@proxy-checkout/cli 0.1.0-prx-128.104.1

package/dist/cjs/webhooks.js

@@ -0,0 +1,343 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyWebhooksClient = void 0;
+exports.runListener = runListener;
+exports.forwardSelectedDelivery = forwardSelectedDelivery;
+const node_child_process_1 = require("node:child_process");
+const errors_js_1 = require("./errors.js");
+const http_client_js_1 = require("./http-client.js");
+const output_js_1 = require("./output.js");
+const claimPollIntervalMs = 1_000;
+const heartbeatIntervalMs = 30_000;
+const localForwardTimeoutMs = 30_000;
+const stripeEvents = [
+    "checkout.session.completed",
+    "customer.subscription.deleted",
+    "customer.subscription.updated",
+    "invoice.paid",
+    "invoice.payment_failed",
+    "payment_intent.canceled",
+    "payment_intent.payment_failed",
+    "payment_intent.succeeded",
+].join(",");
+class ProxyWebhooksClient {
+    api;
+    constructor(apiBaseUrl, token, fetchImpl) {
+        this.api = new http_client_js_1.ProxyApiClient(apiBaseUrl, token, fetchImpl);
+    }
+    async listEndpoints() {
+        return (await this.api.request("/cli/webhook-endpoints")).webhook_endpoints;
+    }
+    async createListener(sourceEndpointId) {
+        return (await this.api.request("/cli/webhook-listeners", {
+            body: { source_webhook_endpoint_id: sourceEndpointId },
+            method: "POST",
+        })).listener;
+    }
+    async getListener(listenerId) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}`)).listener;
+    }
+    async heartbeat(listenerId) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/heartbeat`, { method: "POST" })).listener;
+    }
+    async close(listenerId) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/close`, { method: "POST" })).listener;
+    }
+    async listDeliveries(listenerId, limit) {
+        const query = limit ? `?${new URLSearchParams({ limit: String(limit) })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries${query}`)).deliveries;
+    }
+    async replay(listenerId, deliveryId, reason) {
+        return this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, { body: { reason }, method: "POST" });
+    }
+    async claim(listenerId, selection = {}) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/claims`, {
+            method: "POST",
+            body: {
+                ...(selection.deliveryId ? { delivery_id: selection.deliveryId } : {}),
+                ...(selection.replayOutboxEventId
+                    ? { replay_outbox_event_id: selection.replayOutboxEventId }
+                    : {}),
+            },
+        })).claim;
+    }
+    async complete(attemptId, input) {
+        return this.api.request(`/cli/webhook-delivery-attempts/${encodeURIComponent(attemptId)}/complete`, {
+            method: "POST",
+            body: {
+                duration_ms: input.durationMs,
+                error_class: input.errorClass,
+                response_status_code: input.responseStatusCode,
+            },
+        });
+    }
+    async createStripeIngress(listenerId, webhookSecret, pspConfigId) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
+            method: "POST",
+            body: {
+                ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                webhook_secret: webhookSecret,
+            },
+        })).stripe_ingress;
+    }
+}
+exports.ProxyWebhooksClient = ProxyWebhooksClient;
+async function runListener(input) {
+    const destination = validateLoopbackDestination(input.forwardTo);
+    const listener = await input.client.createListener(input.sourceEndpointId);
+    let stripeProcess;
+    let forwarded = 0;
+    let heartbeatFailure;
+    const heartbeatTimer = setInterval(() => {
+        void input.client.heartbeat(listener.id).catch((error) => {
+            heartbeatFailure = error;
+        });
+    }, heartbeatIntervalMs);
+    input.output.event("listener.started", { forward_to: destination.toString(), listener }, `Listening for Proxy test webhooks on ${listener.id}; forwarding to ${destination}`);
+    try {
+        if (input.signal.aborted)
+            throw listenerInterrupted();
+        if (input.stripe) {
+            const webhookSecret = await captureStripeWebhookSecret(input.signal);
+            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId);
+            stripeProcess = startStripeListener(ingress.inbound_url, input.output);
+            input.output.event("stripe.started", {
+                expires_at: ingress.expires_at,
+                ingress_id: ingress.id,
+                merchant_psp_config_id: ingress.merchant_psp_config_id,
+            }, "Stripe CLI test webhook orchestration is active.");
+        }
+        if (input.signal.aborted)
+            throw listenerInterrupted();
+        while (!input.signal.aborted && (input.maxEvents === 0 || forwarded < input.maxEvents)) {
+            if (heartbeatFailure) {
+                throw heartbeatFailure;
+            }
+            if (stripeProcess && (stripeProcess.exitCode !== null || stripeProcess.signalCode)) {
+                throw new errors_js_1.CliError("Stripe CLI listener exited unexpectedly", "stripe_cli_exited", errors_js_1.cliExitCodes.dependency, { exit_code: stripeProcess.exitCode, signal: stripeProcess.signalCode });
+            }
+            const claim = await input.client.claim(listener.id);
+            if (!claim) {
+                await abortableDelay(claimPollIntervalMs, input.signal);
+                continue;
+            }
+            const completion = await forwardClaim(input.client, claim, destination, input.signal);
+            forwarded += 1;
+            input.output.event("delivery.forwarded", {
+                attempt_id: claim.attempt_id,
+                attempt_number: claim.attempt_number,
+                completion,
+                kind: claim.kind,
+                webhook_delivery_id: claim.webhook_delivery_id,
+            }, `Forwarded ${claim.kind} ${claim.webhook_delivery_id} (${formatCompletion(completion)}).`);
+        }
+        if (input.signal.aborted)
+            throw listenerInterrupted();
+        return { forwarded, listener };
+    }
+    finally {
+        clearInterval(heartbeatTimer);
+        if (stripeProcess && stripeProcess.exitCode === null && !stripeProcess.signalCode) {
+            stripeProcess.kill("SIGTERM");
+            await waitForExit(stripeProcess, 2_000);
+            if (stripeProcess.exitCode === null && !stripeProcess.signalCode) {
+                stripeProcess.kill("SIGKILL");
+            }
+        }
+        try {
+            const closed = await input.client.close(listener.id);
+            input.output.event("listener.closed", { listener: closed }, `Closed local webhook listener ${listener.id}.`);
+        }
+        catch (error) {
+            input.output.event("listener.cleanup_failed", {
+                error_class: error instanceof Error ? error.name : typeof error,
+                listener_id: listener.id,
+            }, `Could not confirm cleanup for listener ${listener.id}; its short lease will expire automatically.`);
+        }
+    }
+}
+async function forwardSelectedDelivery(input) {
+    const claim = await input.client.claim(input.listenerId, {
+        ...(input.deliveryId ? { deliveryId: input.deliveryId } : {}),
+        ...(input.replayOutboxEventId ? { replayOutboxEventId: input.replayOutboxEventId } : {}),
+    });
+    if (!claim) {
+        throw new errors_js_1.CliError("Selected delivery or replay is not currently claimable", "cli_delivery_not_claimable", errors_js_1.cliExitCodes.conflict);
+    }
+    const completion = await forwardClaim(input.client, claim, validateLoopbackDestination(input.forwardTo), input.signal);
+    return {
+        attempt_id: claim.attempt_id,
+        attempt_number: claim.attempt_number,
+        completion,
+        kind: claim.kind,
+        webhook_delivery_id: claim.webhook_delivery_id,
+    };
+}
+async function forwardClaim(client, claim, destination, signal) {
+    const startedAt = Date.now();
+    let errorClass = null;
+    let responseStatusCode = null;
+    try {
+        const timeoutSignal = AbortSignal.timeout(localForwardTimeoutMs);
+        const response = await fetch(destination, {
+            body: claim.body,
+            headers: claim.headers,
+            method: "POST",
+            redirect: "manual",
+            signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal,
+        });
+        responseStatusCode = response.status;
+        await response.body?.cancel().catch(() => undefined);
+    }
+    catch (error) {
+        errorClass =
+            !signal?.aborted &&
+                error instanceof Error &&
+                (error.name === "AbortError" || error.name === "TimeoutError")
+                ? "timeout"
+                : "network_error";
+    }
+    return client.complete(claim.attempt_id, {
+        durationMs: Math.min(Date.now() - startedAt, 300_000),
+        errorClass,
+        responseStatusCode,
+    });
+}
+async function captureStripeWebhookSecret(signal) {
+    const result = await captureProcess("stripe", ["listen", "--events", stripeEvents, "--print-secret"], signal, 30_000);
+    if (signal.aborted)
+        throw listenerInterrupted();
+    const match = `${result.stdout}\n${result.stderr}`.match(/\bwhsec_[A-Za-z0-9_-]{8,512}\b/);
+    if (result.code !== 0 || !match) {
+        throw new errors_js_1.CliError("Stripe CLI could not provide a test webhook signing secret; authenticate Stripe CLI and try again", "stripe_cli_auth_required", errors_js_1.cliExitCodes.dependency, { exit_code: result.code, stderr: (0, output_js_1.redactText)(result.stderr).slice(0, 400) });
+    }
+    return match[0];
+}
+function listenerInterrupted() {
+    return new errors_js_1.CliError("Local webhook listener interrupted", "cli_listener_interrupted", errors_js_1.cliExitCodes.interrupted);
+}
+function startStripeListener(inboundUrl, output) {
+    const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
+        shell: false,
+        stdio: ["pipe", "pipe", "pipe"],
+    });
+    child.stdin.end();
+    pipeSanitized(child.stdout, (line) => output.notice(`[stripe] ${line}`));
+    pipeSanitized(child.stderr, (line) => output.notice(`[stripe] ${line}`));
+    child.once("error", () => undefined);
+    return child;
+}
+function pipeSanitized(stream, writeLine) {
+    let pending = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+        pending += chunk;
+        const lines = pending.split(/\r?\n/);
+        pending = lines.pop() ?? "";
+        for (const line of lines) {
+            if (line)
+                writeLine((0, output_js_1.redactText)(line));
+        }
+        if (pending.length > 8_192) {
+            writeLine((0, output_js_1.redactText)(pending.slice(0, 8_192)));
+            pending = "";
+        }
+    });
+    stream.on("end", () => {
+        if (pending)
+            writeLine((0, output_js_1.redactText)(pending));
+    });
+}
+async function captureProcess(command, args, signal, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(command, args, { shell: false, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const timer = setTimeout(() => child.kill("SIGTERM"), timeoutMs);
+        const abort = () => child.kill("SIGTERM");
+        signal.addEventListener("abort", abort, { once: true });
+        child.stdout.setEncoding("utf8").on("data", (chunk) => {
+            stdout = `${stdout}${chunk}`.slice(-65_536);
+        });
+        child.stderr.setEncoding("utf8").on("data", (chunk) => {
+            stderr = `${stderr}${chunk}`.slice(-65_536);
+        });
+        child.on("error", (error) => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            if (error.code === "ENOENT") {
+                reject(new errors_js_1.CliError("Stripe CLI is not installed or not on PATH", "stripe_cli_not_found", errors_js_1.cliExitCodes.dependency));
+                return;
+            }
+            reject(error);
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+            resolve({ code: code ?? 1, stderr, stdout });
+        });
+        child.stdin.end();
+    });
+}
+function validateLoopbackDestination(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new errors_js_1.CliError("Forward destination must be a valid loopback URL", "cli_forward_destination_invalid", errors_js_1.cliExitCodes.usage);
+    }
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    if ((url.protocol !== "http:" && url.protocol !== "https:") ||
+        !["127.0.0.1", "::1", "localhost"].includes(hostname) ||
+        url.username ||
+        url.password ||
+        url.hash) {
+        throw new errors_js_1.CliError("Forward destination must be an HTTP(S) loopback URL without credentials or a fragment", "cli_forward_destination_invalid", errors_js_1.cliExitCodes.usage);
+    }
+    return url;
+}
+function formatCompletion(completion) {
+    if (completion &&
+        typeof completion === "object" &&
+        "completion" in completion &&
+        completion.completion &&
+        typeof completion.completion === "object" &&
+        "status" in completion.completion) {
+        return String(completion.completion.status);
+    }
+    return "completed";
+}
+function abortableDelay(milliseconds, signal) {
+    if (signal.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, milliseconds);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function waitForExit(child, timeoutMs) {
+    if (child.exitCode !== null || child.signalCode)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const onExit = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            child.removeListener("exit", onExit);
+            resolve();
+        }, timeoutMs);
+        child.once("exit", onExit);
+        if (child.exitCode !== null || child.signalCode)
+            onExit();
+    });
+}

package/dist/esm/auth.d.ts

@@ -0,0 +1,38 @@
+import type { CliConfigStore, CliProfile } from "./config.js";
+import type { CliOutput } from "./output.js";
+interface CredentialExchangeResponse {
+    credential: string;
+    profile: {
+        api_version: string;
+        capability_version: number;
+        credential_id: string;
+        expires_at: string | null;
+        merchant_id: string;
+        mode: "test" | "live";
+        name: string;
+        organization_id: string;
+    };
+}
+export declare function login(input: {
+    apiBaseUrl: string;
+    configStore: CliConfigStore;
+    expectedMerchantId?: string;
+    expectedMode?: "live" | "test";
+    name?: string;
+    noBrowser: boolean;
+    output: CliOutput;
+    profileName: string;
+    signal?: AbortSignal;
+}): Promise<CliProfile>;
+export declare function status(input: {
+    apiBaseUrl: string;
+    token: string;
+}): Promise<CredentialExchangeResponse["profile"]>;
+export declare function logout(input: {
+    apiBaseUrl: string;
+    configStore: CliConfigStore;
+    profileName: string;
+    removeLocalProfile: boolean;
+    token: string;
+}): Promise<void>;
+export {};

package/dist/esm/auth.js

@@ -0,0 +1,253 @@
+import { spawn } from "node:child_process";
+import { hostname, platform } from "node:os";
+import { CliError, cliExitCodes } from "./errors.js";
+import { ProxyApiClient } from "./http-client.js";
+const clientId = "proxy-cli";
+const deviceScope = "proxy.cli.local-webhook-development";
+const deviceGrantType = "urn:ietf:params:oauth:grant-type:device_code";
+export async function login(input) {
+    const signal = input.signal ?? new AbortController().signal;
+    const client = new ProxyApiClient(input.apiBaseUrl);
+    const codeResult = await client.oauthRequest("/api/auth/device/code", {
+        client_id: clientId,
+        scope: deviceScope,
+    }, { signal });
+    const device = requireDeviceCode(codeResult);
+    const verificationUrl = validateVerificationUrl(device.verification_uri_complete);
+    input.output.event("auth.device_code", {
+        expires_in: device.expires_in,
+        user_code: device.user_code,
+        verification_uri: device.verification_uri,
+        verification_uri_complete: verificationUrl,
+    }, `Your pairing code is ${device.user_code}. Approve it at ${verificationUrl}`);
+    if (!input.noBrowser) {
+        const opened = await openBrowser(verificationUrl);
+        if (!opened) {
+            input.output.notice("Could not open a browser automatically; use the approval URL above.");
+        }
+    }
+    const temporarySession = await pollForDeviceToken(client, device, input.output, signal);
+    const approved = parseApprovedScope(temporarySession.scope);
+    const exchangeClient = new ProxyApiClient(input.apiBaseUrl, temporarySession.access_token);
+    const exchanged = await exchangeClient.request("/cli/auth/exchange", {
+        method: "POST",
+        signal,
+        body: {
+            approval_id: approved.approvalId,
+            merchant_id: approved.merchantId,
+            name: normalizeCredentialName(input.name),
+            user_code: device.user_code,
+        },
+    });
+    const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
+    if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
+        const mismatch = new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
+        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
+        throw mismatch;
+    }
+    if (input.expectedMode && profile.mode !== input.expectedMode) {
+        const mismatch = new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
+        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
+        throw mismatch;
+    }
+    try {
+        const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
+        if (saved.credentialStore === "file") {
+            input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
+        }
+        return saved;
+    }
+    catch (error) {
+        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
+        throw error;
+    }
+}
+async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
+    try {
+        await new ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
+            method: "POST",
+        });
+    }
+    catch (cleanupError) {
+        throw new CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", cliExitCodes.network, {
+            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
+            credential_id: profile.credentialId,
+            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
+            original_error_code: originalError instanceof CliError ? originalError.code : undefined,
+        });
+    }
+}
+export async function status(input) {
+    const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status");
+    return response.profile;
+}
+export async function logout(input) {
+    await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/logout", {
+        method: "POST",
+    });
+    if (input.removeLocalProfile) {
+        await input.configStore.removeProfile(input.profileName);
+    }
+}
+async function pollForDeviceToken(client, device, output, signal) {
+    const expiresAt = Date.now() + device.expires_in * 1_000;
+    let intervalMs = Math.max(1, device.interval) * 1_000;
+    while (Date.now() < expiresAt) {
+        await delay(intervalMs, signal);
+        const response = await client.oauthRequest("/api/auth/device/token", {
+            client_id: clientId,
+            device_code: device.device_code,
+            grant_type: deviceGrantType,
+        }, { signal });
+        if (response.ok) {
+            return requireDeviceToken(response.body);
+        }
+        const errorCode = readString(response.body, "error");
+        if (errorCode === "authorization_pending") {
+            continue;
+        }
+        if (errorCode === "slow_down") {
+            intervalMs += 5_000;
+            continue;
+        }
+        if (errorCode === "access_denied") {
+            throw new CliError("Device authorization was denied", "cli_device_access_denied", cliExitCodes.authentication);
+        }
+        if (errorCode === "expired_token") {
+            throw deviceExpired();
+        }
+        output.notice("The authentication service rejected the device exchange.");
+        throw new CliError("Device authorization failed", "cli_device_authorization_failed", cliExitCodes.authentication, { oauth_error: errorCode });
+    }
+    throw deviceExpired();
+}
+function requireDeviceCode(result) {
+    if (!result.ok ||
+        !isRecord(result.body) ||
+        !readString(result.body, "device_code") ||
+        !readString(result.body, "user_code") ||
+        !readString(result.body, "verification_uri") ||
+        !readString(result.body, "verification_uri_complete") ||
+        !readNumber(result.body, "expires_in") ||
+        !readNumber(result.body, "interval")) {
+        throw new CliError("Proxy authentication returned an invalid device code", "cli_invalid_auth_response", cliExitCodes.network, { status: result.status });
+    }
+    return result.body;
+}
+function requireDeviceToken(value) {
+    if (!isRecord(value) ||
+        readString(value, "token_type")?.toLowerCase() !== "bearer" ||
+        !readString(value, "access_token") ||
+        !readString(value, "scope")) {
+        throw new CliError("Proxy authentication returned an invalid temporary session", "cli_invalid_auth_response", cliExitCodes.network);
+    }
+    return value;
+}
+function parseApprovedScope(scope) {
+    const parts = new Set(scope.split(/\s+/));
+    const approval = [...parts].find((part) => part.startsWith("approval:"));
+    const merchant = [...parts].find((part) => part.startsWith("merchant:"));
+    if (!parts.has(deviceScope) ||
+        !parts.has("mode:test") ||
+        !approval?.startsWith("approval:cliappr_") ||
+        !merchant?.startsWith("merchant:merch_")) {
+        throw new CliError("Device approval did not contain the required test-merchant capability grant", "cli_invalid_approval_scope", cliExitCodes.permission);
+    }
+    return {
+        approvalId: approval.slice("approval:".length),
+        merchantId: merchant.slice("merchant:".length),
+    };
+}
+function requireExchangeProfile(profile, apiBaseUrl) {
+    if (profile.mode !== "test" ||
+        typeof profile.api_version !== "string" ||
+        profile.api_version.length === 0 ||
+        !Number.isSafeInteger(profile.capability_version) ||
+        profile.capability_version < 1 ||
+        !profile.credential_id.startsWith("apk_") ||
+        !profile.merchant_id.startsWith("merch_") ||
+        !profile.organization_id.startsWith("org_") ||
+        typeof profile.name !== "string" ||
+        profile.name.length < 1 ||
+        profile.name.length > 80 ||
+        (profile.expires_at !== null && Number.isNaN(Date.parse(profile.expires_at)))) {
+        throw new CliError("Proxy returned an invalid or non-test CLI grant", "cli_invalid_credential_grant", cliExitCodes.permission);
+    }
+    return {
+        apiBaseUrl,
+        apiVersion: profile.api_version,
+        capabilityVersion: profile.capability_version,
+        credentialId: profile.credential_id,
+        expiresAt: profile.expires_at,
+        merchantId: profile.merchant_id,
+        mode: profile.mode,
+        name: profile.name,
+        organizationId: profile.organization_id,
+    };
+}
+function normalizeCredentialName(name) {
+    const value = name?.trim() || `Proxy CLI on ${hostname()}`;
+    if (value.length > 80) {
+        throw new CliError("Credential name must be at most 80 characters", "cli_credential_name_invalid", cliExitCodes.usage);
+    }
+    return value;
+}
+function validateVerificationUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new CliError("Proxy returned an invalid browser approval URL", "cli_invalid_auth_response", cliExitCodes.network);
+    }
+    const loopback = ["127.0.0.1", "::1", "localhost"].includes(url.hostname);
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
+        url.username ||
+        url.password) {
+        throw new CliError("Proxy returned an unsafe browser approval URL", "cli_invalid_auth_response", cliExitCodes.network);
+    }
+    return url.toString();
+}
+async function openBrowser(url) {
+    const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
+    const args = platform() === "win32" ? ["/c", "start", "", url] : [url];
+    return new Promise((resolve) => {
+        const child = spawn(command, args, { detached: true, shell: false, stdio: "ignore" });
+        child.once("error", () => resolve(false));
+        child.once("spawn", () => {
+            child.unref();
+            resolve(true);
+        });
+    });
+}
+function deviceExpired() {
+    return new CliError("Device authorization expired", "cli_device_authorization_expired", cliExitCodes.authentication);
+}
+function readString(value, key) {
+    return isRecord(value) && typeof value[key] === "string" ? value[key] : undefined;
+}
+function readNumber(value, key) {
+    return isRecord(value) && typeof value[key] === "number" ? value[key] : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function delay(milliseconds, signal) {
+    if (signal.aborted)
+        return Promise.reject(authInterrupted());
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            reject(authInterrupted());
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, milliseconds);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function authInterrupted() {
+    return new CliError("Device authorization interrupted", "cli_auth_interrupted", cliExitCodes.interrupted);
+}

package/dist/esm/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/esm/bin.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { runCli } from "./cli.js";
+void runCli(process.argv.slice(2)).then((exitCode) => {
+    process.exitCode = exitCode;
+}, () => {
+    process.stderr.write("Proxy CLI failed unexpectedly.\n");
+    process.exitCode = 10;
+});

package/dist/esm/cli.d.ts

@@ -0,0 +1,10 @@
+import { CliConfigStore } from "./config.js";
+import { type CliIo } from "./output.js";
+export declare const cliVersion = "0.1.0-prx-128.104.1";
+export interface RunCliOptions {
+    configStore?: CliConfigStore;
+    environment?: NodeJS.ProcessEnv;
+    io?: CliIo;
+    signal?: AbortSignal;
+}
+export declare function runCli(argv: readonly string[], options?: RunCliOptions): Promise<number>;