@visa/cli 5.0.0-rc.337 → 5.0.0-rc.339

package/dist/skills/pair-visa-agent/SKILL.md

@@ -370,16 +370,18 @@ BEFORE it is signed), then `wallet_pay`. The served wallet tools are `wallet_dis
 address + faucet), and `wallet_export` (export key material — dangerous). All spending is
 gated by the owner-approved local policy caps.
 
-Card: not available in this build. Visa CLI ships no browser checkout (#8940), so
-`start_card_mandate` returns `card_browser_checkout_removed` and creates no mandate, and
-every `pay_merchant` action refuses with the same code. Nothing is charged. Do not offer
-card checkout to the user, and do not relay a card approval URL; the wallet rail above is
-the payment path where the merchant supports it. A saved card, grant or tester flag does
-not enable card payment, and another enrollment will not repair it. UCP discovery and
-checkout preparation are not payment execution. A continuable `ucp_checkout_handoff`
-returns safe facts and `not_ready` / `card_browser_checkout_removed`, without a payment
-request or continuation capability URL. Preserve the existing checkout for the owner
-to continue with the merchant; use `ucp_checkout_reconcile` afterward to check completion.
+Card: Visa-operated browser checkout is retired; another enrollment will not repair it.
+`start_card_mandate` and `pay_merchant` refuse with `card_browser_checkout_removed`.
+On local builds that list `purchase_create`,
+`purchase_retrieve` and `purchase_cancel`, the protected card preview uses the
+host's checkout tools and the existing eligible card and agent identity. Follow
+`next`: relay the single owner setup or limits URL, let the owner act, then repeat
+the same purchase call. Never ask for funding-card secrets in chat. Explicit
+`include:"card"` may put the issued purchase credential in model/chat history,
+under the owner's disclosure consent. A saved card or tester flag alone does
+not establish eligibility or merchant credential compatibility. UCP discovery
+and preparation remain separate from payment execution; a `not_ready` handoff
+is not permission to pay or to revive the retired browser flow.
 
 On a hosted runtime, **every payment requires the owner's browser
 approval** until the protected no-tap executor lands. Enrollment, a session, or a spending
@@ -418,8 +420,15 @@ org-wide AgentMail key off the runtime — provisioning happens only through
 
 ## Optional checkout profile (separate from setup)
 
-Do not collect a checkout profile to repair `pay_merchant`: card payment is unavailable
-even with a profile, card authority and `checkout_agent_access`. Existing
+Do not collect a checkout profile to repair `pay_merchant`: Visa browser checkout
+is retired. On local builds that list `purchase_create`, `purchase_retrieve` and
+`purchase_cancel`, the protected card preview reuses this identity and verified
+card. The host supplies checkout and billing details, owns browser submission,
+and follows the returned `next` action. Fixed protocol fields and `requestKey`
+may be omitted; retain the same checkout reference and terms on retry. Explicit
+`include:"card"` returns issued purchase credentials under owner consent and may
+put them in model/chat history. Never request original funding-card details in
+chat, bypass eligibility, or retry an uncertain merchant submission. Existing
 `~/.visa-mcp/contact.json` files use the format below; preserve them with mode `0600`.
 Never infer or invent identity or address data.
 

package/dist/skills/visa-shopify-checkout/SKILL.md

@@ -1,18 +1,26 @@
 ---
 name: visa-shopify-checkout
-description: Prepare an exact Shopify checkout with UCP and reconcile a merchant order. Visa card payment is unavailable in this build; preserve the checkout for the owner to continue with the merchant. Use for authorized checkout preparation or reconciliation, without claiming payment support.
+description: Prepare an exact Shopify checkout with UCP and reconcile a merchant order. Payment through the retired Visa browser tools is unavailable; preserve the checkout for the owner to continue with the merchant. Use for authorized checkout preparation or reconciliation, without claiming payment support from those tools.
 allowed-tools: Bash(visa:*) Bash(visa-cli:*)
 metadata:
   author: visa
   version: '0.1.0'
 ---
 
+**Protected card preview:** this skill describes the retired Shopify execution lane.
+Its unavailability does not describe protected device `purchase_create`,
+`purchase_retrieve`, and `purchase_cancel`. For that preview, follow
+`pair-visa-agent`: the host owns browsing and checkout, and must relay the one
+owner setup/limits URL the tool returns. Credentials require explicit retrieval
+and owner disclosure consent. A checkout confirmation is host observation, not
+verified settlement. Never restart a payment to recover an uncertain result.
+
 # Visa Shopify checkout
 
 This skill supports the preview/RC checkout surface only. It prepares and inspects
-merchant checkouts and reconciles their outcomes. Visa card payment is unavailable:
+merchant checkouts and reconciles their outcomes. The retired Visa browser-payment tools are unavailable:
 `pay_merchant` and `start_card_mandate` refuse with `card_browser_checkout_removed`.
-A saved card, grant, tester flag or another enrollment will not enable payment.
+For those retired tools, a saved card, grant, tester flag or another enrollment will not enable payment.
 Do not offer the removed `visa checkout` command or a Visa browser fallback.
 
 The host agent owns shopping and browser interaction. Discovery is optional:
@@ -23,7 +31,7 @@ accept an exact merchant/product supplied by the host or selected through
 
 Before creating a checkout, pin the exact merchant, product, variant, quantity,
 currency, maximum all-in amount including tax and shipping, and authorized
-fulfillment details. Explain that this build cannot pay with a Visa card before
+fulfillment details. Establish whether the host supports the protected device preview described above before
 asking the user to invest in checkout setup. Do not collect a card, grant, mandate
 or contact profile to repair unavailable payment. Inspect unresolved activity
 before starting another checkout for the same purchase.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "5.0.0-rc.337",
+  "version": "5.0.0-rc.339",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "5.0.0-rc.337",
+  "version": "5.0.0-rc.339",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "5.0.0-rc.337",
+      "version": "5.0.0-rc.339",
       "transport": {
         "type": "stdio"
       },