@proxy-checkout/cli 0.1.0-prx-128.114.1 → 0.1.0-prx-124.117.1

package/README.md

@@ -45,7 +45,7 @@ proxy listen \
 
 The listener has a two-minute lease renewed every 30 seconds. Proxy prepares the canonical body and signature headers, the CLI forwards those exact bytes to the loopback URL, and the server records the real local outcome in its normal attempt/retry state machine. The source HTTPS endpoint continues to receive its independent normal delivery. Only `localhost`, `127.0.0.1`, and `::1` HTTP(S) destinations are allowed.
 
-Control-C closes the listener. Logout closes resources owned by the credential. The server expires abandoned listeners after a crash.
+Control-C closes the listener. Logout closes resources owned by the credential. If a device or local credential is lost, an authorized Portal user can revoke the CLI credential from API Keys; remote revocation also closes its active local listeners and temporary Stripe ingress. The server expires abandoned listeners after a crash.
 
 ## Optional Stripe CLI orchestration
 
@@ -64,7 +64,9 @@ proxy listen \
   --forward-to http://127.0.0.1:3000/webhooks
 ```
 
-The Stripe signing secret is captured only in child-process memory, never echoed or placed in argv, and stored only inside Proxy's existing encrypted temporary PSP ingress boundary. The CLI never receives the merchant's Stripe API credential. Both the Stripe ingress and local listener close on exit or expire server-side after a crash.
+Before capturing a signing secret, the CLI asks the authenticated Proxy API for the exact sorted Stripe event union implied by Proxy's existing legacy lifecycle bridge plus the selected configuration's enabled capabilities. Both Stripe CLI processes use that union. Temporary-ingress creation includes a non-secret profile hash that Proxy recomputes under the configuration lock; stale or unsupported profiles fail before secret persistence. No separate local event list or new dashboard configuration is required.
+
+Structured `stripe.started` output includes the selected configuration, effective capability IDs, exact events, manifest version, non-secret profile hash, ingress ID, and expiry for agent/CI evidence. The Stripe signing secret is captured only in child-process memory, never echoed or placed in argv, and stored only inside Proxy's existing encrypted temporary PSP ingress boundary. The CLI never receives the merchant's Stripe API credential. Both the Stripe ingress and local listener close on exit or expire server-side after a crash.
 
 ## Advanced delivery controls
 

package/dist/cjs/auth.d.cts

@@ -37,4 +37,9 @@ export declare function logout(input: {
     signal?: AbortSignal;
     token: string;
 }): Promise<void>;
+export declare function validateVerificationUrl(value: string): string;
+export declare function browserOpenCommand(operatingSystem: NodeJS.Platform, url: string): {
+    args: string[];
+    command: string;
+};
 export {};

package/dist/cjs/auth.d.ts

@@ -37,4 +37,9 @@ export declare function logout(input: {
     signal?: AbortSignal;
     token: string;
 }): Promise<void>;
+export declare function validateVerificationUrl(value: string): string;
+export declare function browserOpenCommand(operatingSystem: NodeJS.Platform, url: string): {
+    args: string[];
+    command: string;
+};
 export {};

package/dist/cjs/auth.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.login = login;
 exports.status = status;
 exports.logout = logout;
+exports.validateVerificationUrl = validateVerificationUrl;
+exports.browserOpenCommand = browserOpenCommand;
 const node_child_process_1 = require("node:child_process");
 const node_os_1 = require("node:os");
 const errors_js_1 = require("./errors.js");
@@ -243,7 +245,8 @@ function validateVerificationUrl(value) {
     catch {
         throw new errors_js_1.CliError("Proxy returned an invalid browser approval URL", "cli_invalid_auth_response", errors_js_1.cliExitCodes.network);
     }
-    const loopback = ["127.0.0.1", "::1", "localhost"].includes(url.hostname);
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const loopback = ["127.0.0.1", "::1", "localhost"].includes(hostname);
     if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
         url.username ||
         url.password) {
@@ -252,8 +255,7 @@ function validateVerificationUrl(value) {
     return url.toString();
 }
 async function openBrowser(url) {
-    const command = (0, node_os_1.platform)() === "darwin" ? "open" : (0, node_os_1.platform)() === "win32" ? "cmd" : "xdg-open";
-    const args = (0, node_os_1.platform)() === "win32" ? ["/c", "start", "", url] : [url];
+    const { args, command } = browserOpenCommand((0, node_os_1.platform)(), url);
     return new Promise((resolve) => {
         const child = (0, node_child_process_1.spawn)(command, args, { detached: true, shell: false, stdio: "ignore" });
         child.once("error", () => resolve(false));
@@ -263,6 +265,17 @@ async function openBrowser(url) {
         });
     });
 }
+function browserOpenCommand(operatingSystem, url) {
+    if (operatingSystem === "darwin") {
+        return { args: [url], command: "open" };
+    }
+    if (operatingSystem === "win32") {
+        // Avoid cmd.exe entirely: even with shell=false, `cmd /c start` reparses URL
+        // metacharacters. Explorer receives the URL as one process argument.
+        return { args: [url], command: "explorer.exe" };
+    }
+    return { args: [url], command: "xdg-open" };
+}
 function deviceExpired() {
     return new errors_js_1.CliError("Device authorization expired", "cli_device_authorization_expired", errors_js_1.cliExitCodes.authentication);
 }

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.114.1";
+export declare const cliVersion = "0.1.0-prx-124.117.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.114.1";
+export declare const cliVersion = "0.1.0-prx-124.117.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0-prx-128.114.1";
+exports.cliVersion = "0.1.0-prx-124.117.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/cjs/config.js

@@ -46,6 +46,8 @@ function run() {
   if (operation === "read") {
     query.setObjectForKey(true, $("r_Data"));
     query.setObjectForKey($("m_LimitOne"), $("m_Limit"));
+    // In JXA's Objective-C bridge, nullary $() creates the mutable CFTypeRef
+    // out reference that SecItemCopyMatching fills with the returned NSData.
     const result = $();
     const status = $.SecItemCopyMatching(query, result);
     if (status === -25300) return "missing";

package/dist/cjs/generated/stripe-integration-capabilities-version.d.cts

@@ -0,0 +1 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;

package/dist/cjs/generated/stripe-integration-capabilities-version.d.ts

@@ -0,0 +1 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;

package/dist/cjs/generated/stripe-integration-capabilities-version.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripeIntegrationCapabilitiesManifestVersion = void 0;
+// Generated by tools/compliance/sync-stripe-integration-capabilities.mjs.
+exports.stripeIntegrationCapabilitiesManifestVersion = 2;

package/dist/cjs/stripe-profile.d.cts

@@ -0,0 +1,13 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/cjs/stripe-profile.d.ts

@@ -0,0 +1,13 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/cjs/stripe-profile.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateStripeIngressProfile = validateStripeIngressProfile;
+exports.assertCreatedStripeIngressProfile = assertCreatedStripeIngressProfile;
+const errors_js_1 = require("./errors.js");
+const stripe_integration_capabilities_version_js_1 = require("./generated/stripe-integration-capabilities-version.js");
+const stripeEventPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const capabilityPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const maximumEntries = 100;
+function validateStripeIngressProfile(profile) {
+    if (profile.manifest_version !== stripe_integration_capabilities_version_js_1.stripeIntegrationCapabilitiesManifestVersion) {
+        throw profileError("Stripe ingress profile uses an incompatible manifest version");
+    }
+    if (!profile.merchant_psp_config_id.startsWith("pspcfg_") ||
+        !sha256Pattern.test(profile.profile_hash)) {
+        throw profileError("Stripe ingress profile identity is invalid");
+    }
+    assertSortedUnique(profile.event_types, stripeEventPattern, false, "event types");
+    assertSortedUnique(profile.effective_capability_ids, capabilityPattern, true, "capability ids");
+    return profile;
+}
+function assertCreatedStripeIngressProfile(expected, actual) {
+    assertSortedUnique(actual.event_types, stripeEventPattern, false, "event types");
+    if (actual.manifest_version !== expected.manifest_version ||
+        actual.profile_hash !== expected.profile_hash ||
+        JSON.stringify(actual.event_types) !== JSON.stringify(expected.event_types)) {
+        throw profileError("Stripe ingress profile changed while the listener was starting");
+    }
+}
+function assertSortedUnique(values, pattern, allowEmpty, label) {
+    if (!Array.isArray(values) ||
+        (!allowEmpty && values.length === 0) ||
+        values.length > maximumEntries ||
+        values.some((value) => !pattern.test(value)) ||
+        values.some((value, index) => index > 0 && values[index - 1] >= value)) {
+        throw profileError(`Stripe ingress profile ${label} are invalid`);
+    }
+}
+function profileError(message) {
+    return new errors_js_1.CliError(message, "stripe_ingress_profile_unsupported", errors_js_1.cliExitCodes.dependency);
+}

package/dist/cjs/webhooks.d.cts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,16 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/cjs/webhooks.d.ts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,16 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/cjs/webhooks.js

@@ -7,19 +7,10 @@ const node_child_process_1 = require("node:child_process");
 const errors_js_1 = require("./errors.js");
 const http_client_js_1 = require("./http-client.js");
 const output_js_1 = require("./output.js");
+const stripe_profile_js_1 = require("./stripe-profile.js");
 const claimPollIntervalMs = 1_000;
 const heartbeatIntervalMs = 30_000;
 const localForwardTimeoutMs = 30_000;
-const stripeEvents = [
-    "checkout.session.completed",
-    "customer.subscription.deleted",
-    "customer.subscription.updated",
-    "invoice.paid",
-    "invoice.payment_failed",
-    "payment_intent.canceled",
-    "payment_intent.payment_failed",
-    "payment_intent.succeeded",
-].join(",");
 class ProxyWebhooksClient {
     api;
     constructor(apiBaseUrl, token, fetchImpl) {
@@ -73,16 +64,21 @@ class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+    async createStripeIngress(listenerId, webhookSecret, profileHash, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                profile_hash: profileHash,
                 webhook_secret: webhookSecret,
             },
             signal,
         })).stripe_ingress;
     }
+    async getStripeIngressProfile(listenerId, pspConfigId, signal) {
+        const query = pspConfigId ? `?${new URLSearchParams({ psp_config_id: pspConfigId })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress-profile${query}`, { signal })).stripe_ingress_profile;
+    }
 }
 exports.ProxyWebhooksClient = ProxyWebhooksClient;
 async function runListener(input) {
@@ -103,15 +99,21 @@ async function runListener(input) {
         if (input.signal.aborted)
             throw listenerInterrupted();
         if (input.stripe) {
-            const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+            const stripeProfile = (0, stripe_profile_js_1.validateStripeIngressProfile)(await input.client.getStripeIngressProfile(listener.id, input.pspConfigId, input.signal));
+            const webhookSecret = await captureStripeWebhookSecret(stripeProfile.event_types, input.signal);
+            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, stripeProfile.profile_hash, input.pspConfigId, input.signal);
+            (0, stripe_profile_js_1.assertCreatedStripeIngressProfile)(stripeProfile, ingress);
+            stripeProcess = await startStripeListener(ingress.inbound_url, ingress.event_types, input.output, (error) => {
                 stripeProcessFailure = stripeListenerStartError(error);
             });
             input.output.event("stripe.started", {
+                effective_capability_ids: stripeProfile.effective_capability_ids,
+                event_types: ingress.event_types,
                 expires_at: ingress.expires_at,
                 ingress_id: ingress.id,
+                manifest_version: ingress.manifest_version,
                 merchant_psp_config_id: ingress.merchant_psp_config_id,
+                profile_hash: ingress.profile_hash,
             }, "Stripe CLI test webhook orchestration is active.");
         }
         if (input.signal.aborted)
@@ -169,6 +171,7 @@ async function runListener(input) {
     }
 }
 async function forwardSelectedDelivery(input) {
+    const destination = validateLoopbackDestination(input.forwardTo);
     const claim = await input.client.claim(input.listenerId, {
         ...(input.deliveryId ? { deliveryId: input.deliveryId } : {}),
         ...(input.replayOutboxEventId ? { replayOutboxEventId: input.replayOutboxEventId } : {}),
@@ -176,7 +179,7 @@ async function forwardSelectedDelivery(input) {
     if (!claim) {
         throw new errors_js_1.CliError("Selected delivery or replay is not currently claimable", "cli_delivery_not_claimable", errors_js_1.cliExitCodes.conflict);
     }
-    const completion = await forwardClaim(input.client, claim, validateLoopbackDestination(input.forwardTo), input.signal);
+    const completion = await forwardClaim(input.client, claim, destination, input.signal);
     return {
         attempt_id: claim.attempt_id,
         attempt_number: claim.attempt_number,
@@ -215,8 +218,8 @@ async function forwardClaim(client, claim, destination, signal) {
         responseStatusCode,
     });
 }
-async function captureStripeWebhookSecret(signal) {
-    const result = await captureProcess("stripe", ["listen", "--events", stripeEvents, "--print-secret"], signal, 30_000);
+async function captureStripeWebhookSecret(eventTypes, signal) {
+    const result = await captureProcess("stripe", ["listen", "--events", eventTypes.join(","), "--print-secret"], signal, 30_000);
     if (signal.aborted)
         throw listenerInterrupted();
     const match = `${result.stdout}\n${result.stderr}`.match(/\bwhsec_[A-Za-z0-9_-]{8,512}\b/);
@@ -228,8 +231,8 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new errors_js_1.CliError("Local webhook listener interrupted", "cli_listener_interrupted", errors_js_1.cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output, onError) {
-    const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
+function startStripeListener(inboundUrl, eventTypes, output, onError) {
+    const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", eventTypes.join(","), "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
     });

package/dist/esm/auth.d.ts

@@ -37,4 +37,9 @@ export declare function logout(input: {
     signal?: AbortSignal;
     token: string;
 }): Promise<void>;
+export declare function validateVerificationUrl(value: string): string;
+export declare function browserOpenCommand(operatingSystem: NodeJS.Platform, url: string): {
+    args: string[];
+    command: string;
+};
 export {};

package/dist/esm/auth.js

@@ -230,7 +230,7 @@ function normalizeCredentialName(name) {
     }
     return value;
 }
-function validateVerificationUrl(value) {
+export function validateVerificationUrl(value) {
     let url;
     try {
         url = new URL(value);
@@ -238,7 +238,8 @@ function validateVerificationUrl(value) {
     catch {
         throw new CliError("Proxy returned an invalid browser approval URL", "cli_invalid_auth_response", cliExitCodes.network);
     }
-    const loopback = ["127.0.0.1", "::1", "localhost"].includes(url.hostname);
+    const hostname = url.hostname.replace(/^\[|\]$/g, "");
+    const loopback = ["127.0.0.1", "::1", "localhost"].includes(hostname);
     if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) ||
         url.username ||
         url.password) {
@@ -247,8 +248,7 @@ function validateVerificationUrl(value) {
     return url.toString();
 }
 async function openBrowser(url) {
-    const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
-    const args = platform() === "win32" ? ["/c", "start", "", url] : [url];
+    const { args, command } = browserOpenCommand(platform(), url);
     return new Promise((resolve) => {
         const child = spawn(command, args, { detached: true, shell: false, stdio: "ignore" });
         child.once("error", () => resolve(false));
@@ -258,6 +258,17 @@ async function openBrowser(url) {
         });
     });
 }
+export function browserOpenCommand(operatingSystem, url) {
+    if (operatingSystem === "darwin") {
+        return { args: [url], command: "open" };
+    }
+    if (operatingSystem === "win32") {
+        // Avoid cmd.exe entirely: even with shell=false, `cmd /c start` reparses URL
+        // metacharacters. Explorer receives the URL as one process argument.
+        return { args: [url], command: "explorer.exe" };
+    }
+    return { args: [url], command: "xdg-open" };
+}
 function deviceExpired() {
     return new CliError("Device authorization expired", "cli_device_authorization_expired", cliExitCodes.authentication);
 }

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.114.1";
+export declare const cliVersion = "0.1.0-prx-124.117.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0-prx-128.114.1";
+export const cliVersion = "0.1.0-prx-124.117.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/esm/config.js

@@ -41,6 +41,8 @@ function run() {
   if (operation === "read") {
     query.setObjectForKey(true, $("r_Data"));
     query.setObjectForKey($("m_LimitOne"), $("m_Limit"));
+    // In JXA's Objective-C bridge, nullary $() creates the mutable CFTypeRef
+    // out reference that SecItemCopyMatching fills with the returned NSData.
     const result = $();
     const status = $.SecItemCopyMatching(query, result);
     if (status === -25300) return "missing";

package/dist/esm/generated/stripe-integration-capabilities-version.d.ts

@@ -0,0 +1 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;

package/dist/esm/generated/stripe-integration-capabilities-version.js

@@ -0,0 +1,2 @@
+// Generated by tools/compliance/sync-stripe-integration-capabilities.mjs.
+export const stripeIntegrationCapabilitiesManifestVersion = 2;

package/dist/esm/stripe-profile.d.ts

@@ -0,0 +1,13 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/esm/stripe-profile.js

@@ -0,0 +1,38 @@
+import { CliError, cliExitCodes } from "./errors.js";
+import { stripeIntegrationCapabilitiesManifestVersion } from "./generated/stripe-integration-capabilities-version.js";
+const stripeEventPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const capabilityPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const maximumEntries = 100;
+export function validateStripeIngressProfile(profile) {
+    if (profile.manifest_version !== stripeIntegrationCapabilitiesManifestVersion) {
+        throw profileError("Stripe ingress profile uses an incompatible manifest version");
+    }
+    if (!profile.merchant_psp_config_id.startsWith("pspcfg_") ||
+        !sha256Pattern.test(profile.profile_hash)) {
+        throw profileError("Stripe ingress profile identity is invalid");
+    }
+    assertSortedUnique(profile.event_types, stripeEventPattern, false, "event types");
+    assertSortedUnique(profile.effective_capability_ids, capabilityPattern, true, "capability ids");
+    return profile;
+}
+export function assertCreatedStripeIngressProfile(expected, actual) {
+    assertSortedUnique(actual.event_types, stripeEventPattern, false, "event types");
+    if (actual.manifest_version !== expected.manifest_version ||
+        actual.profile_hash !== expected.profile_hash ||
+        JSON.stringify(actual.event_types) !== JSON.stringify(expected.event_types)) {
+        throw profileError("Stripe ingress profile changed while the listener was starting");
+    }
+}
+function assertSortedUnique(values, pattern, allowEmpty, label) {
+    if (!Array.isArray(values) ||
+        (!allowEmpty && values.length === 0) ||
+        values.length > maximumEntries ||
+        values.some((value) => !pattern.test(value)) ||
+        values.some((value, index) => index > 0 && values[index - 1] >= value)) {
+        throw profileError(`Stripe ingress profile ${label} are invalid`);
+    }
+}
+function profileError(message) {
+    return new CliError(message, "stripe_ingress_profile_unsupported", cliExitCodes.dependency);
+}

package/dist/esm/webhooks.d.ts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,16 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/esm/webhooks.js

@@ -2,19 +2,10 @@ import { spawn } from "node:child_process";
 import { CliError, cliExitCodes } from "./errors.js";
 import { ProxyApiClient } from "./http-client.js";
 import { redactText } from "./output.js";
+import { assertCreatedStripeIngressProfile, validateStripeIngressProfile, } from "./stripe-profile.js";
 const claimPollIntervalMs = 1_000;
 const heartbeatIntervalMs = 30_000;
 const localForwardTimeoutMs = 30_000;
-const stripeEvents = [
-    "checkout.session.completed",
-    "customer.subscription.deleted",
-    "customer.subscription.updated",
-    "invoice.paid",
-    "invoice.payment_failed",
-    "payment_intent.canceled",
-    "payment_intent.payment_failed",
-    "payment_intent.succeeded",
-].join(",");
 export class ProxyWebhooksClient {
     api;
     constructor(apiBaseUrl, token, fetchImpl) {
@@ -68,16 +59,21 @@ export class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+    async createStripeIngress(listenerId, webhookSecret, profileHash, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                profile_hash: profileHash,
                 webhook_secret: webhookSecret,
             },
             signal,
         })).stripe_ingress;
     }
+    async getStripeIngressProfile(listenerId, pspConfigId, signal) {
+        const query = pspConfigId ? `?${new URLSearchParams({ psp_config_id: pspConfigId })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress-profile${query}`, { signal })).stripe_ingress_profile;
+    }
 }
 export async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
@@ -97,15 +93,21 @@ export async function runListener(input) {
         if (input.signal.aborted)
             throw listenerInterrupted();
         if (input.stripe) {
-            const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+            const stripeProfile = validateStripeIngressProfile(await input.client.getStripeIngressProfile(listener.id, input.pspConfigId, input.signal));
+            const webhookSecret = await captureStripeWebhookSecret(stripeProfile.event_types, input.signal);
+            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, stripeProfile.profile_hash, input.pspConfigId, input.signal);
+            assertCreatedStripeIngressProfile(stripeProfile, ingress);
+            stripeProcess = await startStripeListener(ingress.inbound_url, ingress.event_types, input.output, (error) => {
                 stripeProcessFailure = stripeListenerStartError(error);
             });
             input.output.event("stripe.started", {
+                effective_capability_ids: stripeProfile.effective_capability_ids,
+                event_types: ingress.event_types,
                 expires_at: ingress.expires_at,
                 ingress_id: ingress.id,
+                manifest_version: ingress.manifest_version,
                 merchant_psp_config_id: ingress.merchant_psp_config_id,
+                profile_hash: ingress.profile_hash,
             }, "Stripe CLI test webhook orchestration is active.");
         }
         if (input.signal.aborted)
@@ -163,6 +165,7 @@ export async function runListener(input) {
     }
 }
 export async function forwardSelectedDelivery(input) {
+    const destination = validateLoopbackDestination(input.forwardTo);
     const claim = await input.client.claim(input.listenerId, {
         ...(input.deliveryId ? { deliveryId: input.deliveryId } : {}),
         ...(input.replayOutboxEventId ? { replayOutboxEventId: input.replayOutboxEventId } : {}),
@@ -170,7 +173,7 @@ export async function forwardSelectedDelivery(input) {
     if (!claim) {
         throw new CliError("Selected delivery or replay is not currently claimable", "cli_delivery_not_claimable", cliExitCodes.conflict);
     }
-    const completion = await forwardClaim(input.client, claim, validateLoopbackDestination(input.forwardTo), input.signal);
+    const completion = await forwardClaim(input.client, claim, destination, input.signal);
     return {
         attempt_id: claim.attempt_id,
         attempt_number: claim.attempt_number,
@@ -209,8 +212,8 @@ async function forwardClaim(client, claim, destination, signal) {
         responseStatusCode,
     });
 }
-async function captureStripeWebhookSecret(signal) {
-    const result = await captureProcess("stripe", ["listen", "--events", stripeEvents, "--print-secret"], signal, 30_000);
+async function captureStripeWebhookSecret(eventTypes, signal) {
+    const result = await captureProcess("stripe", ["listen", "--events", eventTypes.join(","), "--print-secret"], signal, 30_000);
     if (signal.aborted)
         throw listenerInterrupted();
     const match = `${result.stdout}\n${result.stderr}`.match(/\bwhsec_[A-Za-z0-9_-]{8,512}\b/);
@@ -222,8 +225,8 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new CliError("Local webhook listener interrupted", "cli_listener_interrupted", cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output, onError) {
-    const child = spawn("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
+function startStripeListener(inboundUrl, eventTypes, output, onError) {
+    const child = spawn("stripe", ["listen", "--events", eventTypes.join(","), "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
     });

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0-prx-128.114.1",
+  "version": "0.1.0-prx-124.117.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },