@visa/cli 4.1.0-rc.203 → 4.1.0-rc.205

package/dist/checkout-engine/cli-engine.d.ts

@@ -198,6 +198,8 @@ export interface CardDrawVerdictDraw {
 export interface CardDrawVerdictCapability {
     /** Opaque to the engine — passed straight back to {@link CardDrawVerdictSeam.fetchVerdict}. */
     agentKey: unknown;
+    /** Root-signed delegation for a short-lived device key. */
+    runtimeCertificate?: string;
     agentJkt: string;
     /** Auth origin that minted the binding and hosts the /v4/card/draw* routes. */
     authBaseUrl: string;
@@ -207,6 +209,7 @@ export interface CardDrawVerdictSeam {
     fetchVerdict: (input: {
         authBaseUrl: string;
         agentKey: unknown;
+        runtimeCertificate?: string;
         mandateId: string;
         drawId: string;
         draw: CardDrawVerdictDraw;
@@ -218,12 +221,14 @@ export interface CardDrawVerdictSeam {
 export interface CardMandateRegisterSeam {
     loadCapability: (agentRef?: string) => {
         agentKey: unknown;
+        runtimeCertificate?: string;
         agentJkt: string;
         authBaseUrl: string;
     } | null;
     register: (input: {
         authBaseUrl: string;
         agentKey: unknown;
+        runtimeCertificate?: string;
         mandateId: string;
         mintToken: string;
         ceiling: string;

package/dist/checkout-engine/cli-engine.js

@@ -241,6 +241,9 @@ export function createCliCheckoutEngine(deps = {}) {
             .register({
             authBaseUrl: args.registerCap.authBaseUrl,
             agentKey: args.registerCap.agentKey,
+            ...(args.registerCap.runtimeCertificate
+                ? { runtimeCertificate: args.registerCap.runtimeCertificate }
+                : {}),
             mandateId: args.mandateId,
             mintToken: args.mintToken,
             ceiling: args.ceiling,
@@ -804,6 +807,9 @@ export function createCliCheckoutEngine(deps = {}) {
                                     const { verdict } = await verdictSeam.fetchVerdict({
                                         authBaseUrl: capability.authBaseUrl,
                                         agentKey: capability.agentKey,
+                                        ...(capability.runtimeCertificate
+                                            ? { runtimeCertificate: capability.runtimeCertificate }
+                                            : {}),
                                         mandateId,
                                         // One draw per review; the reviewId is auth's idempotency key.
                                         drawId: input.reviewId,

package/dist/checkout-engine/mandate/card-mandate.d.ts

@@ -51,7 +51,7 @@ export type CreateCardMandateDeps = {
     ledger: MandateLedger;
     /** verify-web origin the intent is minted against (persisted for later draws). */
     approvalBaseUrl: string;
-    /** Scoped mint token to persist for tap-free draws. */
+    /** @deprecated Accepted from older callers but deliberately never persisted. */
     mintToken?: string;
     now?: () => Date;
 };

package/dist/checkout-engine/mandate/card-mandate.js

@@ -123,7 +123,6 @@ export async function createCardMandate(input, deps) {
         merchantHost: host,
         merchantCountryCode: input.merchant.countryCode.toUpperCase(),
         approvalBaseUrl: deps.approvalBaseUrl,
-        ...(deps.mintToken ? { mintToken: deps.mintToken } : {}),
         expiresAt: new Date(expiryMs).toISOString(),
         maxDraws,
         createdAt: now.toISOString(),

package/dist/checkout-engine/mandate/mandate-ledger.d.ts

@@ -31,11 +31,7 @@ export type CardMandateRecord = {
     merchantCountryCode: string;
     /** verify-web origin the ceiling intent was minted against. */
     approvalBaseUrl: string;
-    /**
-     * Scoped token released by the ceiling approval. It bootstraps the one intent
-     * + register ceremony only. Each cryptogram AND its outcome confirmation use
-     * the exact per-draw verdict instead. Owner-only (0600).
-     */
+    /** @deprecated Read-migration only. New writers never persist this bearer. */
     mintToken?: string;
     expiresAt: string;
     /** Network purchase-count cap disclosed at approval. Absent on legacy rows. */

package/dist/checkout-engine/mandate/mandate-ledger.js

@@ -11,8 +11,8 @@
 //
 // VGS's decline_threshold is a per-transaction NETWORK control; this ledger is
 // the SEPARATE cumulative budget control. The file holds identifiers and
-// accounting state plus the scoped mint token (owner-only) — never PAN, DPAN,
-// CVC, or cryptogram values. Cross-process concurrency is NOT solved by a file
+// accounting state only — never a bootstrap mint token, PAN, DPAN, CVC, or
+// cryptogram values. Cross-process concurrency is NOT solved by a file
 // (same caveat csmoove notes); the in-process mutex below serializes draws
 // within one CLI process, which is the live-spike target.
 //
@@ -121,6 +121,18 @@ export class MandateLedger {
             if (!doc || !Array.isArray(doc.mandates)) {
                 return { version: CARD_MANDATE_LEDGER_VERSION, mandates: [] };
             }
+            // One-time migration for pre-hardening ledgers. The budget mint is a
+            // bootstrap bearer used only during create/register and must not survive
+            // process exit. Scrub it eagerly on read, not merely on the next mutation.
+            let scrubbedBootstrapToken = false;
+            for (const mandate of doc.mandates) {
+                if (Object.prototype.hasOwnProperty.call(mandate, 'mintToken')) {
+                    delete mandate.mintToken;
+                    scrubbedBootstrapToken = true;
+                }
+            }
+            if (scrubbedBootstrapToken)
+                await writeOwnerOnlyJson(this.path, doc);
             // Self-heal: prune reservations stranded by a crash before commit/release
             // so `remaining` reflects reality. In-memory here; a mutating caller then
             // persists the pruned state via save().
@@ -161,9 +173,12 @@ export class MandateLedger {
                 const exp = Date.parse(m.expiresAt);
                 return !Number.isFinite(exp) || exp >= pruneBefore;
             });
-            file.mandates.push(record);
+            // Even an older caller that still supplies the deprecated field cannot
+            // persist the bootstrap bearer.
+            const { mintToken: _discardedBootstrapToken, ...safeRecord } = record;
+            file.mandates.push(safeRecord);
             await this.save(file);
-            return record;
+            return safeRecord;
         });
     }
     /** Read a single mandate (no lock — a snapshot copy). */