@stripe/link-cli 0.10.1 → 0.11.0

package/README.md

@@ -154,6 +154,18 @@ link-cli spend-request create ... \
 
 In MCP/agent mode, pass as a structured object.
 
+#### Metadata
+
+Attach arbitrary string data to a spend request with the repeatable `--metadata` flag (`key:value` format). Max 50 keys, key ≤ 40 chars, value ≤ 500 chars.
+
+```bash
+link-cli spend-request create ... \
+  --metadata "order_id:ord_123" \
+  --metadata "team:growth"
+```
+
+In MCP/agent mode, pass `metadata` as a structured `{ key: value }` object.
+
 #### Credential types
 
 By default, a spend request provisions a virtual card. For merchants that support the [Machine Payments Protocol](https://mpp.dev) (HTTP 402) and the Stripe payment method, instead pass `--credential-type "shared_payment_token"`. 
@@ -207,11 +219,13 @@ When you provide `--client-name`, the Link app displays it when you approve the
 
 With `--interval`, the login command yields the verification code immediately and then polls inline until authenticated or timed out — no separate `auth status` call needed. This is recommended for agents that cannot relay the code while a separate polling command blocks their I/O channel.
 
-`auth status` includes an `update` field when a newer version is available:
+`auth status` reports the `scope` and `authorization_details` the current session was granted (echoed by the token endpoint at login/refresh and stored in the credential file), and includes an `update` field when a newer version is available:
 
 ```json
 {
   "authenticated": true,
+  "scope": "userinfo:read payment_methods.agentic",
+  "authorization_details": [{ "type": "source", "actions": ["read"] }],
   "update": {
     "current_version": "0.1.2",
     "latest_version": "0.2.0",
@@ -220,6 +234,8 @@ With `--interval`, the login command yields the verification code immediately an
 }
 ```
 
+`scope` and `authorization_details` are only present when the token endpoint returned them.
+
 Set `NO_UPDATE_NOTIFIER=1` to suppress update checks (for example, in CI).
 
 All commands accept `--auth <path>` to store auth credentials in a specific file instead of the default location. `auth login` writes to this file; all other commands read from it. Useful for running multiple sessions with separate identities.

package/dist/cli.js

@@ -12656,7 +12656,11 @@ function resolveAuthInfo(envAccessToken2, authStorage2) {
       source: "storage",
       tokenPreview: `${auth.access_token.substring(0, 20)}...`,
       tokenType: auth.token_type,
-      credentialsPath
+      credentialsPath,
+      ...auth.scope && { scope: auth.scope },
+      ...auth.authorization_details && {
+        authorizationDetails: auth.authorization_details
+      }
     };
   }
   return { authenticated: false, source: "storage", credentialsPath };
@@ -12690,6 +12694,15 @@ var AuthStatus = ({
           "Token type: ",
           /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.tokenType })
         ] }),
+        info.source === "storage" && info.scope && /* @__PURE__ */ jsxs3(Text3, { children: [
+          "Scope: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.scope })
+        ] }),
+        info.source === "storage" && info.authorizationDetails && /* @__PURE__ */ jsxs3(Text3, { children: [
+          "Authorization details:",
+          " ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: JSON.stringify(info.authorizationDetails) })
+        ] }),
         info.source === "env" ? /* @__PURE__ */ jsxs3(Text3, { children: [
           "Source: ",
           /* @__PURE__ */ jsx3(Text3, { bold: true, children: "LINK_ACCESS_TOKEN" })
@@ -12730,6 +12743,10 @@ async function* pollAuthStatus(authResource, storage2, opts, update) {
           access_token: `${auth.access_token.substring(0, 20)}...`,
           token_type: auth.token_type,
           credentials_path: storage2.getPath(),
+          ...auth.scope && { scope: auth.scope },
+          ...auth.authorization_details && {
+            authorization_details: auth.authorization_details
+          },
           ...update && { update }
         };
       }
@@ -12939,7 +12956,11 @@ function createAuthCli(authResource, getUpdateInfo2, authStorage2, envAccessToke
                 access_token: info.tokenPreview,
                 token_type: info.tokenType,
                 ...info.source === "storage" && {
-                  credentials_path: info.credentialsPath
+                  credentials_path: info.credentialsPath,
+                  ...info.scope && { scope: info.scope },
+                  ...info.authorizationDetails && {
+                    authorization_details: info.authorizationDetails
+                  }
                 },
                 ...update && { update }
               };
@@ -16824,6 +16845,9 @@ var createOptions = z10.object({
   force: z10.boolean().default(false).describe("Overwrite output file if it already exists"),
   approvalDetail: z10.union([z10.string(), z10.record(z10.string(), z10.unknown())]).optional().describe(
     "Approval details object (MCP/agent: pass as object; CLI: pass as JSON string). Required fields: approved_at (unix timestamp), approval_method (click|programmatic|voice), app_name, external_user_id. Optional: ip_address, user_agent, device_type (mobile|web), agent_log_id, external_user_name, external_session_id, authentication_method (biometric_face|biometric_fingerprint|passkey)."
+  ),
+  metadata: z10.array(z10.union([z10.string(), z10.record(z10.string(), z10.string())])).default([]).describe(
+    'Metadata key:value pair (repeatable). Attaches arbitrary string data to the spend request. Max 50 keys, key <= 40 chars, value <= 500 chars. Example: "order_id:ord_123"'
   )
 });
 var listOptions3 = z10.object({
@@ -17019,6 +17043,16 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
         (item) => typeof item === "string" ? parseTotalFlag(item) : item
       ) : void 0;
       const approvalDetails = opts.approvalDetail !== void 0 ? typeof opts.approvalDetail === "string" ? JSON.parse(opts.approvalDetail) : opts.approvalDetail : void 0;
+      let metadata;
+      if (opts.metadata?.length) {
+        metadata = {};
+        for (const item of opts.metadata) {
+          Object.assign(
+            metadata,
+            typeof item === "string" ? parseKvString(item) : item
+          );
+        }
+      }
       const createParams = {
         payment_details: opts.paymentMethodId,
         credential_type: credentialType,
@@ -17033,7 +17067,8 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
         request_approval: requestApproval || void 0,
         test: opts.test ? true : void 0,
         approve: opts.approve ? true : void 0,
-        approval_details: approvalDetails
+        approval_details: approvalDetails,
+        metadata
       };
       const outputFile = opts.outputFile;
       const forceOverwrite = opts.force;
@@ -17755,7 +17790,11 @@ ${serializeRedactedFormBody(params)}`
         access_token: resp.access_token,
         refresh_token: resp.refresh_token,
         expires_in: resp.expires_in,
-        token_type: resp.token_type
+        token_type: resp.token_type,
+        ...resp.scope && { scope: resp.scope },
+        ...resp.authorization_details && {
+          authorization_details: resp.authorization_details
+        }
       };
     }
     if (status === 400) {
@@ -17835,7 +17874,11 @@ ${serializeRedactedFormBody(params)}`
       access_token: resp.access_token,
       refresh_token: resp.refresh_token,
       expires_in: resp.expires_in,
-      token_type: resp.token_type
+      token_type: resp.token_type,
+      ...resp.scope && { scope: resp.scope },
+      ...resp.authorization_details && {
+        authorization_details: resp.authorization_details
+      }
     };
   }
 };
@@ -18156,7 +18199,7 @@ function cacheUpdateInfo(value, ttlMs = UPDATE_CACHE_TTL_MS) {
 }
 
 // src/cli.tsx
-var cliVersion = "0.10.1";
+var cliVersion = "0.11.0";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
   "User-Agent": `link-cli/${cliVersion}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stripe/link-cli",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "type": "module",
   "bin": {
     "link-cli": "./dist/cli.js"