@visa/cli 4.1.0-rc.24 → 4.1.0-rc.240

package/install.ps1

@@ -108,8 +108,8 @@ try {
     }
 
     $major = [int]$nodeMatch.Groups['major'].Value
-    if ($major -lt 18) {
-        Write-Host "  Node.js $nodeVersion is too old. Version 18+ required." -ForegroundColor Red
+    if ($major -lt 20) {
+        Write-Host "  Node.js $nodeVersion is too old. Version 20+ required." -ForegroundColor Red
         Write-Host "  Install from https://nodejs.org/ and try again." -ForegroundColor Yellow
         Wait-BeforeExit
         exit 1
@@ -137,8 +137,9 @@ try {
 }
 
 # Install via npm
-Write-Host "  Running: npm install -g @visa/cli" -ForegroundColor Gray
-$npmOutput = & npm install -g @visa/cli 2>&1
+$Package = '@visa/cli@rc'
+Write-Host "  Running: npm install -g $Package" -ForegroundColor Gray
+$npmOutput = & npm install -g $Package 2>&1
 $npmExitCode = $LASTEXITCODE
 $npmText = ($npmOutput | Out-String)
 $npmOutput | Out-Host
@@ -158,7 +159,7 @@ if ($npmExitCode -ne 0) {
         Write-Host "  Do not disable TLS verification globally." -ForegroundColor Yellow
     } else {
         Write-Host "  Run manually for the full error, then retry:" -ForegroundColor Yellow
-        Write-Host "    npm install -g @visa/cli" -ForegroundColor Yellow
+        Write-Host "    npm install -g $Package" -ForegroundColor Yellow
     }
 
     Wait-BeforeExit
@@ -168,7 +169,6 @@ if ($npmExitCode -ne 0) {
 # Verify
 $cliCommandNames = Get-InstalledCliCommands
 $verifiedCommand = $null
-$verifiedCommandPath = $null
 $visaVersion = $null
 
 foreach ($commandName in $cliCommandNames) {
@@ -177,12 +177,9 @@ foreach ($commandName in $cliCommandNames) {
         continue
     }
 
-    # Capture the resolved executable path so the setup hand-off below runs
-    # exactly the binary verified here, not a fresh PATH lookup.
     $versionOutput = (& $commandInfo.Source --version 2>$null | Select-Object -First 1)
     if ($LASTEXITCODE -eq 0 -and $versionOutput) {
         $verifiedCommand = $commandName
-        $verifiedCommandPath = $commandInfo.Source
         $visaVersion = $versionOutput.Trim()
         break
     }
@@ -191,46 +188,12 @@ foreach ($commandName in $cliCommandNames) {
 Write-Host ""
 if ($verifiedCommand) {
     Write-Host "  Visa CLI $visaVersion installed." -ForegroundColor Green
-
-    # Hand off straight into setup so install -> setup -> signed-in is one
-    # uninterrupted flow. Hardening:
-    #  * Auto-launch only on an interactive console with input/output/error
-    #    all attached - setup must prompt and open a browser. Redirected
-    #    streams and CI fall back to printing the next step.
-    #  * Invoke $verifiedCommandPath (the path verified just above), not a
-    #    bare command name re-resolved through PATH.
-    #  * Pass only the literal "setup" argument - nothing caller-controlled.
-    if ($Host.Name -eq 'ConsoleHost' -and -not [Console]::IsInputRedirected -and -not [Console]::IsOutputRedirected -and -not [Console]::IsErrorRedirected -and -not $env:CI) {
-        Write-Host ""
-        Write-Host "  Continuing to setup..." -ForegroundColor Cyan
-        Write-Host ""
-        try {
-            $setupProcess = Start-Process -FilePath $verifiedCommandPath -ArgumentList @('setup') -Wait -NoNewWindow -PassThru -ErrorAction Stop
-        } catch {
-            Write-Host ""
-            Write-Host "  Setup could not start. Visa CLI is installed." -ForegroundColor Yellow
-            Write-Host "  PowerShell error: $($_.Exception.Message)" -ForegroundColor Yellow
-            Write-Host "  run '$verifiedCommand setup' when you're ready to finish." -ForegroundColor Yellow
-            Wait-BeforeExit
-            exit 1
-        }
-        if ($setupProcess.ExitCode -ne 0) {
-            Write-Host ""
-            Write-Host "  Setup exited before completion. Visa CLI is installed." -ForegroundColor Yellow
-            Write-Host "  run '$verifiedCommand setup' when you're ready to finish." -ForegroundColor Yellow
-            Wait-BeforeExit
-            exit 1
-        }
-        exit 0
-    } else {
-        Write-Host "  Run '$verifiedCommand setup' to get started." -ForegroundColor Cyan
-        Write-Host "  After setup, run /mcp inside Claude Code, not PowerShell, if Claude Code was already open." -ForegroundColor Cyan
-    }
+    Write-Host "  Connect an AI client with: $verifiedCommand connect <client>" -ForegroundColor Cyan
+    Write-Host "  Then ask your agent to call setup_start." -ForegroundColor Cyan
     Write-Host ""
 } else {
     $primaryCommand = $cliCommandNames | Select-Object -First 1
     Write-Host "  Installed but '$primaryCommand' was not runnable from PATH yet." -ForegroundColor Yellow
-    Write-Host "  Close and reopen PowerShell, then run: $primaryCommand setup" -ForegroundColor Yellow
-    Write-Host "  Run /mcp inside Claude Code after setup if you need to reconnect the MCP server." -ForegroundColor Yellow
+    Write-Host "  Close and reopen PowerShell, then run: $primaryCommand connect <client>" -ForegroundColor Yellow
     Write-Host ""
 }

package/install.sh

@@ -10,8 +10,8 @@
 _visa_install() {
 set -euo pipefail
 
-REQUIRED_NODE_MAJOR=18
-PACKAGE="@visa/cli"
+REQUIRED_NODE_MAJOR=20
+PACKAGE="@visa/cli@rc"
 
 # ── colours (disabled when piped) ─────────────────────────────────────────────
 if [ -t 1 ]; then
@@ -99,9 +99,6 @@ fi
 echo "$NPM_OUTPUT"
 
 # ── verify ────────────────────────────────────────────────────────────────────
-# Capture the absolute path resolved here so the setup hand-off below invokes
-# exactly the binary we just verified, instead of re-resolving "visa-cli"
-# through $PATH a second time.
 VISA_BIN=""
 VISA_VERSION=""
 if VISA_BIN="$(command -v visa-cli 2>/dev/null)"; then
@@ -111,40 +108,11 @@ fi
 echo ""
 if [ -n "$VISA_VERSION" ]; then
   ok "Visa CLI ${VISA_VERSION} installed."
-  # Hand off straight into setup so install -> setup -> signed-in is one
-  # uninterrupted flow. Hardening:
-  #  * Auto-launch only when output streams are real terminals and setup can
-  #    read from either stdin or /dev/tty. That keeps `curl ... | bash` usable:
-  #    the script arrives on stdin, while setup prompts still read from the
-  #    user's terminal. CI and redirected output print the next step instead.
-  #  * Invoke "$VISA_BIN" (the path verified just above), never a bare
-  #    "visa-cli" re-resolved through $PATH at call time.
-  #  * Pass only the literal "setup" argument — "$@" is never forwarded — so
-  #    nothing the script's caller controls reaches the installed binary.
-  if [ -t 1 ] && [ -t 2 ] && { [ -t 0 ] || [ -r /dev/tty ]; }; then
-    echo ""
-    info "Continuing to setup..."
-    echo ""
-    SETUP_EXIT=0
-    if [ -t 0 ]; then
-      "$VISA_BIN" setup || SETUP_EXIT=$?
-    else
-      "$VISA_BIN" setup </dev/tty || SETUP_EXIT=$?
-    fi
-    if [ "$SETUP_EXIT" -ne 0 ]; then
-      echo ""
-      warn "Setup exited before completion. Visa CLI is installed."
-      warn "run 'visa-cli setup' when you're ready to finish."
-      exit 1
-    fi
-    exit 0
-  else
-    info "Run 'visa-cli setup' to get started."
-    info "After setup, run /mcp inside Claude Code, not Terminal, if Claude Code was already open."
-  fi
+  info "Connect an AI client with: visa-cli connect <client>"
+  info "Then ask your agent to call setup_start."
 else
   warn "Installed, but 'visa-cli' was not found on PATH."
-  warn "You may need to restart your shell, then run: visa-cli setup"
+  warn "Restart your shell, then run: visa-cli connect <client>"
 fi
 echo ""
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.24",
-  "description": "AI-powered payments for Claude Code",
+  "version": "4.1.0-rc.240",
+  "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",
     "visa": "./bin/visa-cli.js"
@@ -9,7 +9,7 @@
   "scripts": {
     "sync:server-json": "node scripts/sync-server-json.mjs",
     "check:server-json": "node scripts/sync-server-json.mjs --check",
-    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/wallet-tools build && pnpm --filter @visa/checkout-engine build",
+    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/shared build && pnpm --filter @visa/observability build && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/agent-mail build && pnpm --filter @visa/wallet-tools build && pnpm --filter @visa/checkout-engine build",
     "build": "tsc --noEmit && node esbuild.config.js",
     "prepack": "node scripts/sync-server-json.mjs --check",
     "dev": "tsc --watch",
@@ -20,9 +20,9 @@
     "test:unit:watch": "jest --config jest.config.js --watch",
     "test:unit:coverage": "jest --config jest.config.js --coverage",
     "test:smoke": "VISA_AUTH_URL=https://auth.visacli.sh jest --config jest.smoke.config.js",
+    "test:packed": "node scripts/packed-cli-smoke.mjs",
     "test:integration": "jest --config jest.integration.config.js",
     "test:e2e": "jest --config jest.e2e.config.js",
-    "test:catalog-e2e": "jest --config jest.catalog-e2e.config.js",
     "test:all": "npm run test:unit && npm run test:integration && npm run test:e2e",
     "prepublishOnly": "npm run build && npm test",
     "lint": "eslint src/**/*.ts",
@@ -42,47 +42,52 @@
   "author": "Visa Crypto Labs",
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/ext-apps": "1.7.5",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@ucp-js/sdk": "0.4.4",
     "commander": "^12.1.0",
-    "zod": "^3.23.0"
+    "punycode": "^2.3.1",
+    "toml": "^4.3.0",
+    "yaml": "^2.9.0",
+    "zod": "^3.25.76"
   },
   "optionalDependencies": {
-    "libp2p": "^3.3.4",
-    "@libp2p/tcp": "^11.0.22",
-    "@libp2p/crypto": "^5.1.20",
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
+    "@libp2p/crypto": "^5.1.23",
+    "@libp2p/tcp": "^11.0.26",
     "@multiformats/multiaddr": "^13.0.3",
-    "uint8arrays": "^6.1.1",
-    "playwright-core": "^1.48.2"
+    "libp2p": "^3.3.9",
+    "playwright-core": "^1.62.1",
+    "uint8arrays": "^6.1.1"
   },
   "devDependencies": {
+    "@types/express": "^5.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.1.0",
+    "@typescript-eslint/eslint-plugin": "^8.68.0",
+    "@typescript-eslint/parser": "^8.68.0",
+    "@visa-cli/tools": "workspace:*",
+    "@visa/agent-mail": "workspace:*",
     "@visa/checkout-engine": "workspace:*",
     "@visa/crypto": "workspace:*",
-    "subway-sdk": "workspace:*",
+    "@visa/identity": "workspace:*",
     "@visa/money": "workspace:*",
+    "@visa/observability": "workspace:*",
+    "@visa/shared": "workspace:*",
     "@visa/wallet": "workspace:*",
     "@visa/wallet-tools": "workspace:*",
-    "@visa/observability": "workspace:*",
-    "@visa-cli/tools": "workspace:*",
-    "@changesets/changelog-git": "^0.2.1",
-    "@changesets/cli": "^2.31.0",
-    "@types/jest": "^30.0.0",
-    "@types/node": "^26.1.0",
-    "@typescript-eslint/eslint-plugin": "^8.63.0",
-    "@typescript-eslint/parser": "^8.63.0",
-    "@types/express": "^5.0.0",
     "esbuild": "^0.28.1",
-    "express": "^4.21.0",
     "eslint": "^10.0.2",
-    "eslint-config-prettier": "^10.1.8",
+    "express": "^4.21.0",
     "jest": "^29.7.0",
-    "prettier": "^3.9.4",
-    "ts-jest": "^29.4.11",
+    "prettier": "^3.9.6",
+    "subway-sdk": "workspace:*",
+    "ts-jest": "^29.4.12",
     "typescript": "^5.7.0"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.0.0"
   },
   "mcpName": "io.github.visa-crypto-labs/visa-cli",
   "files": [
@@ -95,7 +100,6 @@
     "native/build-win.bat",
     "native/bin/win32-x64/visa-keychain-win.exe",
     "server.json",
-    "README.md",
-    "LICENSE"
+    "README.md"
   ]
 }

package/server.json

@@ -1,15 +1,15 @@
 {
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.24",
+  "version": "4.1.0-rc.240",
   "title": "Visa CLI",
-  "description": "AI-powered payments and creative tools for coding agents. Generate images, music, video, query crypto prices, and make purchases — all from your AI coding assistant.",
+  "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.24",
+      "version": "4.1.0-rc.240",
       "transport": {
         "type": "stdio"
       },

package/dist/checkout-engine/inline-target.d.ts

@@ -1,13 +0,0 @@
-import type { VgsCheckoutTarget } from './vgs-live-instrument.js';
-/**
- * Build a checkout target from inline CLI flags (`--merchant-url` +
- * `--amount`, with optional `--merchant-name` / `--country` / `--currency`)
- * so any merchant can be paid without authoring a checkout JSON file first.
- *
- * Returns null when neither driving flag is present (file mode). Shape-only:
- * the returned target flows through run-live-fill's existing validation block
- * (positive-decimal amount, ISO codes, HTTPS), which stays the single source
- * of truth — nothing is double-validated here except the URL parse, which
- * must happen early because the merchant-name default derives from it.
- */
-export declare function inlineTargetFromFlags(input: Map<string, string>): VgsCheckoutTarget | null;

package/dist/checkout-engine/inline-target.js

@@ -1,37 +0,0 @@
-/**
- * Build a checkout target from inline CLI flags (`--merchant-url` +
- * `--amount`, with optional `--merchant-name` / `--country` / `--currency`)
- * so any merchant can be paid without authoring a checkout JSON file first.
- *
- * Returns null when neither driving flag is present (file mode). Shape-only:
- * the returned target flows through run-live-fill's existing validation block
- * (positive-decimal amount, ISO codes, HTTPS), which stays the single source
- * of truth — nothing is double-validated here except the URL parse, which
- * must happen early because the merchant-name default derives from it.
- */
-export function inlineTargetFromFlags(input) {
-    const merchantUrl = input.get('--merchant-url');
-    const amount = input.get('--amount');
-    if (merchantUrl === undefined && amount === undefined)
-        return null;
-    if (!merchantUrl || !amount) {
-        throw new Error('inline checkout needs both --merchant-url and --amount');
-    }
-    let host;
-    try {
-        host = new URL(merchantUrl).hostname;
-    }
-    catch {
-        throw new Error('--merchant-url must be a valid URL');
-    }
-    if (!host) {
-        throw new Error('--merchant-url must have a hostname');
-    }
-    return {
-        merchantName: input.get('--merchant-name') ?? host,
-        merchantUrl,
-        merchantCountryCode: input.get('--country') ?? 'US',
-        transactionAmount: amount,
-        transactionCurrencyCode: input.get('--currency') ?? 'USD',
-    };
-}

package/dist/checkout-engine/pay-args.d.ts

@@ -1,14 +0,0 @@
-/**
- * Argv rewriter for the `pnpm pay` positional entry point, extracted pure so
- * it is unit-testable (the pay.ts script executes on import). Maps
- * `<checkout-url> <amount> [flags]` onto run-live-fill's inline flags.
- *
- * Strict by design — this drives a real-money run:
- *  - `--merchant-url`/`--amount` are REJECTED as passthrough flags: the
- *    runner's arg map lets a later flag win, so a stray duplicate would
- *    silently retarget the purchase away from the typed positionals.
- *  - Every flag must carry a value (same grammar as run-live-fill's args()),
- *    so a trailing bare flag fails HERE with pay's usage, not downstream with
- *    fill:live's.
- */
-export declare function rewritePayArgs(argv: string[]): string[];

package/dist/checkout-engine/pay-args.js

@@ -1,44 +0,0 @@
-/**
- * Argv rewriter for the `pnpm pay` positional entry point, extracted pure so
- * it is unit-testable (the pay.ts script executes on import). Maps
- * `<checkout-url> <amount> [flags]` onto run-live-fill's inline flags.
- *
- * Strict by design — this drives a real-money run:
- *  - `--merchant-url`/`--amount` are REJECTED as passthrough flags: the
- *    runner's arg map lets a later flag win, so a stray duplicate would
- *    silently retarget the purchase away from the typed positionals.
- *  - Every flag must carry a value (same grammar as run-live-fill's args()),
- *    so a trailing bare flag fails HERE with pay's usage, not downstream with
- *    fill:live's.
- */
-const USAGE = 'usage: pnpm pay -- <checkout-url> <amount> [--merchant-name <name>] ' +
-    '[--country <CC>] [--currency <ISO>] [--mode dry-run|submit] [--contact-file <path>] ' +
-    '[--agent-credential-file <path>] [--approval-base-url <url>]';
-const RESERVED_FLAGS = ['--merchant-url', '--amount'];
-export function rewritePayArgs(argv) {
-    // pnpm forwards the literal `--` separator; drop it like run-live-fill does.
-    const tokens = argv.filter((a) => a !== '--');
-    const positionals = [];
-    const flags = [];
-    for (let i = 0; i < tokens.length; i++) {
-        const token = tokens[i];
-        if (token.startsWith('--')) {
-            if (RESERVED_FLAGS.includes(token)) {
-                throw new Error(`${token} is derived from the positionals — pass the url and amount ` +
-                    `positionally instead of as flags\n${USAGE}`);
-            }
-            const value = tokens[i + 1];
-            if (value === undefined || value.startsWith('--')) {
-                throw new Error(`flag ${token} needs a value\n${USAGE}`);
-            }
-            flags.push(token, value);
-            i++;
-        }
-        else {
-            positionals.push(token);
-        }
-    }
-    if (positionals.length !== 2)
-        throw new Error(USAGE);
-    return ['--merchant-url', positionals[0], '--amount', positionals[1], ...flags];
-}

package/dist/checkout-engine/pay.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/checkout-engine/pay.js

@@ -1,13 +0,0 @@
-/**
- * Positional sugar over run-live-fill's inline any-merchant mode:
- *
- *   pnpm pay -- <checkout-url> <amount> [--mode submit] [--merchant-name "X"] [...]
- *
- * Rewrites the two positionals into --merchant-url/--amount (pay-args.ts,
- * strict) and re-enters the runner, so every guardrail (typed PAY approval,
- * CHECKOUT_AGENT_ALLOW_SUBMIT, hosted/loopback ceremony, receipts) is exactly
- * the fill:live path — this file must never grow logic of its own.
- */
-import { rewritePayArgs } from './pay-args.js';
-process.argv = [process.argv[0], process.argv[1], ...rewritePayArgs(process.argv.slice(2))];
-await import('./run-live-fill.js');

package/dist/checkout-engine/repo-env.d.ts

@@ -1,11 +0,0 @@
-/**
- * Load the monorepo root `.env` as DEFAULTS for the runner, so stable
- * per-machine config (VGS credentials, CHECKOUT_APPROVAL_BASE_URL,
- * CHECKOUT_AGENT_ALLOW_SUBMIT, CHECKOUT_AGENT_MODE) is set once instead of
- * retyped on every invocation. `process.loadEnvFile` never overrides
- * variables already present in the environment (verified: shell always wins),
- * so an explicit `FOO=x pnpm pay …` still beats the file. A missing file is
- * fine — the runner then relies on the ambient environment exactly as before.
- */
-export declare function defaultRepoEnvPath(): string;
-export declare function loadRepoEnvDefaults(path?: string, log?: (line: string) => void): boolean;

package/dist/checkout-engine/repo-env.js

@@ -1,23 +0,0 @@
-import { fileURLToPath } from 'node:url';
-/**
- * Load the monorepo root `.env` as DEFAULTS for the runner, so stable
- * per-machine config (VGS credentials, CHECKOUT_APPROVAL_BASE_URL,
- * CHECKOUT_AGENT_ALLOW_SUBMIT, CHECKOUT_AGENT_MODE) is set once instead of
- * retyped on every invocation. `process.loadEnvFile` never overrides
- * variables already present in the environment (verified: shell always wins),
- * so an explicit `FOO=x pnpm pay …` still beats the file. A missing file is
- * fine — the runner then relies on the ambient environment exactly as before.
- */
-export function defaultRepoEnvPath() {
-    return fileURLToPath(new URL('../../../.env', import.meta.url));
-}
-export function loadRepoEnvDefaults(path = defaultRepoEnvPath(), log = (line) => process.stdout.write(`${line}\n`)) {
-    try {
-        process.loadEnvFile(path);
-    }
-    catch {
-        return false;
-    }
-    log(`loaded env defaults from ${path} (already-set variables win)`);
-    return true;
-}

package/dist/checkout-engine/run-live-fill.d.ts

@@ -1 +0,0 @@
-export {};