@visa/cli 5.0.0-rc.414 → 5.0.0-rc.415

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +8 -5
  2. package/dist/cli.js +86 -107
  3. package/dist/enrollment-finisher.js +34 -55
  4. package/dist/mcp-server/index.js +231 -252
  5. package/dist/tool-call.js +36 -36
  6. package/install.ps1 +1 -1
  7. package/install.sh +1 -1
  8. package/package.json +1 -1
  9. package/server.json +2 -2
package/README.md CHANGED
@@ -38,8 +38,9 @@ up as an agent:
38
38
  Keychain, Windows DPAPI, Linux Secret Service, or a 0600 file on a headless
39
39
  host with `VISA_RUNTIME_CUSTODY_PROFILE=headless`).
40
40
  2. It starts a setup and opens the owner's approval page. The owner signs in
41
- to the Visa Console, sets the agent's limits and approves. The CLI never
42
- sees an owner key.
41
+ to the Visa Console and approves. The agent connects with no spending limit:
42
+ its wallet key can sign for the owner and can never spend until the owner
43
+ sets a limit in the Console. The CLI never sees an owner key.
43
44
  3. It claims the approved setup with the installation key. A finite background
44
45
  pickup continues after the terminal or MCP host exits, so approval does not
45
46
  need a second `connect` call. `status` reports pickup progress and fresh
@@ -96,7 +97,8 @@ VISA_CLI_RUNTIME=muse VISA_RUNTIME_CUSTODY_PROFILE=headless visa connect --no-op
96
97
  visa-tool --skill # the Visa skill: recovery after a rebuilt VM, and the rules below
97
98
  visa-tool --list # the server's rules and the tools with their inputs (JSON)
98
99
  visa-tool status # one call: the tool's answer as JSON, exit 1 on a refusal
99
- visa-tool pay '{"target":"https://…","request_id":"order-1"}' # no max: a price preview, nothing is paid
100
+ visa-tool discover '{"target":"https://…"}' # the live price, read only: nothing is paid
101
+ visa-tool pay '{"target":"https://…","max":"0.05","request_id":"<new UUID>"}' # pays at most max
100
102
  ```
101
103
 
102
104
  On a computer with no keyring, every command needs
@@ -220,5 +222,6 @@ means no available retained context. The private approval-page purpose may retai
220
222
  original signing intent under its configurable, initially enabled product policy;
221
223
  HTTP replay bodies and headers remain transient and context never goes to logs
222
224
  or telemetry. The owner and original payment/approval/deadline bindings remain
223
- required. This contract does not enable public owner-approved paying; that pause
224
- and internal admission remain in force.
225
+ required. Hosted Tempo payments ask the owner each time and resume the same
226
+ approved purchase. Internal admission and current spending checks still apply.
227
+ This source contract does not establish deployed availability.