@visa/cli 5.0.0-rc.406 → 5.0.0-rc.407

package/dist/skills/visa-shopify-checkout/SKILL.md

@@ -18,8 +18,9 @@ verified settlement. Never restart a payment to recover an uncertain result.
 # Visa Shopify checkout
 
 This skill supports the preview/RC checkout surface only. It prepares and inspects
-merchant checkouts and reconciles their outcomes. The retired Visa browser-payment tools are unavailable:
-`pay_merchant` and `start_card_mandate` refuse with `card_browser_checkout_removed`.
+merchant checkouts and reconciles their outcomes. The retired Visa browser-payment tools
+(`pay_merchant`, `start_card_mandate`) are not served, and `pay` refuses a checkout URL with
+`card_browser_checkout_removed`.
 For those retired tools, a saved card, grant, tester flag or another enrollment will not enable payment.
 Do not offer the removed `visa checkout` command or a Visa browser fallback.
 
@@ -55,13 +56,10 @@ advertised but unproven; even response-confirmed support does not grant completi
 permission. The current adapter has no production completion allowlist, so
 `native_complete` is unreachable.
 
-For a continuable checkout, `ucp_checkout_handoff` reads the same `business` and
-`checkoutId` and validates the merchant-authoritative USD total. It returns
-`success: false`, `status: not_ready`, `reason: card_browser_checkout_removed`,
-safe checkout facts and owner-continuation guidance. It returns no
-`payMerchantRequest`, handoff capability or continuation URL. Do not call
-`pay_merchant` or repeat enrollment in response. Preserve the existing merchant
-checkout for the owner to continue with the merchant.
+For a continuable checkout, read it with `checkout_get` using the same `business`
+and `checkoutId`, and confirm the merchant-authoritative total. Visa cannot pay it:
+do not repeat enrollment or look for a Visa payment tool in response. Preserve the
+existing merchant checkout for the owner to continue with the merchant.
 
 Keep the final all-in amount at or below the user's approved ceiling. Report
 item, fulfillment, currency or total changes before the owner continues; do not
@@ -79,8 +77,9 @@ refusal. Keep `route.resumePoint` transient; it is not a payment capability.
 - `completed` / `reconcile_checkout`: reconcile the same checkout;
 - `canceled`, an unknown state, or `blocked`: stop fail-closed.
 
-After owner completion, call `ucp_checkout_reconcile` with the same checkout id,
-expected minor-unit amount and currency. Inspect existing Visa activity/receipts
+After owner completion, read the same checkout with `checkout_get` (and the order
+with `order_get` when one is returned) and compare the expected minor-unit amount
+and currency. Inspect existing Visa activity/receipts
 when relevant, merchant order history and the authorized receipt mailbox. A valid
 merchant order with matching money proves merchant confirmation, not final issuer
 settlement or successful fulfillment; report those separately.

package/dist/skills/visa-ucp-shopping/SKILL.md

@@ -22,7 +22,7 @@ payment compatibility or authority.
 
 For a named merchant, use the mounted `shopify-ucp` compatibility server's Visa-owned `catalog_search`, `catalog_lookup`, and `catalog_get_product` tools. The adapter maps those stable public names to the merchant-native `search_catalog`, `lookup_catalog`, and `get_product` operations. Pass the exact bare HTTPS merchant origin as `business`; the adapter negotiates the merchant's live UCP root and matching versioned profile on every call. Runtime prefixes vary, so still select tools from the live tool list rather than inventing a prefix.
 
-For a broad request, first use the separately served `ucp_discover` surface when available to obtain candidate merchant origins, then query promising origins through the native merchant adapter. Discovery is not catalog authority: verify every option with `catalog_search` or `catalog_get_product` against that merchant before presenting it. Native merchant catalog calls require neither an API key nor a UCP Playground key; never ask the buyer to paste either into chat.
+For a broad request, first obtain candidate merchant origins from the host's own search or the buyer, then query promising origins through the native merchant adapter. Discovery is not catalog authority: verify every option with `catalog_search` or `catalog_get_product` against that merchant before presenting it. Native merchant catalog calls require neither an API key nor a UCP Playground key; never ask the buyer to paste either into chat.
 
 Do not call any cart creation, checkout build/edit, `complete_checkout`, Visa review, credential, or submission tool from this skill. Only checkout preparation and reconciliation belong to `visa-shopify-checkout` after handoff; Visa card review, credentials and submission are unavailable in this build.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visa/cli",
-  "version": "5.0.0-rc.406",
+  "version": "5.0.0-rc.407",
   "description": "Visa CLI runtime for stable agent identity and separately authorized payment capabilities",
   "bin": {
     "visa-cli": "./bin/visa-cli.js",
@@ -88,7 +88,6 @@
     "install.ps1",
     "install.sh",
     "server.json",
-    "README.md",
-    "native/bin/*/visa-runtime-signer*"
+    "README.md"
   ]
 }

package/server.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.visa-crypto-labs/visa-cli",
-  "version": "5.0.0-rc.406",
+  "version": "5.0.0-rc.407",
   "title": "Visa CLI",
   "description": "Pair a human-approved agent identity, configure payment capabilities separately, and discover and pay x402 services from your AI coding assistant.",
   "websiteUrl": "https://github.com/Visa-Crypto-Labs/Visa-mono/tree/main/packages/cli#readme",
@@ -9,7 +9,7 @@
     {
       "registryType": "npm",
       "identifier": "@visa/cli",
-      "version": "5.0.0-rc.406",
+      "version": "5.0.0-rc.407",
       "transport": {
         "type": "stdio"
       },