@visa/cli 4.1.0-rc.285 → 4.1.0-rc.287
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -0
- package/dist/cli.js +472 -462
- package/dist/mcp-server/index.js +394 -384
- package/dist/merchant-ucp-mcp/index.js +3 -3
- package/native/bin/win32-arm64/visa-runtime-signer.exe +0 -0
- package/native/bin/win32-x64/visa-keychain-win.exe +0 -0
- package/native/bin/win32-x64/visa-runtime-signer.exe +0 -0
- package/package.json +1 -1
- package/server.json +2 -2
package/README.md
CHANGED
|
@@ -436,3 +436,13 @@ Wallet and card custody are separate.
|
|
|
436
436
|
Protected authority onboarding is opt-in with `visa config set wallet.protectedAuthority true` until its deployment is ready. The default retains the existing fresh-enrollment and locally verified legacy managed-wallet path. This setting never downgrades saved protected devices: native pending/active/history records and protected wallet bindings always require protected recovery, including when the authority is unavailable. Existing direct configurations retain their scoped local-credential checks.
|
|
437
437
|
|
|
438
438
|
A managed reconnect without verifiable local enrollment history requires recovery; restore the saved device records or complete independent owner classification through the protected authority deployment. Auth's execution-mode response alone cannot classify that missing history. No automatic retry through legacy setup occurs after an authority error.
|
|
439
|
+
|
|
440
|
+
### Fresh protected native agent
|
|
441
|
+
|
|
442
|
+
An operator must supply the independently trusted HTTPS authority origin. Start from an empty CLI home with:
|
|
443
|
+
|
|
444
|
+
```sh
|
|
445
|
+
visa agent enroll-protected --authority-url https://YOUR-TRUSTED-AUTHORITY --wait
|
|
446
|
+
```
|
|
447
|
+
|
|
448
|
+
Enter the terminal code in the existing browser owner ceremony, then approve the native device and its spending limits. Repeat the same command to resume after interruption; use `--no-open` to print links. `--url` selects the browser origin independently. `--auth-url` selects the HTTPS policy transport (default: local Auth configuration); its exact origin is saved with enrollment and cannot change on resume. Signing uses the existing bearer-free policy/slip adapter at that origin, while identity pickup and protected wallet recovery use the independently trusted authority. No Auth login is needed, but the policy transport must be reachable to authorize a new purchase. An unclaimed expired request can be replaced with `--restart`. This path creates a new authority-owned namespace and preserves any existing Auth login profile. It requires the protected authority's CLI-claim migration and direct HTTPS routes to be deployed; an Auth-supplied origin is not a trusted substitute.
|