dodopayments-cli 3.0.3 → 3.2.3

package/.github/workflows/publish.yml

@@ -5,12 +5,78 @@ on:
     types: [published]
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
 
 jobs:
+  binaries:
+    name: Build and upload release binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 'latest'
+
+      - name: Update package.json version from release tag
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          TAG_STRIPPED="${TAG_NAME#v}"
+          node -e "
+            const fs = require('fs');
+            const pkg = JSON.parse(fs.readFileSync('./package.json', 'utf8'));
+            pkg.version = '${TAG_STRIPPED}';
+            fs.writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
+          "
+
+      - name: Install dependencies
+        env:
+          NODE_ENV: development # For devDependencies to be present
+        run: bun install --frozen-lockfile
+
+      - name: Fetch cross-platform dependencies
+        run: bun run fetch-cross-deps.ts
+
+      - name: Build cross-platform binaries
+        env:
+          NODE_ENV: development # For devDependencies to be present
+        run: bun run build-native
+
+      - name: Generate SHA256SUMS
+        working-directory: dist
+        run: |
+          shasum -a 256 \
+            dodo-cli-darwin-arm64 \
+            dodo-cli-darwin-x64 \
+            dodo-cli-linux-arm64 \
+            dodo-cli-linux-x64 \
+            dodo-cli-windows-x64.exe \
+            > SHA256SUMS.txt
+          echo "--- SHA256SUMS.txt ---"
+          cat SHA256SUMS.txt
+
+      - name: Upload binaries to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          gh release upload "${TAG_NAME}" \
+            dist/dodo-cli-darwin-arm64 \
+            dist/dodo-cli-darwin-x64 \
+            dist/dodo-cli-linux-arm64 \
+            dist/dodo-cli-linux-x64 \
+            dist/dodo-cli-windows-x64.exe \
+            dist/SHA256SUMS.txt \
+            --clobber
+
   publish:
+    name: Publish to npm
     runs-on: ubuntu-latest
+    needs: binaries
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -33,7 +99,7 @@ jobs:
           echo "TAG_NAME=${TAG_NAME}"
           TAG_STRIPPED="${TAG_NAME#v}"
           echo "Updating package.json version to: ${TAG_STRIPPED}"
-          
+
           # Update package.json version using node
           node -e "
             const fs = require('fs');
@@ -42,7 +108,7 @@ jobs:
             fs.writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
             console.log('Updated package.json version to:', pkg.version);
           "
-          
+
           # Verify the update
           PKG_VERSION=$(node -p "require('./package.json').version")
           echo "package.json version after update: ${PKG_VERSION}"
@@ -52,7 +118,7 @@ jobs:
           fi
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build
         run: bun run build

package/README.md

@@ -37,7 +37,7 @@ Manage your [Dodo Payments](https://dodopayments.com/) resources, test webhooks,
 
 - **Interactive TUI** — launch `dodo` with no arguments to open the full interactive interface with command palette, history, and live notifications.
 - **AI assistant built in** — ask questions or take actions in plain English with `/ai`. No extra setup, runs `dodopayments-mcp` locally.
-- **Secure by default** — API keys are stored in your OS secret store (macOS Keychain, Windows Credential Vault, Linux libsecret). No plaintext config on disk.
+- **Encrypted at rest** — API keys are stored in `~/.dodopayments/config.json`, AES-256-GCM encrypted with a machine-derived key. No plaintext credentials on disk.
 - **Auto update** — the CLI checks for new versions and notifies you in-app. Run `/update` to upgrade in place.
 - **Webhook tooling** — listen for live webhooks or trigger payloads offline for local development.
 
@@ -103,9 +103,9 @@ The login flow will:
 1. Open your browser to the Dodo Payments API Keys page.
 2. Prompt you to paste your API Key.
 3. Ask you to select an environment — **Test Mode** or **Live Mode**.
-4. Store the credentials in your OS secret store (Keychain on macOS, Credential Vault on Windows, libsecret on Linux).
+4. Store the credentials encrypted at `~/.dodopayments/config.json` (AES-256-GCM, machine-bound key).
 
-> **Heads up:** Because we use the OS secret store, you may be prompted for your **device password** the first time the CLI reads or writes credentials. If you're upgrading from an older version, any existing plaintext API key will be **migrated to the secret store and the legacy file deleted** automatically.
+> **Upgrading from v3.0.x?** Your previous keychain-stored credentials won't carry over — just run `dodo login` once to re-authenticate.
 
 ### Switching modes / logging out
 
@@ -151,11 +151,11 @@ For example:
 
 ```bash
 dodo payments list 1
-dodo customers create
-dodo wh trigger
+dodo customers list
+dodo wh trigger payment.success http://localhost:3000/webhook
 ```
 
-The reference tables below show every command. In the TUI, prefix them with `/`; in direct mode, drop the `/`.
+The reference tables below show every command. In the TUI, prefix them with `/`; in direct mode, drop the `/`. Commands marked `(TUI only)` are interactive wizards and only work inside the TUI.
 
 ---
 
@@ -198,16 +198,17 @@ The assistant respects your active environment (Test / Live).
 | Command | Description |
 | --- | --- |
 | `/customers list <page>` | List customers |
-| `/customers create` | Create a new customer |
-| `/customers update <id>` | Update an existing customer |
+| `/customers create` | Create a new customer (TUI only) |
+| `/customers update <id>` | Update an existing customer (TUI only) |
+| `/customers portal <id>` | Create a temporary customer portal session |
 
 ### Discounts
 
 | Command | Description |
 | --- | --- |
 | `/discounts list <page>` | List discounts |
-| `/discounts create` | Create a new percentage-based discount |
-| `/discounts delete <id>` | Remove a discount by ID |
+| `/discounts create` | Create a new percentage-based discount (TUI only) |
+| `/discounts delete <id>` | Remove a discount by ID (TUI only) |
 
 ### Licenses
 
@@ -234,7 +235,7 @@ The assistant respects your active environment (Test / Live).
 
 | Command | Description |
 | --- | --- |
-| `/checkout new` | Interactively create a hosted checkout session and get a payment link |
+| `/checkout new` | Interactively create a hosted checkout session and get a payment link (TUI only) |
 
 ### Webhooks
 
@@ -242,10 +243,12 @@ Manage and test webhooks directly from the CLI.
 
 | Command | Description |
 | --- | --- |
-| `/wh listen` | Listen for webhooks in real time and forward them to your local dev server |
-| `/wh trigger` | Trigger a test webhook event interactively — even while logged out |
+| `/wh listen <url>` | Listen for webhooks in real time and forward them to `<url>` |
+| `/wh trigger <event> <url>` | Trigger a test webhook event offline — even while logged out |
 
-The `/wh trigger` flow guides you through:
+In the TUI, omitting the args (`/wh listen` or `/wh trigger`) opens an interactive wizard. In direct mode (`dodo wh …`), both arguments are required.
+
+The interactive `/wh trigger` flow guides you through:
 
 1. Setting a destination **endpoint URL**
 2. Selecting a specific **event** to trigger

package/SECURITY.md

@@ -64,11 +64,12 @@ When using Dodo Payments CLI, please follow these security best practices:
 
 ## Local Storage
 
-The CLI stores the following data locally:
+The CLI stores the following data locally within the `~/.dodopayments/` directory (created with strict `0o700` permissions):
 
 | Data | Location | Purpose |
 |------|----------|---------|
-| API Key | OS secret store (Credential Vault, Keychain, etc.) | Authentication |
+| API Key | `~/.dodopayments/config.json` | Encrypted authentication credentials (AES-256-GCM encrypted using a machine-derived key, stored with strict `0o600` permissions) |
+| Active Mode / Session State | `~/.dodopayments/state.json` | Remembers the active environment mode (`test_mode` or `live_mode`) for the session |
 
 ## Vulnerability Disclosure Policy