@stripe/link-cli 0.5.0 → 0.6.0

package/dist/cli.js

@@ -402,11 +402,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants2) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants);
+          this.rhs = optimizeExpr(this.rhs, names, constants2);
         return this;
       }
       get names() {
@@ -423,10 +423,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants2) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants);
+        this.rhs = optimizeExpr(this.rhs, names, constants2);
         return this;
       }
       get names() {
@@ -487,8 +487,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants) {
-        this.code = optimizeExpr(this.code, names, constants);
+      optimizeNames(names, constants2) {
+        this.code = optimizeExpr(this.code, names, constants2);
         return this;
       }
       get names() {
@@ -517,12 +517,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants2) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants))
+          if (n.optimizeNames(names, constants2))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -575,12 +575,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants2) {
         var _a;
-        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants);
-        if (!(super.optimizeNames(names, constants) || this.else))
+        this.else = (_a = this.else) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants2);
+        if (!(super.optimizeNames(names, constants2) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants);
+        this.condition = optimizeExpr(this.condition, names, constants2);
         return this;
       }
       get names() {
@@ -603,10 +603,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants) {
-        if (!super.optimizeNames(names, constants))
+      optimizeNames(names, constants2) {
+        if (!super.optimizeNames(names, constants2))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants);
+        this.iteration = optimizeExpr(this.iteration, names, constants2);
         return this;
       }
       get names() {
@@ -642,10 +642,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants) {
-        if (!super.optimizeNames(names, constants))
+      optimizeNames(names, constants2) {
+        if (!super.optimizeNames(names, constants2))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants);
+        this.iterable = optimizeExpr(this.iterable, names, constants2);
         return this;
       }
       get names() {
@@ -687,11 +687,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants) {
+      optimizeNames(names, constants2) {
         var _a, _b;
-        super.optimizeNames(names, constants);
-        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants);
+        super.optimizeNames(names, constants2);
+        (_a = this.catch) === null || _a === void 0 ? void 0 : _a.optimizeNames(names, constants2);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants2);
         return this;
       }
       get names() {
@@ -992,7 +992,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants) {
+    function optimizeExpr(expr, names, constants2) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -1007,14 +1007,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants[n.str];
+        const c = constants2[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants2[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -8704,19 +8704,19 @@ var require_range = __commonJS({
     var replaceCaret = (comp, options) => {
       debug("caret", comp, options);
       const r = options.loose ? re[t.CARETLOOSE] : re[t.CARET];
-      const z8 = options.includePrerelease ? "-0" : "";
+      const z9 = options.includePrerelease ? "-0" : "";
       return comp.replace(r, (_, M, m, p, pr) => {
         debug("caret", comp, _, M, m, p, pr);
         let ret;
         if (isX(M)) {
           ret = "";
         } else if (isX(m)) {
-          ret = `>=${M}.0.0${z8} <${+M + 1}.0.0-0`;
+          ret = `>=${M}.0.0${z9} <${+M + 1}.0.0-0`;
         } else if (isX(p)) {
           if (M === "0") {
-            ret = `>=${M}.${m}.0${z8} <${M}.${+m + 1}.0-0`;
+            ret = `>=${M}.${m}.0${z9} <${M}.${+m + 1}.0-0`;
           } else {
-            ret = `>=${M}.${m}.0${z8} <${+M + 1}.0.0-0`;
+            ret = `>=${M}.${m}.0${z9} <${+M + 1}.0.0-0`;
           }
         } else if (pr) {
           debug("replaceCaret pr", pr);
@@ -8733,9 +8733,9 @@ var require_range = __commonJS({
           debug("no pr");
           if (M === "0") {
             if (m === "0") {
-              ret = `>=${M}.${m}.${p}${z8} <${M}.${m}.${+p + 1}-0`;
+              ret = `>=${M}.${m}.${p}${z9} <${M}.${m}.${+p + 1}-0`;
             } else {
-              ret = `>=${M}.${m}.${p}${z8} <${M}.${+m + 1}.0-0`;
+              ret = `>=${M}.${m}.${p}${z9} <${M}.${+m + 1}.0-0`;
             }
           } else {
             ret = `>=${M}.${m}.${p} <${+M + 1}.0.0-0`;
@@ -9458,7 +9458,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/index.js"(exports, module) {
     "use strict";
     var internalRe = require_re();
-    var constants = require_constants();
+    var constants2 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse = require_parse();
@@ -9540,8 +9540,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants2.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants2.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -11269,6 +11269,24 @@ var SpendRequestResource = class {
     }
     return res;
   }
+  list() {
+    return this.listSpendRequests();
+  }
+  async listSpendRequests() {
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "GET",
+      url: this.spendRequestsEndpoint
+    });
+    if (status < 200 || status >= 300) {
+      throw new LinkApiError(
+        `Failed to list spend requests (${status}): ${extractApiError(data, rawBody)}`,
+        { status, rawBody, details: data }
+      );
+    }
+    const body = data;
+    const items = body?.data ?? [];
+    return items.map(normalizeSpendRequest);
+  }
   create(params) {
     return this.createSpendRequest(params);
   }
@@ -11450,9 +11468,138 @@ var UserInfoResource = class {
     };
   }
 };
+var EXPIRY_BUFFER_MS = 3e4;
+var WebBotAuthResource = class {
+  verbose;
+  getAccessToken;
+  fetchImpl;
+  credentialsEndpoint;
+  logger;
+  cache = /* @__PURE__ */ new Map();
+  constructor(options) {
+    const config = resolveLinkSdkConfig(options);
+    this.verbose = config.verbose;
+    this.getAccessToken = config.getAccessToken;
+    this.fetchImpl = requireFetchImplementation(config);
+    this.credentialsEndpoint = `${config.apiBaseUrl}/v1/agent_identity/credentials`;
+    this.logger = config.logger;
+  }
+  async rawFetch(opts) {
+    if (this.verbose) {
+      const redactedHeaders = { ...opts.headers };
+      if (redactedHeaders.Authorization)
+        redactedHeaders.Authorization = "Bearer <redacted>";
+      this.logger.debug(`> ${opts.method} ${opts.url}`);
+      this.logger.debug(`  Headers: ${JSON.stringify(redactedHeaders)}`);
+      if (opts.body) this.logger.debug(opts.body);
+    }
+    const fetchOpts = {
+      method: opts.method,
+      headers: opts.headers
+    };
+    if (opts.body) {
+      fetchOpts.body = opts.body;
+    }
+    let response;
+    try {
+      response = await this.fetchImpl(opts.url, fetchOpts);
+    } catch (error) {
+      throw new LinkTransportError(
+        `Request failed: ${opts.method} ${opts.url}`,
+        { cause: error }
+      );
+    }
+    const rawBody = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(rawBody);
+    } catch {
+    }
+    if (this.verbose) {
+      this.logger.debug(`< ${response.status} ${response.statusText}`);
+      response.headers.forEach((value, key) => {
+        this.logger.debug(`  ${key}: ${value}`);
+      });
+      this.logger.debug(JSON.stringify(data, null, 2) ?? rawBody);
+    }
+    return { status: response.status, data, rawBody };
+  }
+  async apiFetch(opts) {
+    const token = await this.getAccessToken();
+    const authedOpts = {
+      ...opts,
+      headers: { ...opts.headers, Authorization: `Bearer ${token}` }
+    };
+    const res = await this.rawFetch(authedOpts);
+    if (res.status === 401) {
+      const refreshedToken = await this.getAccessToken({ forceRefresh: true });
+      authedOpts.headers.Authorization = `Bearer ${refreshedToken}`;
+      return this.rawFetch(authedOpts);
+    }
+    return res;
+  }
+  /**
+   * Returns Web Bot Auth signature headers for the given URL's authority.
+   *
+   * Pass the full merchant URL (e.g. `https://merchant.com/checkout`). The
+   * authority (hostname) is extracted and used as the cache key — repeated
+   * calls for the same domain within the 10-minute signature window are served
+   * from cache without a network round-trip.
+   *
+   * Attach the returned `signature` and `signature_input` values as the
+   * `Signature` and `Signature-Input` HTTP headers on outbound requests to
+   * the merchant site.
+   *
+   * @throws {LinkSdkError} if `url` is not a valid URL
+   * @throws {LinkSdkError} if the credentials response is missing the web_bot_auth block
+   * @throws {LinkApiError} if the credentials endpoint returns a non-2xx status
+   * @throws {LinkTransportError} if the network request fails
+   */
+  async getHeaders(url) {
+    let authority;
+    try {
+      authority = new URL(url).hostname;
+    } catch {
+      throw new LinkSdkError(`Invalid URL: ${url}`);
+    }
+    const cached = this.cache.get(authority);
+    if (cached && Date.now() < cached.expiresAt - EXPIRY_BUFFER_MS) {
+      return cached.block;
+    }
+    const { status, data, rawBody } = await this.apiFetch({
+      method: "POST",
+      url: this.credentialsEndpoint,
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ url })
+    });
+    if (status < 200 || status >= 300) {
+      const body2 = data;
+      const msg = body2?.error ?? body2?.message ?? (rawBody || "unknown error");
+      throw new LinkApiError(
+        `Failed to get web bot auth headers (${status}): ${msg}`,
+        { status, rawBody, details: data }
+      );
+    }
+    const body = data;
+    const webBotAuth = body?.web_bot_auth;
+    if (!webBotAuth) {
+      throw new LinkSdkError(
+        `Credentials response missing web_bot_auth block (status ${status})`
+      );
+    }
+    const expiresAt = Date.parse(webBotAuth.expires_at);
+    if (Number.isNaN(expiresAt)) {
+      throw new LinkSdkError(
+        `Credentials response has invalid expires_at: ${webBotAuth.expires_at}`
+      );
+    }
+    this.cache.set(authority, { block: webBotAuth, expiresAt });
+    return webBotAuth;
+  }
+};
 
 // src/cli.tsx
-import { Cli as Cli9 } from "incur";
+import { Cli as Cli10 } from "incur";
 
 // src/commands/auth/index.tsx
 import { Cli } from "incur";
@@ -11499,6 +11646,41 @@ async function renderInteractive(element, getResult) {
   }
 }
 
+// src/utils/sanitize-text.ts
+import stripAnsi from "strip-ansi";
+var CONTROL_CHAR_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\r]/g;
+var NEEDS_SANITIZE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\r\x1b]/;
+function sanitizeText(input) {
+  if (!input) {
+    return "";
+  }
+  if (!NEEDS_SANITIZE_RE.test(input)) {
+    return input;
+  }
+  return stripAnsi(input).replace(CONTROL_CHAR_RE, "");
+}
+function sanitizeDeep(value) {
+  if (value === null || value === void 0) {
+    return value;
+  }
+  if (typeof value === "string") {
+    return sanitizeText(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeDeep);
+  }
+  if (typeof value === "object") {
+    const result = {};
+    const keys = Object.keys(value);
+    for (let i = 0; i < keys.length; i++) {
+      const k = keys[i];
+      result[k] = sanitizeDeep(value[k]);
+    }
+    return result;
+  }
+  return value;
+}
+
 // src/commands/auth/login.tsx
 import { Box, Text, useInput } from "ink";
 import Spinner from "ink-spinner";
@@ -11723,7 +11905,12 @@ import { z } from "incur";
 var loginOptions = z.object({
   clientName: z.string().default("Link CLI").describe(
     "Agent or app name shown in the Link app when approving the device connection"
-  )
+  ),
+  interval: z.coerce.number().default(0).describe(
+    "Poll interval in seconds. When > 0, polls until authenticated or timeout is reached, yielding status on each attempt."
+  ),
+  maxAttempts: z.coerce.number().default(0).describe("Max poll attempts. 0 = unlimited (use timeout instead)."),
+  timeout: z.coerce.number().default(300).describe("Polling timeout in seconds.")
 });
 var statusOptions = z.object({
   interval: z.coerce.number().default(0).describe(
@@ -11736,47 +11923,65 @@ var statusOptions = z.object({
 // src/commands/auth/status.tsx
 import { Box as Box3, Text as Text3 } from "ink";
 import { useEffect as useEffect3, useState as useState3 } from "react";
+
+// src/commands/auth/utils.ts
+function resolveAuthInfo(envAccessToken2, authStorage2) {
+  if (envAccessToken2) {
+    return {
+      authenticated: true,
+      source: "env",
+      tokenPreview: `${envAccessToken2.substring(0, 20)}...`,
+      tokenType: "Bearer"
+    };
+  }
+  const auth = authStorage2.getAuth();
+  const credentialsPath = authStorage2.getPath();
+  if (auth) {
+    return {
+      authenticated: true,
+      source: "storage",
+      tokenPreview: `${auth.access_token.substring(0, 20)}...`,
+      tokenType: auth.token_type,
+      credentialsPath
+    };
+  }
+  return { authenticated: false, source: "storage", credentialsPath };
+}
+
+// src/commands/auth/status.tsx
 import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
 var AuthStatus = ({
   authStorage: authStorage2 = storage,
+  envAccessToken: envAccessToken2,
   onComplete
 }) => {
-  const storage2 = authStorage2;
   const [checked, setChecked] = useState3(false);
-  const [authenticated, setAuthenticated] = useState3(false);
-  const [tokenPreview, setTokenPreview] = useState3("");
-  const [tokenType, setTokenType] = useState3("");
-  const [credentialsPath, setCredentialsPath] = useState3("");
   useEffect3(() => {
-    const auth = storage2.getAuth();
-    const credentialsPath2 = storage2.getPath();
-    if (auth) {
-      setAuthenticated(true);
-      setTokenPreview(`${auth.access_token.substring(0, 20)}...`);
-      setTokenType(auth.token_type);
-    }
-    setCredentialsPath(credentialsPath2);
     setChecked(true);
     setTimeout(onComplete, DISPLAY_DELAY_MS);
-  }, [onComplete, storage2]);
+  }, [onComplete]);
   if (!checked) {
     return null;
   }
-  if (authenticated) {
+  const info = resolveAuthInfo(envAccessToken2, authStorage2);
+  if (info.authenticated) {
     return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", children: [
       /* @__PURE__ */ jsx3(Text3, { color: "green", children: "\u2713 Authenticated" }),
       /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
         /* @__PURE__ */ jsxs3(Text3, { children: [
           "Access token: ",
-          /* @__PURE__ */ jsx3(Text3, { bold: true, children: tokenPreview })
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.tokenPreview })
         ] }),
         /* @__PURE__ */ jsxs3(Text3, { children: [
           "Token type: ",
-          /* @__PURE__ */ jsx3(Text3, { bold: true, children: tokenType })
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.tokenType })
         ] }),
-        /* @__PURE__ */ jsxs3(Text3, { children: [
+        info.source === "env" ? /* @__PURE__ */ jsxs3(Text3, { children: [
+          "Source: ",
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: "LINK_ACCESS_TOKEN" })
+        ] }) : /* @__PURE__ */ jsxs3(Text3, { children: [
           "Credentials: ",
-          /* @__PURE__ */ jsx3(Text3, { bold: true, children: credentialsPath })
+          /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.credentialsPath })
         ] })
       ] })
     ] });
@@ -11786,14 +11991,55 @@ var AuthStatus = ({
     /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: 'Run "link-cli auth login" to authenticate' }),
     /* @__PURE__ */ jsx3(Box3, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs3(Text3, { children: [
       "Credentials: ",
-      /* @__PURE__ */ jsx3(Text3, { bold: true, children: credentialsPath })
+      /* @__PURE__ */ jsx3(Text3, { bold: true, children: info.credentialsPath })
     ] }) })
   ] });
 };
 
 // src/commands/auth/index.tsx
 import { jsx as jsx4 } from "react/jsx-runtime";
-function createAuthCli(authResource, getUpdateInfo2, authStorage2) {
+async function* pollAuthStatus(authResource, storage2, opts, update) {
+  for await (const result of pollUntil({
+    fn: async () => {
+      const pending = storage2.getPendingDeviceAuth();
+      if (pending && !storage2.isAuthenticated()) {
+        const tokens = await authResource.pollDeviceAuth(pending.device_code);
+        if (tokens) {
+          storage2.setAuth(tokens);
+          storage2.clearPendingDeviceAuth();
+        }
+      }
+      const auth = storage2.getAuth();
+      if (auth) {
+        return {
+          authenticated: true,
+          access_token: `${auth.access_token.substring(0, 20)}...`,
+          token_type: auth.token_type,
+          credentials_path: storage2.getPath(),
+          ...update && { update }
+        };
+      }
+      const currentPending = storage2.getPendingDeviceAuth();
+      return {
+        authenticated: false,
+        credentials_path: storage2.getPath(),
+        ...update && { update },
+        ...currentPending ? {
+          pending: true,
+          verification_url: currentPending.verification_url,
+          phrase: currentPending.phrase
+        } : {}
+      };
+    },
+    isTerminal: (status) => status.authenticated,
+    interval: opts.interval,
+    maxAttempts: opts.maxAttempts,
+    timeout: opts.timeout
+  })) {
+    yield result.value;
+  }
+}
+function createAuthCli(authResource, getUpdateInfo2, authStorage2, envAccessToken2) {
   const storage2 = authStorage2 ?? storage;
   const cli2 = Cli.create("auth", {
     description: "Authentication commands"
@@ -11833,16 +12079,30 @@ function createAuthCli(authResource, getUpdateInfo2, authStorage2) {
         verification_url: authRequest.verification_url_complete,
         phrase: authRequest.user_code
       });
-      yield {
+      const interval = c.options.interval;
+      if (interval <= 0) {
+        yield sanitizeDeep({
+          verification_url: authRequest.verification_url_complete,
+          phrase: authRequest.user_code,
+          instruction: "Present the verification_url to the user and ask them to approve in the Link app. Then call `auth status --interval 5 --max-attempts 60` to poll until authenticated. Do not wait for the user to reply \u2014 start polling immediately.",
+          _next: {
+            command: "auth status --interval 5 --max-attempts 60",
+            poll_interval_seconds: authRequest.interval,
+            until: "authenticated is true"
+          }
+        });
+        return;
+      }
+      yield sanitizeDeep({
         verification_url: authRequest.verification_url_complete,
         phrase: authRequest.user_code,
-        instruction: "Present the verification_url to the user and ask them to approve in the Link app. Then call `auth status --interval 5 --max-attempts 60` to poll until authenticated. Do not wait for the user to reply \u2014 start polling immediately.",
-        _next: {
-          command: "auth status --interval 5 --max-attempts 60",
-          poll_interval_seconds: authRequest.interval,
-          until: "authenticated is true"
-        }
-      };
+        instruction: "Present the verification_url to the user and ask them to approve in the Link app. Polling has started automatically \u2014 no further action needed."
+      });
+      yield* pollAuthStatus(authResource, storage2, {
+        interval,
+        maxAttempts: c.options.maxAttempts,
+        timeout: c.options.timeout
+      });
     }
   });
   cli2.command("logout", {
@@ -11895,63 +12155,55 @@ function createAuthCli(authResource, getUpdateInfo2, authStorage2) {
       } : void 0;
       if (!c.agent && !c.formatExplicit) {
         return renderInteractive(
-          /* @__PURE__ */ jsx4(AuthStatus, { authStorage: storage2, onComplete: () => {
-          } }),
+          /* @__PURE__ */ jsx4(
+            AuthStatus,
+            {
+              authStorage: storage2,
+              envAccessToken: envAccessToken2,
+              onComplete: () => {
+              }
+            }
+          ),
           () => {
-            const auth = storage2.getAuth();
+            const info = resolveAuthInfo(envAccessToken2, storage2);
+            if (info.authenticated) {
+              return {
+                authenticated: true,
+                access_token: info.tokenPreview,
+                token_type: info.tokenType,
+                ...info.source === "storage" && {
+                  credentials_path: info.credentialsPath
+                },
+                ...update && { update }
+              };
+            }
             return {
-              authenticated: !!auth,
-              ...auth ? {
-                access_token: `${auth.access_token.substring(0, 20)}...`,
-                token_type: auth.token_type
-              } : {},
-              credentials_path: storage2.getPath(),
+              authenticated: false,
+              credentials_path: info.credentialsPath,
               ...update && { update }
             };
           }
         );
       }
-      for await (const result of pollUntil({
-        fn: async () => {
-          const pending = storage2.getPendingDeviceAuth();
-          if (pending && !storage2.isAuthenticated()) {
-            const tokens = await authResource.pollDeviceAuth(
-              pending.device_code
-            );
-            if (tokens) {
-              storage2.setAuth(tokens);
-              storage2.clearPendingDeviceAuth();
-            }
-          }
-          const auth = storage2.getAuth();
-          if (auth) {
-            return {
-              authenticated: true,
-              access_token: `${auth.access_token.substring(0, 20)}...`,
-              token_type: auth.token_type,
-              credentials_path: storage2.getPath(),
-              ...update && { update }
-            };
-          }
-          const currentPending = storage2.getPendingDeviceAuth();
-          return {
-            authenticated: false,
-            credentials_path: storage2.getPath(),
-            ...update && { update },
-            ...currentPending ? {
-              pending: true,
-              verification_url: currentPending.verification_url,
-              phrase: currentPending.phrase
-            } : {}
-          };
-        },
-        isTerminal: (status) => status.authenticated,
-        interval,
-        maxAttempts,
-        timeout: opts.timeout
-      })) {
-        yield result.value;
+      if (envAccessToken2) {
+        yield {
+          authenticated: true,
+          access_token: `${envAccessToken2.substring(0, 20)}...`,
+          token_type: "Bearer",
+          ...update && { update }
+        };
+        return;
       }
+      yield* pollAuthStatus(
+        authResource,
+        storage2,
+        {
+          interval,
+          maxAttempts,
+          timeout: opts.timeout
+        },
+        update
+      );
     }
   });
   return cli2;
@@ -13849,8 +14101,85 @@ function createPaymentMethodsCli(createResource, authStorage2) {
   return cli2;
 }
 
+// src/commands/serve/index.ts
+import {
+  createServer
+} from "http";
+import { Cli as Cli6, z as z5 } from "incur";
+async function nodeRequestToWebRequest(req, port) {
+  const body = await new Promise((resolve) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+  });
+  const headers = new Headers();
+  for (const [key, val] of Object.entries(req.headers)) {
+    if (val == null) continue;
+    headers.set(key, Array.isArray(val) ? val.join(", ") : val);
+  }
+  const method = req.method ?? "GET";
+  return new Request(`http://localhost:${port}${req.url ?? "/"}`, {
+    method,
+    headers,
+    body: ["GET", "HEAD"].includes(method) ? void 0 : body.length > 0 ? new Uint8Array(body) : void 0
+  });
+}
+async function sendWebResponse(webRes, res) {
+  webRes.headers.forEach((val, key) => res.setHeader(key, val));
+  const buffer = await webRes.arrayBuffer();
+  res.writeHead(webRes.status);
+  res.end(Buffer.from(buffer));
+}
+function createServeCli(rootCli) {
+  return Cli6.create("serve", {
+    description: "Start an HTTP server exposing link-cli as an MCP endpoint at /mcp",
+    options: z5.object({
+      port: z5.coerce.number().default(54321).describe("Port to listen on")
+    }),
+    async run(c) {
+      const { port } = c.options;
+      const server = createServer(
+        async (req, res) => {
+          res.setHeader("Access-Control-Allow-Origin", "*");
+          res.setHeader(
+            "Access-Control-Allow-Methods",
+            "GET, POST, DELETE, OPTIONS"
+          );
+          res.setHeader(
+            "Access-Control-Allow-Headers",
+            "Content-Type, Accept, Mcp-Session-Id"
+          );
+          if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+          }
+          try {
+            const webReq = await nodeRequestToWebRequest(req, port);
+            const webRes = await rootCli.fetch(webReq);
+            await sendWebResponse(webRes, res);
+          } catch (err) {
+            console.error("Request handling failed:", err);
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Internal server error" }));
+          }
+        }
+      );
+      await new Promise((resolve, reject) => {
+        server.on("error", reject);
+        server.listen(port, () => {
+          process.stderr.write(
+            `link-cli MCP server listening on http://localhost:${port}/mcp
+`
+          );
+        });
+      });
+    }
+  });
+}
+
 // src/commands/shipping-address/index.tsx
-import { Cli as Cli6 } from "incur";
+import { Cli as Cli7 } from "incur";
 
 // src/commands/shipping-address/list.tsx
 import { Box as Box13, Text as Text14 } from "ink";
@@ -13944,7 +14273,7 @@ var ShippingAddressList = ({
 // src/commands/shipping-address/index.tsx
 import { jsx as jsx20 } from "react/jsx-runtime";
 function createShippingAddressCli(createResource, authStorage2) {
-  const cli2 = Cli6.create("shipping-address", {
+  const cli2 = Cli7.create("shipping-address", {
     description: "Shipping address management commands"
   });
   cli2.command("list", {
@@ -13967,46 +14296,79 @@ function createShippingAddressCli(createResource, authStorage2) {
 }
 
 // src/commands/spend-request/index.tsx
-import { Cli as Cli7, z as z7 } from "incur";
+import { Cli as Cli8, z as z8 } from "incur";
 
 // src/utils/credential-output.ts
+import { constants } from "fs";
 import fs4 from "fs/promises";
 import path6 from "path";
 async function writeCredentialFile(filePath, data, force) {
   const resolved = path6.resolve(filePath);
-  if (!force) {
-    try {
-      await fs4.access(resolved);
+  let existing;
+  try {
+    existing = await fs4.lstat(resolved);
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  if (existing?.isSymbolicLink()) {
+    throw new Error(
+      `OUTPUT_FILE_SYMLINK: ${resolved} is a symbolic link. Refusing to write credentials through it.`
+    );
+  }
+  if (existing) {
+    if (!force) {
       throw new Error(
         `OUTPUT_FILE_EXISTS: ${resolved} already exists. Use --force to overwrite.`
       );
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
     }
+    await fs4.unlink(resolved);
+  }
+  const noFollowFlag = constants.O_NOFOLLOW ?? 0;
+  let handle;
+  try {
+    handle = await fs4.open(
+      resolved,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollowFlag,
+      384
+    );
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") {
+      throw new Error(
+        `OUTPUT_FILE_EXISTS: ${resolved} already exists. Use --force to overwrite.`
+      );
+    }
+    if (code === "ELOOP") {
+      throw new Error(
+        `OUTPUT_FILE_SYMLINK: ${resolved} is a symbolic link. Refusing to write credentials through it.`
+      );
+    }
+    throw err;
+  }
+  try {
+    await handle.write(JSON.stringify(data, null, 2));
+  } finally {
+    await handle.close();
   }
-  await fs4.writeFile(resolved, JSON.stringify(data, null, 2), {
-    mode: 384
-  });
-  await fs4.chmod(resolved, 384);
   return resolved;
 }
 
 // src/utils/line-item-parser.ts
-import { z as z5 } from "zod";
-var LineItemSchema = z5.object({
-  name: z5.string(),
-  url: z5.string().optional(),
-  image_url: z5.string().optional(),
-  description: z5.string().optional(),
-  sku: z5.string().optional(),
-  quantity: z5.coerce.number().optional(),
-  unit_amount: z5.coerce.number().optional(),
-  product_url: z5.string().optional()
+import { z as z6 } from "zod";
+var LineItemSchema = z6.object({
+  name: z6.string(),
+  url: z6.string().optional(),
+  image_url: z6.string().optional(),
+  description: z6.string().optional(),
+  sku: z6.string().optional(),
+  quantity: z6.coerce.number().optional(),
+  unit_amount: z6.coerce.number().optional(),
+  product_url: z6.string().optional()
 }).strict();
-var TotalSchema = z5.object({
-  type: z5.string(),
-  display_text: z5.string(),
-  amount: z5.coerce.number()
+var TotalSchema = z6.object({
+  type: z6.string(),
+  display_text: z6.string(),
+  amount: z6.coerce.number()
 }).strict();
 function parseKvString(raw) {
   const result = {};
@@ -14036,7 +14398,7 @@ function parseLineItemFlag(raw) {
   try {
     return LineItemSchema.parse(obj);
   } catch (err) {
-    if (err instanceof z5.ZodError)
+    if (err instanceof z6.ZodError)
       throw formatZodError(err, "Line item", LineItemSchema);
     throw err;
   }
@@ -14046,7 +14408,7 @@ function parseTotalFlag(raw) {
   try {
     return TotalSchema.parse(obj);
   } catch (err) {
-    if (err instanceof z5.ZodError)
+    if (err instanceof z6.ZodError)
       throw formatZodError(err, "Total", TotalSchema);
     throw err;
   }
@@ -14360,11 +14722,68 @@ var CreateSpendRequest = ({
   ] });
 };
 
-// src/commands/spend-request/request-approval.tsx
-import { Box as Box17, Text as Text18 } from "ink";
+// src/commands/spend-request/list.tsx
+import { Box as Box17, Text as Text18, useApp as useApp4 } from "ink";
 import Spinner9 from "ink-spinner";
-import { useCallback as useCallback7, useEffect as useEffect10, useState as useState10 } from "react";
+import { useCallback as useCallback7 } from "react";
 import { jsx as jsx24, jsxs as jsxs17 } from "react/jsx-runtime";
+var SpendRequestList = ({
+  repository,
+  onComplete
+}) => {
+  const { exit } = useApp4();
+  const action = useCallback7(
+    () => repository.listSpendRequests(),
+    [repository]
+  );
+  const wrappedOnComplete = useCallback7(
+    (result) => {
+      onComplete(result);
+      exit();
+    },
+    [onComplete, exit]
+  );
+  const {
+    status,
+    data: requests,
+    error
+  } = useAsyncAction(action, wrappedOnComplete);
+  if (status === "loading") {
+    return /* @__PURE__ */ jsx24(Box17, { children: /* @__PURE__ */ jsxs17(Text18, { color: "cyan", children: [
+      /* @__PURE__ */ jsx24(Spinner9, { type: "dots" }),
+      " Loading spend requests..."
+    ] }) });
+  }
+  if (status === "error") {
+    return /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx24(Text18, { color: "red", children: "\u2717 Failed to load spend requests" }),
+      /* @__PURE__ */ jsx24(Text18, { color: "red", children: error })
+    ] });
+  }
+  if (!requests || requests.length === 0) {
+    return /* @__PURE__ */ jsx24(Box17, { children: /* @__PURE__ */ jsx24(Text18, { dimColor: true, children: "No active spend requests found" }) });
+  }
+  return /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx24(Text18, { bold: true, children: "Active Spend Requests" }),
+    /* @__PURE__ */ jsx24(Box17, { flexDirection: "column", marginTop: 1, children: requests.map((sr) => {
+      const statusColor = sr.status === "approved" ? "green" : sr.status === "pending_approval" ? "yellow" : "white";
+      const amount = sr.amount != null ? `$${(sr.amount / 100).toFixed(2)} ${(sr.currency ?? "usd").toUpperCase()}` : "";
+      return /* @__PURE__ */ jsx24(Box17, { paddingX: 2, children: /* @__PURE__ */ jsxs17(Text18, { children: [
+        /* @__PURE__ */ jsx24(Text18, { dimColor: true, children: sr.id }),
+        "  ",
+        /* @__PURE__ */ jsx24(Text18, { color: statusColor, children: sr.status }),
+        sr.merchant_name ? `  ${sr.merchant_name}` : "",
+        amount ? `  ${amount}` : ""
+      ] }) }, sr.id);
+    }) })
+  ] });
+};
+
+// src/commands/spend-request/request-approval.tsx
+import { Box as Box18, Text as Text19 } from "ink";
+import Spinner10 from "ink-spinner";
+import { useCallback as useCallback8, useEffect as useEffect10, useState as useState10 } from "react";
+import { jsx as jsx25, jsxs as jsxs18 } from "react/jsx-runtime";
 var RequestApproval = ({
   repository,
   id,
@@ -14374,8 +14793,8 @@ var RequestApproval = ({
   const [approvalUrl, setApprovalUrl] = useState10("");
   const [result, setResult] = useState10(null);
   const [error, setError] = useState10("");
-  const onSuccess = useCallback7((r) => setResult(r), []);
-  const onError = useCallback7((msg) => setError(msg), []);
+  const onSuccess = useCallback8((r) => setResult(r), []);
+  const onError = useCallback8((msg) => setError(msg), []);
   useApprovalPolling({
     status,
     setStatus,
@@ -14400,46 +14819,46 @@ var RequestApproval = ({
     request();
   }, [repository, id]);
   if (status === "requesting") {
-    return /* @__PURE__ */ jsx24(Box17, { children: /* @__PURE__ */ jsxs17(Text18, { color: "cyan", children: [
-      /* @__PURE__ */ jsx24(Spinner9, { type: "dots" }),
+    return /* @__PURE__ */ jsx25(Box18, { children: /* @__PURE__ */ jsxs18(Text19, { color: "cyan", children: [
+      /* @__PURE__ */ jsx25(Spinner10, { type: "dots" }),
       " Requesting approval..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx24(Text18, { color: "red", children: "\u2717 Failed to request approval" }),
-      /* @__PURE__ */ jsx24(Text18, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx25(Text19, { color: "red", children: "\u2717 Failed to request approval" }),
+      /* @__PURE__ */ jsx25(Text19, { color: "red", children: error })
     ] });
   }
   if (status === "success") {
-    return /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx24(Text18, { color: "green", children: "\u2713 Approval completed" }),
-      /* @__PURE__ */ jsxs17(Box17, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs17(Text18, { children: [
+    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx25(Text19, { color: "green", children: "\u2713 Approval completed" }),
+      /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs18(Text19, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx24(Text18, { bold: true, children: result?.id })
+          /* @__PURE__ */ jsx25(Text19, { bold: true, children: result?.id })
         ] }),
-        /* @__PURE__ */ jsxs17(Text18, { children: [
+        /* @__PURE__ */ jsxs18(Text19, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx24(Text18, { bold: true, children: result?.status })
+          /* @__PURE__ */ jsx25(Text19, { bold: true, children: result?.status })
         ] }),
-        /* @__PURE__ */ jsxs17(Text18, { children: [
+        /* @__PURE__ */ jsxs18(Text19, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx24(Text18, { bold: true, children: result?.amount != null ? `${result.amount} ${result.currency?.toUpperCase() ?? ""}`.trim() : "N/A" })
+          /* @__PURE__ */ jsx25(Text19, { bold: true, children: result?.amount != null ? `${result.amount} ${result.currency?.toUpperCase() ?? ""}`.trim() : "N/A" })
         ] }),
-        /* @__PURE__ */ jsxs17(Text18, { children: [
+        /* @__PURE__ */ jsxs18(Text19, { children: [
           "Merchant: ",
-          /* @__PURE__ */ jsx24(Text18, { bold: true, children: result?.merchant_name })
+          /* @__PURE__ */ jsx25(Text19, { bold: true, children: result?.merchant_name })
         ] }),
-        result?.credential_type === "shared_payment_token" && result.shared_payment_token && /* @__PURE__ */ jsxs17(Text18, { children: [
+        result?.credential_type === "shared_payment_token" && result.shared_payment_token && /* @__PURE__ */ jsxs18(Text19, { children: [
           "Token: ",
-          /* @__PURE__ */ jsx24(Text18, { bold: true, children: result.shared_payment_token.id })
+          /* @__PURE__ */ jsx25(Text19, { bold: true, children: result.shared_payment_token.id })
         ] })
       ] })
     ] });
   }
-  return /* @__PURE__ */ jsx24(
+  return /* @__PURE__ */ jsx25(
     ApprovalWaitingView,
     {
       status,
@@ -14449,10 +14868,10 @@ var RequestApproval = ({
 };
 
 // src/commands/spend-request/retrieve.tsx
-import { Box as Box18, Text as Text19 } from "ink";
-import Spinner10 from "ink-spinner";
+import { Box as Box19, Text as Text20 } from "ink";
+import Spinner11 from "ink-spinner";
 import { useEffect as useEffect11, useRef as useRef5, useState as useState11 } from "react";
-import { jsx as jsx25, jsxs as jsxs18 } from "react/jsx-runtime";
+import { jsx as jsx26, jsxs as jsxs19 } from "react/jsx-runtime";
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "approved",
   "denied",
@@ -14576,181 +14995,181 @@ var RetrieveSpendRequest = ({
     };
   }, [phase, repository, id, include, timeout, onComplete]);
   if (phase === "fetching") {
-    return /* @__PURE__ */ jsx25(Box18, { children: /* @__PURE__ */ jsxs18(Text19, { color: "cyan", children: [
-      /* @__PURE__ */ jsx25(Spinner10, { type: "dots" }),
+    return /* @__PURE__ */ jsx26(Box19, { children: /* @__PURE__ */ jsxs19(Text20, { color: "cyan", children: [
+      /* @__PURE__ */ jsx26(Spinner11, { type: "dots" }),
       " Retrieving spend request ",
       id,
       "..."
     ] }) });
   }
   if (phase === "error") {
-    return /* @__PURE__ */ jsx25(Box18, { flexDirection: "column", children: /* @__PURE__ */ jsxs18(Text19, { color: "red", children: [
+    return /* @__PURE__ */ jsx26(Box19, { flexDirection: "column", children: /* @__PURE__ */ jsxs19(Text20, { color: "red", children: [
       "\u2717 ",
       error
     ] }) });
   }
   if (phase === "timeout") {
-    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs18(Text19, { color: "yellow", children: [
+    return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs19(Text20, { color: "yellow", children: [
         "\u2717 Timed out waiting for approval after ",
         timeout,
         "s"
       ] }),
-      request && /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+      request && /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request.id })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request.id })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request.status })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request.status })
         ] })
       ] })
     ] });
   }
   if (phase === "polling") {
-    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx25(Box18, { children: /* @__PURE__ */ jsxs18(Text19, { color: "cyan", children: [
-        /* @__PURE__ */ jsx25(Spinner10, { type: "dots" }),
+    return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx26(Box19, { children: /* @__PURE__ */ jsxs19(Text20, { color: "cyan", children: [
+        /* @__PURE__ */ jsx26(Spinner11, { type: "dots" }),
         " Awaiting approval... (",
         elapsed,
         "s elapsed)"
       ] }) }),
-      request?.approval_url && /* @__PURE__ */ jsx25(Box18, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs18(Text19, { dimColor: true, children: [
+      request?.approval_url && /* @__PURE__ */ jsx26(Box19, { marginTop: 1, paddingX: 2, children: /* @__PURE__ */ jsxs19(Text20, { dimColor: true, children: [
         "Approval URL: ",
-        /* @__PURE__ */ jsx25(Text19, { color: "cyan", children: request.approval_url })
+        /* @__PURE__ */ jsx26(Text20, { color: "cyan", children: request.approval_url })
       ] }) })
     ] });
   }
   if (phase === "finalized") {
-    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsxs18(Text19, { color: "yellow", children: [
+    return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs19(Text20, { color: "yellow", children: [
         "Spend request reached terminal status: ",
         request?.status
       ] }),
-      /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+      /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.id })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.id })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "Status: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.status })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.status })
         ] })
       ] })
     ] });
   }
   if (phase === "declined") {
-    return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx25(Text19, { color: "red", children: "\u2717 Spend request declined" }),
-      /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+    return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx26(Text20, { color: "red", children: "\u2717 Spend request declined" }),
+      /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "ID: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.id })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.id })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "Status:",
           " ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, color: "red", children: request?.status })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, color: "red", children: request?.status })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "Amount:",
           " ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.amount != null ? String(request.amount) : "N/A" })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.amount != null ? String(request.amount) : "N/A" })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           "Merchant: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.merchant_name })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.merchant_name })
         ] })
       ] })
     ] });
   }
-  return /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx25(Text19, { color: "green", children: "\u2713 Spend request approved" }),
-    /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs18(Text19, { children: [
+  return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx26(Text20, { color: "green", children: "\u2713 Spend request approved" }),
+    /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs19(Text20, { children: [
         "ID: ",
-        /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.id })
+        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.id })
       ] }),
-      /* @__PURE__ */ jsxs18(Text19, { children: [
+      /* @__PURE__ */ jsxs19(Text20, { children: [
         "Status:",
         " ",
-        /* @__PURE__ */ jsx25(Text19, { bold: true, color: "green", children: request?.status })
+        /* @__PURE__ */ jsx26(Text20, { bold: true, color: "green", children: request?.status })
       ] }),
-      /* @__PURE__ */ jsxs18(Text19, { children: [
+      /* @__PURE__ */ jsxs19(Text20, { children: [
         "Amount:",
         " ",
-        /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.amount != null ? String(request.amount) : "N/A" })
+        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.amount != null ? String(request.amount) : "N/A" })
       ] }),
-      /* @__PURE__ */ jsxs18(Text19, { children: [
+      /* @__PURE__ */ jsxs19(Text20, { children: [
         "Merchant: ",
-        /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.merchant_name })
+        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.merchant_name })
       ] }),
-      /* @__PURE__ */ jsxs18(Text19, { children: [
+      /* @__PURE__ */ jsxs19(Text20, { children: [
         "Line Items:",
         " ",
-        /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
+        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
       ] }),
-      request?.shared_payment_token && /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
-        /* @__PURE__ */ jsxs18(Text19, { bold: true, children: [
+      request?.shared_payment_token && /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsxs19(Text20, { bold: true, children: [
           "\x1B]8;;https://docs.stripe.com/agentic-commerce/concepts/shared-payment-tokens\x07",
           "Shared Payment Token",
           "\x1B]8;;\x07",
           ":"
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "Token: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request.shared_payment_token.id })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request.shared_payment_token.id })
         ] })
       ] }),
-      request?.card && !outputFile && /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
-        /* @__PURE__ */ jsx25(Text19, { bold: true, children: "Card Details:" }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+      request?.card && !outputFile && /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx26(Text20, { bold: true, children: "Card Details:" }),
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "Number: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.card.number })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.card.number })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "Brand: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request?.card.brand })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.card.brand })
         ] }),
-        /* @__PURE__ */ jsxs18(Text19, { children: [
+        /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "Expiry:",
           " ",
-          /* @__PURE__ */ jsxs18(Text19, { bold: true, children: [
+          /* @__PURE__ */ jsxs19(Text20, { bold: true, children: [
             String(request?.card.exp_month).padStart(2, "0"),
             "/",
             request?.card.exp_year
           ] })
         ] }),
-        request?.card.cvc && /* @__PURE__ */ jsxs18(Text19, { children: [
+        request?.card.cvc && /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "CVC: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request.card.cvc })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request.card.cvc })
         ] }),
-        request?.card.valid_until && /* @__PURE__ */ jsxs18(Text19, { children: [
+        request?.card.valid_until && /* @__PURE__ */ jsxs19(Text20, { children: [
           " ",
           "Valid Until: ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: request.card.valid_until })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: request.card.valid_until })
         ] }),
-        request?.card.billing_address && /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: " Billing Address:" }),
-          /* @__PURE__ */ jsxs18(Text19, { children: [
+        request?.card.billing_address && /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: " Billing Address:" }),
+          /* @__PURE__ */ jsxs19(Text20, { children: [
             "  ",
             request.card.billing_address.name
           ] }),
-          /* @__PURE__ */ jsxs18(Text19, { children: [
+          /* @__PURE__ */ jsxs19(Text20, { children: [
             "  ",
             request.card.billing_address.line1
           ] }),
-          request.card.billing_address.line2 && /* @__PURE__ */ jsxs18(Text19, { children: [
+          request.card.billing_address.line2 && /* @__PURE__ */ jsxs19(Text20, { children: [
             "  ",
             request.card.billing_address.line2
           ] }),
-          /* @__PURE__ */ jsxs18(Text19, { children: [
+          /* @__PURE__ */ jsxs19(Text20, { children: [
             "  ",
             [
               request.card.billing_address.city,
@@ -14758,18 +15177,18 @@ var RetrieveSpendRequest = ({
               request.card.billing_address.postal_code
             ].filter(Boolean).join(", ")
           ] }),
-          /* @__PURE__ */ jsxs18(Text19, { children: [
+          /* @__PURE__ */ jsxs19(Text20, { children: [
             "  ",
             request.card.billing_address.country
           ] })
         ] })
       ] }),
-      request?.card && outputFile && /* @__PURE__ */ jsxs18(Box18, { flexDirection: "column", marginTop: 1, children: [
-        outputFilePath && /* @__PURE__ */ jsxs18(Text19, { color: "green", children: [
+      request?.card && outputFile && /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, children: [
+        outputFilePath && /* @__PURE__ */ jsxs19(Text20, { color: "green", children: [
           "Card credentials written to ",
-          /* @__PURE__ */ jsx25(Text19, { bold: true, children: outputFilePath })
+          /* @__PURE__ */ jsx26(Text20, { bold: true, children: outputFilePath })
         ] }),
-        fileError && /* @__PURE__ */ jsxs18(Text19, { color: "red", children: [
+        fileError && /* @__PURE__ */ jsxs19(Text20, { color: "red", children: [
           "Failed to write card file: ",
           fileError
         ] })
@@ -14779,136 +15198,136 @@ var RetrieveSpendRequest = ({
 };
 
 // src/commands/spend-request/schema.ts
-import { z as z6 } from "incur";
-var createOptions = z6.object({
-  paymentMethodId: z6.string().describe("Payment method ID"),
-  credentialType: z6.enum(["shared_payment_token", "card"]).default("card").describe(
+import { z as z7 } from "incur";
+var createOptions = z7.object({
+  paymentMethodId: z7.string().describe("Payment method ID"),
+  credentialType: z7.enum(["shared_payment_token", "card"]).default("card").describe(
     '"card" for checkout forms/Stripe Elements; "shared_payment_token" for HTTP 402/machine payment flows'
   ),
-  networkId: z6.string().optional().describe(
+  networkId: z7.string().optional().describe(
     "Network ID (required for shared_payment_token) \u2014 use `link-cli mpp decode` to extract"
   ),
-  amount: z6.coerce.number().int().positive().max(5e4).describe("Amount in cents, max 50000 ($500.00)"),
-  currency: z6.string().length(3).default("usd").describe("Currency code"),
-  merchantName: z6.string().optional().describe(
+  amount: z7.coerce.number().int().positive().max(5e4).describe("Amount in cents, max 50000 ($500.00)"),
+  currency: z7.string().length(3).default("usd").describe("Currency code"),
+  merchantName: z7.string().optional().describe(
     "Merchant name (required for card; forbidden for shared_payment_token)"
   ),
-  merchantUrl: z6.string().optional().describe(
+  merchantUrl: z7.string().optional().describe(
     "Merchant URL (required for card; forbidden for shared_payment_token)"
   ),
-  context: z6.string().min(100).describe(
+  context: z7.string().min(100).describe(
     "Min 100 chars \u2014 describe the purchase and rationale; the user reads this when approving"
   ),
-  lineItem: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe(
+  lineItem: z7.array(z7.union([z7.string(), z7.record(z7.string(), z7.unknown())])).default([]).describe(
     'Line item (repeatable, key:value format). Keys: name (required), quantity, unit_amount, description, sku, url, image_url, product_url. Example: "name:Shoes,unit_amount:5000,quantity:2"'
   ),
-  total: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe(
+  total: z7.array(z7.union([z7.string(), z7.record(z7.string(), z7.unknown())])).default([]).describe(
     'Total (repeatable, key:value format). Keys: type (required; one of: subtotal, tax, total, items_base_amount, items_discount, discount, fulfillment, shipping, fee, gift_wrap, tip, store_credit), display_text (required), amount (required). Example: "type:total,display_text:Total,amount:5000"'
   ),
-  requestApproval: z6.boolean().default(true).describe("Request approval and poll until approved/denied/expired"),
-  test: z6.boolean().default(false).describe(
+  requestApproval: z7.boolean().default(true).describe("Request approval and poll until approved/denied/expired"),
+  test: z7.boolean().default(false).describe(
     "Use test mode (creates testmode credentials from test card data)"
   ),
-  outputFile: z6.string().optional().describe(
+  outputFile: z7.string().optional().describe(
     "Write full card credentials to this file path; stdout shows redacted card data only"
   ),
-  force: z6.boolean().default(false).describe("Overwrite output file if it already exists")
+  force: z7.boolean().default(false).describe("Overwrite output file if it already exists")
 });
-var retrieveOptions = z6.object({
-  timeout: z6.coerce.number().default(600).describe(
+var retrieveOptions = z7.object({
+  timeout: z7.coerce.number().default(600).describe(
     "Polling timeout in seconds. When reached during active polling, exits non-zero with POLLING_TIMEOUT. Default exceeds the server-side spend-request expiry so polling outlives the request itself."
   ),
-  interval: z6.coerce.number().default(0).describe(
+  interval: z7.coerce.number().default(0).describe(
     "Poll interval in seconds. When > 0, polls until status is terminal, timeout is reached, or max attempts are exhausted."
   ),
-  maxAttempts: z6.coerce.number().default(0).describe(
+  maxAttempts: z7.coerce.number().default(0).describe(
     "Max poll attempts. 0 = unlimited. Exhaustion during active polling exits non-zero with POLLING_TIMEOUT."
   ),
-  include: z6.array(z6.string()).default([]).describe("Include extra data (repeatable, e.g. --include card)"),
-  outputFile: z6.string().optional().describe(
+  include: z7.array(z7.string()).default([]).describe("Include extra data (repeatable, e.g. --include card)"),
+  outputFile: z7.string().optional().describe(
     "Write full card credentials to this file path; stdout shows redacted card data only"
   ),
-  force: z6.boolean().default(false).describe("Overwrite output file if it already exists")
-});
-var updateOptions = z6.object({
-  paymentMethodId: z6.string().optional().describe("Payment method ID"),
-  amount: z6.coerce.number().optional().describe("Amount in cents"),
-  merchantUrl: z6.string().optional().describe("Merchant URL"),
-  profileId: z6.string().optional().describe("Profile ID"),
-  merchantId: z6.string().optional().describe("Merchant ID"),
-  currency: z6.string().optional().describe("Currency code"),
-  lineItem: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe(
+  force: z7.boolean().default(false).describe("Overwrite output file if it already exists")
+});
+var updateOptions = z7.object({
+  paymentMethodId: z7.string().optional().describe("Payment method ID"),
+  amount: z7.coerce.number().optional().describe("Amount in cents"),
+  merchantUrl: z7.string().optional().describe("Merchant URL"),
+  profileId: z7.string().optional().describe("Profile ID"),
+  merchantId: z7.string().optional().describe("Merchant ID"),
+  currency: z7.string().optional().describe("Currency code"),
+  lineItem: z7.array(z7.union([z7.string(), z7.record(z7.string(), z7.unknown())])).default([]).describe(
     'Line item (repeatable, key:value format). Keys: name (required), quantity, unit_amount, description, sku, url, image_url, product_url. Example: "name:Shoes,unit_amount:5000,quantity:2"'
   ),
-  total: z6.array(z6.union([z6.string(), z6.record(z6.string(), z6.unknown())])).default([]).describe(
+  total: z7.array(z7.union([z7.string(), z7.record(z7.string(), z7.unknown())])).default([]).describe(
     'Total (repeatable, key:value format). Keys: type (required; one of: subtotal, tax, total, items_base_amount, items_discount, discount, fulfillment, shipping, fee, gift_wrap, tip, store_credit), display_text (required), amount (required). Example: "type:total,display_text:Total,amount:5000"'
   )
 });
 
 // src/commands/spend-request/update.tsx
-import { Box as Box19, Text as Text20 } from "ink";
-import Spinner11 from "ink-spinner";
-import { useCallback as useCallback8 } from "react";
-import { jsx as jsx26, jsxs as jsxs19 } from "react/jsx-runtime";
+import { Box as Box20, Text as Text21 } from "ink";
+import Spinner12 from "ink-spinner";
+import { useCallback as useCallback9 } from "react";
+import { jsx as jsx27, jsxs as jsxs20 } from "react/jsx-runtime";
 var UpdateSpendRequest = ({
   repository,
   id,
   params,
   onComplete
 }) => {
-  const action = useCallback8(
+  const action = useCallback9(
     () => repository.updateSpendRequest(id, params),
     [repository, id, params]
   );
   const { status, data: request, error } = useAsyncAction(action, onComplete);
   if (status === "loading") {
-    return /* @__PURE__ */ jsx26(Box19, { children: /* @__PURE__ */ jsxs19(Text20, { color: "cyan", children: [
-      /* @__PURE__ */ jsx26(Spinner11, { type: "dots" }),
+    return /* @__PURE__ */ jsx27(Box20, { children: /* @__PURE__ */ jsxs20(Text21, { color: "cyan", children: [
+      /* @__PURE__ */ jsx27(Spinner12, { type: "dots" }),
       " Updating spend request ",
       id,
       "..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx26(Text20, { color: "red", children: "\u2717 Failed to update spend request" }),
-      /* @__PURE__ */ jsx26(Text20, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx27(Text21, { color: "red", children: "\u2717 Failed to update spend request" }),
+      /* @__PURE__ */ jsx27(Text21, { color: "red", children: error })
     ] });
   }
-  return /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx26(Text20, { color: "green", children: "\u2713 Spend request updated" }),
-    /* @__PURE__ */ jsxs19(Box19, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs19(Text20, { children: [
+  return /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx27(Text21, { color: "green", children: "\u2713 Spend request updated" }),
+    /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs20(Text21, { children: [
         "ID: ",
-        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.id })
+        /* @__PURE__ */ jsx27(Text21, { bold: true, children: request?.id })
       ] }),
-      /* @__PURE__ */ jsxs19(Text20, { children: [
+      /* @__PURE__ */ jsxs20(Text21, { children: [
         "Status: ",
-        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.status })
+        /* @__PURE__ */ jsx27(Text21, { bold: true, children: request?.status })
       ] }),
-      /* @__PURE__ */ jsxs19(Text20, { children: [
+      /* @__PURE__ */ jsxs20(Text21, { children: [
         "Amount:",
         " ",
-        /* @__PURE__ */ jsx26(Text20, { bold: true, children: (() => {
+        /* @__PURE__ */ jsx27(Text21, { bold: true, children: (() => {
           const t = request?.totals.find((t2) => t2.type === "total");
           return t ? String(t.amount) : "N/A";
         })() })
       ] }),
-      /* @__PURE__ */ jsxs19(Text20, { children: [
+      /* @__PURE__ */ jsxs20(Text21, { children: [
         "Merchant: ",
-        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.merchant_name })
+        /* @__PURE__ */ jsx27(Text21, { bold: true, children: request?.merchant_name })
       ] }),
-      /* @__PURE__ */ jsxs19(Text20, { children: [
+      /* @__PURE__ */ jsxs20(Text21, { children: [
         "Line Items:",
         " ",
-        /* @__PURE__ */ jsx26(Text20, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
+        /* @__PURE__ */ jsx27(Text21, { bold: true, children: request?.line_items.map((li) => li.name).join(", ") })
       ] })
     ] })
   ] });
 };
 
 // src/commands/spend-request/index.tsx
-import { jsx as jsx27 } from "react/jsx-runtime";
+import { jsx as jsx28 } from "react/jsx-runtime";
 async function applyOutputFile(request, outputFile, force) {
   if (!outputFile || !request.card) return request;
   const fileData = {
@@ -14927,9 +15346,24 @@ async function applyOutputFile(request, outputFile, force) {
   };
 }
 function createSpendRequestCli(repository, authStorage2) {
-  const cli2 = Cli7.create("spend-request", {
+  const cli2 = Cli8.create("spend-request", {
     description: "Spend request management commands"
   });
+  cli2.command("list", {
+    description: "List active spend requests (created, pending_approval, approved)",
+    outputPolicy: "agent-only",
+    middleware: [requireAuth(authStorage2)],
+    async run(c) {
+      if (!c.agent && !c.formatExplicit) {
+        return renderInteractive(
+          /* @__PURE__ */ jsx28(SpendRequestList, { repository, onComplete: () => {
+          } }),
+          () => repository.listSpendRequests()
+        );
+      }
+      return repository.listSpendRequests();
+    }
+  });
   cli2.command("create", {
     description: "Create a new spend request",
     options: createOptions,
@@ -14998,7 +15432,7 @@ function createSpendRequestCli(repository, authStorage2) {
       if (!c.agent && !c.formatExplicit) {
         let capturedResult = null;
         return renderInteractive(
-          /* @__PURE__ */ jsx27(
+          /* @__PURE__ */ jsx28(
             CreateSpendRequest,
             {
               repository,
@@ -15043,8 +15477,8 @@ function createSpendRequestCli(repository, authStorage2) {
   });
   cli2.command("update", {
     description: "Update a spend request",
-    args: z7.object({
-      id: z7.string().describe("Spend request ID")
+    args: z8.object({
+      id: z8.string().describe("Spend request ID")
     }),
     options: updateOptions,
     outputPolicy: "agent-only",
@@ -15072,7 +15506,7 @@ function createSpendRequestCli(repository, authStorage2) {
       if (!c.agent && !c.formatExplicit) {
         let capturedResult = null;
         return renderInteractive(
-          /* @__PURE__ */ jsx27(
+          /* @__PURE__ */ jsx28(
             UpdateSpendRequest,
             {
               repository,
@@ -15095,8 +15529,8 @@ function createSpendRequestCli(repository, authStorage2) {
   });
   cli2.command("request-approval", {
     description: "Request approval for a spend request",
-    args: z7.object({
-      id: z7.string().describe("Spend request ID")
+    args: z8.object({
+      id: z8.string().describe("Spend request ID")
     }),
     outputPolicy: "agent-only",
     async *run(c) {
@@ -15105,7 +15539,7 @@ function createSpendRequestCli(repository, authStorage2) {
       if (!c.agent && !c.formatExplicit) {
         let capturedResult = null;
         return renderInteractive(
-          /* @__PURE__ */ jsx27(
+          /* @__PURE__ */ jsx28(
             RequestApproval,
             {
               repository,
@@ -15135,8 +15569,8 @@ function createSpendRequestCli(repository, authStorage2) {
   });
   cli2.command("retrieve", {
     description: "Retrieve a spend request",
-    args: z7.object({
-      id: z7.string().describe("Spend request ID")
+    args: z8.object({
+      id: z8.string().describe("Spend request ID")
     }),
     options: retrieveOptions,
     outputPolicy: "agent-only",
@@ -15154,7 +15588,7 @@ function createSpendRequestCli(repository, authStorage2) {
       if (!c.agent && !c.formatExplicit) {
         let capturedResult = null;
         return renderInteractive(
-          /* @__PURE__ */ jsx27(
+          /* @__PURE__ */ jsx28(
             RetrieveSpendRequest,
             {
               repository,
@@ -15226,8 +15660,8 @@ function createSpendRequestCli(repository, authStorage2) {
   });
   cli2.command("cancel", {
     description: "Cancel a spend request",
-    args: z7.object({
-      id: z7.string().describe("Spend request ID")
+    args: z8.object({
+      id: z8.string().describe("Spend request ID")
     }),
     outputPolicy: "agent-only",
     middleware: [requireAuth(authStorage2)],
@@ -15236,7 +15670,7 @@ function createSpendRequestCli(repository, authStorage2) {
       if (!c.agent && !c.formatExplicit) {
         let capturedResult = null;
         return renderInteractive(
-          /* @__PURE__ */ jsx27(
+          /* @__PURE__ */ jsx28(
             CancelSpendRequest,
             {
               repository,
@@ -15260,54 +15694,54 @@ function createSpendRequestCli(repository, authStorage2) {
 }
 
 // src/commands/user-info/index.tsx
-import { Cli as Cli8 } from "incur";
+import { Cli as Cli9 } from "incur";
 
 // src/commands/user-info/retrieve.tsx
-import { Box as Box20, Text as Text21 } from "ink";
-import Spinner12 from "ink-spinner";
-import { useCallback as useCallback9 } from "react";
-import { jsx as jsx28, jsxs as jsxs20 } from "react/jsx-runtime";
+import { Box as Box21, Text as Text22 } from "ink";
+import Spinner13 from "ink-spinner";
+import { useCallback as useCallback10 } from "react";
+import { jsx as jsx29, jsxs as jsxs21 } from "react/jsx-runtime";
 var UserInfoRetrieve = ({
   resource,
   onComplete
 }) => {
-  const action = useCallback9(() => resource.retrieve(), [resource]);
+  const action = useCallback10(() => resource.retrieve(), [resource]);
   const { status, data: userInfo, error } = useAsyncAction(action, onComplete);
   if (status === "loading") {
-    return /* @__PURE__ */ jsx28(Box20, { children: /* @__PURE__ */ jsxs20(Text21, { color: "cyan", children: [
-      /* @__PURE__ */ jsx28(Spinner12, { type: "dots" }),
+    return /* @__PURE__ */ jsx29(Box21, { children: /* @__PURE__ */ jsxs21(Text22, { color: "cyan", children: [
+      /* @__PURE__ */ jsx29(Spinner13, { type: "dots" }),
       " Loading user info..."
     ] }) });
   }
   if (status === "error") {
-    return /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", children: [
-      /* @__PURE__ */ jsx28(Text21, { color: "red", children: "\u2717 Failed to load user info" }),
-      /* @__PURE__ */ jsx28(Text21, { color: "red", children: error })
+    return /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx29(Text22, { color: "red", children: "\u2717 Failed to load user info" }),
+      /* @__PURE__ */ jsx29(Text22, { color: "red", children: error })
     ] });
   }
-  return /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", children: [
-    /* @__PURE__ */ jsx28(Text21, { bold: true, children: "User Info" }),
-    /* @__PURE__ */ jsxs20(Box20, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
-      /* @__PURE__ */ jsxs20(Text21, { children: [
-        /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Email: " }),
-        userInfo?.email ?? /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Not set" })
+  return /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx29(Text22, { bold: true, children: "User Info" }),
+    /* @__PURE__ */ jsxs21(Box21, { flexDirection: "column", marginTop: 1, paddingX: 2, children: [
+      /* @__PURE__ */ jsxs21(Text22, { children: [
+        /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Email: " }),
+        userInfo?.email ?? /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Not set" })
       ] }),
-      /* @__PURE__ */ jsxs20(Text21, { children: [
-        /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Name: " }),
-        userInfo?.name ?? /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Not set" })
+      /* @__PURE__ */ jsxs21(Text22, { children: [
+        /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Name: " }),
+        userInfo?.name ?? /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Not set" })
       ] }),
-      /* @__PURE__ */ jsxs20(Text21, { children: [
-        /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Phone: " }),
-        userInfo?.phone ?? /* @__PURE__ */ jsx28(Text21, { dimColor: true, children: "Not set" })
+      /* @__PURE__ */ jsxs21(Text22, { children: [
+        /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Phone: " }),
+        userInfo?.phone ?? /* @__PURE__ */ jsx29(Text22, { dimColor: true, children: "Not set" })
       ] })
     ] })
   ] });
 };
 
 // src/commands/user-info/index.tsx
-import { jsx as jsx29 } from "react/jsx-runtime";
+import { jsx as jsx30 } from "react/jsx-runtime";
 function createUserInfoCli(createResource, authStorage2) {
-  const cli2 = Cli8.create("user-info", {
+  const cli2 = Cli9.create("user-info", {
     description: "User information commands"
   });
   cli2.command("retrieve", {
@@ -15318,7 +15752,7 @@ function createUserInfoCli(createResource, authStorage2) {
       const resource = createResource();
       if (!c.agent && !c.formatExplicit) {
         return renderInteractive(
-          /* @__PURE__ */ jsx29(UserInfoRetrieve, { resource, onComplete: () => {
+          /* @__PURE__ */ jsx30(UserInfoRetrieve, { resource, onComplete: () => {
           } }),
           () => resource.retrieve()
         );
@@ -15552,8 +15986,8 @@ ${JSON.stringify(redacted, null, 2)}`
 };
 
 // src/auth/session.ts
-var EXPIRY_BUFFER_MS = 6e4;
-function createAccessTokenProvider(authResource, authStorage2 = storage) {
+var EXPIRY_BUFFER_MS2 = 6e4;
+function createAccessTokenProvider(authResource, authStorage2 = storage, options = {}) {
   return async ({ forceRefresh } = {}) => {
     const auth = authStorage2.getAuth();
     if (!auth) {
@@ -15561,51 +15995,21 @@ function createAccessTokenProvider(authResource, authStorage2 = storage) {
         'Not authenticated. Run "link-cli auth login" first.'
       );
     }
-    const isExpired = auth.expires_at != null && Date.now() >= auth.expires_at - EXPIRY_BUFFER_MS;
+    const isExpired = auth.expires_at != null && Date.now() >= auth.expires_at - EXPIRY_BUFFER_MS2;
     if (!forceRefresh && !isExpired) {
       return auth.access_token;
     }
+    if (options.noRefresh) {
+      throw new LinkAuthenticationError(
+        'Access token expired. Re-authenticate with "link-cli auth login".'
+      );
+    }
     const refreshed = await authResource.refreshToken(auth.refresh_token);
     authStorage2.setAuth(refreshed);
     return refreshed.access_token;
   };
 }
 
-// src/utils/sanitize-text.ts
-import stripAnsi from "strip-ansi";
-var CONTROL_CHAR_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\r]/g;
-var NEEDS_SANITIZE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f\r\x1b]/;
-function sanitizeText(input) {
-  if (!input) {
-    return "";
-  }
-  if (!NEEDS_SANITIZE_RE.test(input)) {
-    return input;
-  }
-  return stripAnsi(input).replace(CONTROL_CHAR_RE, "");
-}
-function sanitizeDeep(value) {
-  if (value === null || value === void 0) {
-    return value;
-  }
-  if (typeof value === "string") {
-    return sanitizeText(value);
-  }
-  if (Array.isArray(value)) {
-    return value.map(sanitizeDeep);
-  }
-  if (typeof value === "object") {
-    const result = {};
-    const keys = Object.keys(value);
-    for (let i = 0; i < keys.length; i++) {
-      const k = keys[i];
-      result[k] = sanitizeDeep(value[k]);
-    }
-    return result;
-  }
-  return value;
-}
-
 // src/utils/resource-factory.ts
 function sanitizeResource(resource) {
   return new Proxy(resource, {
@@ -15628,37 +16032,69 @@ var ResourceFactory = class {
   verbose;
   defaultHeaders;
   authStorage;
-  authResource;
+  envAccessToken;
+  envRefreshToken;
+  noRefresh;
+  _authResource;
   accessTokenProvider;
   spendRequestResource;
   paymentMethodsResource;
   shippingAddressResource;
   userInfoResource;
+  webBotAuthResource;
   constructor(options = {}) {
     this.verbose = options.verbose ?? false;
     this.defaultHeaders = options.defaultHeaders;
     this.authStorage = options.authStorage;
+    this.envAccessToken = options.envAccessToken;
+    this.envRefreshToken = options.envRefreshToken;
+    this.noRefresh = options.noRefresh ?? false;
+    this._authResource = options.authResource;
   }
   createAuthResource() {
-    if (this.authResource) {
-      return this.authResource;
+    if (this._authResource) {
+      return this._authResource;
     }
-    this.authResource = new LinkAuthResource({
-      verbose: this.verbose,
-      defaultHeaders: this.defaultHeaders
-    });
-    return this.authResource;
+    this._authResource = sanitizeResource(
+      new LinkAuthResource({
+        verbose: this.verbose,
+        defaultHeaders: this.defaultHeaders
+      })
+    );
+    return this._authResource;
   }
   getAuthStorage() {
     return this.authStorage;
   }
+  getAccessTokenProvider() {
+    return this.createSdkAccessTokenProvider();
+  }
   createSdkAccessTokenProvider() {
     if (this.accessTokenProvider) {
       return this.accessTokenProvider;
     }
+    if (this.envAccessToken) {
+      const envAccessToken2 = this.envAccessToken;
+      const envRefreshToken2 = this.envRefreshToken;
+      const noRefresh2 = this.noRefresh;
+      this.accessTokenProvider = async ({ forceRefresh } = {}) => {
+        if (forceRefresh) {
+          if (noRefresh2 || !envRefreshToken2) {
+            throw new LinkAuthenticationError(
+              "Access token expired. Update LINK_ACCESS_TOKEN and retry."
+            );
+          }
+          const refreshed = await this.createAuthResource().refreshToken(envRefreshToken2);
+          return refreshed.access_token;
+        }
+        return envAccessToken2;
+      };
+      return this.accessTokenProvider;
+    }
     this.accessTokenProvider = createAccessTokenProvider(
       this.createAuthResource(),
-      this.authStorage
+      this.authStorage,
+      { noRefresh: this.noRefresh }
     );
     return this.accessTokenProvider;
   }
@@ -15718,6 +16154,20 @@ var ResourceFactory = class {
     );
     return this.userInfoResource;
   }
+  createWebBotAuthResource() {
+    if (this.webBotAuthResource) {
+      return this.webBotAuthResource;
+    }
+    const getAccessToken = this.createSdkAccessTokenProvider();
+    this.webBotAuthResource = sanitizeResource(
+      new WebBotAuthResource({
+        verbose: this.verbose,
+        defaultHeaders: this.defaultHeaders,
+        getAccessToken
+      })
+    );
+    return this.webBotAuthResource;
+  }
 };
 
 // src/utils/update-info.ts
@@ -15791,12 +16241,10 @@ function cacheUpdateInfo(value, ttlMs = UPDATE_CACHE_TTL_MS) {
 }
 
 // src/cli.tsx
-var cliVersion = "0.5.0";
-var buildNumber = "1";
+var cliVersion = "0.6.0";
 var cliName = "@stripe/link-cli";
 var defaultHeaders = {
-  "User-Agent": `link-cli/${cliVersion} (build ${buildNumber})`,
-  "X-Build-Number": buildNumber
+  "User-Agent": `link-cli/${cliVersion}`
 };
 var verbose = process.argv.includes("--verbose");
 var authFileIndex = process.argv.indexOf("--auth");
@@ -15805,12 +16253,22 @@ if (authFileIndex !== -1) {
   process.argv.splice(authFileIndex, 2);
 }
 var authStorage = credentialFilePath ? new Storage({ configPath: credentialFilePath }) : storage;
-var factory = new ResourceFactory({ verbose, defaultHeaders, authStorage });
+var envAccessToken = process.env.LINK_ACCESS_TOKEN;
+var envRefreshToken = process.env.LINK_REFRESH_TOKEN;
+var noRefresh = Boolean(process.env.LINK_NO_REFRESH);
+var factory = new ResourceFactory({
+  verbose,
+  defaultHeaders,
+  authStorage,
+  envAccessToken,
+  envRefreshToken,
+  noRefresh
+});
 var authRepo = factory.createAuthResource();
 var spendRequestRepo = factory.createSpendRequestResource();
-var cli = Cli9.create("link-cli", {
+var cli = Cli10.create("link-cli", {
   description: "Create a secure, one-time payment credential from a Link wallet to let agents complete purchases on behalf of users.",
-  version: `${cliVersion} (build ${buildNumber})`
+  version: cliVersion
 });
 var isAgent = process.argv.includes("--format") || process.argv.includes("--mcp");
 var agentUpdateInfoProvider = createAgentUpdateInfoProvider(
@@ -15825,7 +16283,9 @@ if (!isAgent && process.stdout.isTTY) {
     process.stderr.write(renderInteractiveUpdateNotice(updateInfo));
   }
 }
-cli.command(createAuthCli(authRepo, getUpdateInfo, authStorage));
+cli.command(
+  createAuthCli(authRepo, getUpdateInfo, authStorage, envAccessToken)
+);
 cli.command(createSpendRequestCli(spendRequestRepo, authStorage));
 cli.command(
   createPaymentMethodsCli(
@@ -15859,6 +16319,7 @@ cli.command(
     authStorage
   )
 );
+cli.command(createServeCli(cli));
 cli.serve();
 var cli_default = cli;
 export {