@visa/cli 4.1.0-rc.25 → 4.1.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "4.1.0-rc.25",
+  "version": "4.1.0-rc.4",
   "description": "AI-powered payments for Claude Code",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",
@@ -9,7 +9,7 @@
   "scripts": {
     "sync:server-json": "node scripts/sync-server-json.mjs",
     "check:server-json": "node scripts/sync-server-json.mjs --check",
-    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/wallet-tools build && pnpm --filter @visa/checkout-engine build",
+    "prebuild": "node scripts/sync-server-json.mjs && pnpm --filter @visa/money build && pnpm --filter @visa/crypto build && pnpm --filter subway-sdk build && pnpm --filter @visa-cli/tools build && pnpm --filter @visa/identity build && pnpm --filter @visa/wallet build && pnpm --filter @visa/wallet-tools build",
     "build": "tsc --noEmit && node esbuild.config.js",
     "prepack": "node scripts/sync-server-json.mjs --check",
     "dev": "tsc --watch",
@@ -53,11 +53,9 @@
     "@chainsafe/libp2p-noise": "^17.0.0",
     "@chainsafe/libp2p-yamux": "^8.0.1",
     "@multiformats/multiaddr": "^13.0.3",
-    "uint8arrays": "^6.1.1",
-    "playwright-core": "^1.48.2"
+    "uint8arrays": "^6.1.1"
   },
   "devDependencies": {
-    "@visa/checkout-engine": "workspace:*",
     "@visa/crypto": "workspace:*",
     "subway-sdk": "workspace:*",
     "@visa/money": "workspace:*",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "4.1.0-rc.25",
+  "version": "4.1.0-rc.4",
   "title": "Visa CLI",
   "description": "AI-powered payments and creative tools for coding agents. Generate images, music, video, query crypto prices, and make purchases — all from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "4.1.0-rc.25",
+      "version": "4.1.0-rc.4",
       "transport": {
         "type": "stdio"
       },

package/dist/checkout-engine/adapters/generic.d.ts

@@ -1,19 +0,0 @@
-import type { Page, Locator } from 'playwright-core';
-import type { DetectResult, FieldEntry, FieldMap } from '../detect.js';
-import type { CardCredential } from '../instrument.js';
-import type { Contact, FillResult, FilledField } from '../types.js';
-export interface CheckoutAdapter {
-    name: string;
-    matches(detected: DetectResult): boolean;
-    fill(page: Page, fields: FieldMap, credential: CardCredential, contact: Contact): Promise<FillResult>;
-}
-export declare function resolveLocator(page: Page, entry: FieldEntry): Locator;
-export declare function scrubFillErrorMessage(message: string, value: string): string;
-export declare function fillFieldMap(page: Page, fields: FieldMap, credential: CardCredential, contact: Contact, opts?: {
-    fillTimeoutMs?: number;
-}): Promise<FilledField[]>;
-export declare class GenericAdapter implements CheckoutAdapter {
-    name: string;
-    matches(_detected: DetectResult): boolean;
-    fill(page: Page, fields: FieldMap, credential: CardCredential, contact: Contact): Promise<FillResult>;
-}

package/dist/checkout-engine/adapters/generic.js

@@ -1,201 +0,0 @@
-// Generic adapter. Drives the detect.ts field map: fills text inputs and
-// <select> dropdowns, handles split vs combined expiry, two- vs four-digit
-// years, and split first/last name. It is the fallback that should beat any
-// well-behaved guest checkout on its own.
-import { maskCvc, maskExpiry, maskPan, redactContact } from '../evidence.js';
-function pad2(n) {
-    return String(n).padStart(2, '0');
-}
-export function resolveLocator(page, entry) {
-    if (entry.frame)
-        return page.frameLocator(entry.frame).locator(entry.locator);
-    return page.locator(entry.locator);
-}
-function matchOption(options, wanted) {
-    for (const w of wanted) {
-        const lc = w.toLowerCase();
-        for (const o of options) {
-            if (o.value === w)
-                return o.value;
-            if (o.value.toLowerCase() === lc)
-                return o.value;
-            if (o.text.toLowerCase() === lc)
-                return o.value;
-        }
-    }
-    // looser: contains
-    for (const w of wanted) {
-        const lc = w.toLowerCase();
-        for (const o of options)
-            if (o.text.toLowerCase().includes(lc))
-                return o.value;
-    }
-    return null;
-}
-const MONTH_NAMES = [
-    'january',
-    'february',
-    'march',
-    'april',
-    'may',
-    'june',
-    'july',
-    'august',
-    'september',
-    'october',
-    'november',
-    'december',
-];
-function monthOptionValue(options, month) {
-    return matchOption(options, [pad2(month), String(month), MONTH_NAMES[month - 1] ?? '']);
-}
-function yearOptionValue(options, year) {
-    return matchOption(options, [String(year), pad2(year % 100), String(year % 100)]);
-}
-// value chosen for a select-style role, or the typed string for inputs.
-function expCombinedValue(entry, month, year) {
-    const mm = pad2(month);
-    const yy = pad2(year % 100);
-    const max = entry.maxlength ?? 0;
-    // A maxlength of exactly 4 means MMYY with no separator.
-    if (max === 4)
-        return `${mm}${yy}`;
-    return `${mm}/${yy}`;
-}
-// Playwright failure messages embed the attempted value in their call log
-// (`- fill("4242…")`, `- selectOption("123")`), so an unscrubbed error from a
-// FAILED fill would write the exact secret it was typing (cvc/DAVV, expiry,
-// contact PII) into evidence — and from there into the persisted receipt.
-// Scrub the call-log payloads and every literal occurrence of the value.
-export function scrubFillErrorMessage(message, value) {
-    let scrubbed = message.replace(/\b(fill|selectOption)\("(?:[^"\\]|\\.)*"\)/g, '$1("<redacted>")');
-    if (value)
-        scrubbed = scrubbed.split(value).join('<redacted>');
-    return scrubbed;
-}
-const DEFAULT_FILL_TIMEOUT_MS = 5000;
-async function fillOne(page, role, entry, value, displayValue, fillTimeoutMs) {
-    const base = {
-        role,
-        locator: entry.locator,
-        confidence: entry.confidence,
-        source: entry.source,
-        frame: entry.frame,
-        value: displayValue,
-    };
-    try {
-        const loc = resolveLocator(page, entry);
-        if (entry.tag === 'select') {
-            await loc.selectOption(value, { timeout: fillTimeoutMs });
-        }
-        else {
-            await loc.fill(value, { timeout: fillTimeoutMs });
-        }
-        return { ...base, ok: true };
-    }
-    catch (err) {
-        return { ...base, ok: false, error: scrubFillErrorMessage(err.message, value) };
-    }
-}
-// The shared fill routine used by every adapter. Takes an already-detected
-// FieldMap so the executor controls when detection runs.
-export async function fillFieldMap(page, fields, credential, contact, opts = {}) {
-    const fillTimeoutMs = opts.fillTimeoutMs ?? DEFAULT_FILL_TIMEOUT_MS;
-    const filled = [];
-    const first = contact.firstName ?? credential.cardholderName.split(/\s+/)[0] ?? credential.cardholderName;
-    const last = contact.lastName ?? credential.cardholderName.split(/\s+/).slice(1).join(' ') ?? '';
-    // Order matters a little: contact/name before card is harmless, but we fill
-    // card fields explicitly per role so order is not load-bearing.
-    const jobs = [];
-    const add = (role, entry, value, display) => {
-        if (!entry)
-            return;
-        // Skip fields that are not currently visible (e.g. a collapsed accordion
-        // panel or a not-yet-reached step). The executor reveals them and re-fills.
-        if (entry.visible === false)
-            return;
-        jobs.push({
-            role,
-            entry,
-            run: async () => fillOne(page, role, entry, value(), display(), fillTimeoutMs),
-        });
-    };
-    add('number', fields.number, () => credential.pan, () => maskPan(credential.pan));
-    add('cvc', fields.cvc, () => credential.cvc, () => maskCvc(credential.cvc));
-    add('name', fields.name, () => credential.cardholderName, () => redactContact('name', credential.cardholderName));
-    add('nameFirst', fields.nameFirst, () => first, () => redactContact('nameFirst', first));
-    add('nameLast', fields.nameLast, () => last, () => redactContact('nameLast', last));
-    // Expiry display values are always redacted: the expiry is part of the
-    // keyable credential (DPAN + expiry + DAVV) and never enters the log.
-    if (fields.expCombined) {
-        const e = fields.expCombined;
-        const v = expCombinedValue(e, credential.expMonth, credential.expYear);
-        add('expCombined', e, () => v, () => maskExpiry());
-    }
-    if (fields.expMonth) {
-        const e = fields.expMonth;
-        const value = e.tag === 'select'
-            ? (monthOptionValue(e.options ?? [], credential.expMonth) ?? pad2(credential.expMonth))
-            : pad2(credential.expMonth);
-        add('expMonth', e, () => value, () => maskExpiry());
-    }
-    if (fields.expYear) {
-        const e = fields.expYear;
-        let value;
-        if (e.tag === 'select') {
-            value = yearOptionValue(e.options ?? [], credential.expYear) ?? String(credential.expYear);
-        }
-        else if ((e.maxlength ?? 0) === 2) {
-            value = pad2(credential.expYear % 100);
-        }
-        else {
-            value = String(credential.expYear);
-        }
-        add('expYear', e, () => value, () => maskExpiry());
-    }
-    // Contact / shipping. Display values are always redacted: these are PII and
-    // the evidence log is built to be persistable.
-    if (contact.email)
-        add('email', fields.email, () => contact.email, () => redactContact('email', contact.email));
-    if (contact.addressLine1)
-        add('addressLine1', fields.addressLine1, () => contact.addressLine1, () => redactContact('addressLine1', contact.addressLine1));
-    if (contact.addressLine2)
-        add('addressLine2', fields.addressLine2, () => contact.addressLine2, () => redactContact('addressLine2', contact.addressLine2));
-    if (contact.city)
-        add('city', fields.city, () => contact.city, () => redactContact('city', contact.city));
-    if (contact.postalCode)
-        add('postalCode', fields.postalCode, () => contact.postalCode, () => redactContact('postalCode', contact.postalCode));
-    if (fields.state && contact.state) {
-        const e = fields.state;
-        const wanted = contact.state;
-        const value = e.tag === 'select' ? (matchOption(e.options ?? [], [wanted]) ?? wanted) : wanted;
-        add('state', e, () => value, () => redactContact('state', value));
-    }
-    if (fields.country && contact.country) {
-        const e = fields.country;
-        const value = e.tag === 'select'
-            ? (matchOption(e.options ?? [], [contact.country]) ?? contact.country)
-            : contact.country;
-        add('country', e, () => value, () => redactContact('country', value));
-    }
-    for (const j of jobs) {
-        const r = await j.run();
-        if (r)
-            filled.push(r);
-    }
-    return filled;
-}
-export class GenericAdapter {
-    name = 'generic';
-    matches(_detected) {
-        // The generic adapter is the universal fallback; it always matches.
-        return true;
-    }
-    async fill(page, fields, credential, contact) {
-        const filled = await fillFieldMap(page, fields, credential, contact);
-        return {
-            ok: filled.some((f) => f.role === 'number' && f.ok),
-            filled,
-        };
-    }
-}

package/dist/checkout-engine/adapters/index.d.ts

@@ -1,7 +0,0 @@
-import type { DetectResult } from '../detect.js';
-import type { CheckoutAdapter } from './generic.js';
-export type { CheckoutAdapter } from './generic.js';
-export { GenericAdapter } from './generic.js';
-export { StripeLikeAdapter } from './stripe-like.js';
-export { fillFieldMap, resolveLocator } from './generic.js';
-export declare function selectAdapter(detected: DetectResult): CheckoutAdapter;

package/dist/checkout-engine/adapters/index.js

@@ -1,17 +0,0 @@
-// Adapter registry. Specific adapters get first crack; the generic adapter is
-// the universal fallback and always matches last. Selection is a pure
-// function of an already-run detection — adapters never re-detect.
-import { GenericAdapter } from './generic.js';
-import { StripeLikeAdapter } from './stripe-like.js';
-export { GenericAdapter } from './generic.js';
-export { StripeLikeAdapter } from './stripe-like.js';
-export { fillFieldMap, resolveLocator } from './generic.js';
-const SPECIFIC = [new StripeLikeAdapter()];
-const FALLBACK = new GenericAdapter();
-export function selectAdapter(detected) {
-    for (const a of SPECIFIC) {
-        if (a.matches(detected))
-            return a;
-    }
-    return FALLBACK;
-}

package/dist/checkout-engine/adapters/stripe-like.d.ts

@@ -1,10 +0,0 @@
-import type { Page } from 'playwright-core';
-import type { DetectResult, FieldMap } from '../detect.js';
-import type { CardCredential } from '../instrument.js';
-import type { Contact, FillResult } from '../types.js';
-import { type CheckoutAdapter } from './generic.js';
-export declare class StripeLikeAdapter implements CheckoutAdapter {
-    name: string;
-    matches(detected: DetectResult): boolean;
-    fill(page: Page, fields: FieldMap, credential: CardCredential, contact: Contact): Promise<FillResult>;
-}

package/dist/checkout-engine/adapters/stripe-like.js

@@ -1,21 +0,0 @@
-// Stripe-like adapter. Matches checkouts whose card fields live inside a
-// same-origin iframe laid out like Stripe Elements (a card-number frame, an
-// expiry frame, a cvc frame, or one combined frame). It fills through
-// Playwright frameLocator. For M0 only same-origin test iframes are fillable;
-// a real cross-origin PSP iframe is detected upstream and reported as
-// requiresAdapter instead.
-import { fillFieldMap } from './generic.js';
-export class StripeLikeAdapter {
-    name = 'stripe-like';
-    matches(detected) {
-        // We take this adapter when the card number was found inside a frame.
-        return Boolean(detected.fields.number?.frame);
-    }
-    async fill(page, fields, credential, contact) {
-        const filled = await fillFieldMap(page, fields, credential, contact);
-        return {
-            ok: filled.some((f) => f.role === 'number' && f.ok),
-            filled,
-        };
-    }
-}

package/dist/checkout-engine/browser-launch.d.ts

@@ -1,46 +0,0 @@
-/**
- * Browser provisioning for the checkout engine.
- *
- * @purpose The engine depends on `playwright-core` (NOT `playwright`) so that
- * installing @visa/cli never triggers a postinstall Chromium download. A real
- * browser is resolved lazily, on the first checkout, in this order:
- *
- *   1. VISA_CHECKOUT_BROWSER  — explicit executable path override (deterministic
- *      for CI / pinned environments; wins over everything). If it is set but
- *      FAILS to launch, we ABORT loudly rather than fall through — a pinned
- *      money flow must not run in a browser the operator did not choose.
- *   2. channel: 'chrome'      — a system-installed Google Chrome (no download).
- *   3. channel: 'msedge'      — a system-installed Microsoft Edge (no download).
- *   4. default chromium       — a playwright-managed browser, IF one was already
- *      installed via `npx playwright-core install chromium` (still no download
- *      here — it only USES an existing one; launch throws if absent).
- *
- * If none launch, we throw one actionable error listing every attempt and the
- * three ways to fix it. We never silently download hundreds of MB mid-command;
- * provisioning stays an explicit user choice (install Chrome, run the documented
- * `playwright-core install`, or point VISA_CHECKOUT_BROWSER at a binary).
- *
- * The install command is `playwright-core`, NOT `playwright`: this package no
- * longer depends on the full `playwright`, so `npx playwright …` would fetch an
- * unrelated latest `playwright` and can install a browser revision that does not
- * match the pinned `playwright-core` — the very launch this is meant to fix.
- * `npx playwright-core install` uses the installed, version-matched package.
- */
-import { type Browser, type LaunchOptions } from 'playwright-core';
-export type LaunchCheckoutBrowserDeps = {
-    env?: NodeJS.ProcessEnv;
-    /** Injectable launcher (default: playwright-core chromium.launch) — tests
-     *  pass a fake to assert the fallback order without a real browser. */
-    launch?: (opts: LaunchOptions) => Promise<Browser>;
-    log?: (msg: string) => void;
-};
-type Attempt = {
-    label: string;
-    opts: LaunchOptions;
-    override?: boolean;
-};
-/** Build the ordered launch attempts for the current environment. Exported for
- *  unit testing the resolution order without launching anything. */
-export declare function buildLaunchAttempts(env: NodeJS.ProcessEnv): Attempt[];
-export declare function launchCheckoutBrowser(deps?: LaunchCheckoutBrowserDeps): Promise<Browser>;
-export {};

package/dist/checkout-engine/browser-launch.js

@@ -1,81 +0,0 @@
-/**
- * Browser provisioning for the checkout engine.
- *
- * @purpose The engine depends on `playwright-core` (NOT `playwright`) so that
- * installing @visa/cli never triggers a postinstall Chromium download. A real
- * browser is resolved lazily, on the first checkout, in this order:
- *
- *   1. VISA_CHECKOUT_BROWSER  — explicit executable path override (deterministic
- *      for CI / pinned environments; wins over everything). If it is set but
- *      FAILS to launch, we ABORT loudly rather than fall through — a pinned
- *      money flow must not run in a browser the operator did not choose.
- *   2. channel: 'chrome'      — a system-installed Google Chrome (no download).
- *   3. channel: 'msedge'      — a system-installed Microsoft Edge (no download).
- *   4. default chromium       — a playwright-managed browser, IF one was already
- *      installed via `npx playwright-core install chromium` (still no download
- *      here — it only USES an existing one; launch throws if absent).
- *
- * If none launch, we throw one actionable error listing every attempt and the
- * three ways to fix it. We never silently download hundreds of MB mid-command;
- * provisioning stays an explicit user choice (install Chrome, run the documented
- * `playwright-core install`, or point VISA_CHECKOUT_BROWSER at a binary).
- *
- * The install command is `playwright-core`, NOT `playwright`: this package no
- * longer depends on the full `playwright`, so `npx playwright …` would fetch an
- * unrelated latest `playwright` and can install a browser revision that does not
- * match the pinned `playwright-core` — the very launch this is meant to fix.
- * `npx playwright-core install` uses the installed, version-matched package.
- */
-import { chromium } from 'playwright-core';
-const HEADFUL = { headless: false };
-/** Build the ordered launch attempts for the current environment. Exported for
- *  unit testing the resolution order without launching anything. */
-export function buildLaunchAttempts(env) {
-    const attempts = [];
-    const override = env.VISA_CHECKOUT_BROWSER?.trim();
-    if (override) {
-        attempts.push({
-            label: `VISA_CHECKOUT_BROWSER (${override})`,
-            opts: { ...HEADFUL, executablePath: override },
-            override: true,
-        });
-    }
-    attempts.push({
-        label: 'system Chrome (channel=chrome)',
-        opts: { ...HEADFUL, channel: 'chrome' },
-    });
-    attempts.push({ label: 'system Edge (channel=msedge)', opts: { ...HEADFUL, channel: 'msedge' } });
-    attempts.push({ label: 'playwright-managed chromium', opts: { ...HEADFUL } });
-    return attempts;
-}
-export async function launchCheckoutBrowser(deps = {}) {
-    const env = deps.env ?? process.env;
-    const launch = deps.launch ?? ((opts) => chromium.launch(opts));
-    const log = deps.log ?? (() => { });
-    const errors = [];
-    for (const attempt of buildLaunchAttempts(env)) {
-        try {
-            const browser = await launch(attempt.opts);
-            log(`checkout browser: launched via ${attempt.label}`);
-            return browser;
-        }
-        catch (err) {
-            const first = err.message.split('\n')[0];
-            if (attempt.override) {
-                // An explicit VISA_CHECKOUT_BROWSER is a deterministic, pinned choice
-                // (CI / a locked-down operator env). If it fails to launch, ABORT loudly
-                // rather than silently substituting a system browser the operator did
-                // not pin — this is a money flow. Unsetting the var opts back into the
-                // system-browser fallback below.
-                throw new Error(`VISA_CHECKOUT_BROWSER="${env.VISA_CHECKOUT_BROWSER?.trim()}" failed to launch: ${first}. ` +
-                    'Fix the path/binary, or unset VISA_CHECKOUT_BROWSER to allow a system-browser ' +
-                    'fallback — refusing to substitute an unpinned browser for a checkout.');
-            }
-            errors.push(`${attempt.label}: ${first}`);
-        }
-    }
-    throw new Error('Could not launch a browser for checkout. Tried — ' +
-        errors.join(' | ') +
-        '. Install Google Chrome, or run `npx playwright-core install chromium` ' +
-        '(matches the pinned version), or set VISA_CHECKOUT_BROWSER to a browser executable path.');
-}

package/dist/checkout-engine/ceremony.d.ts

@@ -1,64 +0,0 @@
-import type { PurchaseAssurance, VgsCheckoutTarget } from './vgs-live-instrument.js';
-/** ISO-4217 numeric codes for the consent screen — mirrors the dev-harness map. */
-export declare const CURRENCY_NUMERIC: Record<string, string>;
-export declare function currencyNumeric(code: string): string | null;
-/**
- * Build the runner-side PurchaseAssurance from a completed ceremony. Scope
- * fields come verbatim from the checkout target, so the instrument's
- * scope-alignment validation (#5709) is satisfied by construction; `now` is
- * injectable for tests.
- */
-export declare function assuranceFromCeremony(target: VgsCheckoutTarget, assuranceData: unknown, now?: Date): PurchaseAssurance;
-export type CeremonyPageConfig = {
-    tokenId: string;
-    environment: 'live' | 'sandbox';
-    consumerEmail: string;
-    merchantName: string;
-    /** Decimal major-unit amount, e.g. "1.00" — drives the consent screen. */
-    amount: string;
-    /** Display currency, e.g. "USD". */
-    currency: string;
-    /** ISO-4217 numeric code for the SDK, e.g. "840". */
-    currencyNumericCode: string;
-};
-/**
- * The single-purpose approval page. Pure string builder so tests can assert
- * the config embed is intact and escape-safe. The config is embedded as JSON
- * with `<` escaped, so a hostile merchant name cannot break out of the script
- * element.
- */
-export declare function ceremonyPageHtml(cfg: CeremonyPageConfig): string;
-export type RunCeremonyOptions = {
-    page: CeremonyPageConfig;
-    target: VgsCheckoutTarget;
-    /** Contents of the vendored VgsAgenticAuth module, served to the page. */
-    vendorSdkJs: string;
-    /** Short-lived VGS bearer for the ceremony SDK (client-credentials mint). */
-    mintAccessToken: () => Promise<string>;
-    /**
-     * TLS material for the loopback server. The Visa device-binding iframe
-     * requires an HTTPS parent page, so real callers must pass this; `null`
-     * serves plain HTTP and exists ONLY so tests can exercise the server
-     * without certificates.
-     */
-    tls: {
-        key: string | Buffer;
-        cert: string | Buffer;
-    } | null;
-    /** Default 4400 — the origin the operator's browser already trusts. */
-    port?: number;
-    /** Overall wait for the human to complete the ceremony. Default 4 minutes. */
-    timeoutMs?: number;
-    /** Open the approval page in the operator's browser. Default: macOS `open`. */
-    openUrl?: (url: string) => void;
-    /** Status output. Default: stderr. */
-    log?: (line: string) => void;
-};
-export declare const CEREMONY_DEFAULT_PORT = 4400;
-export declare const CEREMONY_DEFAULT_TIMEOUT_MS: number;
-/**
- * Serve the approval page on loopback, open it in the operator's browser, and
- * resolve with the fresh PurchaseAssurance once the passkey completes. Rejects
- * on timeout, port conflict, or server failure; the server is always closed.
- */
-export declare function runInteractiveCeremony(opts: RunCeremonyOptions): Promise<PurchaseAssurance>;