@nebulr-group/bridge-cli 0.4.4 → 0.5.1-beta.0

package/dist/commands/setup.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.command.d.ts","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuD5D"}
+{"version":3,"file":"setup.command.d.ts","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAuB5C,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,aAAa,CAAC;AAS9D,sEAAsE;AACtE,qBAAa,UAAW,SAAQ,KAAK;IACN,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAtC,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAInD;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe;;;;;GA4CnD;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB;;;;;GA+BvE;AAKD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC5D"}

package/dist/commands/setup.command.js

@@ -1,25 +1,133 @@
+import { Option } from 'commander';
 import { getManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
+/*
+ * TBP-663 — `setup sso` and `setup communication` talk to the app service
+ * (`app.updateCredentials` / `app.update` / `app.get`) directly instead of
+ * `workflows.setupSSO` / `workflows.setupCommunication`.
+ *
+ * Why not the workflows: in auth-core <= 0.7.0-beta.0 they send fields the
+ * API rejects under forbidNonWhitelisted — azure as `azureClientId`, saml/oidc
+ * as `samlMetadataUrl` / `oidcDiscoveryUrl`, email as `sendgridApiKey` — so
+ * both commands 400'd. auth-core main (#34) fixed them but changed their
+ * signatures and throws on the options this CLI used to pass. The app service
+ * has the same shape in both, so calling it with the server's own field names
+ * behaves identically whichever auth-core is installed.
+ *
+ * Field names are the server's: bridge-api
+ * microservices/account/nebulr-api/app/dto/update-credentials-request.dto.ts
+ * and update-app-request.dto.ts. Same table as auth-core's `setupSSO` and the
+ * MCP `setup_sso` tool. `setup-command.test.ts` pins them to those DTOs.
+ */
+export const SSO_PROVIDERS = {
+    google: { clientId: 'googleClientId', clientSecret: 'googleClientSecret', enable: 'googleSsoEnabled' },
+    github: { clientId: 'githubClientId', clientSecret: 'githubClientSecret', enable: 'githubSsoEnabled' },
+    linkedin: { clientId: 'linkedinClientId', clientSecret: 'linkedinClientSecret', enable: 'linkedinSsoEnabled' },
+    facebook: { clientId: 'facebookClientId', clientSecret: 'facebookClientSecret', enable: 'facebookSsoEnabled' },
+    azure: {
+        clientId: 'microsoftAzureADClientId',
+        clientSecret: 'microsoftAzureADClientSecret',
+        tenantId: 'microsoftAzureADTenantId',
+        enable: 'azureAdSsoEnabled',
+    },
+};
+const SUPPORTED = Object.keys(SSO_PROVIDERS).join(', ');
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Carries a machine-readable `code`, which `outputError` reports. */
+export class SetupError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'SetupError';
+    }
+}
+const NOT_SAVED = ' Nothing was saved.';
+const invalid = (message) => new SetupError(message + NOT_SAVED, 'INVALID_ARGUMENT');
+function isSupported(provider) {
+    return Object.prototype.hasOwnProperty.call(SSO_PROVIDERS, provider);
+}
+export async function setupSso(opts) {
+    const provider = String(opts.provider).toLowerCase();
+    if (!isSupported(provider)) {
+        throw new SetupError(provider === 'saml' || provider === 'oidc'
+            ? `SSO provider "${provider}" is not supported by the Bridge API: it has no fields for SAML or OIDC ` +
+                `connections. Set them up in the Bridge admin UI. Supported here: ${SUPPORTED}.${NOT_SAVED}`
+            : `Unknown SSO provider "${provider}". Supported: ${SUPPORTED}.${NOT_SAVED}`, 'SSO_PROVIDER_NOT_SUPPORTED');
+    }
+    for (const [flag, value] of [['--metadata-url', opts.metadataUrl], ['--discovery-url', opts.discoveryUrl]]) {
+        if (value !== undefined) {
+            throw new SetupError(`${flag} was removed: the Bridge API has no field for it (SAML and OIDC are set up in the Bridge admin UI).${NOT_SAVED}`, 'SSO_PROVIDER_NOT_SUPPORTED');
+        }
+    }
+    if (!opts.clientId || !opts.clientSecret) {
+        throw invalid('--client-id and --client-secret are required (from the provider console).');
+    }
+    const fields = SSO_PROVIDERS[provider];
+    const credentials = {
+        [fields.clientId]: opts.clientId,
+        [fields.clientSecret]: opts.clientSecret,
+    };
+    if ('tenantId' in fields) {
+        if (!opts.tenantId) {
+            throw invalid('azure needs --tenant-id: the Directory (tenant) ID from the Entra ID app registration.');
+        }
+        credentials[fields.tenantId] = opts.tenantId;
+    }
+    else if (opts.tenantId !== undefined) {
+        throw invalid(`--tenant-id applies to azure only, not "${provider}".`);
+    }
+    const mgmt = getManagementClient();
+    await mgmt.app.updateCredentials(credentials);
+    const enable = { [fields.enable]: true };
+    await mgmt.app.update(enable);
+    const app = await mgmt.app.get();
+    return { provider, enabled: true, callbackUrl: app.defaultCallbackUri, app };
+}
+export async function setupCommunication(opts) {
+    if (opts.provider !== undefined || opts.apiKey !== undefined) {
+        throw new SetupError('--provider and --api-key were removed: Bridge sends all email through its own provider, so there is ' +
+            'no provider or API key to configure (the Bridge API has never accepted one). ' +
+            `Pass only --from-address and/or --from-name.${NOT_SAVED}`, 'EMAIL_PROVIDER_NOT_SUPPORTED');
+    }
+    const { fromAddress, fromName } = opts;
+    if (fromAddress === undefined && fromName === undefined) {
+        throw invalid('Nothing to set: pass --from-address, --from-name, or both.');
+    }
+    if (fromAddress !== undefined && !EMAIL.test(fromAddress)) {
+        throw invalid('--from-address must be an email address, e.g. "no-reply@example.com".');
+    }
+    if (fromName !== undefined && fromName.trim() === '') {
+        throw invalid('--from-name must not be empty.');
+    }
+    const update = {};
+    if (fromAddress !== undefined)
+        update.emailSenderEmail = fromAddress;
+    if (fromName !== undefined)
+        update.emailSenderName = fromName;
+    const app = await getManagementClient().app.update(update);
+    return {
+        configured: true,
+        emailSenderEmail: app.emailSenderEmail ?? null,
+        emailSenderName: app.emailSenderName ?? null,
+        app,
+    };
+}
+/** Accepted only to refuse it with an explanation instead of commander's bare "unknown option". */
+const removed = (flags, description) => new Option(flags, description).hideHelp();
 export function registerSetupCommands(program) {
     const setup = program.command('setup').description('Run setup workflows (multi-step operations)');
     setup.command('sso')
-        .description('Enable an SSO provider and get callback URL')
-        .requiredOption('--provider <provider>', 'SSO provider: google, azure, github, linkedin, facebook, saml, oidc')
-        .option('--client-id <id>', 'OAuth client ID')
-        .option('--client-secret <secret>', 'OAuth client secret')
-        .option('--metadata-url <url>', 'SAML metadata URL')
-        .option('--discovery-url <url>', 'OIDC discovery URL')
+        .description('Enable an SSO login provider and get the callback URL to register with it')
+        .requiredOption('--provider <provider>', `SSO provider: ${SUPPORTED} (SAML/OIDC are set up in the Bridge admin UI)`)
+        .requiredOption('--client-id <id>', 'OAuth client ID from the provider console')
+        .requiredOption('--client-secret <secret>', 'OAuth client secret from the provider console')
+        .option('--tenant-id <id>', 'azure only, required: Entra ID Directory (tenant) ID (not a Bridge tenant)')
+        .addOption(removed('--metadata-url <url>', 'removed: SAML is not supported by the Bridge API'))
+        .addOption(removed('--discovery-url <url>', 'removed: OIDC is not supported by the Bridge API'))
         .action(async (opts) => {
         try {
-            outputSuccess(await getManagementClient().workflows.setupSSO({
-                provider: opts.provider,
-                config: {
-                    clientId: opts.clientId,
-                    clientSecret: opts.clientSecret,
-                    metadataUrl: opts.metadataUrl,
-                    discoveryUrl: opts.discoveryUrl,
-                },
-            }));
+            outputSuccess(await setupSso(opts));
         }
         catch (err) {
             outputError(err);
@@ -41,21 +149,14 @@ export function registerSetupCommands(program) {
         }
     });
     setup.command('communication')
-        .description('Configure email/communication provider')
-        .requiredOption('--provider <provider>', 'Provider name (e.g., sendgrid)')
-        .requiredOption('--api-key <key>', 'Provider API key')
-        .option('--from-address <email>', 'Sender email address')
-        .option('--from-name <name>', 'Sender name')
+        .description("Set the sender name and address of your app's emails (sent through Bridge's own email provider)")
+        .option('--from-address <email>', 'Sender email address. A new address is verified by email before Bridge uses it')
+        .option('--from-name <name>', 'Sender display name')
+        .addOption(removed('--provider <provider>', 'removed: email goes through Bridge\'s own provider'))
+        .addOption(removed('--api-key <key>', 'removed: email goes through Bridge\'s own provider'))
         .action(async (opts) => {
         try {
-            outputSuccess(await getManagementClient().workflows.setupCommunication({
-                provider: opts.provider,
-                config: {
-                    apiKey: opts.apiKey,
-                    fromAddress: opts.fromAddress,
-                    fromName: opts.fromName,
-                },
-            }));
+            outputSuccess(await setupCommunication(opts));
         }
         catch (err) {
             outputError(err);

package/dist/commands/setup.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.command.js","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG1D,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC;IAElG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;SACjB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,cAAc,CAAC,uBAAuB,EAAE,qEAAqE,CAAC;SAC9G,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SACnD,MAAM,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC3D,QAAQ,EAAE,IAAI,CAAC,QAAuB;gBACtC,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SACtB,WAAW,CAAC,4CAA4C,CAAC;SACzD,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACzD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC;gBAChE,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;SAC3B,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;SACzE,cAAc,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SACrD,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;SACxD,MAAM,CAAC,oBAAoB,EAAE,aAAa,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;gBACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE;oBACN,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB;aACF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"setup.command.js","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,MAAM,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAC9G,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAC9G,KAAK,EAAE;QACL,QAAQ,EAAE,0BAA0B;QACpC,YAAY,EAAE,8BAA8B;QAC5C,QAAQ,EAAE,0BAA0B;QACpC,MAAM,EAAE,mBAAmB;KAC5B;CACO,CAAC;AAQX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAE3C,sEAAsE;AACtE,MAAM,OAAO,UAAW,SAAQ,KAAK;IACG;IAAtC,YAAY,OAAe,EAAW,IAAY;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAQ;QAEhD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7F,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACvE,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAqB;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;YACxC,CAAC,CAAC,iBAAiB,QAAQ,0EAA0E;gBACnG,oEAAoE,SAAS,IAAI,SAAS,EAAE;YAC9F,CAAC,CAAC,yBAAyB,QAAQ,iBAAiB,SAAS,IAAI,SAAS,EAAE,EAC9E,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAU,EAAE,CAAC;QACpH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,sGAAsG,SAAS,EAAE,EACxH,4BAA4B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,CAAC,2EAA2E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,WAAW,GAA6C;QAC5D,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ;QAChC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY;KACzC,CAAC;IACF,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,wFAAwF,CAAC,CAAC;QAC1G,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,2CAA2C,QAAQ,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAA6C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACnF,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAEjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,UAAU,CAClB,sGAAsG;YACpG,+EAA+E;YAC/E,+CAA+C,SAAS,EAAE,EAC5D,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACvC,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAA4D,EAAE,CAAC;IAC3E,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,gBAAgB,GAAG,WAAW,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3D,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AAElG,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC;IAElG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;SACjB,WAAW,CAAC,2EAA2E,CAAC;SACxF,cAAc,CAAC,uBAAuB,EAAE,iBAAiB,SAAS,gDAAgD,CAAC;SACnH,cAAc,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SAC/E,cAAc,CAAC,0BAA0B,EAAE,+CAA+C,CAAC;SAC3F,MAAM,CAAC,kBAAkB,EAAE,4EAA4E,CAAC;SACxG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;SAC9F,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;SAC/F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SACtB,WAAW,CAAC,4CAA4C,CAAC;SACzD,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACzD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC;gBAChE,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;SAC3B,WAAW,CAAC,iGAAiG,CAAC;SAC9G,MAAM,CAAC,wBAAwB,EAAE,gFAAgF,CAAC;SAClH,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACnD,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;SACjG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;SAC3F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/stripe.command.d.ts

@@ -1,3 +1,39 @@
 import { Command } from 'commander';
+export interface ServerCredentialsState {
+    stripeCredentialsAdded: boolean;
+    /** TBP-658. Optional: older account APIs do not send it. */
+    stripeWebhookConfigured?: boolean;
+    azureMarketplaceCredentialsAdded: boolean;
+    azureAdSsoCredentialsAdded: boolean;
+    linkedinSsoCredentialsAdded: boolean;
+    googleSsoCredentialsAdded: boolean;
+    appleSsoCredentialsAdded: boolean;
+    githubSsoCredentialsAdded: boolean;
+    facebookSsoCredentialsAdded: boolean;
+}
+/** Webhook health fields on the app response (TBP-658). All optional: older APIs omit them. */
+export interface ServerAppStripeState {
+    stripeSetupStatus?: 'pending' | 'completed' | 'failed' | null;
+    stripeSetupError?: string | null;
+    stripeLastWebhookAt?: string | null;
+    stripeLastWebhookRejectedAt?: string | null;
+    stripeLastWebhookRejectionReason?: string | null;
+}
+/** `true` only when the server confirms stored Stripe keys; never undefined. */
+export declare function stripeConnectedFrom(state: unknown): boolean;
+/** `null` when the API does not report it (older account API), so absence is not read as broken. */
+export declare function stripeWebhookConfiguredFrom(state: unknown): boolean | null;
+export interface StripeStatus {
+    connected: boolean;
+    webhookConfigured: boolean | null;
+    webhookHealthy: boolean | null;
+    lastWebhookAt: string | null;
+    lastWebhookRejectedAt: string | null;
+    lastWebhookRejectionReason: string | null;
+    setupStatus: string | null;
+    setupError: string | null;
+    message: string;
+}
+export declare function stripeStatusFrom(state: unknown, app: unknown): StripeStatus;
 export declare function registerStripeCommands(program: Command): void;
 //# sourceMappingURL=stripe.command.d.ts.map

package/dist/commands/stripe.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.command.d.ts","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmC7D"}
+{"version":3,"file":"stripe.command.d.ts","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,MAAM,WAAW,sBAAsB;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gCAAgC,EAAE,OAAO,CAAC;IAC1C,0BAA0B,EAAE,OAAO,CAAC;IACpC,2BAA2B,EAAE,OAAO,CAAC;IACrC,yBAAyB,EAAE,OAAO,CAAC;IACnC,wBAAwB,EAAE,OAAO,CAAC;IAClC,yBAAyB,EAAE,OAAO,CAAC;IACnC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,gCAAgC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,oGAAoG;AACpG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAG1E;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,YAAY,CAuB3E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqC7D"}

package/dist/commands/stripe.command.js

@@ -1,18 +1,71 @@
 import { getManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
+/** `true` only when the server confirms stored Stripe keys; never undefined. */
+export function stripeConnectedFrom(state) {
+    return state?.stripeCredentialsAdded === true;
+}
+/** `null` when the API does not report it (older account API), so absence is not read as broken. */
+export function stripeWebhookConfiguredFrom(state) {
+    const value = state?.stripeWebhookConfigured;
+    return typeof value === 'boolean' ? value : null;
+}
+const CONNECT_HINT = 'run: bridge stripe connect --secret-key sk_... --publishable-key pk_...';
+const REPAIR_HINT = 'Checkout still works, but subscription changes, cancellations and payment failures are not ' +
+    'reaching Bridge. Repair: re-run `bridge setup payments` with the same keys, or use "Repair ' +
+    'webhook" in the Bridge admin payment settings.';
+/*
+ * Mirrors bridge-api's `AppService._stripeWebhookUnhealthy` plus the two
+ * explicit failure signals. `null` = the API gave us nothing to judge by.
+ */
+function webhookHealthy(configured, app) {
+    if (configured === false || app.stripeSetupStatus === 'failed')
+        return false;
+    const rejectedAt = app.stripeLastWebhookRejectedAt;
+    if (rejectedAt) {
+        const lastAt = app.stripeLastWebhookAt;
+        if (!lastAt || new Date(rejectedAt).getTime() > new Date(lastAt).getTime())
+            return false;
+    }
+    return configured;
+}
+export function stripeStatusFrom(state, app) {
+    const a = (app ?? {});
+    const connected = stripeConnectedFrom(state);
+    const webhookConfigured = stripeWebhookConfiguredFrom(state);
+    const healthy = connected ? webhookHealthy(webhookConfigured, a) : null;
+    let message;
+    if (!connected)
+        message = `Stripe is not connected — ${CONNECT_HINT}`;
+    else if (healthy === false)
+        message = `Stripe is connected, but its webhook is not working. ${REPAIR_HINT}`;
+    else if (healthy === null)
+        message = 'Stripe is connected (webhook health not reported by this API)';
+    else
+        message = 'Stripe is connected and its webhook is configured';
+    return {
+        connected,
+        webhookConfigured,
+        webhookHealthy: healthy,
+        lastWebhookAt: a.stripeLastWebhookAt ?? null,
+        lastWebhookRejectedAt: a.stripeLastWebhookRejectedAt ?? null,
+        lastWebhookRejectionReason: a.stripeLastWebhookRejectionReason ?? null,
+        setupStatus: a.stripeSetupStatus ?? null,
+        setupError: a.stripeSetupError ?? null,
+        message,
+    };
+}
 export function registerStripeCommands(program) {
     const stripe = program.command('stripe').description('Manage Stripe integration');
     stripe.command('status')
-        .description('Show whether Stripe credentials are configured')
+        .description('Show whether Stripe credentials are configured and whether its webhook works')
         .action(async () => {
         try {
-            const state = await getManagementClient().app.getCredentialsState();
-            outputSuccess({
-                connected: state.hasStripeCredentials,
-                message: state.hasStripeCredentials
-                    ? 'Stripe is connected'
-                    : 'Stripe is not connected — run: bridge stripe connect --secret-key sk_... --publishable-key pk_...',
-            });
+            const client = getManagementClient();
+            const [state, app] = await Promise.all([
+                client.app.getCredentialsState(),
+                client.app.get(),
+            ]);
+            outputSuccess(stripeStatusFrom(state, app));
         }
         catch (err) {
             outputError(err);
@@ -28,12 +81,15 @@ export function registerStripeCommands(program) {
                 stripeSecretKey: opts.secretKey,
                 stripePublicKey: opts.publishableKey,
             });
-            outputSuccess({
-                connected: state.hasStripeCredentials,
-                message: state.hasStripeCredentials
-                    ? 'Stripe connected successfully'
-                    : 'Credentials saved but Stripe did not confirm — check your keys and try again',
-            });
+            const connected = stripeConnectedFrom(state);
+            const webhookConfigured = stripeWebhookConfiguredFrom(state);
+            let message = connected
+                ? 'Stripe connected successfully'
+                : 'Credentials saved but Stripe did not confirm — check your keys and try again';
+            if (connected && webhookConfigured === false) {
+                message += '. Warning: the Stripe webhook is not configured — run `bridge stripe status` for details';
+            }
+            outputSuccess({ connected, webhookConfigured, message });
         }
         catch (err) {
             outputError(err);

package/dist/commands/stripe.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.command.js","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACrB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACpE,aAAa,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,oBAAoB;gBACrC,OAAO,EAAE,KAAK,CAAC,oBAAoB;oBACjC,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,mGAAmG;aACxG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtB,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;SACtF,cAAc,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9D,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,aAAa,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,oBAAoB;gBACrC,OAAO,EAAE,KAAK,CAAC,oBAAoB;oBACjC,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,8EAA8E;aACnF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"stripe.command.js","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAmC1D,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAQ,KAA4D,EAAE,sBAAsB,KAAK,IAAI,CAAC;AACxG,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,KAAK,GAAI,KAA4D,EAAE,uBAAuB,CAAC;IACrG,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAcD,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAC/F,MAAM,WAAW,GACf,6FAA6F;IAC7F,6FAA6F;IAC7F,gDAAgD,CAAC;AAEnD;;;GAGG;AACH,SAAS,cAAc,CACrB,UAA0B,EAC1B,GAAyB;IAEzB,IAAI,UAAU,KAAK,KAAK,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,UAAU,GAAG,GAAG,CAAC,2BAA2B,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,GAAY;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAyB,CAAC;IAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,6BAA6B,YAAY,EAAE,CAAC;SACjE,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,wDAAwD,WAAW,EAAE,CAAC;SACvG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,+DAA+D,CAAC;;QAChG,OAAO,GAAG,mDAAmD,CAAC;IAEnE,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,cAAc,EAAE,OAAO;QACvB,aAAa,EAAE,CAAC,CAAC,mBAAmB,IAAI,IAAI;QAC5C,qBAAqB,EAAE,CAAC,CAAC,2BAA2B,IAAI,IAAI;QAC5D,0BAA0B,EAAE,CAAC,CAAC,gCAAgC,IAAI,IAAI;QACtE,WAAW,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QACxC,UAAU,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;QACtC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACrB,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;aACjB,CAAC,CAAC;YACH,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtB,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;SACtF,cAAc,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9D,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,OAAO,GAAG,SAAS;gBACrB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,8EAA8E,CAAC;YACnF,IAAI,SAAS,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBAC7C,OAAO,IAAI,0FAA0F,CAAC;YACxG,CAAC;YACD,aAAa,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/config.d.ts

@@ -1,22 +1,29 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
 export declare const DEFAULT_BASE_URL = "https://api.thebridge.dev";
+/** Called once from the CLI entrypoint, before any action runs. */
+export declare function setProfileOverride(profile: string | null | undefined): void;
 /**
  * Resolution order:
- *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
- *      written by `bridge auth login`. The interactive primary path. Token
- *      carries the appId baked in by /v1/auth/cli/token, so post-login the
- *      JWT is the source of truth for which app the CLI operates on.
- *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
- *      credentials file exists — typical CI runner shape.
- *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *   1. `--profile <label|id|name>` / `BRIDGE_PROFILE` — a stored credential,
+ *      named for this one invocation. Never falls back: naming a profile and
+ *      silently getting a different app is the exact failure TBP-628 exists to
+ *      stop, so an unknown or expired profile is an error.
+ *   2. The ACTIVE credential in `~/.config/bridge/credentials.json` (or
+ *      `$XDG_CONFIG_HOME/...`), written by `bridge auth login` and moved by
+ *      `bridge auth use`.
+ *   3. `BRIDGE_API_KEY` env var (CI / service-account fallback). Used when no
+ *      usable credentials file exists — the typical CI runner shape.
+ *   4. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
  *
- * Note: credentials-file wins over env so `bridge auth login` does what users
- * expect — the new login takes effect immediately. CI is unaffected because
- * runners typically have no credentials file and fall through to step 2.
+ * The credentials file still wins over `BRIDGE_API_KEY`, unchanged, so
+ * `bridge auth login` takes effect immediately and CI is unaffected. What HAS
+ * changed is that being ignored is now said out loud: `BRIDGE_API_KEY` and
+ * `BRIDGE_APP_ID` look like a way to retarget the CLI and are not, and reading
+ * that in the output beats discovering it from a write that went to the wrong
+ * app (TBP-628).
  *
- * If a credentials file exists but its `expiresAt` is in the past, we fall
- * through to env (if set) — same as if there were no file. Otherwise throw a
- * friendly error pointing the user back to `bridge auth login`.
+ * Every resolution also prints one line to stderr naming the app that is about
+ * to answer. See `writeContextBanner`.
  */
 export declare function getManagementClient(): BridgeManagement;
 /**

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAGlE,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAI5D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CA+CtD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AASlE,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAa5D,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE3E;AAQD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,CA0EtD;AAoDD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQnE;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B"}

package/dist/config.js

@@ -1,24 +1,47 @@
 import { BridgeManagement } from '@nebulr-group/bridge-auth-core';
-import { isExpired, readCredentials } from './credentials.js';
+import { CredentialSelectorError, findCredential, isExpired, readCredentials, } from './credentials.js';
 export const DEFAULT_BASE_URL = 'https://api.thebridge.dev';
 let _client = null;
+/**
+ * The `--profile` value for this invocation, set by the CLI's preAction hook.
+ *
+ * A per-invocation override rather than a persisted switch, because that is
+ * what scripts and long-running agent sessions need: target one app for one
+ * command without mutating state another process is reading (TBP-628).
+ */
+let _profileOverride = null;
+/** Called once from the CLI entrypoint, before any action runs. */
+export function setProfileOverride(profile) {
+    _profileOverride = profile?.trim() || null;
+}
+/** The profile in force: `--profile` beats `BRIDGE_PROFILE`. */
+function activeProfileSelector() {
+    if (_profileOverride)
+        return _profileOverride;
+    return process.env.BRIDGE_PROFILE?.trim() || null;
+}
 /**
  * Resolution order:
- *   1. `~/.config/bridge/credentials.json` (or `$XDG_CONFIG_HOME/bridge/credentials.json`)
- *      written by `bridge auth login`. The interactive primary path. Token
- *      carries the appId baked in by /v1/auth/cli/token, so post-login the
- *      JWT is the source of truth for which app the CLI operates on.
- *   2. `BRIDGE_API_KEY` env var  (CI / service-account fallback). Used when no
- *      credentials file exists — typical CI runner shape.
- *   3. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
+ *   1. `--profile <label|id|name>` / `BRIDGE_PROFILE` — a stored credential,
+ *      named for this one invocation. Never falls back: naming a profile and
+ *      silently getting a different app is the exact failure TBP-628 exists to
+ *      stop, so an unknown or expired profile is an error.
+ *   2. The ACTIVE credential in `~/.config/bridge/credentials.json` (or
+ *      `$XDG_CONFIG_HOME/...`), written by `bridge auth login` and moved by
+ *      `bridge auth use`.
+ *   3. `BRIDGE_API_KEY` env var (CI / service-account fallback). Used when no
+ *      usable credentials file exists — the typical CI runner shape.
+ *   4. Throw `ConfigError("Not logged in. Run `bridge auth login`.")`.
  *
- * Note: credentials-file wins over env so `bridge auth login` does what users
- * expect — the new login takes effect immediately. CI is unaffected because
- * runners typically have no credentials file and fall through to step 2.
+ * The credentials file still wins over `BRIDGE_API_KEY`, unchanged, so
+ * `bridge auth login` takes effect immediately and CI is unaffected. What HAS
+ * changed is that being ignored is now said out loud: `BRIDGE_API_KEY` and
+ * `BRIDGE_APP_ID` look like a way to retarget the CLI and are not, and reading
+ * that in the output beats discovering it from a write that went to the wrong
+ * app (TBP-628).
  *
- * If a credentials file exists but its `expiresAt` is in the past, we fall
- * through to env (if set) — same as if there were no file. Otherwise throw a
- * friendly error pointing the user back to `bridge auth login`.
+ * Every resolution also prints one line to stderr naming the app that is about
+ * to answer. See `writeContextBanner`.
  */
 export function getManagementClient() {
     if (_client)
@@ -29,29 +52,56 @@ export function getManagementClient() {
     let apiKey;
     let baseUrl;
     let source;
-    // 1. Credentials file from `bridge auth login` (interactive primary).
-    const creds = safeReadCredentials();
-    if (creds && !isExpired(creds)) {
+    let creds = null;
+    const selector = activeProfileSelector();
+    if (selector) {
+        // 1. Explicit profile. Resolve it or fail — no fallback of any kind.
+        let entry;
+        try {
+            entry = findCredential(selector);
+        }
+        catch (err) {
+            if (err instanceof CredentialSelectorError)
+                throw new ConfigError(err.message);
+            throw err;
+        }
+        if (isExpired(entry.creds)) {
+            throw new ConfigError(`Credential for "${selector}" (${entry.creds.app.name}) expired ` +
+                `${entry.creds.expiresAt}. Run \`bridge auth login\` to re-authenticate it. ` +
+                'Refusing to fall back to another app.');
+        }
+        creds = entry.creds;
         apiKey = creds.apiKey;
-        // Env override still wins for baseUrl (useful for hitting a local bridge-api
-        // with a token issued by prod, or vice versa during dev).
         baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : creds.baseUrl;
-        source = 'credentials-file';
-    }
-    else if (envApiKey && envApiKey.length > 0) {
-        // 2. BRIDGE_API_KEY env var (CI / service-account fallback).
-        apiKey = envApiKey;
-        baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : DEFAULT_BASE_URL;
-        source = 'env';
-    }
-    else if (creds && isExpired(creds)) {
-        // 3a. Found a credentials file but token expired; no env fallback either.
-        throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
+        source = 'profile';
     }
     else {
-        // 3b. No credentials at all.
-        throw new ConfigError('Not logged in. Run `bridge auth login`.');
+        // 2. Active credential from `bridge auth login` / `bridge auth use`.
+        const active = safeReadCredentials();
+        if (active && !isExpired(active)) {
+            creds = active;
+            apiKey = active.apiKey;
+            // Env override still wins for baseUrl (useful for hitting a local
+            // bridge-api with a token issued by prod, or vice versa during dev).
+            baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : active.baseUrl;
+            source = 'credentials-file';
+        }
+        else if (envApiKey && envApiKey.length > 0) {
+            // 3. BRIDGE_API_KEY env var (CI / service-account fallback).
+            apiKey = envApiKey;
+            baseUrl = envBaseUrl && envBaseUrl.length > 0 ? envBaseUrl : DEFAULT_BASE_URL;
+            source = 'env';
+        }
+        else if (active && isExpired(active)) {
+            // 4a. Found a credentials file but token expired; no env fallback either.
+            throw new ConfigError('Token expired. Run `bridge auth login` to re-authenticate.');
+        }
+        else {
+            // 4b. No credentials at all.
+            throw new ConfigError('Not logged in. Run `bridge auth login`.');
+        }
     }
+    writeContextBanner({ creds, source, baseUrl, selector });
     if (debug) {
         const baseSource = envBaseUrl && envBaseUrl.length > 0
             ? 'env'
@@ -63,6 +113,44 @@ export function getManagementClient() {
     _client = new BridgeManagement({ apiKey, baseUrl, debug });
     return _client;
 }
+/**
+ * One line on stderr naming the app that is about to answer.
+ *
+ * On EVERY command, not only writes. The incident behind TBP-628 started with a
+ * read: `bridge role list` was believed to describe the local app and described
+ * production, and nothing in the output said otherwise. A banner that only
+ * appears on writes would not have prevented it, because the wrong belief was
+ * already formed by then.
+ *
+ * stderr, so stdout stays pure JSON for the agents and scripts that parse it.
+ * Suppress with `BRIDGE_NO_BANNER=true` — for the one caller who is already
+ * certain and is merging the two streams.
+ */
+function writeContextBanner(ctx) {
+    if (process.env.BRIDGE_NO_BANNER === 'true')
+        return;
+    const { creds, source, baseUrl, selector } = ctx;
+    const who = creds
+        ? `${creds.label ?? creds.app.name} (${creds.app.id})`
+        : 'BRIDGE_API_KEY (app unknown — the key carries it)';
+    const via = source === 'profile'
+        ? `--profile ${selector}`
+        : source === 'env'
+            ? 'BRIDGE_API_KEY'
+            : 'saved default';
+    process.stderr.write(`bridge: ${who} · ${baseUrl} · via ${via}\n`);
+    // The two env vars that look like a way to retarget the CLI and are not.
+    // Saying so here, at the moment they are being ignored, is the whole point:
+    // the reported incident was a session that set them and believed them.
+    if (source !== 'env' && process.env.BRIDGE_API_KEY?.trim()) {
+        process.stderr.write('bridge: BRIDGE_API_KEY is set but IGNORED — the credentials file wins. ' +
+            'Use `--profile <label>` to pick a stored app, or `bridge auth logout` to use the key.\n');
+    }
+    if (process.env.BRIDGE_APP_ID?.trim()) {
+        process.stderr.write('bridge: BRIDGE_APP_ID has no effect — the app is carried by the credential itself. ' +
+            'Use `--profile <label|app id>` or `BRIDGE_PROFILE` to target another app.\n');
+    }
+}
 /**
  * For tests and for `bridge auth logout` / `bridge auth status` — they need
  * to reset the cached client between operations.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,eAAe,EAA0B,MAAM,kBAAkB,CAAC;AAEtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IAEnB,sEAAsE;IACtE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACtB,6EAA6E;QAC7E,0DAA0D;QAC1D,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3E,MAAM,GAAG,kBAAkB,CAAC;IAC9B,CAAC;SAAM,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,6DAA6D;QAC7D,MAAM,GAAG,SAAS,CAAC;QACnB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC9E,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;SAAM,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,0EAA0E;QAC1E,MAAM,IAAI,WAAW,CACnB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,KAAK;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,aAAa,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACtF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,eAAe,GAEhB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C;;;;;;GAMG;AACH,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,gBAAgB,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AAC7C,CAAC;AAED,gEAAgE;AAChE,SAAS,qBAAqB;IAC5B,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,GAA6B,IAAI,CAAC;IAE3C,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,qEAAqE;QACrE,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,WAAW,CACnB,mBAAmB,QAAQ,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY;gBAC/D,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,qDAAqD;gBAC7E,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACpB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACtB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAC3E,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,KAAK,GAAG,MAAM,CAAC;YACf,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5E,MAAM,GAAG,kBAAkB,CAAC;QAC9B,CAAC;aAAM,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,6DAA6D;YAC7D,MAAM,GAAG,SAAS,CAAC;YACnB,OAAO,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC9E,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;aAAM,IAAI,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,0EAA0E;YAC1E,MAAM,IAAI,WAAW,CACnB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,6BAA6B;YAC7B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,KAAK,KAAK;gBAChB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,aAAa,OAAO,KAAK,UAAU,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,GAAG,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,GAK3B;IACC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,MAAM;QAAE,OAAO;IAEpD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG;QACtD,CAAC,CAAC,mDAAmD,CAAC;IACxD,MAAM,GAAG,GACP,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,aAAa,QAAQ,EAAE;QACzB,CAAC,CAAC,MAAM,KAAK,KAAK;YAChB,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,eAAe,CAAC;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,OAAO,UAAU,GAAG,IAAI,CAAC,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yEAAyE;YACvE,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qFAAqF;YACnF,6EAA6E,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACtF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}