@proxy-checkout/cli 0.1.0 → 0.1.1-prx-124.139.1

package/README.md

@@ -64,7 +64,9 @@ proxy listen \
   --forward-to http://127.0.0.1:3000/webhooks
 ```
 
-The Stripe signing secret is captured only in child-process memory, never echoed or placed in argv, and stored only inside Proxy's existing encrypted temporary PSP ingress boundary. The CLI never receives the merchant's Stripe API credential. Both the Stripe ingress and local listener close on exit or expire server-side after a crash.
+Before capturing a signing secret, the CLI asks the authenticated Proxy API for the exact sorted Stripe event union implied by Proxy's existing legacy lifecycle bridge plus the selected configuration's enabled capabilities. Both Stripe CLI processes use that union. Temporary-ingress creation includes a non-secret profile hash that Proxy recomputes under the configuration lock; stale or unsupported profiles fail before secret persistence. No separate local event list or new dashboard configuration is required.
+
+Structured `stripe.started` output includes the selected configuration, effective capability IDs, exact events, manifest version, non-secret profile hash, ingress ID, and expiry for agent/CI evidence. The Stripe signing secret is captured only in child-process memory, never echoed or placed in argv, and stored only inside Proxy's existing encrypted temporary PSP ingress boundary. The CLI never receives the merchant's Stripe API credential. Both the Stripe ingress and local listener close on exit or expire server-side after a crash.
 
 ## Advanced delivery controls
 

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0";
+export declare const cliVersion = "0.1.1-prx-124.139.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0";
+export declare const cliVersion = "0.1.1-prx-124.139.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0";
+exports.cliVersion = "0.1.1-prx-124.139.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/cjs/generated/stripe-integration-capabilities-version.d.cts

@@ -0,0 +1,2 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;
+export declare const stripeLegacyCliEventTypes: readonly ["checkout.session.completed", "customer.subscription.deleted", "customer.subscription.updated", "invoice.paid", "invoice.payment_failed", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.succeeded"];

package/dist/cjs/generated/stripe-integration-capabilities-version.d.ts

@@ -0,0 +1,2 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;
+export declare const stripeLegacyCliEventTypes: readonly ["checkout.session.completed", "customer.subscription.deleted", "customer.subscription.updated", "invoice.paid", "invoice.payment_failed", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.succeeded"];

package/dist/cjs/generated/stripe-integration-capabilities-version.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripeLegacyCliEventTypes = exports.stripeIntegrationCapabilitiesManifestVersion = void 0;
+// Generated by tools/compliance/sync-stripe-integration-capabilities.mjs.
+exports.stripeIntegrationCapabilitiesManifestVersion = 2;
+exports.stripeLegacyCliEventTypes = [
+    "checkout.session.completed",
+    "customer.subscription.deleted",
+    "customer.subscription.updated",
+    "invoice.paid",
+    "invoice.payment_failed",
+    "payment_intent.canceled",
+    "payment_intent.payment_failed",
+    "payment_intent.succeeded",
+];

package/dist/cjs/stripe-profile.d.cts

@@ -0,0 +1,14 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function canonicalLegacyStripeIngressEventTypes(): string[];
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/cjs/stripe-profile.d.ts

@@ -0,0 +1,14 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function canonicalLegacyStripeIngressEventTypes(): string[];
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/cjs/stripe-profile.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalLegacyStripeIngressEventTypes = canonicalLegacyStripeIngressEventTypes;
+exports.validateStripeIngressProfile = validateStripeIngressProfile;
+exports.assertCreatedStripeIngressProfile = assertCreatedStripeIngressProfile;
+const errors_js_1 = require("./errors.js");
+const stripe_integration_capabilities_version_js_1 = require("./generated/stripe-integration-capabilities-version.js");
+const stripeEventPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const capabilityPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const maximumEntries = 100;
+function canonicalLegacyStripeIngressEventTypes() {
+    return [...stripe_integration_capabilities_version_js_1.stripeLegacyCliEventTypes];
+}
+function validateStripeIngressProfile(profile) {
+    if (profile.manifest_version !== stripe_integration_capabilities_version_js_1.stripeIntegrationCapabilitiesManifestVersion) {
+        throw profileError("Stripe ingress profile uses an incompatible manifest version");
+    }
+    if (!profile.merchant_psp_config_id.startsWith("pspcfg_") ||
+        !sha256Pattern.test(profile.profile_hash)) {
+        throw profileError("Stripe ingress profile identity is invalid");
+    }
+    assertSortedUnique(profile.event_types, stripeEventPattern, false, "event types");
+    assertSortedUnique(profile.effective_capability_ids, capabilityPattern, true, "capability ids");
+    return profile;
+}
+function assertCreatedStripeIngressProfile(expected, actual) {
+    assertSortedUnique(actual.event_types, stripeEventPattern, false, "event types");
+    if (actual.manifest_version !== expected.manifest_version ||
+        actual.profile_hash !== expected.profile_hash ||
+        JSON.stringify(actual.event_types) !== JSON.stringify(expected.event_types)) {
+        throw profileError("Stripe ingress profile changed while the listener was starting");
+    }
+}
+function assertSortedUnique(values, pattern, allowEmpty, label) {
+    if (!Array.isArray(values) ||
+        (!allowEmpty && values.length === 0) ||
+        values.length > maximumEntries ||
+        values.some((value) => !pattern.test(value)) ||
+        values.some((value, index) => {
+            const previous = values[index - 1];
+            return previous !== undefined && previous >= value;
+        })) {
+        throw profileError(`Stripe ingress profile ${label} are invalid`);
+    }
+}
+function profileError(message) {
+    return new errors_js_1.CliError(message, "stripe_ingress_profile_unsupported", errors_js_1.cliExitCodes.dependency);
+}

package/dist/cjs/webhooks.d.cts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,22 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    createLegacyStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        expires_at: string;
+        id: string;
+        inbound_url: string;
+        merchant_psp_config_id: string;
+    }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/cjs/webhooks.d.ts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,22 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    createLegacyStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        expires_at: string;
+        id: string;
+        inbound_url: string;
+        merchant_psp_config_id: string;
+    }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/cjs/webhooks.js

@@ -7,19 +7,10 @@ const node_child_process_1 = require("node:child_process");
 const errors_js_1 = require("./errors.js");
 const http_client_js_1 = require("./http-client.js");
 const output_js_1 = require("./output.js");
+const stripe_profile_js_1 = require("./stripe-profile.js");
 const claimPollIntervalMs = 1_000;
 const heartbeatIntervalMs = 30_000;
 const localForwardTimeoutMs = 30_000;
-const stripeEvents = [
-    "checkout.session.completed",
-    "customer.subscription.deleted",
-    "customer.subscription.updated",
-    "invoice.paid",
-    "invoice.payment_failed",
-    "payment_intent.canceled",
-    "payment_intent.payment_failed",
-    "payment_intent.succeeded",
-].join(",");
 class ProxyWebhooksClient {
     api;
     constructor(apiBaseUrl, token, fetchImpl) {
@@ -73,16 +64,31 @@ class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+    async createStripeIngress(listenerId, webhookSecret, profileHash, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                profile_hash: profileHash,
                 webhook_secret: webhookSecret,
             },
             signal,
         })).stripe_ingress;
     }
+    async createLegacyStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
+            method: "POST",
+            body: {
+                ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                webhook_secret: webhookSecret,
+            },
+            signal,
+        })).stripe_ingress;
+    }
+    async getStripeIngressProfile(listenerId, pspConfigId, signal) {
+        const query = pspConfigId ? `?${new URLSearchParams({ psp_config_id: pspConfigId })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress-profile${query}`, { signal })).stripe_ingress_profile;
+    }
 }
 exports.ProxyWebhooksClient = ProxyWebhooksClient;
 async function runListener(input) {
@@ -103,16 +109,47 @@ async function runListener(input) {
         if (input.signal.aborted)
             throw listenerInterrupted();
         if (input.stripe) {
-            const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+            let stripeProfile;
+            try {
+                stripeProfile = (0, stripe_profile_js_1.validateStripeIngressProfile)(await input.client.getStripeIngressProfile(listener.id, input.pspConfigId, input.signal));
+            }
+            catch (error) {
+                if (!isMissingStripeIngressProfileRoute(error))
+                    throw error;
+            }
+            const eventTypes = stripeProfile
+                ? stripeProfile.event_types
+                : (0, stripe_profile_js_1.canonicalLegacyStripeIngressEventTypes)();
+            const webhookSecret = await captureStripeWebhookSecret(eventTypes, input.signal);
+            let ingress;
+            if (stripeProfile) {
+                const profiledIngress = await input.client.createStripeIngress(listener.id, webhookSecret, stripeProfile.profile_hash, input.pspConfigId, input.signal);
+                (0, stripe_profile_js_1.assertCreatedStripeIngressProfile)(stripeProfile, profiledIngress);
+                ingress = profiledIngress;
+            }
+            else {
+                ingress = await input.client.createLegacyStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
+            }
+            stripeProcess = await startStripeListener(ingress.inbound_url, eventTypes, input.output, (error) => {
                 stripeProcessFailure = stripeListenerStartError(error);
             });
-            input.output.event("stripe.started", {
-                expires_at: ingress.expires_at,
-                ingress_id: ingress.id,
-                merchant_psp_config_id: ingress.merchant_psp_config_id,
-            }, "Stripe CLI test webhook orchestration is active.");
+            input.output.event("stripe.started", stripeProfile
+                ? {
+                    effective_capability_ids: stripeProfile.effective_capability_ids,
+                    event_types: eventTypes,
+                    expires_at: ingress.expires_at,
+                    ingress_id: ingress.id,
+                    manifest_version: stripeProfile.manifest_version,
+                    merchant_psp_config_id: ingress.merchant_psp_config_id,
+                    profile_hash: stripeProfile.profile_hash,
+                }
+                : {
+                    compatibility_mode: "legacy_api",
+                    event_types: eventTypes,
+                    expires_at: ingress.expires_at,
+                    ingress_id: ingress.id,
+                    merchant_psp_config_id: ingress.merchant_psp_config_id,
+                }, "Stripe CLI test webhook orchestration is active.");
         }
         if (input.signal.aborted)
             throw listenerInterrupted();
@@ -168,6 +205,9 @@ async function runListener(input) {
         }
     }
 }
+function isMissingStripeIngressProfileRoute(error) {
+    return error instanceof errors_js_1.CliError && error.code === "http_404" && error.details?.status === 404;
+}
 async function forwardSelectedDelivery(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
     const claim = await input.client.claim(input.listenerId, {
@@ -216,8 +256,8 @@ async function forwardClaim(client, claim, destination, signal) {
         responseStatusCode,
     });
 }
-async function captureStripeWebhookSecret(signal) {
-    const result = await captureProcess("stripe", ["listen", "--events", stripeEvents, "--print-secret"], signal, 30_000);
+async function captureStripeWebhookSecret(eventTypes, signal) {
+    const result = await captureProcess("stripe", ["listen", "--events", eventTypes.join(","), "--print-secret"], signal, 30_000);
     if (signal.aborted)
         throw listenerInterrupted();
     const match = `${result.stdout}\n${result.stderr}`.match(/\bwhsec_[A-Za-z0-9_-]{8,512}\b/);
@@ -229,8 +269,8 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new errors_js_1.CliError("Local webhook listener interrupted", "cli_listener_interrupted", errors_js_1.cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output, onError) {
-    const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
+function startStripeListener(inboundUrl, eventTypes, output, onError) {
+    const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", eventTypes.join(","), "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
     });

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0";
+export declare const cliVersion = "0.1.1-prx-124.139.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0";
+export const cliVersion = "0.1.1-prx-124.139.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/esm/generated/stripe-integration-capabilities-version.d.ts

@@ -0,0 +1,2 @@
+export declare const stripeIntegrationCapabilitiesManifestVersion: 2;
+export declare const stripeLegacyCliEventTypes: readonly ["checkout.session.completed", "customer.subscription.deleted", "customer.subscription.updated", "invoice.paid", "invoice.payment_failed", "payment_intent.canceled", "payment_intent.payment_failed", "payment_intent.succeeded"];

package/dist/esm/generated/stripe-integration-capabilities-version.js

@@ -0,0 +1,12 @@
+// Generated by tools/compliance/sync-stripe-integration-capabilities.mjs.
+export const stripeIntegrationCapabilitiesManifestVersion = 2;
+export const stripeLegacyCliEventTypes = [
+    "checkout.session.completed",
+    "customer.subscription.deleted",
+    "customer.subscription.updated",
+    "invoice.paid",
+    "invoice.payment_failed",
+    "payment_intent.canceled",
+    "payment_intent.payment_failed",
+    "payment_intent.succeeded",
+];

package/dist/esm/stripe-profile.d.ts

@@ -0,0 +1,14 @@
+export interface StripeIngressProfileRecord {
+    effective_capability_ids: string[];
+    event_types: string[];
+    manifest_version: number;
+    merchant_psp_config_id: string;
+    profile_hash: string;
+}
+export declare function canonicalLegacyStripeIngressEventTypes(): string[];
+export declare function validateStripeIngressProfile(profile: StripeIngressProfileRecord): StripeIngressProfileRecord;
+export declare function assertCreatedStripeIngressProfile(expected: StripeIngressProfileRecord, actual: {
+    event_types: string[];
+    manifest_version: number;
+    profile_hash: string;
+}): void;

package/dist/esm/stripe-profile.js

@@ -0,0 +1,44 @@
+import { CliError, cliExitCodes } from "./errors.js";
+import { stripeIntegrationCapabilitiesManifestVersion, stripeLegacyCliEventTypes, } from "./generated/stripe-integration-capabilities-version.js";
+const stripeEventPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const capabilityPattern = /^[a-z0-9_]+(?:\.[a-z0-9_]+)+$/;
+const sha256Pattern = /^[0-9a-f]{64}$/;
+const maximumEntries = 100;
+export function canonicalLegacyStripeIngressEventTypes() {
+    return [...stripeLegacyCliEventTypes];
+}
+export function validateStripeIngressProfile(profile) {
+    if (profile.manifest_version !== stripeIntegrationCapabilitiesManifestVersion) {
+        throw profileError("Stripe ingress profile uses an incompatible manifest version");
+    }
+    if (!profile.merchant_psp_config_id.startsWith("pspcfg_") ||
+        !sha256Pattern.test(profile.profile_hash)) {
+        throw profileError("Stripe ingress profile identity is invalid");
+    }
+    assertSortedUnique(profile.event_types, stripeEventPattern, false, "event types");
+    assertSortedUnique(profile.effective_capability_ids, capabilityPattern, true, "capability ids");
+    return profile;
+}
+export function assertCreatedStripeIngressProfile(expected, actual) {
+    assertSortedUnique(actual.event_types, stripeEventPattern, false, "event types");
+    if (actual.manifest_version !== expected.manifest_version ||
+        actual.profile_hash !== expected.profile_hash ||
+        JSON.stringify(actual.event_types) !== JSON.stringify(expected.event_types)) {
+        throw profileError("Stripe ingress profile changed while the listener was starting");
+    }
+}
+function assertSortedUnique(values, pattern, allowEmpty, label) {
+    if (!Array.isArray(values) ||
+        (!allowEmpty && values.length === 0) ||
+        values.length > maximumEntries ||
+        values.some((value) => !pattern.test(value)) ||
+        values.some((value, index) => {
+            const previous = values[index - 1];
+            return previous !== undefined && previous >= value;
+        })) {
+        throw profileError(`Stripe ingress profile ${label} are invalid`);
+    }
+}
+function profileError(message) {
+    return new CliError(message, "stripe_ingress_profile_unsupported", cliExitCodes.dependency);
+}

package/dist/esm/webhooks.d.ts

@@ -1,4 +1,5 @@
 import type { CliOutput } from "./output.js";
+import { type StripeIngressProfileRecord } from "./stripe-profile.js";
 export interface WebhookEndpointRecord {
     event_schema_version: string;
     event_types: string[] | null;
@@ -44,12 +45,22 @@ export declare class ProxyWebhooksClient {
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, profileHash: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        event_types: string[];
         expires_at: string;
         id: string;
         inbound_url: string;
+        manifest_version: number;
         merchant_psp_config_id: string;
+        profile_hash: string;
     }>;
+    createLegacyStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
+        expires_at: string;
+        id: string;
+        inbound_url: string;
+        merchant_psp_config_id: string;
+    }>;
+    getStripeIngressProfile(listenerId: string, pspConfigId?: string, signal?: AbortSignal): Promise<StripeIngressProfileRecord>;
 }
 export declare function runListener(input: {
     client: ProxyWebhooksClient;

package/dist/esm/webhooks.js

@@ -2,19 +2,10 @@ import { spawn } from "node:child_process";
 import { CliError, cliExitCodes } from "./errors.js";
 import { ProxyApiClient } from "./http-client.js";
 import { redactText } from "./output.js";
+import { assertCreatedStripeIngressProfile, canonicalLegacyStripeIngressEventTypes, validateStripeIngressProfile, } from "./stripe-profile.js";
 const claimPollIntervalMs = 1_000;
 const heartbeatIntervalMs = 30_000;
 const localForwardTimeoutMs = 30_000;
-const stripeEvents = [
-    "checkout.session.completed",
-    "customer.subscription.deleted",
-    "customer.subscription.updated",
-    "invoice.paid",
-    "invoice.payment_failed",
-    "payment_intent.canceled",
-    "payment_intent.payment_failed",
-    "payment_intent.succeeded",
-].join(",");
 export class ProxyWebhooksClient {
     api;
     constructor(apiBaseUrl, token, fetchImpl) {
@@ -68,16 +59,31 @@ export class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+    async createStripeIngress(listenerId, webhookSecret, profileHash, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                profile_hash: profileHash,
                 webhook_secret: webhookSecret,
             },
             signal,
         })).stripe_ingress;
     }
+    async createLegacyStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
+            method: "POST",
+            body: {
+                ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
+                webhook_secret: webhookSecret,
+            },
+            signal,
+        })).stripe_ingress;
+    }
+    async getStripeIngressProfile(listenerId, pspConfigId, signal) {
+        const query = pspConfigId ? `?${new URLSearchParams({ psp_config_id: pspConfigId })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress-profile${query}`, { signal })).stripe_ingress_profile;
+    }
 }
 export async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
@@ -97,16 +103,47 @@ export async function runListener(input) {
         if (input.signal.aborted)
             throw listenerInterrupted();
         if (input.stripe) {
-            const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+            let stripeProfile;
+            try {
+                stripeProfile = validateStripeIngressProfile(await input.client.getStripeIngressProfile(listener.id, input.pspConfigId, input.signal));
+            }
+            catch (error) {
+                if (!isMissingStripeIngressProfileRoute(error))
+                    throw error;
+            }
+            const eventTypes = stripeProfile
+                ? stripeProfile.event_types
+                : canonicalLegacyStripeIngressEventTypes();
+            const webhookSecret = await captureStripeWebhookSecret(eventTypes, input.signal);
+            let ingress;
+            if (stripeProfile) {
+                const profiledIngress = await input.client.createStripeIngress(listener.id, webhookSecret, stripeProfile.profile_hash, input.pspConfigId, input.signal);
+                assertCreatedStripeIngressProfile(stripeProfile, profiledIngress);
+                ingress = profiledIngress;
+            }
+            else {
+                ingress = await input.client.createLegacyStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
+            }
+            stripeProcess = await startStripeListener(ingress.inbound_url, eventTypes, input.output, (error) => {
                 stripeProcessFailure = stripeListenerStartError(error);
             });
-            input.output.event("stripe.started", {
-                expires_at: ingress.expires_at,
-                ingress_id: ingress.id,
-                merchant_psp_config_id: ingress.merchant_psp_config_id,
-            }, "Stripe CLI test webhook orchestration is active.");
+            input.output.event("stripe.started", stripeProfile
+                ? {
+                    effective_capability_ids: stripeProfile.effective_capability_ids,
+                    event_types: eventTypes,
+                    expires_at: ingress.expires_at,
+                    ingress_id: ingress.id,
+                    manifest_version: stripeProfile.manifest_version,
+                    merchant_psp_config_id: ingress.merchant_psp_config_id,
+                    profile_hash: stripeProfile.profile_hash,
+                }
+                : {
+                    compatibility_mode: "legacy_api",
+                    event_types: eventTypes,
+                    expires_at: ingress.expires_at,
+                    ingress_id: ingress.id,
+                    merchant_psp_config_id: ingress.merchant_psp_config_id,
+                }, "Stripe CLI test webhook orchestration is active.");
         }
         if (input.signal.aborted)
             throw listenerInterrupted();
@@ -162,6 +199,9 @@ export async function runListener(input) {
         }
     }
 }
+function isMissingStripeIngressProfileRoute(error) {
+    return error instanceof CliError && error.code === "http_404" && error.details?.status === 404;
+}
 export async function forwardSelectedDelivery(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
     const claim = await input.client.claim(input.listenerId, {
@@ -210,8 +250,8 @@ async function forwardClaim(client, claim, destination, signal) {
         responseStatusCode,
     });
 }
-async function captureStripeWebhookSecret(signal) {
-    const result = await captureProcess("stripe", ["listen", "--events", stripeEvents, "--print-secret"], signal, 30_000);
+async function captureStripeWebhookSecret(eventTypes, signal) {
+    const result = await captureProcess("stripe", ["listen", "--events", eventTypes.join(","), "--print-secret"], signal, 30_000);
     if (signal.aborted)
         throw listenerInterrupted();
     const match = `${result.stdout}\n${result.stderr}`.match(/\bwhsec_[A-Za-z0-9_-]{8,512}\b/);
@@ -223,8 +263,8 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new CliError("Local webhook listener interrupted", "cli_listener_interrupted", cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output, onError) {
-    const child = spawn("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
+function startStripeListener(inboundUrl, eventTypes, output, onError) {
+    const child = spawn("stripe", ["listen", "--events", eventTypes.join(","), "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
     });

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0",
+  "version": "0.1.1-prx-124.139.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },