@stripe/link-cli 0.10.0 → 0.11.0

package/README.md

@@ -154,6 +154,18 @@ link-cli spend-request create ... \
 
 In MCP/agent mode, pass as a structured object.
 
+#### Metadata
+
+Attach arbitrary string data to a spend request with the repeatable `--metadata` flag (`key:value` format). Max 50 keys, key ≤ 40 chars, value ≤ 500 chars.
+
+```bash
+link-cli spend-request create ... \
+  --metadata "order_id:ord_123" \
+  --metadata "team:growth"
+```
+
+In MCP/agent mode, pass `metadata` as a structured `{ key: value }` object.
+
 #### Credential types
 
 By default, a spend request provisions a virtual card. For merchants that support the [Machine Payments Protocol](https://mpp.dev) (HTTP 402) and the Stripe payment method, instead pass `--credential-type "shared_payment_token"`. 
@@ -207,11 +219,13 @@ When you provide `--client-name`, the Link app displays it when you approve the
 
 With `--interval`, the login command yields the verification code immediately and then polls inline until authenticated or timed out — no separate `auth status` call needed. This is recommended for agents that cannot relay the code while a separate polling command blocks their I/O channel.
 
-`auth status` includes an `update` field when a newer version is available:
+`auth status` reports the `scope` and `authorization_details` the current session was granted (echoed by the token endpoint at login/refresh and stored in the credential file), and includes an `update` field when a newer version is available:
 
 ```json
 {
   "authenticated": true,
+  "scope": "userinfo:read payment_methods.agentic",
+  "authorization_details": [{ "type": "source", "actions": ["read"] }],
   "update": {
     "current_version": "0.1.2",
     "latest_version": "0.2.0",
@@ -220,6 +234,8 @@ With `--interval`, the login command yields the verification code immediately an
 }
 ```
 
+`scope` and `authorization_details` are only present when the token endpoint returned them.
+
 Set `NO_UPDATE_NOTIFIER=1` to suppress update checks (for example, in CI).
 
 All commands accept `--auth <path>` to store auth credentials in a specific file instead of the default location. `auth login` writes to this file; all other commands read from it. Useful for running multiple sessions with separate identities.
@@ -231,7 +247,7 @@ A spend request moves through: **create** → **request approval** → **approve
 **Required fields for create:** `merchant_name`, `merchant_url`, `context`, `amount`. `payment_method_id` is optional — if omitted, your default payment method will be used, or the first eligible one if no default is set.
 
 **Constraints:** `context` must be at least 100 characters; `amount` must not exceed 500000 (cents); `currency` must be a 3-letter ISO code. The user has 10 minutes from when approval is requested to approve. Approved credentials (card or SPT) are valid for 12 hours from spend request creation.
-**Test mode:** Pass `--test` to create testmode credentials (uses test card `4242424242424242`), useful for development and integration testing without real payment methods.
+**Test mode:** Pass `--test` to create a testmode SpendRequest. A testmode SpendRequest will return test payment credentials (e.g test card `4000009990001984`) rather than a real payment credential. Testmode SpendRequests will not charge the underlying payment method of the SpendRequest. This is useful for development and integration testing without real payment methods.
 
 ```bash
 # Update before approval

package/dist/cli.js

@@ -12656,7 +12656,11 @@ function resolveAuthInfo(envAccessToken2, authStorage2) {
       source: "storage",
       tokenPreview: `${auth.access_token.substring(0, 20)}...`,
       tokenType: auth.token_type,
-      credentialsPath
+      credentialsPath,
+      ...auth.scope && { scope: auth.scope },
+      ...auth.authorization_details && {
+        authorizationDetails: auth.authorization_details
+      }
     };
   }
   return { authenticated: false, source: "storage", credentialsPath };
@@ -12690,6 +12694,15 @@ var AuthStatus = ({
           "Token type: ",
           /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.tokenType })
         ] }),
+        info.source === "storage" && info.scope && /* @__PURE__ */ jsxs3(Text3, { children: [
+          "Scope: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.scope })
+        ] }),
+        info.source === "storage" && info.authorizationDetails && /* @__PURE__ */ jsxs3(Text3, { children: [
+          "Authorization details:",
+          " ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: JSON.stringify(info.authorizationDetails) })
+        ] }),
         info.source === "env" ? /* @__PURE__ */ jsxs3(Text3, { children: [
           "Source: ",
           /* @__PURE__ */ jsx3(Text3, { bold: true, children: "LINK_ACCESS_TOKEN" })
@@ -12730,6 +12743,10 @@ async function* pollAuthStatus(authResource, storage2, opts, update) {
           access_token: `${auth.access_token.substring(0, 20)}...`,
           token_type: auth.token_type,
           credentials_path: storage2.getPath(),
+          ...auth.scope && { scope: auth.scope },
+          ...auth.authorization_details && {
+            authorization_details: auth.authorization_details
+          },
           ...update && { update }
         };
       }
@@ -12939,7 +12956,11 @@ function createAuthCli(authResource, getUpdateInfo2, authStorage2, envAccessToke
                 access_token: info.tokenPreview,
                 token_type: info.tokenType,
                 ...info.source === "storage" && {
-                  credentials_path: info.credentialsPath
+                  credentials_path: info.credentialsPath,
+                  ...info.scope && { scope: info.scope },
+                  ...info.authorizationDetails && {
+                    authorization_details: info.authorizationDetails
+                  }
                 },
                 ...update && { update }
               };
@@ -13894,7 +13915,11 @@ function buildHeaders(data, headers) {
 async function readPayResult(response) {
   const responseHeaders = Object.fromEntries(response.headers.entries());
   const body = await response.text();
-  return { status: response.status, headers: responseHeaders, body };
+  return sanitizeDeep({
+    status: response.status,
+    headers: responseHeaders,
+    body
+  });
 }
 function createStripePaymentClient(spt) {
   const stripeCharge = Method.toClient(StripeMethods.charge, {
@@ -15998,6 +16023,7 @@ var CreateSpendRequest = ({
   const [request, setRequest] = useState9(null);
   const [error, setError] = useState9("");
   const [verificationUrl, setVerificationUrl] = useState9("");
+  const [supportUrl, setSupportUrl] = useState9("");
   const [outputFilePath, setOutputFilePath] = useState9(null);
   const [fileError, setFileError] = useState9("");
   const approvalUrl = request?.approval_url ?? "";
@@ -16038,8 +16064,11 @@ var CreateSpendRequest = ({
       } catch (err) {
         setError(err.message);
         if (err instanceof LinkApiError) {
-          const url = err.details?.error?.verification_url;
-          if (url) setVerificationUrl(url);
+          const errDetail = err.details;
+          if (errDetail?.error?.verification_url)
+            setVerificationUrl(errDetail.error.verification_url);
+          if (errDetail?.error?.support_url)
+            setSupportUrl(errDetail.error.support_url);
         }
         setStatus("error");
         setTimeout(() => completeAndExit(null), DISPLAY_DELAY_MS);
@@ -16072,6 +16101,10 @@ var CreateSpendRequest = ({
       verificationUrl && /* @__PURE__ */ jsxs18(Text20, { color: "red", children: [
         "Complete additional verification at: ",
         verificationUrl
+      ] }),
+      supportUrl && /* @__PURE__ */ jsxs18(Text20, { color: "red", children: [
+        "Identity verification failed. Contact support at: ",
+        supportUrl
       ] })
     ] });
   }
@@ -16241,6 +16274,7 @@ var RequestApproval = ({
   const [result, setResult] = useState10(null);
   const [error, setError] = useState10("");
   const [verificationUrl, setVerificationUrl] = useState10("");
+  const [supportUrl, setSupportUrl] = useState10("");
   const { exit } = useApp6();
   const completeAndExit = useCallback10(
     (result2) => {
@@ -16270,8 +16304,11 @@ var RequestApproval = ({
       } catch (err) {
         setError(err.message);
         if (err instanceof LinkApiError) {
-          const url = err.details?.error?.verification_url;
-          if (url) setVerificationUrl(url);
+          const errDetail = err.details;
+          if (errDetail?.error?.verification_url)
+            setVerificationUrl(errDetail.error.verification_url);
+          if (errDetail?.error?.support_url)
+            setSupportUrl(errDetail.error.support_url);
         }
         setStatus("error");
         setTimeout(() => {
@@ -16295,6 +16332,10 @@ var RequestApproval = ({
       verificationUrl && /* @__PURE__ */ jsxs20(Text22, { color: "red", children: [
         "Complete additional verification at: ",
         verificationUrl
+      ] }),
+      supportUrl && /* @__PURE__ */ jsxs20(Text22, { color: "red", children: [
+        "Identity verification failed. Contact support at: ",
+        supportUrl
       ] })
     ] });
   }
@@ -16580,7 +16621,16 @@ var RetrieveSpendRequest = ({
               /* @__PURE__ */ jsx30(Text23, { bold: true, children: psd.refund_details.state })
             ] })
           ] })
-        ] })
+        ] }),
+        request?.link_transaction_id && /* @__PURE__ */ jsx30(Box21, { marginTop: 1, children: /* @__PURE__ */ jsxs21(Text23, { children: [
+          "Transaction ID: ",
+          /* @__PURE__ */ jsx30(Text23, { bold: true, children: request.link_transaction_id })
+        ] }) }),
+        request?.status === "succeeded" && request?.activity_url && /* @__PURE__ */ jsx30(Box21, { marginTop: 1, children: /* @__PURE__ */ jsxs21(Text23, { children: [
+          "Activity URL:",
+          " ",
+          /* @__PURE__ */ jsx30(Text23, { bold: true, color: "cyan", children: request.activity_url })
+        ] }) })
       ] })
     ] });
   }
@@ -16795,6 +16845,9 @@ var createOptions = z10.object({
   force: z10.boolean().default(false).describe("Overwrite output file if it already exists"),
   approvalDetail: z10.union([z10.string(), z10.record(z10.string(), z10.unknown())]).optional().describe(
     "Approval details object (MCP/agent: pass as object; CLI: pass as JSON string). Required fields: approved_at (unix timestamp), approval_method (click|programmatic|voice), app_name, external_user_id. Optional: ip_address, user_agent, device_type (mobile|web), agent_log_id, external_user_name, external_session_id, authentication_method (biometric_face|biometric_fingerprint|passkey)."
+  ),
+  metadata: z10.array(z10.union([z10.string(), z10.record(z10.string(), z10.string())])).default([]).describe(
+    'Metadata key:value pair (repeatable). Attaches arbitrary string data to the spend request. Max 50 keys, key <= 40 chars, value <= 500 chars. Example: "order_id:ord_123"'
   )
 });
 var listOptions3 = z10.object({
@@ -16990,6 +17043,16 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
         (item) => typeof item === "string" ? parseTotalFlag(item) : item
       ) : void 0;
       const approvalDetails = opts.approvalDetail !== void 0 ? typeof opts.approvalDetail === "string" ? JSON.parse(opts.approvalDetail) : opts.approvalDetail : void 0;
+      let metadata;
+      if (opts.metadata?.length) {
+        metadata = {};
+        for (const item of opts.metadata) {
+          Object.assign(
+            metadata,
+            typeof item === "string" ? parseKvString(item) : item
+          );
+        }
+      }
       const createParams = {
         payment_details: opts.paymentMethodId,
         credential_type: credentialType,
@@ -17004,7 +17067,8 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
         request_approval: requestApproval || void 0,
         test: opts.test ? true : void 0,
         approve: opts.approve ? true : void 0,
-        approval_details: approvalDetails
+        approval_details: approvalDetails,
+        metadata
       };
       const outputFile = opts.outputFile;
       const forceOverwrite = opts.force;
@@ -17044,6 +17108,12 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
               message: `${err.message} Verification URL: ${apiErr.error.verification_url}`
             });
           }
+          if (apiErr?.error?.support_url) {
+            return c.error({
+              code: err.code,
+              message: `${err.message} Support URL: ${apiErr.error.support_url}`
+            });
+          }
         }
         throw err;
       }
@@ -17163,6 +17233,12 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
               message: `${err.message} Verification URL: ${apiErr.error.verification_url}`
             });
           }
+          if (apiErr?.error?.support_url) {
+            return c.error({
+              code: err.code,
+              message: `${err.message} Support URL: ${apiErr.error.support_url}`
+            });
+          }
         }
         throw err;
       }
@@ -17714,7 +17790,11 @@ ${serializeRedactedFormBody(params)}`
         access_token: resp.access_token,
         refresh_token: resp.refresh_token,
         expires_in: resp.expires_in,
-        token_type: resp.token_type
+        token_type: resp.token_type,
+        ...resp.scope && { scope: resp.scope },
+        ...resp.authorization_details && {
+          authorization_details: resp.authorization_details
+        }
       };
     }
     if (status === 400) {
@@ -17794,7 +17874,11 @@ ${serializeRedactedFormBody(params)}`
       access_token: resp.access_token,
       refresh_token: resp.refresh_token,
       expires_in: resp.expires_in,
-      token_type: resp.token_type
+      token_type: resp.token_type,
+      ...resp.scope && { scope: resp.scope },
+      ...resp.authorization_details && {
+        authorization_details: resp.authorization_details
+      }
     };
   }
 };
@@ -18115,7 +18199,7 @@ function cacheUpdateInfo(value, ttlMs = UPDATE_CACHE_TTL_MS) {
 }
 
 // src/cli.tsx
-var cliVersion = "0.10.0";
+var cliVersion = "0.11.0";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
   "User-Agent": `link-cli/${cliVersion}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stripe/link-cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "type": "module",
   "bin": {
     "link-cli": "./dist/cli.js"
@@ -8,6 +8,7 @@
   "files": [
     "dist",
     "!dist/sea",
+    "postinstall.mjs",
     "README.md",
     "LICENSE"
   ],
@@ -49,6 +50,7 @@
   "scripts": {
     "build": "tsup",
     "build:sea": "tsup --config tsup.sea.config.ts",
+    "postinstall": "node postinstall.mjs",
     "typecheck": "tsc",
     "test": "vitest run",
     "dev": "tsx src/cli.tsx"

package/postinstall.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// Refresh the create-payment-credential skill whenever the CLI is (re)installed
+// or upgraded via npm. Delegates to the openclaw `skills` CLI so the skill file
+// stays in sync with the installed CLI version. Must never fail the install.
+
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const REPO = 'stripe/link-cli';
+
+function run() {
+  // Skip when running from the source monorepo (dev `pnpm install`). Installed
+  // copies live under node_modules; the dev tree does not.
+  if (!fileURLToPath(import.meta.url).includes('node_modules')) {
+    return;
+  }
+
+  if (process.env.CI || process.env.LINK_CLI_SKIP_SKILL_INSTALL) {
+    return;
+  }
+
+  process.stdout.write(
+    'link-cli: refreshing the create-payment-credential skill…\n',
+  );
+
+  const result = spawnSync(
+    'npx',
+    ['--yes', 'skills', 'add', REPO, '-g', '-y'],
+    {
+      stdio: 'inherit',
+      timeout: 60_000,
+    },
+  );
+
+  if (result.error || result.status !== 0) {
+    process.stdout.write(
+      `link-cli: skipped skill refresh; run 'npx skills add ${REPO}' manually.\n`,
+    );
+  }
+}
+
+try {
+  run();
+} catch {
+  // Never fail the install.
+}
+
+process.exit(0);