@visa/cli 4.1.0-rc.120 → 4.1.0-rc.122

package/README.md

@@ -128,9 +128,9 @@ receives a delegated, capped, revocable signer (it can never mint one itself).
 With a wallet delegated, set caps before funding:
 
 ```bash
-visa wallet limits --per-transaction 0.25 --daily 2.00   # BEFORE any funds arrive
-visa wallet show                                          # address, network, policy
-visa wallet fund                                          # funding instructions
+visa wallet limits --agent <agent-id> --per-transaction 0.25 --daily 2.00
+visa wallet show --agent <agent-id>                       # address, network, policy
+visa wallet fund --agent <agent-id>                       # funding instructions
 ```
 
 Fund the wallet with USDC only after limits are set. Payments are gasless — no ETH is ever needed. Mainnet (Base) is the production default; set `VISA_V4_NETWORK=base-sepolia` for testnet, where `visa wallet fund` points at the faucet.
@@ -140,9 +140,9 @@ Fund the wallet with USDC only after limits are set. Payments are gasless — no
 ```bash
 visa find "current weather by city" --max 0.10   # discovery; spends nothing
 visa inspect <listing-id>                        # fetches the live 402 challenge; spends nothing
-visa pay <listing-id> --max 0.05                 # policy check → sign → settle
-visa activity                                    # recent payments
-visa receipt <receipt-id>                        # journaled proof with on-chain tx
+visa pay <listing-id> --agent <agent-id> --max 0.05 # policy check → sign → settle
+visa activity --agent <agent-id>                    # recent payments
+visa receipt <receipt-id> --agent <agent-id>        # journaled proof with on-chain tx
 
 # Advanced direct-URL mode uses the same probe, policy, and receipt path.
 visa inspect --url https://provider.example/paid
@@ -156,6 +156,11 @@ owned by `apps/mpp`, and VIC uses the checkout/mandate surface. Unsupported
 rails are refused before signing. The wallet exposes no agent key-export
 command.
 
+Each wallet-enabled agent has an isolated Turnkey credential, policy, journal,
+receipts, and paid-response directory. `--agent` / the MCP `agent` field may be
+omitted while exactly one wallet authority exists; with multiple authorities it
+is required so the CLI never guesses which agent can spend.
+
 ## MCP tools (v4 surface)
 
 | Tool | Description |
@@ -256,8 +261,9 @@ visa-cli feedback                   # submit feedback
 | `~/.visa-cli/pairings/` | Pending ceremony verifier or runtime identity key (owner-only mode 0600 on macOS/Linux; v2 pairing currently disabled on Windows) |
 | `~/.visa-cli/agents/` | Activated agent identity, runtime private key, and signed activation credentials (owner-only mode 0600 on macOS/Linux; v2 pairing currently disabled on Windows) |
 | `~/.visa-cli/session-recovery/` | Pending login-only PKCE verifier and pinned web origin (owner-only mode 0600 on macOS/Linux) |
+| `~/.visa-cli/removed-agents/` | Records of agents deleted on the server, kept 30 days then dropped. Written automatically; nothing reads it |
 | `~/.visa-mcp/agent-credential.json` | Legacy checkout-credential compatibility record (mode 0600) |
-| `~/.visa-v4/policy.json` | Wallet spend policy — never edit by hand; use `visa wallet limits` |
+| `~/.visa-v4/agents/<agentId>/` | Per-agent Turnkey credential, spend policy, reservation journal, receipts, and paid responses — never edit by hand |
 
 ## Troubleshooting
 

package/dist/checkout-engine/live-fill-approval.d.ts

@@ -1,21 +1,10 @@
 import type { CheckoutMode, CheckoutOutcome, CheckoutResult } from './executor.js';
-export declare const SUBMIT_ENV_FLAG = "CHECKOUT_AGENT_ALLOW_SUBMIT";
 export declare const MODE_ENV_FLAG = "CHECKOUT_AGENT_MODE";
 /**
  * `--mode` values map 1:1 onto CheckoutMode; an absent flag falls back to the
  * CHECKOUT_AGENT_MODE environment default, then to the safe dry-run default.
  */
 export declare function parseCheckoutMode(value: string | undefined, env?: Record<string, string | undefined>): CheckoutMode;
-/**
- * Fail fast (before any file read or browser launch) when submit lacks an
- * enablement. The env arm exists to stop AUTOMATION from reaching a live
- * charge by accident — so it is required only when stdin is not a real TTY
- * (scripts, agents, pipes). An interactive human needs no standing config:
- * their per-run consent is the typed PAY phrase plus the passkey tap, both of
- * which a non-interactive caller cannot fake (the phrase names the exact
- * review id; the passkey is a FIDO ceremony on the verify site).
- */
-export declare function assertSubmitAllowed(mode: CheckoutMode, env?: Record<string, string | undefined>, isInteractive?: boolean): void;
 /** Distinct phrases per mode so dry-run muscle memory can never authorize a payment. */
 export declare function approvalPhrase(mode: CheckoutMode, reviewId: string): string;
 /** Integer-only minor→display formatting (two-decimal currencies, the same assumption as decimalToMinor). */

package/dist/checkout-engine/live-fill-approval.js

@@ -1,18 +1,19 @@
 // Deliberate-enablement seam for run-live-fill's submit mode. A real submit
 // moves real money, so it requires:
-//   1. an interactive human at a real TTY — or, for scripted/agent runs,
-//      the explicit CHECKOUT_AGENT_ALLOW_SUBMIT=1 environment arm,
-//   2. the invocation opts in (--mode submit, or the CHECKOUT_AGENT_MODE
+//   1. the invocation opts in (--mode submit, or the CHECKOUT_AGENT_MODE
 //      environment default for operators who always run one mode),
-//   3. the operator types the PAY phrase against the exact review id (and a
+//   2. the operator types the PAY phrase against the exact review id (and a
 //      hosted run additionally requires the passkey tap on the verify site).
-// The env arm is an anti-automation gate, not a human ritual: a TTY human's
-// consent is act 3 — the PAY phrase differs from dry-run's FILL phrase, so a
-// muscle-memory rerun of the dry-run procedure still cannot drift into
-// charging a card — while a non-interactive caller (script, agent, pipe) can
-// fake neither the phrase's review id nor the FIDO ceremony and must also be
-// explicitly armed. Fresh checkouts therefore need ZERO persisted config.
-export const SUBMIT_ENV_FLAG = 'CHECKOUT_AGENT_ALLOW_SUBMIT';
+// The PAY phrase differs from dry-run's FILL phrase and names the exact review
+// id, so a muscle-memory rerun of the dry-run procedure cannot drift into
+// charging a card. Fresh checkouts need ZERO persisted config.
+//
+// There was a third requirement — a CHECKOUT_AGENT_ALLOW_SUBMIT=1 environment
+// arm, exempted for interactive TTYs — meant to stop AUTOMATION reaching a live
+// charge. It never ran: nothing in the product ever called `assertSubmitAllowed`.
+// The same flag DID gate `pay_merchant`, where being default-off with no
+// in-product way to set it meant a real install could not complete a purchase at
+// all. Both are gone; the phrase and the mandate caps are the gates.
 export const MODE_ENV_FLAG = 'CHECKOUT_AGENT_MODE';
 /**
  * `--mode` values map 1:1 onto CheckoutMode; an absent flag falls back to the
@@ -26,26 +27,6 @@ export function parseCheckoutMode(value, env = process.env) {
         return 'submit';
     throw new Error(`--mode (or ${MODE_ENV_FLAG}) must be dry-run or submit (got ${JSON.stringify(effective)})`);
 }
-/**
- * Fail fast (before any file read or browser launch) when submit lacks an
- * enablement. The env arm exists to stop AUTOMATION from reaching a live
- * charge by accident — so it is required only when stdin is not a real TTY
- * (scripts, agents, pipes). An interactive human needs no standing config:
- * their per-run consent is the typed PAY phrase plus the passkey tap, both of
- * which a non-interactive caller cannot fake (the phrase names the exact
- * review id; the passkey is a FIDO ceremony on the verify site).
- */
-export function assertSubmitAllowed(mode, env = process.env, isInteractive = process.stdin.isTTY === true) {
-    if (mode !== 'submit')
-        return;
-    if (env[SUBMIT_ENV_FLAG] === '1')
-        return;
-    if (isInteractive)
-        return;
-    throw new Error(`--mode submit refused: this is not an interactive terminal, and scripted submits ` +
-        `require ${SUBMIT_ENV_FLAG}=1. The gate is default-off so automation cannot ` +
-        'reach a live charge by accident.');
-}
 /** Distinct phrases per mode so dry-run muscle memory can never authorize a payment. */
 export function approvalPhrase(mode, reviewId) {
     return `${mode === 'submit' ? 'PAY' : 'CHECK'} ${reviewId}`;

package/dist/checkout-engine/repo-env.d.ts

@@ -1,7 +1,7 @@
 /**
  * Load the monorepo root `.env` as DEFAULTS for the runner, so stable
  * per-machine config (VGS credentials, CHECKOUT_APPROVAL_BASE_URL,
- * CHECKOUT_AGENT_ALLOW_SUBMIT, CHECKOUT_AGENT_MODE) is set once instead of
+ * CHECKOUT_AGENT_MODE) is set once instead of
  * retyped on every invocation. `process.loadEnvFile` never overrides
  * variables already present in the environment (verified: shell always wins),
  * so an explicit `FOO=x pnpm pay …` still beats the file. A missing file is

package/dist/checkout-engine/repo-env.js

@@ -2,7 +2,7 @@ import { fileURLToPath } from 'node:url';
 /**
  * Load the monorepo root `.env` as DEFAULTS for the runner, so stable
  * per-machine config (VGS credentials, CHECKOUT_APPROVAL_BASE_URL,
- * CHECKOUT_AGENT_ALLOW_SUBMIT, CHECKOUT_AGENT_MODE) is set once instead of
+ * CHECKOUT_AGENT_MODE) is set once instead of
  * retyped on every invocation. `process.loadEnvFile` never overrides
  * variables already present in the environment (verified: shell always wins),
  * so an explicit `FOO=x pnpm pay …` still beats the file. A missing file is