* Send link-cli User-Agent on mpp pay merchant requests.
MPP probes and paid retries used global fetch, so merchants saw Node's default User-Agent and LINK_HTTP_PROXY was skipped. Route those calls through the CLI's configured fetch so User-Agent applies unless -H overrides it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Committed-By-Agent: cursor
* Set mpp pay User-Agent in buildHeaders instead of wrapping fetch.
The fetchImpl wiring was more than this needed; default the header on merchant requests and leave -H User-Agent as an override.
Co-authored-by: Cursor <cursoragent@cursor.com>
Committed-By-Agent: cursor
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add changesets for PRs #255, #257, #258, #260, #261
Covers spend-request expires-at, SDK transport hardening, canonical
SDK resource adoption, response validation, and moving auth ownership
into the CLI — none of which shipped with a changeset, so CI had
nothing to version since @stripe/link-cli@0.13.1.
Committed-By-Agent: claude
* Version Packages
Release @stripe/link-cli@0.14.0 via changesets: consume pending changesets and update CHANGELOG.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Add --expires-at support to spend-request create
Mirrors the mint PR (stripe-internal/mint#2484603) that lets allow-listed
OAuth clients request a spend request expiration up to 7 days out instead
of the default 12 hours, for extended/repeat-use agent scenarios.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Committed-By-Agent: claude
* Hide --expires-at from docs and CLI schema output
Most OAuth clients aren't allow-listed for the server-side flag; leaving
it documented in SKILL.md/README.md/schema descriptions would prompt
general agents to try it and hit a 400. The flag stays functional
(same as the existing `approve` field) but drops its description so it
no longer shows up meaningfully in --schema/--llms-full.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Committed-By-Agent: claude
* Note the unit for --expires-at in its schema description
Bare field with no description gave zero signal, but agents seeing an
undocumented integer field could just as easily guess wrong (e.g.
milliseconds). Clarifying the unit alone doesn't explain the gating or
bounds, so it stays unlikely to be tried speculatively.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Committed-By-Agent: claude
* Fix biome formatting on expiresAt schema field
CI was failing pnpm biome check on the line-length wrap for the
one-line describe() call added in 1b6021f.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* update table styling for balances and sources commands
* test
* fix: rename Account name column to Source name for consistency
Committed-By-Agent: claude
- Handle nested `{ error: { message } }` error shape in auth resources
(both CLI and SDK implementations) by replacing the cast-only
`err?.error` interpolation with `extractOAuthErrorMessage`, which
does a runtime typeof check before descending into the object
- Fix `switch (err.error)` in `pollDeviceAuth` to switch on
`extractOAuthErrorCode(err)` so polling continues correctly when a
non-string error arrives (object would never match a string case)
- Fix `error_description` truthy guard to a nullish check so an empty
string from the server is preserved rather than falling back to the
error code
- Replace inline cast-only error extraction in payment-methods,
shipping-address, user-info, and web-bot-auth resources with
`extractErrorMessage` from base.ts, which already handles both
string and nested-object error shapes
- Replace `String(err)` in `useAsyncAction` with `JSON.stringify(err)`
so thrown plain objects produce readable output instead of
[object Object]
- Add tests covering all of the above
Committed-By-Agent: claude
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The link-api PR (mint#2412595, LINK_AI_WALLET-365) added top-level
`card_brand` and `card_last4` to the RetrieveSpendRequest response so
integrators can identify a card for debugging without expanding the full
`card` object via `include=card`.
Add both fields to the SDK `SpendRequest` type and display them in the
interactive `retrieve` view when the full card is not expanded. The SDK
already passed these through to `--format json` output via its
pass-through cast; this closes the typing and interactive-display gap.
Docs (README, SKILL.md, CLAUDE.md) updated to match.
Committed-By-Agent: claude
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a postinstall script that copies the SKILL.md into
~/.claude/skills/ and ~/.codex/skills/ so the skill is
available globally without being inside the repo. Updated
prepack to bundle the skills directory into dist/.
Committed-By-Agent: claude
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add MPP inspect command
* feat: rework mpp pay to handle full end-to-end 402 flow
mpp pay now probes the URL for a 402 challenge, parses the
WWW-Authenticate header to extract network_id and amount, creates a
spend request, yields the approval URL for the agent to present, and
completes payment with the SPT after approval.
- Remove mpp inspect (subsumed into pay flow)
- Add --context, --amount, --payment-method-id, --test flags
- Make --spend-request-id optional (backward compat)
- Agent mode yields approval URL immediately with _next hints
- Interactive mode handles full flow inline with polling
- Update SKILL.md and CLAUDE.md with new flow docs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: update mpp pay tests to handle generator array output
The mpp pay command now uses an async generator (`async *run`) which
wraps yielded values in an array in JSON output mode. Update three
tests to extract [0] from the output array.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* refactor: remove auto-generated context and step translation layer in mpp pay
Context is now required (min 100 chars) for the full MPP flow — agents must
provide a meaningful description. Also refactors onStep to emit typed Step
values directly, removing the string-to-enum mapping in the component.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* revert version bump in SKILL.md
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: remove extra blank line to pass biome format check
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat(mpp): support stripe session challenges alongside charge
Add intent="session" support to the MPP flow. Session challenges use an
open/grantedToken credential shape instead of the bare SPT payload.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Committed-By-Agent: claude
* chore: retrigger CI
Committed-By-Agent: claude
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: surface verification_url in spend-request error output
When the API returns additional_verification_required, surface the
verification_url so users know where to complete stepup verification.
Also fixes interactive mode hanging on error by calling useApp().exit().
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: resolve biome lint and format errors in spend-request commands
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
github-actions[bot]