@proxy-checkout/cli 0.1.0-prx-128.108.1 → 0.1.0-prx-128.110.1

package/dist/cjs/auth.d.cts

@@ -26,6 +26,7 @@ export declare function login(input: {
 }): Promise<CliProfile>;
 export declare function status(input: {
     apiBaseUrl: string;
+    signal?: AbortSignal;
     token: string;
 }): Promise<CredentialExchangeResponse["profile"]>;
 export declare function logout(input: {
@@ -33,6 +34,7 @@ export declare function logout(input: {
     configStore: CliConfigStore;
     profileName: string;
     removeLocalProfile: boolean;
+    signal?: AbortSignal;
     token: string;
 }): Promise<void>;
 export {};

package/dist/cjs/auth.d.ts

@@ -26,6 +26,7 @@ export declare function login(input: {
 }): Promise<CliProfile>;
 export declare function status(input: {
     apiBaseUrl: string;
+    signal?: AbortSignal;
     token: string;
 }): Promise<CredentialExchangeResponse["profile"]>;
 export declare function logout(input: {
@@ -33,6 +34,7 @@ export declare function logout(input: {
     configStore: CliConfigStore;
     profileName: string;
     removeLocalProfile: boolean;
+    signal?: AbortSignal;
     token: string;
 }): Promise<void>;
 export {};

package/dist/cjs/auth.js

@@ -12,6 +12,7 @@ const deviceScope = "proxy.cli.local-webhook-development";
 const deviceGrantType = "urn:ietf:params:oauth:grant-type:device_code";
 async function login(input) {
     const signal = input.signal ?? new AbortController().signal;
+    const previousCredential = await input.configStore.readStoredCredential(input.profileName);
     const client = new http_client_js_1.ProxyApiClient(input.apiBaseUrl);
     const codeResult = await client.oauthRequest("/api/auth/device/code", {
         client_id: clientId,
@@ -55,17 +56,39 @@ async function login(input) {
         await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
         throw mismatch;
     }
+    let saved;
     try {
-        const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-        if (saved.credentialStore === "file") {
-            input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
-        }
-        return saved;
+        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     }
     catch (error) {
         await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
         throw error;
     }
+    if (saved.credentialStore === "file") {
+        input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
+    }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    return saved;
+}
+async function revokeSupersededCredential(previous, newCredential, output) {
+    if (!previous || previous.token === newCredential)
+        return;
+    if (!previous.token) {
+        output.notice(`Previous CLI credential ${previous.profile.credentialId} was not available locally and could not be automatically revoked; verify its state in the Proxy Portal.`);
+        return;
+    }
+    try {
+        await new http_client_js_1.ProxyApiClient(previous.profile.apiBaseUrl, previous.token).request("/cli/auth/logout", { method: "POST" });
+    }
+    catch (error) {
+        if (error instanceof errors_js_1.CliError && error.exitCode === errors_js_1.cliExitCodes.authentication)
+            return;
+        throw new errors_js_1.CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
+            cleanup_error_class: error instanceof Error ? error.name : typeof error,
+            cleanup_error_code: error instanceof errors_js_1.CliError ? error.code : undefined,
+            credential_id: previous.profile.credentialId,
+        });
+    }
 }
 async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
     try {
@@ -83,12 +106,13 @@ async function revokeExchangedCredential(apiBaseUrl, credential, profile, origin
     }
 }
 async function status(input) {
-    const response = await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status");
+    const response = await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });
     return response.profile;
 }
 async function logout(input) {
     await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/logout", {
         method: "POST",
+        signal: input.signal,
     });
     if (input.removeLocalProfile) {
         await input.configStore.removeProfile(input.profileName);

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.108.1";
+export declare const cliVersion = "0.1.0-prx-128.110.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.108.1";
+export declare const cliVersion = "0.1.0-prx-128.110.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0-prx-128.108.1";
+exports.cliVersion = "0.1.0-prx-128.110.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
@@ -109,7 +109,7 @@ async function executeCommand(input) {
         profileName: input.profileName,
     });
     if (input.command.path === "auth status") {
-        const remoteProfile = await (0, auth_js_1.status)(resolved);
+        const remoteProfile = await (0, auth_js_1.status)({ ...resolved, signal: input.signal });
         assertRemoteTarget(remoteProfile, input);
         input.output.result({
             profile: {
@@ -122,54 +122,55 @@ async function executeCommand(input) {
     }
     if (input.command.path === "auth logout") {
         if (input.expectedMerchantId || input.expectedMode) {
-            assertRemoteTarget(await (0, auth_js_1.status)(resolved), input);
+            assertRemoteTarget(await (0, auth_js_1.status)({ ...resolved, signal: input.signal }), input);
         }
         await (0, auth_js_1.logout)({
             apiBaseUrl: resolved.apiBaseUrl,
             configStore: input.configStore,
             profileName: resolved.profileName,
             removeLocalProfile: resolved.source !== "environment",
+            signal: input.signal,
             token: resolved.token,
         });
         input.output.result({ profile: resolved.profileName, revoked: true }, `Logged out profile ${resolved.profileName}.`);
         return;
     }
     if (input.expectedMerchantId || input.expectedMode) {
-        assertRemoteTarget(await (0, auth_js_1.status)(resolved), input);
+        assertRemoteTarget(await (0, auth_js_1.status)({ ...resolved, signal: input.signal }), input);
     }
     const webhooks = new webhooks_js_1.ProxyWebhooksClient(resolved.apiBaseUrl, resolved.token);
     if (input.command.path === "webhooks endpoints list") {
-        const endpoints = await webhooks.listEndpoints();
+        const endpoints = await webhooks.listEndpoints(input.signal);
         input.output.result({ webhook_endpoints: endpoints }, formatEndpointList(endpoints));
         return;
     }
     if (input.command.path === "webhooks listeners create") {
-        const listener = await webhooks.createListener(readRequiredString(input.options, "--endpoint"));
+        const listener = await webhooks.createListener(readRequiredString(input.options, "--endpoint"), input.signal);
         input.output.result({ listener }, `Created listener ${listener.id}; lease expires ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners status") {
-        const listener = await webhooks.getListener(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.getListener(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Listener ${listener.id} is ${listener.status}; lease expires ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners heartbeat") {
-        const listener = await webhooks.heartbeat(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.heartbeat(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Extended listener ${listener.id} through ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners close") {
-        const listener = await webhooks.close(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.close(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Closed listener ${listener.id}.`);
         return;
     }
     if (input.command.path === "webhooks deliveries list") {
-        const deliveries = await webhooks.listDeliveries(readRequiredString(input.options, "--listener"), readOptionalInteger(input.options, "--limit"));
+        const deliveries = await webhooks.listDeliveries(readRequiredString(input.options, "--listener"), readOptionalInteger(input.options, "--limit"), input.signal);
         input.output.result({ deliveries }, `${deliveries.length} local webhook deliveries.`);
         return;
     }
     if (input.command.path === "webhooks deliveries replay") {
-        const replay = await webhooks.replay(readRequiredString(input.options, "--listener"), readRequiredString(input.options, "--delivery"), readRequiredString(input.options, "--reason"));
+        const replay = await webhooks.replay(readRequiredString(input.options, "--listener"), readRequiredString(input.options, "--delivery"), readRequiredString(input.options, "--reason"), input.signal);
         input.output.result(replay, "Replay scheduled.");
         return;
     }
@@ -191,13 +192,14 @@ async function executeCommand(input) {
         return;
     }
     if (input.command.path === "listen") {
-        const endpoints = await webhooks.listEndpoints();
+        const endpoints = await webhooks.listEndpoints(input.signal);
         const sourceEndpointId = await selectEndpoint({
             endpoints,
             io: input.io,
             noInput: input.noInput,
             output: input.output,
             requested: readOptionalString(input.options, "--endpoint"),
+            signal: input.signal,
         });
         const maxEvents = readOptionalInteger(input.options, "--max-events") ?? 0;
         if (maxEvents < 0)
@@ -348,12 +350,20 @@ async function selectEndpoint(input) {
         output: input.io.stderr,
     });
     try {
-        const answer = await prompt.question("Select a source endpoint number: ");
+        const answer = await prompt.question("Select a source endpoint number: ", {
+            signal: input.signal,
+        });
         const selected = input.endpoints[Number(answer) - 1];
         if (!selected)
             throw (0, errors_js_1.usageError)("Invalid endpoint selection");
         return selected.id;
     }
+    catch (error) {
+        if (input.signal.aborted) {
+            throw new errors_js_1.CliError("CLI command interrupted", "cli_command_interrupted", errors_js_1.cliExitCodes.interrupted);
+        }
+        throw error;
+    }
     finally {
         prompt.close();
     }

package/dist/cjs/config.d.cts

@@ -17,6 +17,10 @@ export interface ResolvedCredential {
     source: "environment" | "file" | "keychain" | "secret-service";
     token: string;
 }
+export interface StoredProfileCredential {
+    profile: CliProfile;
+    token?: string;
+}
 export interface ConfigEnvironment {
     HOME?: string;
     PATH?: string;
@@ -40,6 +44,7 @@ export declare class CliConfigStore {
     apiBaseUrl(requested?: string, profile?: CliProfile): string;
     readProfile(profileName: string): Promise<CliProfile | undefined>;
     saveProfile(profileName: string, profile: Omit<CliProfile, "credentialStore">, token: string): Promise<CliProfile>;
+    readStoredCredential(profileName: string): Promise<StoredProfileCredential | undefined>;
     resolveCredential(input: {
         apiBaseUrl?: string;
         profileName?: string;

package/dist/cjs/config.d.ts

@@ -17,6 +17,10 @@ export interface ResolvedCredential {
     source: "environment" | "file" | "keychain" | "secret-service";
     token: string;
 }
+export interface StoredProfileCredential {
+    profile: CliProfile;
+    token?: string;
+}
 export interface ConfigEnvironment {
     HOME?: string;
     PATH?: string;
@@ -40,6 +44,7 @@ export declare class CliConfigStore {
     apiBaseUrl(requested?: string, profile?: CliProfile): string;
     readProfile(profileName: string): Promise<CliProfile | undefined>;
     saveProfile(profileName: string, profile: Omit<CliProfile, "credentialStore">, token: string): Promise<CliProfile>;
+    readStoredCredential(profileName: string): Promise<StoredProfileCredential | undefined>;
     resolveCredential(input: {
         apiBaseUrl?: string;
         profileName?: string;

package/dist/cjs/config.js

@@ -96,19 +96,58 @@ class CliConfigStore {
     }
     async saveProfile(profileName, profile, token) {
         validateToken(token);
-        const credentialStore = await this.storeToken(profileName, token);
         const configuration = await this.readConfiguration();
+        const previousProfile = configuration.profiles[profileName];
+        const previousToken = previousProfile
+            ? await this.readToken(profileName, previousProfile.credentialStore)
+            : undefined;
+        const credentialStore = await this.storeToken(profileName, token);
         const storedProfile = { ...profile, credentialStore };
         configuration.profiles[profileName] = storedProfile;
         try {
             await writePrivateJson(this.configFile, configuration);
         }
         catch (error) {
-            await this.deleteToken(profileName, credentialStore).catch(() => undefined);
+            try {
+                if (previousProfile?.credentialStore === credentialStore && previousToken !== undefined) {
+                    await this.storeToken(profileName, previousToken);
+                }
+                else {
+                    await this.deleteToken(profileName, credentialStore);
+                }
+            }
+            catch (rollbackError) {
+                throw credentialRollbackError(error, rollbackError);
+            }
             throw error;
         }
+        if (previousProfile && previousProfile.credentialStore !== credentialStore) {
+            try {
+                await this.deleteToken(profileName, previousProfile.credentialStore);
+            }
+            catch (error) {
+                configuration.profiles[profileName] = previousProfile;
+                try {
+                    await writePrivateJson(this.configFile, configuration);
+                    await this.deleteToken(profileName, credentialStore);
+                }
+                catch (rollbackError) {
+                    throw credentialRollbackError(error, rollbackError);
+                }
+                throw error;
+            }
+        }
         return storedProfile;
     }
+    async readStoredCredential(profileName) {
+        const profile = await this.readProfile(profileName);
+        if (!profile)
+            return undefined;
+        const token = await this.readToken(profileName, profile.credentialStore);
+        if (token !== undefined)
+            validateToken(token);
+        return { profile, ...(token === undefined ? {} : { token }) };
+    }
     async resolveCredential(input) {
         const profileName = this.profileName(input.profileName);
         const profile = await this.readProfile(profileName);
@@ -198,7 +237,13 @@ class CliConfigStore {
                 "profile",
                 profileName,
             ]);
-            return result.code === 0 ? result.stdout.trim() : undefined;
+            if (result.code !== 0) {
+                if (result.stderr.trim()) {
+                    throw credentialStoreError("Secret Service", result.stderr);
+                }
+                return undefined;
+            }
+            return result.stdout.trim();
         }
         return (await this.readFileCredentials()).tokens[profileName];
     }
@@ -211,13 +256,16 @@ class CliConfigStore {
             return;
         }
         if (store === "secret-service") {
-            await runProcess("secret-tool", [
+            const result = await runProcess("secret-tool", [
                 "clear",
                 "service",
                 keychainService,
                 "profile",
                 profileName,
             ]);
+            if (result.code !== 0 && result.stderr.trim()) {
+                throw credentialStoreError("Secret Service", result.stderr);
+            }
             return;
         }
         const credentials = await this.readFileCredentials();
@@ -331,6 +379,12 @@ function validateToken(token) {
 function credentialStoreError(store, stderr) {
     return new errors_js_1.CliError(`${store} could not access the Proxy CLI credential`, "cli_credential_store_failed", errors_js_1.cliExitCodes.internal, { diagnostic: stderr.trim().slice(0, 200) });
 }
+function credentialRollbackError(originalError, rollbackError) {
+    return new errors_js_1.CliError("Proxy CLI could not restore credential storage after profile replacement failed", "cli_credential_store_rollback_failed", errors_js_1.cliExitCodes.internal, {
+        original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
+        rollback_error_class: rollbackError instanceof Error ? rollbackError.name : typeof rollbackError,
+    });
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/cjs/http-client.js

@@ -14,6 +14,7 @@ class ProxyApiClient {
     }
     async request(path, options = {}) {
         let response;
+        let body;
         try {
             response = await this.fetchImpl(new URL(path, `${this.baseUrl}/`), {
                 body: options.body === undefined ? undefined : JSON.stringify(options.body),
@@ -26,13 +27,15 @@ class ProxyApiClient {
                     ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
                 },
             });
+            body = await readJson(response);
         }
         catch (error) {
+            if (error instanceof errors_js_1.CliError)
+                throw error;
             if (options.signal?.aborted)
                 throw commandInterrupted();
             throw new errors_js_1.CliError("Could not reach the Proxy API", "cli_network_error", errors_js_1.cliExitCodes.network, { error_class: error instanceof Error ? error.name : typeof error });
         }
-        const body = await readJson(response);
         if (!response.ok) {
             const errorBody = isRecord(body) ? body : {};
             const code = errorBody.error?.code ?? `http_${response.status}`;
@@ -46,6 +49,7 @@ class ProxyApiClient {
     }
     async oauthRequest(path, body, options = {}) {
         let response;
+        let responseBody;
         try {
             response = await this.fetchImpl(new URL(path, `${this.baseUrl}/`), {
                 body: JSON.stringify(body),
@@ -54,14 +58,17 @@ class ProxyApiClient {
                 redirect: "manual",
                 signal: requestSignal(options.signal),
             });
+            responseBody = await readJson(response);
         }
         catch (error) {
+            if (error instanceof errors_js_1.CliError)
+                throw error;
             if (options.signal?.aborted)
                 throw commandInterrupted();
             throw new errors_js_1.CliError("Could not reach the Proxy authentication service", "cli_network_error", errors_js_1.cliExitCodes.network, { error_class: error instanceof Error ? error.name : typeof error });
         }
         return {
-            body: (await readJson(response)),
+            body: responseBody,
             ok: response.ok,
             status: response.status,
         };

package/dist/cjs/webhooks.d.cts

@@ -28,23 +28,23 @@ interface DeliveryClaim {
 export declare class ProxyWebhooksClient {
     private readonly api;
     constructor(apiBaseUrl: string, token: string, fetchImpl?: typeof fetch);
-    listEndpoints(): Promise<WebhookEndpointRecord[]>;
-    createListener(sourceEndpointId: string): Promise<WebhookListenerRecord>;
-    getListener(listenerId: string): Promise<WebhookListenerRecord>;
-    heartbeat(listenerId: string): Promise<WebhookListenerRecord>;
-    close(listenerId: string): Promise<WebhookListenerRecord>;
-    listDeliveries(listenerId: string, limit?: number): Promise<unknown[]>;
-    replay(listenerId: string, deliveryId: string, reason: string): Promise<unknown>;
+    listEndpoints(signal?: AbortSignal): Promise<WebhookEndpointRecord[]>;
+    createListener(sourceEndpointId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    getListener(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    heartbeat(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    close(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    listDeliveries(listenerId: string, limit?: number, signal?: AbortSignal): Promise<unknown[]>;
+    replay(listenerId: string, deliveryId: string, reason: string, signal?: AbortSignal): Promise<unknown>;
     claim(listenerId: string, selection?: {
         deliveryId?: string;
         replayOutboxEventId?: string;
-    }): Promise<DeliveryClaim | null>;
+    }, signal?: AbortSignal): Promise<DeliveryClaim | null>;
     complete(attemptId: string, input: {
         durationMs: number;
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
         expires_at: string;
         id: string;
         inbound_url: string;

package/dist/cjs/webhooks.d.ts

@@ -28,23 +28,23 @@ interface DeliveryClaim {
 export declare class ProxyWebhooksClient {
     private readonly api;
     constructor(apiBaseUrl: string, token: string, fetchImpl?: typeof fetch);
-    listEndpoints(): Promise<WebhookEndpointRecord[]>;
-    createListener(sourceEndpointId: string): Promise<WebhookListenerRecord>;
-    getListener(listenerId: string): Promise<WebhookListenerRecord>;
-    heartbeat(listenerId: string): Promise<WebhookListenerRecord>;
-    close(listenerId: string): Promise<WebhookListenerRecord>;
-    listDeliveries(listenerId: string, limit?: number): Promise<unknown[]>;
-    replay(listenerId: string, deliveryId: string, reason: string): Promise<unknown>;
+    listEndpoints(signal?: AbortSignal): Promise<WebhookEndpointRecord[]>;
+    createListener(sourceEndpointId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    getListener(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    heartbeat(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    close(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    listDeliveries(listenerId: string, limit?: number, signal?: AbortSignal): Promise<unknown[]>;
+    replay(listenerId: string, deliveryId: string, reason: string, signal?: AbortSignal): Promise<unknown>;
     claim(listenerId: string, selection?: {
         deliveryId?: string;
         replayOutboxEventId?: string;
-    }): Promise<DeliveryClaim | null>;
+    }, signal?: AbortSignal): Promise<DeliveryClaim | null>;
     complete(attemptId: string, input: {
         durationMs: number;
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
         expires_at: string;
         id: string;
         inbound_url: string;

package/dist/cjs/webhooks.js

@@ -25,32 +25,33 @@ class ProxyWebhooksClient {
     constructor(apiBaseUrl, token, fetchImpl) {
         this.api = new http_client_js_1.ProxyApiClient(apiBaseUrl, token, fetchImpl);
     }
-    async listEndpoints() {
-        return (await this.api.request("/cli/webhook-endpoints")).webhook_endpoints;
+    async listEndpoints(signal) {
+        return (await this.api.request("/cli/webhook-endpoints", { signal })).webhook_endpoints;
     }
-    async createListener(sourceEndpointId) {
+    async createListener(sourceEndpointId, signal) {
         return (await this.api.request("/cli/webhook-listeners", {
             body: { source_webhook_endpoint_id: sourceEndpointId },
             method: "POST",
+            signal,
         })).listener;
     }
-    async getListener(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}`)).listener;
+    async getListener(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}`, { signal })).listener;
     }
-    async heartbeat(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/heartbeat`, { method: "POST" })).listener;
+    async heartbeat(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/heartbeat`, { method: "POST", signal })).listener;
     }
-    async close(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/close`, { method: "POST" })).listener;
+    async close(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/close`, { method: "POST", signal })).listener;
     }
-    async listDeliveries(listenerId, limit) {
-        const query = limit ? `?${new URLSearchParams({ limit: String(limit) })}` : "";
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries${query}`)).deliveries;
+    async listDeliveries(listenerId, limit, signal) {
+        const query = limit !== undefined ? `?${new URLSearchParams({ limit: String(limit) })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries${query}`, { signal })).deliveries;
     }
-    async replay(listenerId, deliveryId, reason) {
-        return this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, { body: { reason }, method: "POST" });
+    async replay(listenerId, deliveryId, reason, signal) {
+        return this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, { body: { reason }, method: "POST", signal });
     }
-    async claim(listenerId, selection = {}) {
+    async claim(listenerId, selection = {}, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/claims`, {
             method: "POST",
             body: {
@@ -59,6 +60,7 @@ class ProxyWebhooksClient {
                     ? { replay_outbox_event_id: selection.replayOutboxEventId }
                     : {}),
             },
+            signal,
         })).claim;
     }
     async complete(attemptId, input) {
@@ -71,26 +73,28 @@ class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId) {
+    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
                 webhook_secret: webhookSecret,
             },
+            signal,
         })).stripe_ingress;
     }
 }
 exports.ProxyWebhooksClient = ProxyWebhooksClient;
 async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
-    const listener = await input.client.createListener(input.sourceEndpointId);
+    const listener = await input.client.createListener(input.sourceEndpointId, input.signal);
     let stripeProcess;
     let forwarded = 0;
     let heartbeatFailure;
     const heartbeatTimer = setInterval(() => {
-        void input.client.heartbeat(listener.id).catch((error) => {
-            heartbeatFailure = error;
+        void input.client.heartbeat(listener.id, input.signal).catch((error) => {
+            if (!input.signal.aborted)
+                heartbeatFailure = error;
         });
     }, heartbeatIntervalMs);
     input.output.event("listener.started", { forward_to: destination.toString(), listener }, `Listening for Proxy test webhooks on ${listener.id}; forwarding to ${destination}`);
@@ -99,7 +103,7 @@ async function runListener(input) {
             throw listenerInterrupted();
         if (input.stripe) {
             const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId);
+            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
             stripeProcess = startStripeListener(ingress.inbound_url, input.output);
             input.output.event("stripe.started", {
                 expires_at: ingress.expires_at,
@@ -116,7 +120,7 @@ async function runListener(input) {
             if (stripeProcess && (stripeProcess.exitCode !== null || stripeProcess.signalCode)) {
                 throw new errors_js_1.CliError("Stripe CLI listener exited unexpectedly", "stripe_cli_exited", errors_js_1.cliExitCodes.dependency, { exit_code: stripeProcess.exitCode, signal: stripeProcess.signalCode });
             }
-            const claim = await input.client.claim(listener.id);
+            const claim = await input.client.claim(listener.id, {}, input.signal);
             if (!claim) {
                 await abortableDelay(claimPollIntervalMs, input.signal);
                 continue;
@@ -160,7 +164,7 @@ async function forwardSelectedDelivery(input) {
     const claim = await input.client.claim(input.listenerId, {
         ...(input.deliveryId ? { deliveryId: input.deliveryId } : {}),
         ...(input.replayOutboxEventId ? { replayOutboxEventId: input.replayOutboxEventId } : {}),
-    });
+    }, input.signal);
     if (!claim) {
         throw new errors_js_1.CliError("Selected delivery or replay is not currently claimable", "cli_delivery_not_claimable", errors_js_1.cliExitCodes.conflict);
     }

package/dist/esm/auth.d.ts

@@ -26,6 +26,7 @@ export declare function login(input: {
 }): Promise<CliProfile>;
 export declare function status(input: {
     apiBaseUrl: string;
+    signal?: AbortSignal;
     token: string;
 }): Promise<CredentialExchangeResponse["profile"]>;
 export declare function logout(input: {
@@ -33,6 +34,7 @@ export declare function logout(input: {
     configStore: CliConfigStore;
     profileName: string;
     removeLocalProfile: boolean;
+    signal?: AbortSignal;
     token: string;
 }): Promise<void>;
 export {};

package/dist/esm/auth.js

@@ -7,6 +7,7 @@ const deviceScope = "proxy.cli.local-webhook-development";
 const deviceGrantType = "urn:ietf:params:oauth:grant-type:device_code";
 export async function login(input) {
     const signal = input.signal ?? new AbortController().signal;
+    const previousCredential = await input.configStore.readStoredCredential(input.profileName);
     const client = new ProxyApiClient(input.apiBaseUrl);
     const codeResult = await client.oauthRequest("/api/auth/device/code", {
         client_id: clientId,
@@ -50,17 +51,39 @@ export async function login(input) {
         await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
         throw mismatch;
     }
+    let saved;
     try {
-        const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-        if (saved.credentialStore === "file") {
-            input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
-        }
-        return saved;
+        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     }
     catch (error) {
         await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
         throw error;
     }
+    if (saved.credentialStore === "file") {
+        input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
+    }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    return saved;
+}
+async function revokeSupersededCredential(previous, newCredential, output) {
+    if (!previous || previous.token === newCredential)
+        return;
+    if (!previous.token) {
+        output.notice(`Previous CLI credential ${previous.profile.credentialId} was not available locally and could not be automatically revoked; verify its state in the Proxy Portal.`);
+        return;
+    }
+    try {
+        await new ProxyApiClient(previous.profile.apiBaseUrl, previous.token).request("/cli/auth/logout", { method: "POST" });
+    }
+    catch (error) {
+        if (error instanceof CliError && error.exitCode === cliExitCodes.authentication)
+            return;
+        throw new CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
+            cleanup_error_class: error instanceof Error ? error.name : typeof error,
+            cleanup_error_code: error instanceof CliError ? error.code : undefined,
+            credential_id: previous.profile.credentialId,
+        });
+    }
 }
 async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
     try {
@@ -78,12 +101,13 @@ async function revokeExchangedCredential(apiBaseUrl, credential, profile, origin
     }
 }
 export async function status(input) {
-    const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status");
+    const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });
     return response.profile;
 }
 export async function logout(input) {
     await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/logout", {
         method: "POST",
+        signal: input.signal,
     });
     if (input.removeLocalProfile) {
         await input.configStore.removeProfile(input.profileName);

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.108.1";
+export declare const cliVersion = "0.1.0-prx-128.110.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0-prx-128.108.1";
+export const cliVersion = "0.1.0-prx-128.110.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
@@ -105,7 +105,7 @@ async function executeCommand(input) {
         profileName: input.profileName,
     });
     if (input.command.path === "auth status") {
-        const remoteProfile = await status(resolved);
+        const remoteProfile = await status({ ...resolved, signal: input.signal });
         assertRemoteTarget(remoteProfile, input);
         input.output.result({
             profile: {
@@ -118,54 +118,55 @@ async function executeCommand(input) {
     }
     if (input.command.path === "auth logout") {
         if (input.expectedMerchantId || input.expectedMode) {
-            assertRemoteTarget(await status(resolved), input);
+            assertRemoteTarget(await status({ ...resolved, signal: input.signal }), input);
         }
         await logout({
             apiBaseUrl: resolved.apiBaseUrl,
             configStore: input.configStore,
             profileName: resolved.profileName,
             removeLocalProfile: resolved.source !== "environment",
+            signal: input.signal,
             token: resolved.token,
         });
         input.output.result({ profile: resolved.profileName, revoked: true }, `Logged out profile ${resolved.profileName}.`);
         return;
     }
     if (input.expectedMerchantId || input.expectedMode) {
-        assertRemoteTarget(await status(resolved), input);
+        assertRemoteTarget(await status({ ...resolved, signal: input.signal }), input);
     }
     const webhooks = new ProxyWebhooksClient(resolved.apiBaseUrl, resolved.token);
     if (input.command.path === "webhooks endpoints list") {
-        const endpoints = await webhooks.listEndpoints();
+        const endpoints = await webhooks.listEndpoints(input.signal);
         input.output.result({ webhook_endpoints: endpoints }, formatEndpointList(endpoints));
         return;
     }
     if (input.command.path === "webhooks listeners create") {
-        const listener = await webhooks.createListener(readRequiredString(input.options, "--endpoint"));
+        const listener = await webhooks.createListener(readRequiredString(input.options, "--endpoint"), input.signal);
         input.output.result({ listener }, `Created listener ${listener.id}; lease expires ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners status") {
-        const listener = await webhooks.getListener(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.getListener(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Listener ${listener.id} is ${listener.status}; lease expires ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners heartbeat") {
-        const listener = await webhooks.heartbeat(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.heartbeat(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Extended listener ${listener.id} through ${listener.lease_expires_at}.`);
         return;
     }
     if (input.command.path === "webhooks listeners close") {
-        const listener = await webhooks.close(readRequiredString(input.options, "--listener"));
+        const listener = await webhooks.close(readRequiredString(input.options, "--listener"), input.signal);
         input.output.result({ listener }, `Closed listener ${listener.id}.`);
         return;
     }
     if (input.command.path === "webhooks deliveries list") {
-        const deliveries = await webhooks.listDeliveries(readRequiredString(input.options, "--listener"), readOptionalInteger(input.options, "--limit"));
+        const deliveries = await webhooks.listDeliveries(readRequiredString(input.options, "--listener"), readOptionalInteger(input.options, "--limit"), input.signal);
         input.output.result({ deliveries }, `${deliveries.length} local webhook deliveries.`);
         return;
     }
     if (input.command.path === "webhooks deliveries replay") {
-        const replay = await webhooks.replay(readRequiredString(input.options, "--listener"), readRequiredString(input.options, "--delivery"), readRequiredString(input.options, "--reason"));
+        const replay = await webhooks.replay(readRequiredString(input.options, "--listener"), readRequiredString(input.options, "--delivery"), readRequiredString(input.options, "--reason"), input.signal);
         input.output.result(replay, "Replay scheduled.");
         return;
     }
@@ -187,13 +188,14 @@ async function executeCommand(input) {
         return;
     }
     if (input.command.path === "listen") {
-        const endpoints = await webhooks.listEndpoints();
+        const endpoints = await webhooks.listEndpoints(input.signal);
         const sourceEndpointId = await selectEndpoint({
             endpoints,
             io: input.io,
             noInput: input.noInput,
             output: input.output,
             requested: readOptionalString(input.options, "--endpoint"),
+            signal: input.signal,
         });
         const maxEvents = readOptionalInteger(input.options, "--max-events") ?? 0;
         if (maxEvents < 0)
@@ -344,12 +346,20 @@ async function selectEndpoint(input) {
         output: input.io.stderr,
     });
     try {
-        const answer = await prompt.question("Select a source endpoint number: ");
+        const answer = await prompt.question("Select a source endpoint number: ", {
+            signal: input.signal,
+        });
         const selected = input.endpoints[Number(answer) - 1];
         if (!selected)
             throw usageError("Invalid endpoint selection");
         return selected.id;
     }
+    catch (error) {
+        if (input.signal.aborted) {
+            throw new CliError("CLI command interrupted", "cli_command_interrupted", cliExitCodes.interrupted);
+        }
+        throw error;
+    }
     finally {
         prompt.close();
     }

package/dist/esm/config.d.ts

@@ -17,6 +17,10 @@ export interface ResolvedCredential {
     source: "environment" | "file" | "keychain" | "secret-service";
     token: string;
 }
+export interface StoredProfileCredential {
+    profile: CliProfile;
+    token?: string;
+}
 export interface ConfigEnvironment {
     HOME?: string;
     PATH?: string;
@@ -40,6 +44,7 @@ export declare class CliConfigStore {
     apiBaseUrl(requested?: string, profile?: CliProfile): string;
     readProfile(profileName: string): Promise<CliProfile | undefined>;
     saveProfile(profileName: string, profile: Omit<CliProfile, "credentialStore">, token: string): Promise<CliProfile>;
+    readStoredCredential(profileName: string): Promise<StoredProfileCredential | undefined>;
     resolveCredential(input: {
         apiBaseUrl?: string;
         profileName?: string;

package/dist/esm/config.js

@@ -91,19 +91,58 @@ export class CliConfigStore {
     }
     async saveProfile(profileName, profile, token) {
         validateToken(token);
-        const credentialStore = await this.storeToken(profileName, token);
         const configuration = await this.readConfiguration();
+        const previousProfile = configuration.profiles[profileName];
+        const previousToken = previousProfile
+            ? await this.readToken(profileName, previousProfile.credentialStore)
+            : undefined;
+        const credentialStore = await this.storeToken(profileName, token);
         const storedProfile = { ...profile, credentialStore };
         configuration.profiles[profileName] = storedProfile;
         try {
             await writePrivateJson(this.configFile, configuration);
         }
         catch (error) {
-            await this.deleteToken(profileName, credentialStore).catch(() => undefined);
+            try {
+                if (previousProfile?.credentialStore === credentialStore && previousToken !== undefined) {
+                    await this.storeToken(profileName, previousToken);
+                }
+                else {
+                    await this.deleteToken(profileName, credentialStore);
+                }
+            }
+            catch (rollbackError) {
+                throw credentialRollbackError(error, rollbackError);
+            }
             throw error;
         }
+        if (previousProfile && previousProfile.credentialStore !== credentialStore) {
+            try {
+                await this.deleteToken(profileName, previousProfile.credentialStore);
+            }
+            catch (error) {
+                configuration.profiles[profileName] = previousProfile;
+                try {
+                    await writePrivateJson(this.configFile, configuration);
+                    await this.deleteToken(profileName, credentialStore);
+                }
+                catch (rollbackError) {
+                    throw credentialRollbackError(error, rollbackError);
+                }
+                throw error;
+            }
+        }
         return storedProfile;
     }
+    async readStoredCredential(profileName) {
+        const profile = await this.readProfile(profileName);
+        if (!profile)
+            return undefined;
+        const token = await this.readToken(profileName, profile.credentialStore);
+        if (token !== undefined)
+            validateToken(token);
+        return { profile, ...(token === undefined ? {} : { token }) };
+    }
     async resolveCredential(input) {
         const profileName = this.profileName(input.profileName);
         const profile = await this.readProfile(profileName);
@@ -193,7 +232,13 @@ export class CliConfigStore {
                 "profile",
                 profileName,
             ]);
-            return result.code === 0 ? result.stdout.trim() : undefined;
+            if (result.code !== 0) {
+                if (result.stderr.trim()) {
+                    throw credentialStoreError("Secret Service", result.stderr);
+                }
+                return undefined;
+            }
+            return result.stdout.trim();
         }
         return (await this.readFileCredentials()).tokens[profileName];
     }
@@ -206,13 +251,16 @@ export class CliConfigStore {
             return;
         }
         if (store === "secret-service") {
-            await runProcess("secret-tool", [
+            const result = await runProcess("secret-tool", [
                 "clear",
                 "service",
                 keychainService,
                 "profile",
                 profileName,
             ]);
+            if (result.code !== 0 && result.stderr.trim()) {
+                throw credentialStoreError("Secret Service", result.stderr);
+            }
             return;
         }
         const credentials = await this.readFileCredentials();
@@ -325,6 +373,12 @@ function validateToken(token) {
 function credentialStoreError(store, stderr) {
     return new CliError(`${store} could not access the Proxy CLI credential`, "cli_credential_store_failed", cliExitCodes.internal, { diagnostic: stderr.trim().slice(0, 200) });
 }
+function credentialRollbackError(originalError, rollbackError) {
+    return new CliError("Proxy CLI could not restore credential storage after profile replacement failed", "cli_credential_store_rollback_failed", cliExitCodes.internal, {
+        original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
+        rollback_error_class: rollbackError instanceof Error ? rollbackError.name : typeof rollbackError,
+    });
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/esm/http-client.js

@@ -11,6 +11,7 @@ export class ProxyApiClient {
     }
     async request(path, options = {}) {
         let response;
+        let body;
         try {
             response = await this.fetchImpl(new URL(path, `${this.baseUrl}/`), {
                 body: options.body === undefined ? undefined : JSON.stringify(options.body),
@@ -23,13 +24,15 @@ export class ProxyApiClient {
                     ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
                 },
             });
+            body = await readJson(response);
         }
         catch (error) {
+            if (error instanceof CliError)
+                throw error;
             if (options.signal?.aborted)
                 throw commandInterrupted();
             throw new CliError("Could not reach the Proxy API", "cli_network_error", cliExitCodes.network, { error_class: error instanceof Error ? error.name : typeof error });
         }
-        const body = await readJson(response);
         if (!response.ok) {
             const errorBody = isRecord(body) ? body : {};
             const code = errorBody.error?.code ?? `http_${response.status}`;
@@ -43,6 +46,7 @@ export class ProxyApiClient {
     }
     async oauthRequest(path, body, options = {}) {
         let response;
+        let responseBody;
         try {
             response = await this.fetchImpl(new URL(path, `${this.baseUrl}/`), {
                 body: JSON.stringify(body),
@@ -51,14 +55,17 @@ export class ProxyApiClient {
                 redirect: "manual",
                 signal: requestSignal(options.signal),
             });
+            responseBody = await readJson(response);
         }
         catch (error) {
+            if (error instanceof CliError)
+                throw error;
             if (options.signal?.aborted)
                 throw commandInterrupted();
             throw new CliError("Could not reach the Proxy authentication service", "cli_network_error", cliExitCodes.network, { error_class: error instanceof Error ? error.name : typeof error });
         }
         return {
-            body: (await readJson(response)),
+            body: responseBody,
             ok: response.ok,
             status: response.status,
         };

package/dist/esm/webhooks.d.ts

@@ -28,23 +28,23 @@ interface DeliveryClaim {
 export declare class ProxyWebhooksClient {
     private readonly api;
     constructor(apiBaseUrl: string, token: string, fetchImpl?: typeof fetch);
-    listEndpoints(): Promise<WebhookEndpointRecord[]>;
-    createListener(sourceEndpointId: string): Promise<WebhookListenerRecord>;
-    getListener(listenerId: string): Promise<WebhookListenerRecord>;
-    heartbeat(listenerId: string): Promise<WebhookListenerRecord>;
-    close(listenerId: string): Promise<WebhookListenerRecord>;
-    listDeliveries(listenerId: string, limit?: number): Promise<unknown[]>;
-    replay(listenerId: string, deliveryId: string, reason: string): Promise<unknown>;
+    listEndpoints(signal?: AbortSignal): Promise<WebhookEndpointRecord[]>;
+    createListener(sourceEndpointId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    getListener(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    heartbeat(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    close(listenerId: string, signal?: AbortSignal): Promise<WebhookListenerRecord>;
+    listDeliveries(listenerId: string, limit?: number, signal?: AbortSignal): Promise<unknown[]>;
+    replay(listenerId: string, deliveryId: string, reason: string, signal?: AbortSignal): Promise<unknown>;
     claim(listenerId: string, selection?: {
         deliveryId?: string;
         replayOutboxEventId?: string;
-    }): Promise<DeliveryClaim | null>;
+    }, signal?: AbortSignal): Promise<DeliveryClaim | null>;
     complete(attemptId: string, input: {
         durationMs: number;
         errorClass: "network_error" | "timeout" | null;
         responseStatusCode: number | null;
     }): Promise<unknown>;
-    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string): Promise<{
+    createStripeIngress(listenerId: string, webhookSecret: string, pspConfigId?: string, signal?: AbortSignal): Promise<{
         expires_at: string;
         id: string;
         inbound_url: string;

package/dist/esm/webhooks.js

@@ -20,32 +20,33 @@ export class ProxyWebhooksClient {
     constructor(apiBaseUrl, token, fetchImpl) {
         this.api = new ProxyApiClient(apiBaseUrl, token, fetchImpl);
     }
-    async listEndpoints() {
-        return (await this.api.request("/cli/webhook-endpoints")).webhook_endpoints;
+    async listEndpoints(signal) {
+        return (await this.api.request("/cli/webhook-endpoints", { signal })).webhook_endpoints;
     }
-    async createListener(sourceEndpointId) {
+    async createListener(sourceEndpointId, signal) {
         return (await this.api.request("/cli/webhook-listeners", {
             body: { source_webhook_endpoint_id: sourceEndpointId },
             method: "POST",
+            signal,
         })).listener;
     }
-    async getListener(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}`)).listener;
+    async getListener(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}`, { signal })).listener;
     }
-    async heartbeat(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/heartbeat`, { method: "POST" })).listener;
+    async heartbeat(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/heartbeat`, { method: "POST", signal })).listener;
     }
-    async close(listenerId) {
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/close`, { method: "POST" })).listener;
+    async close(listenerId, signal) {
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/close`, { method: "POST", signal })).listener;
     }
-    async listDeliveries(listenerId, limit) {
-        const query = limit ? `?${new URLSearchParams({ limit: String(limit) })}` : "";
-        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries${query}`)).deliveries;
+    async listDeliveries(listenerId, limit, signal) {
+        const query = limit !== undefined ? `?${new URLSearchParams({ limit: String(limit) })}` : "";
+        return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries${query}`, { signal })).deliveries;
     }
-    async replay(listenerId, deliveryId, reason) {
-        return this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, { body: { reason }, method: "POST" });
+    async replay(listenerId, deliveryId, reason, signal) {
+        return this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/deliveries/${encodeURIComponent(deliveryId)}/replay`, { body: { reason }, method: "POST", signal });
     }
-    async claim(listenerId, selection = {}) {
+    async claim(listenerId, selection = {}, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/claims`, {
             method: "POST",
             body: {
@@ -54,6 +55,7 @@ export class ProxyWebhooksClient {
                     ? { replay_outbox_event_id: selection.replayOutboxEventId }
                     : {}),
             },
+            signal,
         })).claim;
     }
     async complete(attemptId, input) {
@@ -66,25 +68,27 @@ export class ProxyWebhooksClient {
             },
         });
     }
-    async createStripeIngress(listenerId, webhookSecret, pspConfigId) {
+    async createStripeIngress(listenerId, webhookSecret, pspConfigId, signal) {
         return (await this.api.request(`/cli/webhook-listeners/${encodeURIComponent(listenerId)}/stripe-ingress`, {
             method: "POST",
             body: {
                 ...(pspConfigId ? { psp_config_id: pspConfigId } : {}),
                 webhook_secret: webhookSecret,
             },
+            signal,
         })).stripe_ingress;
     }
 }
 export async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
-    const listener = await input.client.createListener(input.sourceEndpointId);
+    const listener = await input.client.createListener(input.sourceEndpointId, input.signal);
     let stripeProcess;
     let forwarded = 0;
     let heartbeatFailure;
     const heartbeatTimer = setInterval(() => {
-        void input.client.heartbeat(listener.id).catch((error) => {
-            heartbeatFailure = error;
+        void input.client.heartbeat(listener.id, input.signal).catch((error) => {
+            if (!input.signal.aborted)
+                heartbeatFailure = error;
         });
     }, heartbeatIntervalMs);
     input.output.event("listener.started", { forward_to: destination.toString(), listener }, `Listening for Proxy test webhooks on ${listener.id}; forwarding to ${destination}`);
@@ -93,7 +97,7 @@ export async function runListener(input) {
             throw listenerInterrupted();
         if (input.stripe) {
             const webhookSecret = await captureStripeWebhookSecret(input.signal);
-            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId);
+            const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
             stripeProcess = startStripeListener(ingress.inbound_url, input.output);
             input.output.event("stripe.started", {
                 expires_at: ingress.expires_at,
@@ -110,7 +114,7 @@ export async function runListener(input) {
             if (stripeProcess && (stripeProcess.exitCode !== null || stripeProcess.signalCode)) {
                 throw new CliError("Stripe CLI listener exited unexpectedly", "stripe_cli_exited", cliExitCodes.dependency, { exit_code: stripeProcess.exitCode, signal: stripeProcess.signalCode });
             }
-            const claim = await input.client.claim(listener.id);
+            const claim = await input.client.claim(listener.id, {}, input.signal);
             if (!claim) {
                 await abortableDelay(claimPollIntervalMs, input.signal);
                 continue;
@@ -154,7 +158,7 @@ export async function forwardSelectedDelivery(input) {
     const claim = await input.client.claim(input.listenerId, {
         ...(input.deliveryId ? { deliveryId: input.deliveryId } : {}),
         ...(input.replayOutboxEventId ? { replayOutboxEventId: input.replayOutboxEventId } : {}),
-    });
+    }, input.signal);
     if (!claim) {
         throw new CliError("Selected delivery or replay is not currently claimable", "cli_delivery_not_claimable", cliExitCodes.conflict);
     }

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0-prx-128.108.1",
+  "version": "0.1.0-prx-128.110.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },