@proxy-checkout/cli 0.1.0-prx-128.112.1 → 0.1.0-prx-128.113.1

package/README.md

@@ -20,7 +20,7 @@ proxy auth status \
   --mode test
 ```
 
-Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct `pcli_test_...` credential, revokes the temporary session, and stores only the CLI credential. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
+Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct but initially disabled `pcli_test_...` credential and revokes the temporary session. The CLI stores only that credential, then proves possession to an idempotent activation endpoint; a lost response or interrupted save cannot leave an unreachable active grant. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
 
 Profiles bind the saved API origin, organization, merchant, and mode. `--merchant` and `--mode` assert the target returned by login or remote credential introspection; they do not select or elevate a merchant client-side. Stored credentials cannot be sent to a different API origin.
 

package/dist/cjs/auth.js

@@ -47,27 +47,24 @@ async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -83,27 +80,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof errors_js_1.CliError && error.exitCode === errors_js_1.cliExitCodes.authentication)
             return;
-        throw new errors_js_1.CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
+        throw new errors_js_1.CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof errors_js_1.CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new http_client_js_1.ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new errors_js_1.CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof errors_js_1.CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new errors_js_1.CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", errors_js_1.cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new errors_js_1.CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", errors_js_1.cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = (0, errors_js_1.asCliError)(error);
+            if (lastError.exitCode !== errors_js_1.cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new errors_js_1.CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 async function status(input) {
     const response = await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0-prx-128.112.1";
+exports.cliVersion = "0.1.0-prx-128.113.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/esm/auth.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { hostname, platform } from "node:os";
-import { CliError, cliExitCodes } from "./errors.js";
+import { asCliError, CliError, cliExitCodes } from "./errors.js";
 import { ProxyApiClient } from "./http-client.js";
 const clientId = "proxy-cli";
 const deviceScope = "proxy.cli.local-webhook-development";
@@ -42,27 +42,24 @@ export async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -78,27 +75,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof CliError && error.exitCode === cliExitCodes.authentication)
             return;
-        throw new CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
+        throw new CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = asCliError(error);
+            if (lastError.exitCode !== cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 export async function status(input) {
     const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.113.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0-prx-128.112.1";
+export const cliVersion = "0.1.0-prx-128.113.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0-prx-128.112.1",
+  "version": "0.1.0-prx-128.113.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },