@proxy-checkout/cli 0.1.0-prx-128.111.1 → 0.1.0-prx-128.113.1

package/README.md

@@ -20,7 +20,7 @@ proxy auth status \
   --mode test
 ```
 
-Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct `pcli_test_...` credential, revokes the temporary session, and stores only the CLI credential. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
+Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct but initially disabled `pcli_test_...` credential and revokes the temporary session. The CLI stores only that credential, then proves possession to an idempotent activation endpoint; a lost response or interrupted save cannot leave an unreachable active grant. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
 
 Profiles bind the saved API origin, organization, merchant, and mode. `--merchant` and `--mode` assert the target returned by login or remote credential introspection; they do not select or elevate a merchant client-side. Stored credentials cannot be sent to a different API origin.
 

package/dist/cjs/auth.js

@@ -47,27 +47,24 @@ async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -83,27 +80,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof errors_js_1.CliError && error.exitCode === errors_js_1.cliExitCodes.authentication)
             return;
-        throw new errors_js_1.CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
+        throw new errors_js_1.CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof errors_js_1.CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new http_client_js_1.ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new errors_js_1.CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof errors_js_1.CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new errors_js_1.CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", errors_js_1.cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new errors_js_1.CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", errors_js_1.cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = (0, errors_js_1.asCliError)(error);
+            if (lastError.exitCode !== errors_js_1.cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new errors_js_1.CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 async function status(input) {
     const response = await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.111.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.111.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0-prx-128.111.1";
+exports.cliVersion = "0.1.0-prx-128.113.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/cjs/webhooks.js

@@ -89,6 +89,7 @@ async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
     const listener = await input.client.createListener(input.sourceEndpointId, input.signal);
     let stripeProcess;
+    let stripeProcessFailure;
     let forwarded = 0;
     let heartbeatFailure;
     const heartbeatTimer = setInterval(() => {
@@ -104,7 +105,9 @@ async function runListener(input) {
         if (input.stripe) {
             const webhookSecret = await captureStripeWebhookSecret(input.signal);
             const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = startStripeListener(ingress.inbound_url, input.output);
+            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+                stripeProcessFailure = stripeListenerStartError(error);
+            });
             input.output.event("stripe.started", {
                 expires_at: ingress.expires_at,
                 ingress_id: ingress.id,
@@ -117,6 +120,9 @@ async function runListener(input) {
             if (heartbeatFailure) {
                 throw heartbeatFailure;
             }
+            if (stripeProcessFailure) {
+                throw stripeProcessFailure;
+            }
             if (stripeProcess && (stripeProcess.exitCode !== null || stripeProcess.signalCode)) {
                 throw new errors_js_1.CliError("Stripe CLI listener exited unexpectedly", "stripe_cli_exited", errors_js_1.cliExitCodes.dependency, { exit_code: stripeProcess.exitCode, signal: stripeProcess.signalCode });
             }
@@ -135,6 +141,8 @@ async function runListener(input) {
                 webhook_delivery_id: claim.webhook_delivery_id,
             }, `Forwarded ${claim.kind} ${claim.webhook_delivery_id} (${formatCompletion(completion)}).`);
         }
+        if (stripeProcessFailure)
+            throw stripeProcessFailure;
         if (input.signal.aborted)
             throw listenerInterrupted();
         return { forwarded, listener };
@@ -220,7 +228,7 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new errors_js_1.CliError("Local webhook listener interrupted", "cli_listener_interrupted", errors_js_1.cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output) {
+function startStripeListener(inboundUrl, output, onError) {
     const child = (0, node_child_process_1.spawn)("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
@@ -228,8 +236,28 @@ function startStripeListener(inboundUrl, output) {
     child.stdin.end();
     pipeSanitized(child.stdout, (line) => output.notice(`[stripe] ${line}`));
     pipeSanitized(child.stderr, (line) => output.notice(`[stripe] ${line}`));
-    child.once("error", () => undefined);
-    return child;
+    return new Promise((resolve, reject) => {
+        const handleInitialError = (error) => {
+            child.removeListener("spawn", handleSpawn);
+            reject(stripeListenerStartError(error));
+        };
+        const handleSpawn = () => {
+            child.removeListener("spawn", handleSpawn);
+            child.removeListener("error", handleInitialError);
+            child.once("error", onError);
+            resolve(child);
+        };
+        child.once("error", handleInitialError);
+        child.once("spawn", handleSpawn);
+        if (child.exitCode !== null || child.signalCode)
+            handleSpawn();
+    });
+}
+function stripeListenerStartError(error) {
+    if (error?.code === "ENOENT") {
+        return new errors_js_1.CliError("Stripe CLI is not installed or not on PATH", "stripe_cli_not_found", errors_js_1.cliExitCodes.dependency);
+    }
+    return new errors_js_1.CliError("Stripe CLI listener could not start", "stripe_cli_start_failed", errors_js_1.cliExitCodes.dependency);
 }
 function pipeSanitized(stream, writeLine) {
     let pending = "";

package/dist/esm/auth.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { hostname, platform } from "node:os";
-import { CliError, cliExitCodes } from "./errors.js";
+import { asCliError, CliError, cliExitCodes } from "./errors.js";
 import { ProxyApiClient } from "./http-client.js";
 const clientId = "proxy-cli";
 const deviceScope = "proxy.cli.local-webhook-development";
@@ -42,27 +42,24 @@ export async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -78,27 +75,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof CliError && error.exitCode === cliExitCodes.authentication)
             return;
-        throw new CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
+        throw new CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = asCliError(error);
+            if (lastError.exitCode !== cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 export async function status(input) {
     const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.111.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0-prx-128.111.1";
+export const cliVersion = "0.1.0-prx-128.113.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/esm/webhooks.js

@@ -83,6 +83,7 @@ export async function runListener(input) {
     const destination = validateLoopbackDestination(input.forwardTo);
     const listener = await input.client.createListener(input.sourceEndpointId, input.signal);
     let stripeProcess;
+    let stripeProcessFailure;
     let forwarded = 0;
     let heartbeatFailure;
     const heartbeatTimer = setInterval(() => {
@@ -98,7 +99,9 @@ export async function runListener(input) {
         if (input.stripe) {
             const webhookSecret = await captureStripeWebhookSecret(input.signal);
             const ingress = await input.client.createStripeIngress(listener.id, webhookSecret, input.pspConfigId, input.signal);
-            stripeProcess = startStripeListener(ingress.inbound_url, input.output);
+            stripeProcess = await startStripeListener(ingress.inbound_url, input.output, (error) => {
+                stripeProcessFailure = stripeListenerStartError(error);
+            });
             input.output.event("stripe.started", {
                 expires_at: ingress.expires_at,
                 ingress_id: ingress.id,
@@ -111,6 +114,9 @@ export async function runListener(input) {
             if (heartbeatFailure) {
                 throw heartbeatFailure;
             }
+            if (stripeProcessFailure) {
+                throw stripeProcessFailure;
+            }
             if (stripeProcess && (stripeProcess.exitCode !== null || stripeProcess.signalCode)) {
                 throw new CliError("Stripe CLI listener exited unexpectedly", "stripe_cli_exited", cliExitCodes.dependency, { exit_code: stripeProcess.exitCode, signal: stripeProcess.signalCode });
             }
@@ -129,6 +135,8 @@ export async function runListener(input) {
                 webhook_delivery_id: claim.webhook_delivery_id,
             }, `Forwarded ${claim.kind} ${claim.webhook_delivery_id} (${formatCompletion(completion)}).`);
         }
+        if (stripeProcessFailure)
+            throw stripeProcessFailure;
         if (input.signal.aborted)
             throw listenerInterrupted();
         return { forwarded, listener };
@@ -214,7 +222,7 @@ async function captureStripeWebhookSecret(signal) {
 function listenerInterrupted() {
     return new CliError("Local webhook listener interrupted", "cli_listener_interrupted", cliExitCodes.interrupted);
 }
-function startStripeListener(inboundUrl, output) {
+function startStripeListener(inboundUrl, output, onError) {
     const child = spawn("stripe", ["listen", "--events", stripeEvents, "--forward-to", inboundUrl], {
         shell: false,
         stdio: ["pipe", "pipe", "pipe"],
@@ -222,8 +230,28 @@ function startStripeListener(inboundUrl, output) {
     child.stdin.end();
     pipeSanitized(child.stdout, (line) => output.notice(`[stripe] ${line}`));
     pipeSanitized(child.stderr, (line) => output.notice(`[stripe] ${line}`));
-    child.once("error", () => undefined);
-    return child;
+    return new Promise((resolve, reject) => {
+        const handleInitialError = (error) => {
+            child.removeListener("spawn", handleSpawn);
+            reject(stripeListenerStartError(error));
+        };
+        const handleSpawn = () => {
+            child.removeListener("spawn", handleSpawn);
+            child.removeListener("error", handleInitialError);
+            child.once("error", onError);
+            resolve(child);
+        };
+        child.once("error", handleInitialError);
+        child.once("spawn", handleSpawn);
+        if (child.exitCode !== null || child.signalCode)
+            handleSpawn();
+    });
+}
+function stripeListenerStartError(error) {
+    if (error?.code === "ENOENT") {
+        return new CliError("Stripe CLI is not installed or not on PATH", "stripe_cli_not_found", cliExitCodes.dependency);
+    }
+    return new CliError("Stripe CLI listener could not start", "stripe_cli_start_failed", cliExitCodes.dependency);
 }
 function pipeSanitized(stream, writeLine) {
     let pending = "";

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0-prx-128.111.1",
+  "version": "0.1.0-prx-128.113.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },