@visa/cli 4.1.0-rc.277 → 4.1.0-rc.279

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -430,3 +430,9 @@ confirms revocation of the exact previous child. Only then does cleanup remove i
430
430
  native handle or isolated legacy Subway key file. `keychain revoke --purpose subway`
431
431
  revokes the selected child before deleting its key; repeat it to retry locked cleanup.
432
432
  Wallet and card custody are separate.
433
+
434
+ ### Protected managed-wallet rollout
435
+
436
+ Protected authority onboarding is opt-in with `visa config set wallet.protectedAuthority true` until its deployment is ready. The default retains the existing fresh-enrollment and locally verified legacy managed-wallet path. This setting never downgrades saved protected devices: native pending/active/history records and protected wallet bindings always require protected recovery, including when the authority is unavailable. Existing direct configurations retain their scoped local-credential checks.
437
+
438
+ A managed reconnect without verifiable local enrollment history requires recovery; restore the saved device records or complete independent owner classification through the protected authority deployment. Auth's execution-mode response alone cannot classify that missing history. No automatic retry through legacy setup occurs after an authority error.