [
+  ProtocolId,
+  PlacementRegistration,
+])[] {
+  return Object.entries(PLACEMENTS) as readonly (readonly [
+    ProtocolId,
+    PlacementRegistration,
+  ])[];
+}
+
+/**
+ * Turn one registration into an adapter, or THROW naming what the caller owes.
+ *
+ * A namespaced registration with no deployment is a caller defect, not an absence: the placement exists and
+ * is reachable the moment a namespace is supplied. Answering `undefined` would report it as "this protocol
+ * has no placement", which is the silent hole this package exists to close, and defaulting the namespace
+ * would be worse — a signed document carrying a domain nobody chose.
+ */
+function buildRegistration(
+  protocol: ProtocolId,
+  registration: PlacementRegistration,
+  deployment: PlacementDeployment | undefined,
+): ReferencePlacementAdapter {
+  if (registration.kind === "singleton") return registration.adapter;
+  if (deployment === undefined)
+    throw new Error(
+      `${protocol} is a namespaced placement: its carrier sits under the deployment's own reverse-domain namespace, which has no default — supply { reverseDomain }`,
+    );
+  return registration.build(deployment.reverseDomain);
+}
+
+/**
+ * The adapter for a protocol, or `undefined` when this build has no placement for it.
+ *
+ * TOTAL over the closed protocol set — a caller decides what an absence means, and gets an absence only for a
+ * protocol that genuinely has no placement. `deployment` is optional because most protocols need nothing from
+ * it; omitting it against a `namespaced` registration throws rather than silently answering `undefined`.
+ *
+ * OWN properties only. `PLACEMENTS` is an object, so a bare index reads through the prototype chain and
+ * `PLACEMENTS["toString"]` answers `Object.prototype.toString` — a value that is not `undefined`, is not
+ * `kind: "singleton"`, and therefore reaches the `namespaced` arm, where the registry either asserts a
+ * namespace requirement about a protocol that does not exist or throws a raw `TypeError` on
+ * `registration.build`. `protocol` is typed `ProtocolId`, but this is the dispatch point a wire token and an
+ * MCP tool argument arrive at, and a cast at one caller would be enough. Same guard, same reason, as
+ * `binding-core`'s `readAtPath` (the repository's read-path tests — "does not walk prototype keys").
+ *
+ * ONE guard, not two. `Object.hasOwn` as a separate early return would leave the `=== undefined` check that
+ * follows it unreachable — `Partial` admits `undefined` in the value type, but no key here is written with
+ * one, so an own key always has a registration. Mutation testing is what says so out loud: with two guards,
+ * neutering the second to `if (false)` SURVIVES, which is the instrument reporting a branch no input can take.
+ * Folding the own-property test into the lookup leaves exactly one reachable absence and both mutants die.
+ */
+export function placementFor(
+  protocol: ProtocolId,
+  deployment?: PlacementDeployment,
+): ReferencePlacementAdapter | undefined {
+  const registration = Object.hasOwn(PLACEMENTS, protocol)
+    ? PLACEMENTS[protocol]
+    : undefined;
+  if (registration === undefined) return undefined;
+  return buildRegistration(protocol, registration, deployment);
+}
+
+/** Every protocol this build can place a reference into, in the closed set's own order. */
+export function supportedProtocols(): readonly ProtocolId[] {
+  return registrations().map(([protocol]) => protocol);
+}
+
+/**
+ * The answer to a tier query: what this deployment can build at that tier, and what it could not classify.
+ *
+ * `unconfigured` is the load-bearing half. A tier query is a question about a WHOLE set ("everything I can
+ * ship against stock implementations"), and a namespaced registration cannot be classified at all until its
+ * namespace arrives — the tier is a property of the built manifest. Dropping it would answer "no Tier B
+ * placements exist" while one sits registered a namespace away, which is a hole read as a fact. Reporting it
+ * instead of throwing keeps the caller from inventing a namespace to satisfy a signature, which is the one
+ * outcome worse than the hole.
+ */
+export type TierSelection = {
+  /** The placements at the requested tier, in registration order. */
+  readonly adapters: readonly ReferencePlacementAdapter[];
+  /** Registered protocols whose tier is unknown because the deployment supplied nothing they require. */
+  readonly unconfigured: readonly ProtocolId[];
+};
+
+/**
+ * The placements at one §8.3 wire-compatibility tier.
+ *
+ * The selector that makes the host-governs rule operational: a deployment that will only ship what works against stock
+ * implementations asks for `"A"` and gets exactly that, rather than reading tiers out of documentation and
+ * hoping. Tier B adapters remain constructible — they are simply never returned to a Tier-A caller.
+ */
+export function placementsByTier(
+  tier: PlacementTier,
+  deployment?: PlacementDeployment,
+): TierSelection {
+  const adapters: ReferencePlacementAdapter[] = [];
+  const unconfigured: ProtocolId[] = [];
+  for (const [protocol, registration] of registrations()) {
+    if (registration.kind === "namespaced" && deployment === undefined) {
+      unconfigured.push(protocol);
+      continue;
+    }
+    const adapter = buildRegistration(protocol, registration, deployment);
+    if (adapter.manifest.tier === tier) adapters.push(adapter);
+  }
+  return { adapters, unconfigured };
+}