@visa/cli 5.0.0-rc.372 → 5.0.0-rc.373

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +10 -6
  2. package/dist/cli.js +6 -6
  3. package/dist/mcp-server/index.js +9 -9
  4. package/dist/merchant-ucp-mcp/index.js +3 -3
  5. package/package.json +1 -1
  6. package/server.json +2 -2
package/README.md CHANGED
@@ -211,12 +211,16 @@ are kept as `*.replaced-<time>` backups). `--restart` never touches the
211
211
  installed `pair-visa-agent` skill; `--force-skill` replaces it, moving a locally
212
212
  edited copy to `.visa-cli-managed/backups/` first.
213
213
 
214
- On macOS and Linux the private identity key lives under `~/.visa-cli/` in an
215
- owner-only directory with file mode `0600`. It is an exportable local file:
216
- copying it transfers identity proof, and losing it blocks new proofs, because
217
- same-agent key recovery does not exist yet. Protocol-v2 identity pairing fails
218
- closed on Windows until the CLI can apply and verify an owner-only Windows ACL.
219
- The approval link carries no credential and no private key.
214
+ The agent's keys (wallet, card and TAP) live in the operating system's
215
+ store: the macOS Keychain, Windows data protection (DPAPI), or the Linux Secret
216
+ Service; a server without one uses an owner-only `0600` file only when
217
+ `VISA_RUNTIME_CUSTODY_PROFILE=headless` is set. There are no password prompts,
218
+ and software running as you on this machine can use the keys, so treat the
219
+ machine as the key: pause or revoke the agent in the Console if it is lost. To
220
+ move an agent to another computer, run `visa connect` there and choose
221
+ **Replacing** on the approval page: the same agent gets new keys, keeps its
222
+ budget and history, and the old keys are retired. The approval link carries no
223
+ credential and no private key.
220
224
 
221
225
  ## Limits: what may be spent
222
226