@stripe/link-cli 0.15.0 → 0.16.0

package/README.md

@@ -310,6 +310,24 @@ card SpendRequest instead; do not create an LPT request.
 | Rolling creation rate | 200 per 60 days |
 
 
+Use `mpp pay` to complete purchases on merchants that use the [Machine Payments Protocol](https://mpp.dev). The spend request must use `credential_type: "shared_payment_token"` and you must approve it before paying. The SPT is one-time-use — if payment fails, create a new spend request.
+
+```bash
+link-cli mpp pay https://climate.stripe.dev/api/contribute \
+  --spend-request-id lsrq_001 \
+  --method POST \
+  --data '{"amount":100}' \
+  --header "X-Custom: value"
+```
+
+In agent mode (`--format json`), the full flow returns the payment continuation twice: as `_next.pay_argv` (`{ "command": "mpp", "args": [...] }`) and as `_next.pay_command`. Prefer `pay_argv` and invoke it directly, passing each `args` entry as its own process argument. The URL, body and headers can carry merchant-controlled text, so `pay_command` is shell-quoted for callers that must go through a shell — pass it to the shell verbatim, without unquoting or re-splitting it.
+
+Use `mpp decode` to validate a raw `WWW-Authenticate` header and extract the `network_id` needed for `shared_payment_token` spend requests:
+
+```bash
+link-cli mpp decode \
+  --challenge 'Payment id="ch_001", realm="merchant.example", method="stripe", intent="charge", request="..."'
+```
 
 ### Report outcomes
 

package/dist/cli.js

@@ -593,7 +593,9 @@ var BalancesResource = class extends BaseResource {
 var paymentMethodSchema = z2.looseObject({
   id: z2.string(),
   type: z2.string(),
-  is_default: z2.boolean()
+  is_default: z2.boolean(),
+  name: z2.string(),
+  nickname: z2.optional(z2.string().nullable())
 });
 var paymentMethodsResponseSchema = z2.looseObject({
   payment_details: z2.array(paymentMethodSchema)
@@ -649,7 +651,7 @@ var ReportResource = class extends BaseResource {
 var shippingAddressSchema = z4.looseObject({
   id: z4.string(),
   is_default: z4.boolean(),
-  nickname: z4.string().nullable(),
+  nickname: z4.optional(z4.string().nullable()),
   address: z4.looseObject({}).nullable()
 });
 var shippingAddressesResponseSchema = z4.looseObject({
@@ -2799,7 +2801,7 @@ function buildHeaders(data, headers) {
     if (key) result[key] = value;
   }
   if (!Object.keys(result).some((key) => key.toLowerCase() === "user-agent")) {
-    result["User-Agent"] = `link-cli/${"0.15.0"}`;
+    result["User-Agent"] = `link-cli/${"0.16.0"}`;
   }
   return result;
 }
@@ -3658,6 +3660,21 @@ function createDemoCli(authRepo2, spendRequestRepo2, createPaymentMethodsResourc
 // src/commands/mpp/index.tsx
 import { Cli as Cli4, z as z14 } from "incur";
 
+// src/utils/shell-quote.ts
+var SAFE_RE = /^[A-Za-z0-9_@%+=:,./-]+$/;
+function shellQuote(value) {
+  if (value === "") {
+    return "''";
+  }
+  if (SAFE_RE.test(value)) {
+    return value;
+  }
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function shellCommand(parts) {
+  return parts.map(shellQuote).join(" ");
+}
+
 // src/commands/mpp/decode-view.tsx
 import { Box as Box10, Text as Text12 } from "ink";
 import { jsx as jsx14, jsxs as jsxs10 } from "react/jsx-runtime";
@@ -3829,20 +3846,22 @@ function createMppCli(repository, paymentMethodsFactory, authStorage2, envAccess
         request_approval: true,
         test: opts.test || void 0
       });
-      const nextFlags = [`--spend-request-id ${spendRequest.id}`];
-      if (method) nextFlags.push(`-X ${method}`);
-      if (data) nextFlags.push(`-d '${data}'`);
+      const nextArgs = ["pay", url, "--spend-request-id", spendRequest.id];
+      if (method) nextArgs.push("-X", method);
+      if (data) nextArgs.push("-d", data);
       if (headers) {
-        for (const h of headers) nextFlags.push(`-H '${h}'`);
+        for (const h of headers) nextArgs.push("-H", h);
       }
-      const nextCommand = `mpp pay ${url} ${nextFlags.join(" ")}`;
+      const nextCommand = `mpp ${shellCommand(nextArgs)}`;
+      const pollCommand = `spend-request retrieve ${shellQuote(spendRequest.id)} --interval 2 --max-attempts 300`;
       yield {
         ...spendRequest,
-        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`spend-request retrieve ${spendRequest.id} --interval 2 --max-attempts 300\` to poll until approved. Once approved, run the _next.command to complete payment. Do not wait for the user to reply \u2014 start polling immediately.`,
+        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`${pollCommand}\` to poll until approved. Once approved, run _next.pay_argv (preferred \u2014 invoke it directly without a shell) or _next.pay_command to complete payment. Do not wait for the user to reply \u2014 start polling immediately.`,
         _next: {
-          poll_command: `spend-request retrieve ${spendRequest.id} --interval 2 --max-attempts 300`,
+          poll_command: pollCommand,
           pay_command: nextCommand,
-          until: "status changes from pending_approval, then run pay_command"
+          pay_argv: { command: "mpp", args: nextArgs },
+          until: "status changes from pending_approval, then run pay_argv"
         }
       };
     }
@@ -4094,7 +4113,7 @@ var PaymentMethodsList = ({
   return /* @__PURE__ */ jsxs13(Box13, { flexDirection: "column", children: [
     /* @__PURE__ */ jsx19(Text15, { bold: true, children: "Payment Methods" }),
     /* @__PURE__ */ jsx19(Box13, { flexDirection: "column", marginTop: 1, children: methods.map((pm) => {
-      const label = pm.card_details?.brand ?? pm.bank_account_details?.bank_name ?? "Bank account";
+      const label = pm.name ?? pm.card_details?.brand ?? pm.bank_account_details?.bank_name ?? "Bank account";
       const last4 = pm.card_details?.last4 ?? pm.bank_account_details?.last4;
       const suffix = pm.nickname ? `(${pm.nickname})` : "";
       const agenticCap = pm.capabilities?.agentic_payments;
@@ -6243,9 +6262,9 @@ function buildRequiresActionResult(request) {
   const isAutoResume2 = nextAction?.resolution === "auto_resume";
   return {
     ...request,
-    instruction: isAutoResume2 ? `The spend request requires 3D Secure verification. Present action_url (${nextAction?.action_url}) to the user, then call \`spend-request retrieve ${request.id} --interval 2 --max-attempts 300\` to poll until it resolves. Do not create a new spend request \u2014 this one resumes automatically once the challenge is completed.` : `The spend request requires action (${nextAction?.type}): ${nextAction?.display_message}${nextAction?.action_url ? ` URL: ${nextAction.action_url}` : ""} Have the user complete this, then create a new spend request.`,
+    instruction: isAutoResume2 ? `The spend request requires 3D Secure verification. Present action_url (${nextAction?.action_url}) to the user, then call \`spend-request retrieve ${shellQuote(request.id)} --interval 2 --max-attempts 300\` to poll until it resolves. Do not create a new spend request \u2014 this one resumes automatically once the challenge is completed.` : `The spend request requires action (${nextAction?.type}): ${nextAction?.display_message}${nextAction?.action_url ? ` URL: ${nextAction.action_url}` : ""} Have the user complete this, then create a new spend request.`,
     _next: isAutoResume2 ? {
-      command: `spend-request retrieve ${request.id} --interval 2 --max-attempts 300`,
+      command: `spend-request retrieve ${shellQuote(request.id)} --interval 2 --max-attempts 300`,
       until: "status changes from requires_action"
     } : void 0
   };
@@ -6503,9 +6522,9 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
       }
       yield {
         ...created,
-        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`spend-request retrieve ${created.id} --interval 2 --max-attempts 300\` to poll until approved. Do not wait for the user to reply \u2014 start polling immediately.`,
+        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`spend-request retrieve ${shellQuote(created.id)} --interval 2 --max-attempts 300\` to poll until approved. Do not wait for the user to reply \u2014 start polling immediately.`,
         _next: {
-          command: `spend-request retrieve ${created.id} --interval 2 --max-attempts 300`,
+          command: `spend-request retrieve ${shellQuote(created.id)} --interval 2 --max-attempts 300`,
           until: "status changes from pending_approval"
         }
       };
@@ -6616,9 +6635,9 @@ function createSpendRequestCli(repository, authStorage2, envAccessToken2) {
       }
       yield {
         ...approval,
-        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`spend-request retrieve ${id} --interval 2 --max-attempts 300\` to poll until approved. Do not wait for the user to reply \u2014 start polling immediately.`,
+        instruction: `Present the approval_url to the user and ask them to approve in the Link app. Then call \`spend-request retrieve ${shellQuote(id)} --interval 2 --max-attempts 300\` to poll until approved. Do not wait for the user to reply \u2014 start polling immediately.`,
         _next: {
-          command: `spend-request retrieve ${id} --interval 2 --max-attempts 300`,
+          command: `spend-request retrieve ${shellQuote(id)} --interval 2 --max-attempts 300`,
           until: "status changes from pending_approval"
         }
       };
@@ -7580,7 +7599,7 @@ function cacheUpdateInfo(value, ttlMs = UPDATE_CACHE_TTL_MS) {
 }
 
 // src/cli.tsx
-var cliVersion = "0.15.0";
+var cliVersion = "0.16.0";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
   "User-Agent": `link-cli/${cliVersion}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stripe/link-cli",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "type": "module",
   "bin": {
     "link-cli": "./dist/cli.js"
@@ -45,7 +45,7 @@
     "tsx": "^4.23.5",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10",
-    "@stripe/link-sdk": "0.2.0",
+    "@stripe/link-sdk": "0.2.1",
     "@stripe/link-typescript-config": "0.0.0"
   },
   "scripts": {