@proxy-checkout/cli 0.1.0-prx-128.112.1 → 0.1.0-prx-128.114.1

package/README.md

@@ -20,7 +20,7 @@ proxy auth status \
   --mode test
 ```
 
-Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct `pcli_test_...` credential, revokes the temporary session, and stores only the CLI credential. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
+Authentication uses an RFC 8628 browser/device handoff. Proxy exchanges the short-lived approved browser session for a distinct but initially disabled `pcli_test_...` credential and revokes the temporary session. The CLI stores only that credential, then proves possession to an idempotent activation endpoint; a lost response or interrupted save cannot leave an unreachable active grant. Activation becomes terminal, so logout or another revocation cannot be undone by replaying the activation request. The CLI never persists a Portal session or exposes a merchant `sk_test_*` key.
 
 Profiles bind the saved API origin, organization, merchant, and mode. `--merchant` and `--mode` assert the target returned by login or remote credential introspection; they do not select or elevate a merchant client-side. Stored credentials cannot be sent to a different API origin.
 

package/dist/cjs/auth.js

@@ -47,27 +47,24 @@ async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", errors_js_1.cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new errors_js_1.CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", errors_js_1.cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -83,27 +80,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof errors_js_1.CliError && error.exitCode === errors_js_1.cliExitCodes.authentication)
             return;
-        throw new errors_js_1.CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
+        throw new errors_js_1.CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof errors_js_1.CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new http_client_js_1.ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new errors_js_1.CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", errors_js_1.cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof errors_js_1.CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new errors_js_1.CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", errors_js_1.cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new errors_js_1.CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", errors_js_1.cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = (0, errors_js_1.asCliError)(error);
+            if (lastError.exitCode !== errors_js_1.cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new errors_js_1.CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 async function status(input) {
     const response = await new http_client_js_1.ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/cjs/cli.d.cts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.114.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.114.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/cjs/cli.js

@@ -9,7 +9,7 @@ const config_js_1 = require("./config.js");
 const errors_js_1 = require("./errors.js");
 const output_js_1 = require("./output.js");
 const webhooks_js_1 = require("./webhooks.js");
-exports.cliVersion = "0.1.0-prx-128.112.1";
+exports.cliVersion = "0.1.0-prx-128.114.1";
 async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/dist/esm/auth.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { hostname, platform } from "node:os";
-import { CliError, cliExitCodes } from "./errors.js";
+import { asCliError, CliError, cliExitCodes } from "./errors.js";
 import { ProxyApiClient } from "./http-client.js";
 const clientId = "proxy-cli";
 const deviceScope = "proxy.cli.local-webhook-development";
@@ -42,27 +42,24 @@ export async function login(input) {
     });
     const profile = requireExchangeProfile(exchanged.profile, input.apiBaseUrl);
     if (input.expectedMerchantId && profile.merchantId !== input.expectedMerchantId) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
+        throw new CliError("The approved CLI credential does not match the requested merchant", "cli_merchant_not_allowed", cliExitCodes.permission);
     }
     if (input.expectedMode && profile.mode !== input.expectedMode) {
-        const mismatch = new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, mismatch);
-        throw mismatch;
-    }
-    let saved;
-    try {
-        saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
-    }
-    catch (error) {
-        await revokeExchangedCredential(input.apiBaseUrl, exchanged.credential, profile, error);
-        throw error;
+        throw new CliError("The approved CLI credential does not match the requested mode", input.expectedMode === "live" ? "cli_live_mode_not_enabled" : "cli_mode_not_allowed", cliExitCodes.permission);
     }
+    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    const saved = await input.configStore.saveProfile(input.profileName, profile, exchanged.credential);
     if (saved.credentialStore === "file") {
         input.output.notice("Warning: native credential storage is unavailable; the CLI credential is in an owner-only (0600) file fallback.");
     }
-    await revokeSupersededCredential(previousCredential, exchanged.credential, input.output);
+    await activateCredential({
+        apiBaseUrl: input.apiBaseUrl,
+        approvalId: approved.approvalId,
+        credential: exchanged.credential,
+        credentialId: profile.credentialId,
+        merchantId: profile.merchantId,
+        signal,
+    });
     return saved;
 }
 async function revokeSupersededCredential(previous, newCredential, output) {
@@ -78,27 +75,44 @@ async function revokeSupersededCredential(previous, newCredential, output) {
     catch (error) {
         if (error instanceof CliError && error.exitCode === cliExitCodes.authentication)
             return;
-        throw new CliError(`The new profile is saved, but previous credential ${previous.profile.credentialId} could not be revoked automatically; revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
+        throw new CliError(`Login stopped before replacing this profile because previous credential ${previous.profile.credentialId} could not be revoked automatically; retry or revoke it in the Proxy Portal`, "cli_previous_credential_cleanup_failed", cliExitCodes.network, {
             cleanup_error_class: error instanceof Error ? error.name : typeof error,
             cleanup_error_code: error instanceof CliError ? error.code : undefined,
             credential_id: previous.profile.credentialId,
         });
     }
 }
-async function revokeExchangedCredential(apiBaseUrl, credential, profile, originalError) {
-    try {
-        await new ProxyApiClient(apiBaseUrl, credential).request("/cli/auth/logout", {
-            method: "POST",
-        });
-    }
-    catch (cleanupError) {
-        throw new CliError(`Login did not complete and cleanup of credential ${profile.credentialId} could not be confirmed; revoke it in the Proxy Portal`, "cli_credential_cleanup_failed", cliExitCodes.network, {
-            cleanup_error_class: cleanupError instanceof Error ? cleanupError.name : typeof cleanupError,
-            credential_id: profile.credentialId,
-            original_error_class: originalError instanceof Error ? originalError.name : typeof originalError,
-            original_error_code: originalError instanceof CliError ? originalError.code : undefined,
-        });
+async function activateCredential(input) {
+    const client = new ProxyApiClient(input.apiBaseUrl, input.credential);
+    let lastError = new CliError("Credential activation was not attempted", "cli_credential_activation_unconfirmed", cliExitCodes.network);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+            const result = await client.request("/cli/auth/activate", {
+                method: "POST",
+                signal: input.signal,
+                body: {
+                    approval_id: input.approvalId,
+                    credential_id: input.credentialId,
+                    merchant_id: input.merchantId,
+                },
+            });
+            if (typeof result.activated !== "boolean") {
+                throw new CliError("Proxy authentication returned an invalid credential activation response", "cli_invalid_auth_response", cliExitCodes.network);
+            }
+            return;
+        }
+        catch (error) {
+            lastError = asCliError(error);
+            if (lastError.exitCode !== cliExitCodes.network) {
+                break;
+            }
+        }
     }
+    throw new CliError(`CLI credential ${input.credentialId} was saved locally, but activation could not be confirmed; rerun proxy auth login to recover safely`, "cli_credential_activation_unconfirmed", lastError.exitCode, {
+        activation_error_class: lastError.name,
+        activation_error_code: lastError.code,
+        credential_id: input.credentialId,
+    });
 }
 export async function status(input) {
     const response = await new ProxyApiClient(input.apiBaseUrl, input.token).request("/cli/auth/status", { signal: input.signal });

package/dist/esm/cli.d.ts

@@ -1,6 +1,6 @@
 import { CliConfigStore } from "./config.js";
 import { type CliIo } from "./output.js";
-export declare const cliVersion = "0.1.0-prx-128.112.1";
+export declare const cliVersion = "0.1.0-prx-128.114.1";
 export interface RunCliOptions {
     configStore?: CliConfigStore;
     environment?: NodeJS.ProcessEnv;

package/dist/esm/cli.js

@@ -5,7 +5,7 @@ import { CliConfigStore } from "./config.js";
 import { asCliError, CliError, cliExitCodes, usageError } from "./errors.js";
 import { CliOutput } from "./output.js";
 import { forwardSelectedDelivery, ProxyWebhooksClient, runListener, } from "./webhooks.js";
-export const cliVersion = "0.1.0-prx-128.112.1";
+export const cliVersion = "0.1.0-prx-128.114.1";
 export async function runCli(argv, options = {}) {
     const io = options.io ?? {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),

package/package.json

@@ -7,7 +7,7 @@
   "sideEffects": false,
   "type": "module",
   "types": "./dist/esm/index.d.ts",
-  "version": "0.1.0-prx-128.112.1",
+  "version": "0.1.0-prx-128.114.1",
   "bin": {
     "proxy": "./dist/esm/bin.js"
   },