@stripe/link-cli 0.12.0 → 0.13.1

package/README.md

@@ -124,6 +124,8 @@ The `--request-approval` flag triggers a push notification to the user for appro
 
 Easily approve requests with the [Link app](https://link.com/download).
 
+If the created spend request comes back with `status: "requires_action"`, no approval is needed yet — the payment method or account needs attention first. Check `status_details.requires_action.next_action` for `type`, `display_message`, `action_url`, and `resolution`. For 3D Secure (`resolution: "auto_resume"`), keep polling `spend-request retrieve` — the request resolves on its own once the challenge is completed. For any other resolution, complete the indicated action and create a new spend request.
+
 #### Line items and totals
 
 `--line-item` and `--total` use repeatable `key:value` format.
@@ -223,7 +225,7 @@ For agent polling, pass `--interval` and optionally `--max-attempts`:
 link-cli spend-request retrieve lsrq_001 --interval 2 --max-attempts 300
 ```
 
-Polling exits successfully only after the request reaches a terminal status such as `approved`, `denied`, `expired`, or `canceled`. If polling reaches `--timeout` or exhausts `--max-attempts` while the request is still non-terminal, the command exits non-zero with `code: "POLLING_TIMEOUT"` so callers do not treat a still-pending request as complete.
+Polling exits successfully only after the request reaches a terminal status such as `approved`, `denied`, `expired`, or `canceled`. If the status becomes `requires_action`, behavior depends on `next_action.resolution`: `auto_resume` (used for 3D Secure) means polling continues automatically — the request resolves on its own once the user completes the challenge. Any other resolution stops polling immediately and the command exits with the `next_action` details instead of waiting for a terminal status; the caller must have the user act, then create a new spend request. If `--timeout` is reached or `--max-attempts` is exhausted while the request is still non-terminal, the command exits non-zero with `code: "POLLING_TIMEOUT"` so callers do not treat a still-pending request as complete.
 
 If the merchant supports MPP, use `link-cli mpp pay` instead:
 
@@ -285,7 +287,7 @@ Link Pay Token requests require `execution_method=link_pay_token` and the
 DOM-derived `merchant_account_id`, and Link supplies their canonical merchant
 identity.
 
-**Constraints:** `context` must be at least 100 characters; `amount` must not exceed 500000 (cents); `currency` must be a 3-letter ISO code. The user has 10 minutes from when approval is requested to approve. Approved credentials (card or SPT) are valid for 12 hours from spend request creation.
+**Constraints:** `context` must be at least 100 characters; `amount` must not exceed 50000 (cents); `currency` must be a 3-letter ISO code. The user has 10 minutes from when approval is requested to approve. Approved credentials (card or SPT) are valid for 12 hours from spend request creation.
 **Test mode:** Pass `--test` to create a testmode SpendRequest. A testmode SpendRequest will return test payment credentials (e.g test card `4000009990001984`) rather than a real payment credential. Testmode SpendRequests will not charge the underlying payment method of the SpendRequest. This is useful for development and integration testing without real payment methods.
 
 ```bash
@@ -307,10 +309,10 @@ link-cli spend-request cancel lsrq_001
 
 | Limit | Value |
 |-------|-------|
-| Max amount per spend request | $5,000 (500,000 cents) |
+| Max amount per spend request | $500 (50,000 cents) |
 | Approval window | 10 minutes — user must approve within 10 min of `request-approval` |
 | Card / SPT validity | 12 hours from spend request creation |
-| Daily spend | $5,000 |
+| Daily spend | $500 |
 | Monthly spend (30 days) | $20,000 |
 | Concurrent active requests (created + approved) | 30 |
 | Concurrent approved requests | 10 |

package/dist/cli.js

@@ -11885,6 +11885,13 @@ function normalizeSpendRequest(data) {
   }
   return sr;
 }
+function getDuplicateSpendRequest(error) {
+  if (!(error instanceof LinkApiError)) return null;
+  const details = error.details;
+  const duplicate = details?.error?.duplicate_spend_request;
+  if (!duplicate || typeof duplicate !== "object") return null;
+  return normalizeSpendRequest(duplicate);
+}
 function extractApiError(data, rawBody) {
   if (data && typeof data === "object") {
     const body = data;
@@ -12771,6 +12778,8 @@ import { useEffect, useState } from "react";
 
 // src/utils/constants.ts
 var DISPLAY_DELAY_MS = 1500;
+var RESUME_POLL_INTERVAL_MS = 2e3;
+var RESUME_TIMEOUT_MS = 6e5;
 
 // src/utils/open-url.ts
 import { spawn } from "child_process";
@@ -16488,6 +16497,21 @@ import { Box as Box18, Text as Text20, useApp as useApp4, useInput as useInput8
 import Spinner10 from "ink-spinner";
 import { useCallback as useCallback8, useEffect as useEffect9, useState as useState9 } from "react";
 
+// src/utils/format-amount.ts
+function formatAmount(amount, currency) {
+  const currencyCode = currency.toUpperCase();
+  try {
+    const formatter = new Intl.NumberFormat("en-US", {
+      style: "currency",
+      currency: currencyCode
+    });
+    const fractionDigits = formatter.resolvedOptions().maximumFractionDigits ?? 2;
+    return formatter.format(amount / 10 ** fractionDigits);
+  } catch {
+    return `${amount} ${currency}`;
+  }
+}
+
 // src/commands/spend-request/approval-waiting-view.tsx
 import { Box as Box17, Text as Text19 } from "ink";
 import Spinner9 from "ink-spinner";
@@ -16532,7 +16556,8 @@ function useApprovalPolling({
   requestId,
   onComplete,
   onSuccess,
-  onError
+  onError,
+  onRequiresAction
 }) {
   const isWaiting = status === "waiting" || status === "polling";
   useInput7(
@@ -16553,6 +16578,12 @@ function useApprovalPolling({
       try {
         const final = await pollUntilApproved(repository, requestId);
         if (cancelled) return;
+        if (final.status === "requires_action") {
+          onRequiresAction(final);
+          setStatus("requires_action");
+          setTimeout(() => onComplete(final), DISPLAY_DELAY_MS);
+          return;
+        }
         if (final.status !== "approved") {
           onError(
             `Spend request did not reach approved (status: ${final.status})`
@@ -16582,6 +16613,7 @@ function useApprovalPolling({
     onComplete,
     onSuccess,
     onError,
+    onRequiresAction,
     setStatus
   ]);
 }
@@ -16599,12 +16631,16 @@ var CreateSpendRequest = ({
   const { exit } = useApp4();
   const [status, setStatus] = useState9("creating");
   const [request, setRequest] = useState9(null);
+  const [duplicateRequest, setDuplicateRequest] = useState9(
+    null
+  );
   const [error, setError] = useState9("");
   const [verificationUrl, setVerificationUrl] = useState9("");
   const [supportUrl, setSupportUrl] = useState9("");
   const [countdown, setCountdown] = useState9(30);
   const [outputFilePath, setOutputFilePath] = useState9(null);
   const [fileError, setFileError] = useState9("");
+  const [nextAction, setNextAction] = useState9(null);
   const approvalUrl = request?.approval_url ?? "";
   const completeAndExit = useCallback8(
     (result) => {
@@ -16618,6 +16654,10 @@ var CreateSpendRequest = ({
     []
   );
   const onError = useCallback8((msg) => setError(msg), []);
+  const onRequiresAction = useCallback8((result) => {
+    setRequest(result);
+    setNextAction(result.status_details?.requires_action?.next_action ?? null);
+  }, []);
   useApprovalPolling({
     status,
     setStatus,
@@ -16626,8 +16666,66 @@ var CreateSpendRequest = ({
     requestId: request?.id ?? null,
     onComplete: completeAndExit,
     onSuccess,
-    onError
+    onError,
+    onRequiresAction
   });
+  useInput8(
+    (_input, key) => {
+      if (key.return && nextAction?.action_url) {
+        openUrl(nextAction.action_url);
+        completeAndExit(request);
+      }
+    },
+    {
+      isActive: status === "requires_action" && nextAction?.resolution !== "auto_resume"
+    }
+  );
+  useEffect9(() => {
+    if (status !== "requires_action") return;
+    if (nextAction?.resolution === "auto_resume") {
+      setStatus("resuming");
+    }
+  }, [status, nextAction]);
+  useEffect9(() => {
+    if (status !== "resuming" || !request?.id) return;
+    let cancelled = false;
+    const requestId = request.id;
+    const deadline = Date.now() + RESUME_TIMEOUT_MS;
+    const poll = async () => {
+      while (!cancelled) {
+        if (Date.now() > deadline) {
+          setStatus("resume_timeout");
+          setTimeout(() => completeAndExit(request), DISPLAY_DELAY_MS);
+          return;
+        }
+        await new Promise((r) => setTimeout(r, RESUME_POLL_INTERVAL_MS));
+        if (cancelled) return;
+        let latest;
+        try {
+          latest = await repository.getSpendRequest(requestId);
+        } catch {
+          continue;
+        }
+        if (cancelled || !latest) continue;
+        setRequest(latest);
+        if (latest.status === "requires_action") continue;
+        if (latest.status === "approved" || latest.status === "succeeded") {
+          setStatus("success");
+        } else {
+          setError(
+            `Spend request did not resolve after 3D Secure (status: ${latest.status})`
+          );
+          setStatus("error");
+        }
+        setTimeout(() => completeAndExit(latest), DISPLAY_DELAY_MS);
+        return;
+      }
+    };
+    poll();
+    return () => {
+      cancelled = true;
+    };
+  }, [status, request, repository, completeAndExit]);
   useInput8((_, key) => {
     if (key.return && (verificationUrl || supportUrl) && status === "verification_required") {
       openUrl(verificationUrl || supportUrl);
@@ -16644,12 +16742,27 @@ var CreateSpendRequest = ({
     const timer = setTimeout(() => setCountdown((c) => c - 1), 1e3);
     return () => clearTimeout(timer);
   }, [status, countdown, completeAndExit]);
+  useEffect9(() => {
+    if (status !== "requires_action") return;
+    if (nextAction?.resolution === "auto_resume") return;
+    if (countdown <= 0) {
+      completeAndExit(request);
+      return;
+    }
+    const timer = setTimeout(() => setCountdown((c) => c - 1), 1e3);
+    return () => clearTimeout(timer);
+  }, [status, nextAction, countdown, completeAndExit, request]);
   useEffect9(() => {
     const create = async () => {
       try {
         const result = await repository.createSpendRequest(params);
         setRequest(result);
-        if (requestApproval) {
+        if (result.status === "requires_action") {
+          setNextAction(
+            result.status_details?.requires_action?.next_action ?? null
+          );
+          setStatus("requires_action");
+        } else if (requestApproval) {
           setStatus("waiting");
         } else {
           setStatus("success");
@@ -16667,6 +16780,8 @@ var CreateSpendRequest = ({
             setStatus("verification_required");
             return;
           }
+          const duplicate = getDuplicateSpendRequest(err);
+          if (duplicate) setDuplicateRequest(sanitizeDeep(duplicate));
         }
         setStatus("error");
         setTimeout(() => completeAndExit(null), DISPLAY_DELAY_MS);
@@ -16724,6 +16839,72 @@ var CreateSpendRequest = ({
       /* @__PURE__ */ jsx27(Text20, { color: "green", children: "\u2713 Opened verification URL in browser" })
     ] });
   }
+  if (status === "requires_action") {
+    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx27(Text20, { color: "yellow", children: "\u26A0 Action required before payment can proceed" }),
+      /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs18(Text20, { children: [
+          "ID: ",
+          /* @__PURE__ */ jsx27(Text20, { bold: true, children: request?.id })
+        ] }),
+        /* @__PURE__ */ jsxs18(Text20, { children: [
+          "Type: ",
+          /* @__PURE__ */ jsx27(Text20, { bold: true, children: nextAction?.type })
+        ] }),
+        /* @__PURE__ */ jsx27(Text20, { children: nextAction?.display_message })
+      ] }),
+      nextAction?.action_url && /* @__PURE__ */ jsxs18(
+        Box18,
+        {
+          flexDirection: "column",
+          borderStyle: "round",
+          borderColor: "cyan",
+          paddingX: 2,
+          paddingY: 1,
+          marginTop: 1,
+          children: [
+            /* @__PURE__ */ jsxs18(Text20, { children: [
+              "Open:",
+              " ",
+              /* @__PURE__ */ jsx27(Text20, { bold: true, color: "cyan", children: nextAction.action_url })
+            ] }),
+            /* @__PURE__ */ jsx27(Text20, { dimColor: true, children: "Press Enter to open in browser" }),
+            /* @__PURE__ */ jsxs18(Text20, { dimColor: true, children: [
+              "Exiting in ",
+              countdown,
+              "s..."
+            ] })
+          ]
+        }
+      ),
+      /* @__PURE__ */ jsx27(Box18, { marginTop: 1, children: /* @__PURE__ */ jsx27(Text20, { dimColor: true, children: "Complete this step, then create a new spend request." }) })
+    ] });
+  }
+  if (status === "resuming") {
+    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs18(Text20, { color: "cyan", children: [
+        /* @__PURE__ */ jsx27(Spinner10, { type: "dots" }),
+        " Waiting for 3D Secure verification to complete..."
+      ] }),
+      /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsx27(Text20, { children: nextAction?.display_message }),
+        nextAction?.action_url && /* @__PURE__ */ jsxs18(Text20, { dimColor: true, children: [
+          "URL: ",
+          /* @__PURE__ */ jsx27(Text20, { color: "cyan", children: nextAction.action_url })
+        ] })
+      ] })
+    ] });
+  }
+  if (status === "resume_timeout") {
+    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx27(Text20, { color: "yellow", children: "\u2717 Timed out waiting for 3D Secure verification to resolve" }),
+      /* @__PURE__ */ jsxs18(Text20, { dimColor: true, children: [
+        "Run `spend-request retrieve ",
+        request?.id,
+        "` to check the current status."
+      ] })
+    ] });
+  }
   if (status === "creating") {
     return /* @__PURE__ */ jsx27(Box18, { children: /* @__PURE__ */ jsxs18(Text20, { color: "cyan", children: [
       /* @__PURE__ */ jsx27(Spinner10, { type: "dots" }),
@@ -16733,7 +16914,53 @@ var CreateSpendRequest = ({
   if (status === "error") {
     return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx27(Text20, { color: "red", children: "\u2717 Failed to create spend request" }),
-      /* @__PURE__ */ jsx27(Text20, { color: "red", children: error })
+      /* @__PURE__ */ jsx27(Text20, { color: "red", children: error }),
+      duplicateRequest && /* @__PURE__ */ jsxs18(
+        Box18,
+        {
+          flexDirection: "column",
+          borderStyle: "round",
+          borderColor: "yellow",
+          paddingX: 2,
+          paddingY: 1,
+          marginTop: 1,
+          children: [
+            /* @__PURE__ */ jsx27(Text20, { bold: true, color: "yellow", children: "A matching spend request already exists" }),
+            /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
+              /* @__PURE__ */ jsxs18(Text20, { children: [
+                "ID: ",
+                /* @__PURE__ */ jsx27(Text20, { bold: true, children: duplicateRequest.id })
+              ] }),
+              /* @__PURE__ */ jsxs18(Text20, { children: [
+                "Status: ",
+                /* @__PURE__ */ jsx27(Text20, { bold: true, children: duplicateRequest.status })
+              ] }),
+              /* @__PURE__ */ jsxs18(Text20, { children: [
+                "Amount:",
+                " ",
+                /* @__PURE__ */ jsx27(Text20, { bold: true, children: duplicateRequest.amount != null ? formatAmount(
+                  duplicateRequest.amount,
+                  duplicateRequest.currency ?? ""
+                ) : "N/A" })
+              ] }),
+              /* @__PURE__ */ jsxs18(Text20, { children: [
+                "Merchant: ",
+                /* @__PURE__ */ jsx27(Text20, { bold: true, children: duplicateRequest.merchant_name })
+              ] })
+            ] }),
+            duplicateRequest.status !== "expired" && duplicateRequest.status !== "canceled" && duplicateRequest.status !== "failed" && /* @__PURE__ */ jsxs18(Fragment4, { children: [
+              /* @__PURE__ */ jsxs18(Text20, { dimColor: true, children: [
+                "\n",
+                "Retrieve it to resume instead of creating a new one:"
+              ] }),
+              /* @__PURE__ */ jsxs18(Text20, { color: "cyan", children: [
+                "spend-request retrieve ",
+                duplicateRequest.id
+              ] })
+            ] })
+          ]
+        }
+      )
     ] });
   }
   if (status === "success") {
@@ -16751,7 +16978,7 @@ var CreateSpendRequest = ({
         /* @__PURE__ */ jsxs18(Text20, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx27(Text20, { bold: true, children: request?.amount != null ? `${request.amount} ${request.currency?.toUpperCase() ?? ""}`.trim() : "N/A" })
+          /* @__PURE__ */ jsx27(Text20, { bold: true, children: request?.amount != null ? formatAmount(request.amount, request.currency ?? "") : "N/A" })
         ] }),
         /* @__PURE__ */ jsxs18(Text20, { children: [
           "Merchant: ",
@@ -16874,7 +17101,7 @@ var SpendRequestList = ({
   return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
     /* @__PURE__ */ jsx28(Text21, { bold: true, children: includeHistory ? "All Spend Requests" : "Active Spend Requests" }),
     /* @__PURE__ */ jsx28(Box19, { flexDirection: "column", marginTop: 1, children: requests.map((sr) => {
-      const statusColor = sr.status === "approved" ? "green" : sr.status === "pending_approval" ? "yellow" : "white";
+      const statusColor = sr.status === "approved" ? "green" : sr.status === "pending_approval" || sr.status === "requires_action" ? "yellow" : "white";
       const amount = sr.amount != null ? `$${(sr.amount / 100).toFixed(2)} ${(sr.currency ?? "usd").toUpperCase()}` : "";
       return /* @__PURE__ */ jsx28(Box19, { paddingX: 2, children: /* @__PURE__ */ jsxs19(Text21, { children: [
         /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: sr.id }),
@@ -16912,8 +17139,13 @@ var RequestApproval = ({
   const [verificationUrl, setVerificationUrl] = useState10("");
   const [supportUrl, setSupportUrl] = useState10("");
   const [countdown, setCountdown] = useState10(30);
+  const [nextAction, setNextAction] = useState10(null);
   const onSuccess = useCallback10((r) => setResult(r), []);
   const onError = useCallback10((msg) => setError(msg), []);
+  const onRequiresAction = useCallback10((r) => {
+    setResult(r);
+    setNextAction(r.status_details?.requires_action?.next_action ?? null);
+  }, []);
   useApprovalPolling({
     status,
     setStatus,
@@ -16922,7 +17154,8 @@ var RequestApproval = ({
     requestId: id,
     onComplete: completeAndExit,
     onSuccess,
-    onError
+    onError,
+    onRequiresAction
   });
   useInput9((_, key) => {
     if (key.return && (verificationUrl || supportUrl) && status === "verification_required") {
@@ -17006,6 +17239,22 @@ var RequestApproval = ({
       /* @__PURE__ */ jsx29(Text22, { color: "green", children: "\u2713 Opened verification URL in browser" })
     ] });
   }
+  if (status === "requires_action") {
+    return /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx29(Text22, { color: "yellow", children: "\u26A0 Action required before payment can proceed" }),
+      /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs20(Text22, { children: [
+          "ID: ",
+          /* @__PURE__ */ jsx29(Text22, { bold: true, children: result?.id })
+        ] }),
+        /* @__PURE__ */ jsx29(Text22, { children: nextAction?.display_message }),
+        nextAction?.action_url && /* @__PURE__ */ jsxs20(Text22, { children: [
+          "URL: ",
+          /* @__PURE__ */ jsx29(Text22, { color: "cyan", children: nextAction.action_url })
+        ] })
+      ] })
+    ] });
+  }
   if (status === "requesting") {
     return /* @__PURE__ */ jsx29(Box20, { children: /* @__PURE__ */ jsxs20(Text22, { color: "cyan", children: [
       /* @__PURE__ */ jsx29(Spinner12, { type: "dots" }),
@@ -17068,6 +17317,9 @@ var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "failed",
   "canceled"
 ]);
+function isAutoResume(request) {
+  return request.status_details?.requires_action?.next_action?.resolution === "auto_resume";
+}
 var RetrieveSpendRequest = ({
   repository,
   id,
@@ -17123,6 +17375,9 @@ var RetrieveSpendRequest = ({
         } else if (result.status === "denied") {
           setPhase("declined");
           setTimeout(() => onComplete(result), DISPLAY_DELAY_MS);
+        } else if (result.status === "requires_action" && !isAutoResume(result)) {
+          setPhase("requires_action");
+          setTimeout(() => onComplete(result), DISPLAY_DELAY_MS);
         } else if (TERMINAL_STATUSES.has(result.status)) {
           setPhase("finalized");
           setTimeout(() => onComplete(result), DISPLAY_DELAY_MS);
@@ -17168,6 +17423,11 @@ var RetrieveSpendRequest = ({
           if (timerRef.current) clearInterval(timerRef.current);
           setPhase("declined");
           setTimeout(() => onComplete(result), DISPLAY_DELAY_MS);
+        } else if (result.status === "requires_action" && !isAutoResume(result)) {
+          if (pollRef.current) clearInterval(pollRef.current);
+          if (timerRef.current) clearInterval(timerRef.current);
+          setPhase("requires_action");
+          setTimeout(() => onComplete(result), DISPLAY_DELAY_MS);
         } else if (TERMINAL_STATUSES.has(result.status)) {
           if (pollRef.current) clearInterval(pollRef.current);
           if (timerRef.current) clearInterval(timerRef.current);
@@ -17216,14 +17476,24 @@ var RetrieveSpendRequest = ({
     ] });
   }
   if (phase === "polling") {
+    const resumingNextAction = request?.status === "requires_action" ? request.status_details?.requires_action?.next_action : void 0;
     return /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx30(Box21, { children: /* @__PURE__ */ jsxs21(Text23, { color: "cyan", children: [
         /* @__PURE__ */ jsx30(Spinner13, { type: "dots" }),
-        " Awaiting approval... (",
+        " ",
+        resumingNextAction ? "Waiting for 3D Secure verification to complete..." : "Awaiting approval...",
+        " ",
+        "(",
         elapsed,
         "s elapsed)"
       ] }) }),
-      request?.approval_url && /* @__PURE__ */ jsx30(Box21, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs21(Text23, { dimColor: true, children: [
+      resumingNextAction ? /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsx30(Text23, { dimColor: true, children: resumingNextAction.display_message }),
+        resumingNextAction.action_url && /* @__PURE__ */ jsxs21(Text23, { dimColor: true, children: [
+          "URL: ",
+          /* @__PURE__ */ jsx30(Text23, { color: "cyan", children: resumingNextAction.action_url })
+        ] })
+      ] }) : request?.approval_url && /* @__PURE__ */ jsx30(Box21, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs21(Text23, { dimColor: true, children: [
         "Approval URL: ",
         /* @__PURE__ */ jsx30(Text23, { color: "cyan", children: request.approval_url })
       ] }) })
@@ -17313,6 +17583,28 @@ var RetrieveSpendRequest = ({
       ] })
     ] });
   }
+  if (phase === "requires_action") {
+    const nextAction = request?.status_details?.requires_action?.next_action;
+    return /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx30(Text23, { color: "yellow", children: "\u26A0 Action required before payment can proceed" }),
+      /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs21(Text23, { children: [
+          "ID: ",
+          /* @__PURE__ */ jsx30(Text23, { bold: true, children: request?.id })
+        ] }),
+        /* @__PURE__ */ jsxs21(Text23, { children: [
+          "Type: ",
+          /* @__PURE__ */ jsx30(Text23, { bold: true, children: nextAction?.type })
+        ] }),
+        /* @__PURE__ */ jsx30(Text23, { children: nextAction?.display_message }),
+        nextAction?.action_url && /* @__PURE__ */ jsxs21(Text23, { children: [
+          "URL: ",
+          /* @__PURE__ */ jsx30(Text23, { color: "cyan", children: nextAction.action_url })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx30(Box21, { marginTop: 1, children: /* @__PURE__ */ jsx30(Text23, { dimColor: true, children: "Complete this step, then create a new spend request." }) })
+    ] });
+  }
   if (phase === "declined") {
     return /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx30(Text23, { color: "red", children: "\u2717 Spend request declined" }),
@@ -17516,7 +17808,7 @@ var createOptions = z10.object({
   merchantAccountId: z10.string().optional().describe(
     "Stripe account ID from data-stripe-merchant-account; required with execution_method link_pay_token"
   ),
-  amount: z10.coerce.number().int().positive().max(5e5).describe("Amount in cents, max 500000 ($5,000.00)"),
+  amount: z10.coerce.number().int().positive().max(5e5).describe("Amount in cents"),
   currency: z10.string().length(3).default("usd").describe("Currency code"),
   merchantName: z10.string().optional().describe(
     "Merchant name (required for regular card requests; omit for link_pay_token and shared_payment_token)"
@@ -17533,7 +17825,9 @@ var createOptions = z10.object({
   total: z10.array(z10.union([z10.string(), z10.record(z10.string(), z10.unknown())])).default([]).describe(
     'Total (repeatable, key:value format). Keys: type (required; one of: subtotal, tax, total, items_base_amount, items_discount, discount, fulfillment, shipping, fee, gift_wrap, tip, store_credit), display_text (required), amount (required). Example: "type:total,display_text:Total,amount:5000"'
   ),
-  requestApproval: z10.boolean().default(true).describe("Request approval and poll until approved/denied/expired"),
+  requestApproval: z10.boolean().default(true).describe(
+    "Request approval and poll until approved/denied/expired, or until requires_action with a non-auto_resume resolution"
+  ),
   test: z10.boolean().default(false).describe(
     "Use test mode (creates testmode credentials from test card data)"
   ),
@@ -17647,6 +17941,18 @@ var UpdateSpendRequest = ({
 
 // src/commands/spend-request/index.tsx
 import { jsx as jsx32 } from "react/jsx-runtime";
+function buildRequiresActionResult(request) {
+  const nextAction = request.status_details?.requires_action?.next_action;
+  const isAutoResume2 = nextAction?.resolution === "auto_resume";
+  return {
+    ...request,
+    instruction: isAutoResume2 ? `The spend request requires 3D Secure verification. Present action_url (${nextAction?.action_url}) to the user, then call \`spend-request retrieve ${request.id} --interval 2 --max-attempts 300\` to poll until it resolves. Do not create a new spend request \u2014 this one resumes automatically once the challenge is completed.` : `The spend request requires action (${nextAction?.type}): ${nextAction?.display_message}${nextAction?.action_url ? ` URL: ${nextAction.action_url}` : ""} Have the user complete this, then create a new spend request.`,
+    _next: isAutoResume2 ? {
+      command: `spend-request retrieve ${request.id} --interval 2 --max-attempts 300`,
+      until: "status changes from requires_action"
+    } : void 0
+  };
+}
 async function applyOutputFile(request, outputFile, force) {
   if (!outputFile || !request.card) return request;
   const fileData = {
@@ -17862,9 +18168,29 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
               message: `${err.message} Support URL: ${apiErr.error.support_url}`
             });
           }
+          const duplicate = getDuplicateSpendRequest(err);
+          if (duplicate) {
+            return c.error({
+              code: apiErr?.error?.code ?? "spend_request_rate_limited",
+              message: `${err.message} A matching spend request already exists: ${duplicate.id} (status: ${duplicate.status}). Retrieve it to resume instead of creating a new one.`,
+              cta: {
+                description: "Retrieve the conflicting spend request to inspect its status and resume it if valid.",
+                commands: [
+                  {
+                    command: `spend-request retrieve ${duplicate.id}`,
+                    description: "Retrieve the conflicting spend request to resume it"
+                  }
+                ]
+              }
+            });
+          }
         }
         throw err;
       }
+      if (created.status === "requires_action") {
+        yield buildRequiresActionResult(created);
+        return;
+      }
       if (!requestApproval) {
         try {
           yield await applyOutputFile(created, outputFile, forceOverwrite);
@@ -18050,9 +18376,16 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
         "failed",
         "canceled"
       ]);
+      const isPollTerminal = (req) => {
+        if (terminalStatuses.has(req.status)) return true;
+        if (req.status === "requires_action") {
+          return req.status_details?.requires_action?.next_action?.resolution !== "auto_resume";
+        }
+        return false;
+      };
       for await (const result of pollUntil({
         fn: () => repository.getSpendRequest(id, { include }),
-        isTerminal: (req) => req === null || terminalStatuses.has(req.status),
+        isTerminal: (req) => req === null || isPollTerminal(req),
         interval,
         maxAttempts,
         timeout
@@ -18064,6 +18397,10 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
           });
         }
         if (result.terminal) {
+          if (result.value.status === "requires_action" && !result.reason) {
+            yield buildRequiresActionResult(result.value);
+            return;
+          }
           if (terminalStatuses.has(result.value.status) || !result.reason) {
             try {
               yield await applyOutputFile(
@@ -18141,19 +18478,6 @@ var STATUS_WIDTH = 10;
 var CATEGORY_WIDTH = 16;
 var MIN_DESCRIPTION_WIDTH = 16;
 var HORIZONTAL_PADDING2 = 4;
-function formatAmount(amount, currency) {
-  const currencyCode = currency.toUpperCase();
-  try {
-    const formatter = new Intl.NumberFormat("en-US", {
-      style: "currency",
-      currency: currencyCode
-    });
-    const fractionDigits = formatter.resolvedOptions().maximumFractionDigits ?? 2;
-    return formatter.format(amount / 10 ** fractionDigits);
-  } catch {
-    return `${amount} ${currency}`;
-  }
-}
 function truncateCell3(value, width) {
   if (value.length <= width) {
     return value;
@@ -18965,7 +19289,7 @@ function cacheUpdateInfo(value, ttlMs = UPDATE_CACHE_TTL_MS) {
 }
 
 // src/cli.tsx
-var cliVersion = "0.12.0";
+var cliVersion = "0.13.1";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
   "User-Agent": `link-cli/${cliVersion}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stripe/link-cli",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "type": "module",
   "bin": {
     "link-cli": "./dist/cli.js"