@proxy-checkout/cli 0.1.0-prx-128.104.1

package/dist/cjs/command-schema.js

@@ -0,0 +1,238 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSchemas = void 0;
+exports.findCommandSchema = findCommandSchema;
+exports.commandSchemaDocument = commandSchemaDocument;
+exports.llmsFullDocument = llmsFullDocument;
+const profileOption = {
+    description: "Credential profile name.",
+    env: "PROXY_PROFILE",
+    name: "--profile",
+    type: "string",
+};
+const apiBaseOption = {
+    description: "Proxy API base URL.",
+    env: "PROXY_API_BASE_URL",
+    name: "--api-base",
+    type: "string",
+};
+const merchantOption = {
+    description: "Assert the credential's target merchant ID.",
+    name: "--merchant",
+    type: "string",
+};
+const modeOption = {
+    description: "Assert the command mode (test or live).",
+    name: "--mode",
+    type: "string",
+};
+const commonOptions = [profileOption, apiBaseOption, merchantOption, modeOption];
+function withCommonOptions(...options) {
+    return [...commonOptions, ...options];
+}
+exports.commandSchemas = [
+    {
+        capabilities: [],
+        description: "Authorize a revocable, test-merchant Proxy CLI credential in the browser.",
+        interactive: true,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Print the approval URL without opening a browser.",
+            name: "--no-browser",
+            type: "boolean",
+        }, { description: "Human-readable profile label.", name: "--name", type: "string" }),
+        output: "The non-secret profile and credential metadata.",
+        path: "auth login",
+        streaming: true,
+    },
+    {
+        capabilities: ["cliAuth:read"],
+        description: "Show the active profile and server-verified credential status.",
+        interactive: false,
+        modes: ["test", "live"],
+        options: withCommonOptions(),
+        output: "The active non-secret profile.",
+        path: "auth status",
+    },
+    {
+        capabilities: ["cliAuth:read", "cliAuth:revoke"],
+        description: "Close owned listeners, revoke the CLI credential, and remove it locally.",
+        interactive: false,
+        modes: ["test", "live"],
+        options: withCommonOptions(),
+        output: "Revocation status.",
+        path: "auth logout",
+    },
+    {
+        description: "Relay signed Proxy test webhooks to a loopback development server.",
+        interactive: true,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Loopback HTTP(S) destination.",
+            name: "--forward-to",
+            required: true,
+            type: "string",
+        }, { description: "Source webhook endpoint ID.", name: "--endpoint", type: "string" }, {
+            description: "Orchestrate Stripe CLI test webhooks through Proxy.",
+            name: "--stripe",
+            type: "boolean",
+        }, {
+            description: "Explicit active Stripe PSP configuration ID.",
+            name: "--stripe-psp-config",
+            type: "string",
+        }, {
+            description: "Stop after this many forwarded events; zero means run until interrupted.",
+            name: "--max-events",
+            type: "integer",
+        }),
+        output: "A stream of listener, delivery, retry, and cleanup events.",
+        path: "listen",
+        streaming: true,
+        capabilities: [
+            "cliAuth:read",
+            "localWebhookListeners:read",
+            "localWebhookListeners:create",
+            "localWebhookListeners:heartbeat",
+            "localWebhookListeners:close",
+            "localWebhookDeliveries:claim",
+            "localWebhookDeliveries:complete",
+            "localPspIngresses:create",
+        ],
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookListeners:read"],
+        description: "List active HTTPS webhook endpoints eligible as relay sources.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions(),
+        output: "Source endpoint records.",
+        path: "webhooks endpoints list",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookListeners:create"],
+        description: "Create a temporary local relay listener.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Source webhook endpoint ID.",
+            name: "--endpoint",
+            required: true,
+            type: "string",
+        }),
+        output: "Listener record and lease.",
+        path: "webhooks listeners create",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookListeners:read"],
+        description: "Read an owned relay listener.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Listener ID.",
+            name: "--listener",
+            required: true,
+            type: "string",
+        }),
+        output: "Listener record and lease.",
+        path: "webhooks listeners status",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookListeners:heartbeat"],
+        description: "Extend an owned relay listener lease.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Listener ID.",
+            name: "--listener",
+            required: true,
+            type: "string",
+        }),
+        output: "Updated listener lease.",
+        path: "webhooks listeners heartbeat",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookListeners:close"],
+        description: "Close an owned relay listener and temporary ingress.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({
+            description: "Listener ID.",
+            name: "--listener",
+            required: true,
+            type: "string",
+        }),
+        output: "Archived listener record.",
+        path: "webhooks listeners close",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookDeliveries:read"],
+        description: "List delivery state for an owned relay listener.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({ description: "Listener ID.", name: "--listener", required: true, type: "string" }, { description: "Maximum records (1-100).", name: "--limit", type: "integer" }),
+        output: "Delivery records in server order.",
+        path: "webhooks deliveries list",
+    },
+    {
+        capabilities: ["cliAuth:read", "localWebhookDeliveries:replay"],
+        description: "Schedule an explicit replay of a completed local delivery.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({ description: "Listener ID.", name: "--listener", required: true, type: "string" }, { description: "Delivery ID.", name: "--delivery", required: true, type: "string" }, { description: "Audit reason.", name: "--reason", required: true, type: "string" }),
+        output: "Replay outbox identifier and state.",
+        path: "webhooks deliveries replay",
+    },
+    {
+        description: "Claim and forward one selected delivery or replay, enabling explicit processing order.",
+        interactive: false,
+        modes: ["test"],
+        options: withCommonOptions({ description: "Listener ID.", name: "--listener", required: true, type: "string" }, {
+            description: "Pending delivery ID (exclusive with --replay-outbox).",
+            name: "--delivery",
+            type: "string",
+        }, {
+            description: "Replay outbox ID (exclusive with --delivery).",
+            name: "--replay-outbox",
+            type: "string",
+        }, {
+            description: "Loopback HTTP(S) destination.",
+            name: "--forward-to",
+            required: true,
+            type: "string",
+        }),
+        output: "Non-sensitive claim metadata and forwarding completion.",
+        path: "webhooks deliveries forward",
+        capabilities: [
+            "cliAuth:read",
+            "localWebhookDeliveries:claim",
+            "localWebhookDeliveries:complete",
+        ],
+    },
+];
+function findCommandSchema(path) {
+    return exports.commandSchemas.find((command) => command.path === path);
+}
+function commandSchemaDocument(path) {
+    if (!path) {
+        return { commands: exports.commandSchemas, schema_version: "2026-07-14" };
+    }
+    return findCommandSchema(path);
+}
+function llmsFullDocument() {
+    return [
+        "# Proxy CLI command reference",
+        "",
+        "All operational resource commands currently accept test-mode credentials only. Auth status and logout are mode-neutral safety controls for future separately issued grants. Use `--format json` for one-shot commands and `--format jsonl` for streaming commands. Use `--no-input` to prohibit prompts.",
+        "",
+        ...exports.commandSchemas.flatMap((command) => [
+            `## proxy ${command.path}`,
+            "",
+            command.description,
+            "",
+            `Capabilities: ${command.capabilities.join(", ") || "none"}`,
+            `Modes: ${command.modes.join(", ")}`,
+            ...command.options.map((option) => `- ${option.name} (${option.type}${option.required ? ", required" : ""}): ${option.description}`),
+            "",
+        ]),
+    ].join("\n");
+}

package/dist/cjs/config.d.cts

@@ -0,0 +1,55 @@
+export interface CliProfile {
+    apiBaseUrl: string;
+    apiVersion: string;
+    capabilityVersion: number;
+    credentialId: string;
+    credentialStore: "file" | "keychain" | "secret-service";
+    expiresAt: string | null;
+    merchantId: string;
+    mode: "test" | "live";
+    name: string;
+    organizationId: string;
+}
+export interface ResolvedCredential {
+    apiBaseUrl: string;
+    profile?: CliProfile;
+    profileName: string;
+    source: "environment" | "file" | "keychain" | "secret-service";
+    token: string;
+}
+export interface ConfigEnvironment {
+    HOME?: string;
+    PATH?: string;
+    PROXY_API_BASE_URL?: string;
+    PROXY_CLI_TOKEN?: string;
+    PROXY_CONFIG_HOME?: string;
+    PROXY_PROFILE?: string;
+    XDG_CONFIG_HOME?: string;
+    XDG_DATA_HOME?: string;
+}
+export declare class CliConfigStore {
+    private readonly configFile;
+    private readonly credentialsFile;
+    private readonly environment;
+    private readonly operatingSystem;
+    constructor(options?: {
+        environment?: ConfigEnvironment;
+        operatingSystem?: NodeJS.Platform;
+    });
+    profileName(requested?: string): string;
+    apiBaseUrl(requested?: string, profile?: CliProfile): string;
+    readProfile(profileName: string): Promise<CliProfile | undefined>;
+    saveProfile(profileName: string, profile: Omit<CliProfile, "credentialStore">, token: string): Promise<CliProfile>;
+    resolveCredential(input: {
+        apiBaseUrl?: string;
+        profileName?: string;
+    }): Promise<ResolvedCredential>;
+    removeProfile(profileName: string): Promise<void>;
+    private readConfiguration;
+    private storeToken;
+    private readToken;
+    private deleteToken;
+    private readFileCredentials;
+}
+export declare function normalizeApiBaseUrl(value: string): string;
+export declare function writePrivateJson(path: string, value: unknown): Promise<void>;

package/dist/cjs/config.d.ts

@@ -0,0 +1,55 @@
+export interface CliProfile {
+    apiBaseUrl: string;
+    apiVersion: string;
+    capabilityVersion: number;
+    credentialId: string;
+    credentialStore: "file" | "keychain" | "secret-service";
+    expiresAt: string | null;
+    merchantId: string;
+    mode: "test" | "live";
+    name: string;
+    organizationId: string;
+}
+export interface ResolvedCredential {
+    apiBaseUrl: string;
+    profile?: CliProfile;
+    profileName: string;
+    source: "environment" | "file" | "keychain" | "secret-service";
+    token: string;
+}
+export interface ConfigEnvironment {
+    HOME?: string;
+    PATH?: string;
+    PROXY_API_BASE_URL?: string;
+    PROXY_CLI_TOKEN?: string;
+    PROXY_CONFIG_HOME?: string;
+    PROXY_PROFILE?: string;
+    XDG_CONFIG_HOME?: string;
+    XDG_DATA_HOME?: string;
+}
+export declare class CliConfigStore {
+    private readonly configFile;
+    private readonly credentialsFile;
+    private readonly environment;
+    private readonly operatingSystem;
+    constructor(options?: {
+        environment?: ConfigEnvironment;
+        operatingSystem?: NodeJS.Platform;
+    });
+    profileName(requested?: string): string;
+    apiBaseUrl(requested?: string, profile?: CliProfile): string;
+    readProfile(profileName: string): Promise<CliProfile | undefined>;
+    saveProfile(profileName: string, profile: Omit<CliProfile, "credentialStore">, token: string): Promise<CliProfile>;
+    resolveCredential(input: {
+        apiBaseUrl?: string;
+        profileName?: string;
+    }): Promise<ResolvedCredential>;
+    removeProfile(profileName: string): Promise<void>;
+    private readConfiguration;
+    private storeToken;
+    private readToken;
+    private deleteToken;
+    private readFileCredentials;
+}
+export declare function normalizeApiBaseUrl(value: string): string;
+export declare function writePrivateJson(path: string, value: unknown): Promise<void>;

package/dist/cjs/config.js

@@ -0,0 +1,339 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliConfigStore = void 0;
+exports.normalizeApiBaseUrl = normalizeApiBaseUrl;
+exports.writePrivateJson = writePrivateJson;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_js_1 = require("./errors.js");
+const configurationVersion = 1;
+const keychainService = "com.proxycheckout.cli";
+const defaultApiBaseUrl = "https://api.proxycheckout.com";
+const profileNamePattern = /^[A-Za-z0-9._-]{1,64}$/;
+const macosKeychainScript = String.raw `
+ObjC.import("Foundation");
+ObjC.import("Security");
+
+function run() {
+  const stdin = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile;
+  const raw = ObjC.unwrap(
+    $.NSString.alloc.initWithDataEncoding(stdin, $.NSUTF8StringEncoding),
+  );
+  const [operation, serviceValue, accountValue, credential = ""] = raw.split("\n");
+  if (!operation || !serviceValue || !accountValue) throw new Error("invalid input");
+
+  const query = $.NSMutableDictionary.alloc.init;
+  query.setObjectForKey($("genp"), $("class"));
+  query.setObjectForKey($(serviceValue), $("svce"));
+  query.setObjectForKey($(accountValue), $("acct"));
+
+  if (operation === "write") {
+    const data = $(credential).dataUsingEncoding($.NSUTF8StringEncoding);
+    const update = $.NSMutableDictionary.alloc.init;
+    update.setObjectForKey(data, $("v_Data"));
+    const updateStatus = $.SecItemUpdate(query, update);
+    if (updateStatus === 0) return "stored";
+    if (updateStatus !== -25300) throw new Error("keychain update failed: " + updateStatus);
+    query.setObjectForKey(data, $("v_Data"));
+    const addStatus = $.SecItemAdd(query, $());
+    if (addStatus !== 0) throw new Error("keychain add failed: " + addStatus);
+    return "stored";
+  }
+
+  if (operation === "read") {
+    query.setObjectForKey(true, $("r_Data"));
+    query.setObjectForKey($("m_LimitOne"), $("m_Limit"));
+    const result = $();
+    const status = $.SecItemCopyMatching(query, result);
+    if (status === -25300) return "missing";
+    if (status !== 0) throw new Error("keychain read failed: " + status);
+    $.NSFileHandle.fileHandleWithStandardOutput.writeData(result);
+    return "";
+  }
+
+  if (operation === "delete") {
+    const status = $.SecItemDelete(query);
+    if (status !== 0 && status !== -25300) {
+      throw new Error("keychain delete failed: " + status);
+    }
+    return "deleted";
+  }
+
+  throw new Error("unknown operation");
+}
+`;
+class CliConfigStore {
+    configFile;
+    credentialsFile;
+    environment;
+    operatingSystem;
+    constructor(options = {}) {
+        this.environment = options.environment ?? process.env;
+        this.operatingSystem = options.operatingSystem ?? (0, node_os_1.platform)();
+        const home = this.environment.HOME ?? (0, node_os_1.homedir)();
+        const configHome = this.environment.PROXY_CONFIG_HOME ??
+            this.environment.XDG_CONFIG_HOME ??
+            (0, node_path_1.join)(home, ".config");
+        const dataHome = this.environment.XDG_DATA_HOME ?? (0, node_path_1.join)(home, ".local", "share");
+        this.configFile = (0, node_path_1.join)(configHome, "proxy", "config.json");
+        this.credentialsFile = (0, node_path_1.join)(dataHome, "proxy", "credentials.json");
+    }
+    profileName(requested) {
+        const value = requested ?? this.environment.PROXY_PROFILE ?? "default";
+        if (!profileNamePattern.test(value)) {
+            throw (0, errors_js_1.usageError)("Profile names may contain only letters, digits, dot, underscore, and dash");
+        }
+        return value;
+    }
+    apiBaseUrl(requested, profile) {
+        return normalizeApiBaseUrl(requested ?? this.environment.PROXY_API_BASE_URL ?? profile?.apiBaseUrl ?? defaultApiBaseUrl);
+    }
+    async readProfile(profileName) {
+        return (await this.readConfiguration()).profiles[profileName];
+    }
+    async saveProfile(profileName, profile, token) {
+        validateToken(token);
+        const credentialStore = await this.storeToken(profileName, token);
+        const configuration = await this.readConfiguration();
+        const storedProfile = { ...profile, credentialStore };
+        configuration.profiles[profileName] = storedProfile;
+        try {
+            await writePrivateJson(this.configFile, configuration);
+        }
+        catch (error) {
+            await this.deleteToken(profileName, credentialStore).catch(() => undefined);
+            throw error;
+        }
+        return storedProfile;
+    }
+    async resolveCredential(input) {
+        const profileName = this.profileName(input.profileName);
+        const profile = await this.readProfile(profileName);
+        const environmentToken = this.environment.PROXY_CLI_TOKEN;
+        const apiBaseOverride = input.apiBaseUrl ?? this.environment.PROXY_API_BASE_URL;
+        if (profile &&
+            !environmentToken &&
+            apiBaseOverride &&
+            normalizeApiBaseUrl(apiBaseOverride) !== normalizeApiBaseUrl(profile.apiBaseUrl)) {
+            throw (0, errors_js_1.usageError)("A stored credential may be sent only to the API origin saved with its profile; use PROXY_CLI_TOKEN for an explicit override");
+        }
+        const apiBaseUrl = this.apiBaseUrl(input.apiBaseUrl, profile);
+        if (environmentToken) {
+            validateToken(environmentToken);
+            return {
+                apiBaseUrl,
+                ...(profile ? { profile } : {}),
+                profileName,
+                source: "environment",
+                token: environmentToken,
+            };
+        }
+        if (!profile) {
+            throw new errors_js_1.CliError(`Profile ${profileName} is not authenticated. Run proxy auth login.`, "cli_not_authenticated", errors_js_1.cliExitCodes.authentication);
+        }
+        const token = await this.readToken(profileName, profile.credentialStore);
+        if (!token) {
+            throw new errors_js_1.CliError(`Credential for profile ${profileName} is missing. Run proxy auth login again.`, "cli_credential_missing", errors_js_1.cliExitCodes.authentication);
+        }
+        validateToken(token);
+        return { apiBaseUrl, profile, profileName, source: profile.credentialStore, token };
+    }
+    async removeProfile(profileName) {
+        const configuration = await this.readConfiguration();
+        const profile = configuration.profiles[profileName];
+        if (profile) {
+            await this.deleteToken(profileName, profile.credentialStore);
+            delete configuration.profiles[profileName];
+            await writePrivateJson(this.configFile, configuration);
+        }
+    }
+    async readConfiguration() {
+        const raw = await readOptionalJson(this.configFile);
+        if (raw === undefined) {
+            return { profiles: {}, version: configurationVersion };
+        }
+        if (!isRecord(raw) || raw.version !== configurationVersion || !isRecord(raw.profiles)) {
+            throw new errors_js_1.CliError("Proxy CLI configuration is invalid", "cli_config_invalid", errors_js_1.cliExitCodes.internal);
+        }
+        return raw;
+    }
+    async storeToken(profileName, token) {
+        if (this.operatingSystem === "darwin" &&
+            (await executableExists("osascript", this.environment))) {
+            const result = await runProcess("osascript", ["-l", "JavaScript", "-e", macosKeychainScript], keychainInput("write", profileName, token));
+            if (result.code !== 0) {
+                throw credentialStoreError("macOS Keychain", result.stderr);
+            }
+            return "keychain";
+        }
+        if (this.operatingSystem === "linux" &&
+            (await executableExists("secret-tool", this.environment))) {
+            const result = await runProcess("secret-tool", ["store", "--label=Proxy CLI", "service", keychainService, "profile", profileName], token);
+            if (result.code !== 0) {
+                throw credentialStoreError("Secret Service", result.stderr);
+            }
+            return "secret-service";
+        }
+        const credentials = await this.readFileCredentials();
+        credentials.tokens[profileName] = token;
+        await writePrivateJson(this.credentialsFile, credentials);
+        return "file";
+    }
+    async readToken(profileName, store) {
+        if (store === "keychain") {
+            const result = await runProcess("osascript", ["-l", "JavaScript", "-e", macosKeychainScript], keychainInput("read", profileName));
+            if (result.code !== 0) {
+                throw credentialStoreError("macOS Keychain", result.stderr);
+            }
+            return result.stdout.trim() !== "missing" ? result.stdout.trim() : undefined;
+        }
+        if (store === "secret-service") {
+            const result = await runProcess("secret-tool", [
+                "lookup",
+                "service",
+                keychainService,
+                "profile",
+                profileName,
+            ]);
+            return result.code === 0 ? result.stdout.trim() : undefined;
+        }
+        return (await this.readFileCredentials()).tokens[profileName];
+    }
+    async deleteToken(profileName, store) {
+        if (store === "keychain") {
+            const result = await runProcess("osascript", ["-l", "JavaScript", "-e", macosKeychainScript], keychainInput("delete", profileName));
+            if (result.code !== 0) {
+                throw credentialStoreError("macOS Keychain", result.stderr);
+            }
+            return;
+        }
+        if (store === "secret-service") {
+            await runProcess("secret-tool", [
+                "clear",
+                "service",
+                keychainService,
+                "profile",
+                profileName,
+            ]);
+            return;
+        }
+        const credentials = await this.readFileCredentials();
+        delete credentials.tokens[profileName];
+        await writePrivateJson(this.credentialsFile, credentials);
+    }
+    async readFileCredentials() {
+        const raw = await readOptionalJson(this.credentialsFile);
+        if (raw === undefined) {
+            return { tokens: {}, version: configurationVersion };
+        }
+        if (!isRecord(raw) || raw.version !== configurationVersion || !isRecord(raw.tokens)) {
+            throw new errors_js_1.CliError("Proxy CLI credential file is invalid", "cli_credential_file_invalid", errors_js_1.cliExitCodes.internal);
+        }
+        return raw;
+    }
+}
+exports.CliConfigStore = CliConfigStore;
+function keychainInput(operation, profileName, token = "") {
+    return `${operation}\n${keychainService}\n${profileName}\n${token}\n`;
+}
+function normalizeApiBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw (0, errors_js_1.usageError)("Proxy API base URL must be a valid URL");
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const isLoopback = ["127.0.0.1", "::1", "localhost"].includes(hostname);
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) ||
+        url.username ||
+        url.password) {
+        throw (0, errors_js_1.usageError)("Proxy API base URL must use HTTPS, except for loopback development");
+    }
+    if (url.pathname !== "/" || url.search || url.hash) {
+        throw (0, errors_js_1.usageError)("Proxy API base URL must be an origin without a path, query, or fragment");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+async function executableExists(command, environment) {
+    for (const path of (environment.PATH ?? process.env.PATH ?? "").split(node_path_1.delimiter)) {
+        if (!path)
+            continue;
+        try {
+            await (0, promises_1.access)((0, node_path_1.join)(path, command), node_fs_1.constants.X_OK);
+            return true;
+        }
+        catch {
+            // Continue through PATH entries.
+        }
+    }
+    return false;
+}
+async function runProcess(command, args, input) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(command, args, { shell: false, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8").on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.setEncoding("utf8").on("data", (chunk) => {
+            stderr += chunk;
+        });
+        child.on("error", reject);
+        child.on("close", (code) => resolve({ code: code ?? 1, stderr, stdout }));
+        child.stdin.on("error", (error) => {
+            if (!isNodeError(error, "EPIPE"))
+                reject(error);
+        });
+        child.stdin.end(input);
+    });
+}
+async function readOptionalJson(path) {
+    try {
+        return JSON.parse(await (0, promises_1.readFile)(path, "utf8"));
+    }
+    catch (error) {
+        if (isNodeError(error, "ENOENT")) {
+            return undefined;
+        }
+        if (error instanceof SyntaxError) {
+            throw new errors_js_1.CliError(`Invalid JSON in ${path}`, "cli_config_invalid", errors_js_1.cliExitCodes.internal);
+        }
+        throw error;
+    }
+}
+async function writePrivateJson(path, value) {
+    await (0, promises_1.mkdir)((0, node_path_1.dirname)(path), { mode: 0o700, recursive: true });
+    await (0, promises_1.chmod)((0, node_path_1.dirname)(path), 0o700);
+    const temporaryPath = `${path}.${process.pid}.tmp`;
+    try {
+        await (0, promises_1.writeFile)(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        await (0, promises_1.rename)(temporaryPath, path);
+        await (0, promises_1.chmod)(path, 0o600);
+    }
+    finally {
+        await (0, promises_1.unlink)(temporaryPath).catch((error) => {
+            if (!isNodeError(error, "ENOENT"))
+                throw error;
+        });
+    }
+}
+function validateToken(token) {
+    if (!/^pcli_(?:test|live)_[A-Za-z0-9_-]{20,}$/.test(token)) {
+        throw new errors_js_1.CliError("Proxy CLI credential has an invalid format", "cli_credential_invalid", errors_js_1.cliExitCodes.authentication);
+    }
+}
+function credentialStoreError(store, stderr) {
+    return new errors_js_1.CliError(`${store} could not access the Proxy CLI credential`, "cli_credential_store_failed", errors_js_1.cliExitCodes.internal, { diagnostic: stderr.trim().slice(0, 200) });
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeError(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}