dodopayments-cli 3.1.0 → 3.3.0

package/.github/workflows/publish.yml

@@ -5,12 +5,78 @@ on:
     types: [published]
 
 permissions:
-  contents: read
+  contents: write
   id-token: write
 
 jobs:
+  binaries:
+    name: Build and upload release binaries
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 'latest'
+
+      - name: Update package.json version from release tag
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          TAG_STRIPPED="${TAG_NAME#v}"
+          node -e "
+            const fs = require('fs');
+            const pkg = JSON.parse(fs.readFileSync('./package.json', 'utf8'));
+            pkg.version = '${TAG_STRIPPED}';
+            fs.writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
+          "
+
+      - name: Install dependencies
+        env:
+          NODE_ENV: development # For devDependencies to be present
+        run: bun install --frozen-lockfile
+
+      - name: Fetch cross-platform dependencies
+        run: bun run fetch-cross-deps.ts
+
+      - name: Build cross-platform binaries
+        env:
+          NODE_ENV: development # For devDependencies to be present
+        run: bun run build-native
+
+      - name: Generate SHA256SUMS
+        working-directory: dist
+        run: |
+          shasum -a 256 \
+            dodo-cli-darwin-arm64 \
+            dodo-cli-darwin-x64 \
+            dodo-cli-linux-arm64 \
+            dodo-cli-linux-x64 \
+            dodo-cli-windows-x64.exe \
+            > SHA256SUMS.txt
+          echo "--- SHA256SUMS.txt ---"
+          cat SHA256SUMS.txt
+
+      - name: Upload binaries to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          gh release upload "${TAG_NAME}" \
+            dist/dodo-cli-darwin-arm64 \
+            dist/dodo-cli-darwin-x64 \
+            dist/dodo-cli-linux-arm64 \
+            dist/dodo-cli-linux-x64 \
+            dist/dodo-cli-windows-x64.exe \
+            dist/SHA256SUMS.txt \
+            --clobber
+
   publish:
+    name: Publish to npm
     runs-on: ubuntu-latest
+    needs: binaries
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -33,7 +99,7 @@ jobs:
           echo "TAG_NAME=${TAG_NAME}"
           TAG_STRIPPED="${TAG_NAME#v}"
           echo "Updating package.json version to: ${TAG_STRIPPED}"
-          
+
           # Update package.json version using node
           node -e "
             const fs = require('fs');
@@ -42,7 +108,7 @@ jobs:
             fs.writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
             console.log('Updated package.json version to:', pkg.version);
           "
-          
+
           # Verify the update
           PKG_VERSION=$(node -p "require('./package.json').version")
           echo "package.json version after update: ${PKG_VERSION}"
@@ -52,7 +118,7 @@ jobs:
           fi
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Build
         run: bun run build

package/README.md

@@ -40,6 +40,7 @@ Manage your [Dodo Payments](https://dodopayments.com/) resources, test webhooks,
 - **Encrypted at rest** — API keys are stored in `~/.dodopayments/config.json`, AES-256-GCM encrypted with a machine-derived key. No plaintext credentials on disk.
 - **Auto update** — the CLI checks for new versions and notifies you in-app. Run `/update` to upgrade in place.
 - **Webhook tooling** — listen for live webhooks or trigger payloads offline for local development.
+- **Scaffolding support** — scaffold billing routes for Next.js, Express, and Better-Auth.
 
 ## Installation
 
@@ -200,6 +201,7 @@ The assistant respects your active environment (Test / Live).
 | `/customers list <page>` | List customers |
 | `/customers create` | Create a new customer (TUI only) |
 | `/customers update <id>` | Update an existing customer (TUI only) |
+| `/customers portal <id>` | Create a temporary customer portal session |
 
 ### Discounts
 
@@ -268,6 +270,14 @@ The interactive `/wh trigger` flow guides you through:
 | **Dispute** | `opened`, `expired`, `accepted`, `cancelled`, `challenged`, `won`, `lost` |
 | **License** | `created` |
 
+### Init commands
+
+| Command | Description |
+| --- | --- |
+| `/init nextjs` | Initialize Next.js App Router billing routes |
+| `/init express` | Initialize Express server billing routes |
+| `/init better-auth [plugins]` | Initialize Better-Auth plugin configuration (plugins: `checkout`, `portal`, `usage`, `webhooks`) |
+
 ### Session commands
 
 | Command | Description |

package/SECURITY.md

@@ -64,11 +64,12 @@ When using Dodo Payments CLI, please follow these security best practices:
 
 ## Local Storage
 
-The CLI stores the following data locally:
+The CLI stores the following data locally within the `~/.dodopayments/` directory (created with strict `0o700` permissions):
 
 | Data | Location | Purpose |
 |------|----------|---------|
-| API Key | OS secret store (Credential Vault, Keychain, etc.) | Authentication |
+| API Key | `~/.dodopayments/config.json` | Encrypted authentication credentials (AES-256-GCM encrypted using a machine-derived key, stored with strict `0o600` permissions) |
+| Active Mode / Session State | `~/.dodopayments/state.json` | Remembers the active environment mode (`test_mode` or `live_mode`) for the session |
 
 ## Vulnerability Disclosure Policy