@nebulr-group/bridge-cli 0.4.4 → 0.5.1-beta.0

package/dist/credentials.d.ts

@@ -20,6 +20,21 @@ export interface StoredCredentials {
     /** Optional human-friendly label set via `bridge auth login --label`. */
     label?: string;
 }
+/** Current on-disk shape. See the module docstring for why it is a map. */
+export interface CredentialsFile {
+    version: 2;
+    /** App id of the credential commands use by default. `null` when empty. */
+    active: string | null;
+    /** All stored credentials, keyed by `app.id`. */
+    credentials: Record<string, StoredCredentials>;
+}
+/** One entry, as `bridge auth status` and the selector logic see it. */
+export interface CredentialEntry {
+    /** The map key — always `creds.app.id`. */
+    key: string;
+    creds: StoredCredentials;
+    isActive: boolean;
+}
 /**
  * Returns the absolute path to the credentials file based on the current
  * environment. Does not create directories or files — pure path resolution.
@@ -37,17 +52,65 @@ export interface StoredCredentials {
  */
 export declare function credentialsPath(): string;
 /**
- * Reads and parses the credentials file. Returns `null` if the file does not
- * exist. Throws if the file exists but is unreadable or contains invalid JSON.
+ * Read the whole store, migrating a v1 file in memory. `null` if no file.
+ *
+ * Throws if the file exists but is unreadable or malformed — a corrupt store is
+ * not the same as an absent one, and silently treating it as absent would make
+ * `bridge auth status` report "not logged in" to somebody who very much is.
+ */
+export declare function readCredentialsFile(): CredentialsFile | null;
+/**
+ * The credential commands act on by default: the active one.
+ *
+ * Kept with its original name and signature because every existing caller wants
+ * exactly this, and because "which credential is in force" is a question with
+ * one answer whether the file holds one app or ten.
  */
 export declare function readCredentials(): StoredCredentials | null;
+/** Every stored credential, active one first, then by app name. */
+export declare function listCredentials(): CredentialEntry[];
+/** Raised when a selector matches nothing, or matches more than one entry. */
+export declare class CredentialSelectorError extends Error {
+    constructor(message: string);
+}
+/**
+ * Find one stored credential by label, app id, or app name.
+ *
+ * Label first: users think in environments, not in 24-character object ids, and
+ * `--label` exists precisely so they can name one. App id is exact and always
+ * works. App name is last because two apps may share one.
+ *
+ * An ambiguous selector is an ERROR, never a first match. Picking one of two
+ * candidate apps silently is the whole failure mode this ticket is about.
+ */
+export declare function findCredential(selector: string): CredentialEntry;
 /**
- * Writes the credentials atomically with mode 0600. Creates the parent
- * directory with mode 0700 if it does not exist.
+ * Upsert a credential by app id and make it active.
+ *
+ * Same name and signature as before: `bridge auth login` still ends with one
+ * call, and still leaves the app it just authorised in force.
  */
 export declare function writeCredentials(creds: StoredCredentials): void;
+/** Point the persisted default at an already-stored credential. Offline. */
+export declare function setActiveCredential(key: string): void;
+/** Persist the store atomically with mode 0600, dir 0700. */
+export declare function writeCredentialsFile(file: CredentialsFile): void;
 /**
- * Deletes the credentials file. No-op if it does not exist.
+ * Remove ONE credential. Deletes the file entirely when it was the last.
+ *
+ * Returns the remaining count so a caller can tell the user what is left.
+ * Removing the active one moves `active` to another entry rather than leaving a
+ * dangling pointer — with credentials still stored, "logged out of everything"
+ * would be a lie.
+ */
+export declare function removeCredential(key: string): number;
+/** Delete the whole credentials file. No-op if it does not exist. */
+export declare function deleteAllCredentials(): void;
+/**
+ * Back-compat alias for the single-app era: remove the active credential.
+ *
+ * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
+ * say which of the two things they do.
  */
 export declare function deleteCredentials(): void;
 /**

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,qCAAqC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAiB1D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CA4B/D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAQxC;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAInF"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,qCAAqC;IACrC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,2EAA2E;IAC3E,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAQxC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,eAAe,GAAG,IAAI,CAyB5D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAU1D;AAED,mEAAmE;AACnE,wBAAgB,eAAe,IAAI,eAAe,EAAE,CASnD;AAED,8EAA8E;AAC9E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAmChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAK/D;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA4BhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWpD;AAED,qEAAqE;AACrE,wBAAgB,oBAAoB,IAAI,IAAI,CAQ3C;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC;AAsBD;;GAEG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAInF"}

package/dist/credentials.js

@@ -10,6 +10,34 @@
  *   2. `~/.config/bridge/credentials.json` otherwise
  *
  * File mode: 0600 (owner read/write only). Containing dir created with 0700.
+ *
+ * ## The file holds MANY apps (TBP-628)
+ *
+ * It used to hold exactly one. Anyone running the same product as several apps
+ * — one appId per environment — had to `logout` + `login` through the browser
+ * to move between them, even though the token they already held had days left
+ * on it. Worse, nothing in a read command's output said which app answered, so
+ * a session holding a prod token could run `role list` believing it described
+ * local, and the next step would have rewritten production roles.
+ *
+ * So the on-disk shape is now a map keyed by app id, plus a pointer at the
+ * active one:
+ *
+ * ```json
+ * {
+ *   "version": 2,
+ *   "active": "606b4416fabdc800087d09ec",
+ *   "credentials": { "606b4416fabdc800087d09ec": { …StoredCredentials } }
+ * }
+ * ```
+ *
+ * Keyed by app id, not by label: the label is optional and user-chosen, so it
+ * is a fine way to SELECT a credential and a bad way to key one.
+ *
+ * A v1 file (a bare `StoredCredentials` object) is migrated on read, in memory
+ * only. Reading never rewrites the file — a read command must not mutate state
+ * another process is reading. The v2 shape is persisted the next time
+ * something writes.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -39,10 +67,13 @@ export function credentialsPath() {
     return path.join(base, '.config', 'bridge', 'credentials.json');
 }
 /**
- * Reads and parses the credentials file. Returns `null` if the file does not
- * exist. Throws if the file exists but is unreadable or contains invalid JSON.
+ * Read the whole store, migrating a v1 file in memory. `null` if no file.
+ *
+ * Throws if the file exists but is unreadable or malformed — a corrupt store is
+ * not the same as an absent one, and silently treating it as absent would make
+ * `bridge auth status` report "not logged in" to somebody who very much is.
  */
-export function readCredentials() {
+export function readCredentialsFile() {
     const filePath = credentialsPath();
     if (!fs.existsSync(filePath))
         return null;
@@ -54,16 +85,120 @@ export function readCredentials() {
     catch {
         throw new Error(`Credentials file at ${filePath} is not valid JSON.`);
     }
-    if (!isStoredCredentials(parsed)) {
-        throw new Error(`Credentials file at ${filePath} is missing required fields.`);
+    // v2 — the current shape.
+    if (isCredentialsFile(parsed))
+        return parsed;
+    // v1 — a bare StoredCredentials object. Migrate in memory; do NOT write.
+    if (isStoredCredentials(parsed)) {
+        return {
+            version: 2,
+            active: parsed.app.id,
+            credentials: { [parsed.app.id]: parsed },
+        };
     }
-    return parsed;
+    throw new Error(`Credentials file at ${filePath} is missing required fields.`);
 }
 /**
- * Writes the credentials atomically with mode 0600. Creates the parent
- * directory with mode 0700 if it does not exist.
+ * The credential commands act on by default: the active one.
+ *
+ * Kept with its original name and signature because every existing caller wants
+ * exactly this, and because "which credential is in force" is a question with
+ * one answer whether the file holds one app or ten.
+ */
+export function readCredentials() {
+    const file = readCredentialsFile();
+    if (!file)
+        return null;
+    if (file.active && file.credentials[file.active])
+        return file.credentials[file.active];
+    // A pointer at a credential that is gone. Fall back to the only entry if
+    // there is exactly one — otherwise there is no defensible default, and
+    // guessing would pick an app on the user's behalf, which is the failure this
+    // ticket exists to stop.
+    const keys = Object.keys(file.credentials);
+    return keys.length === 1 ? file.credentials[keys[0]] : null;
+}
+/** Every stored credential, active one first, then by app name. */
+export function listCredentials() {
+    const file = readCredentialsFile();
+    if (!file)
+        return [];
+    return Object.entries(file.credentials)
+        .map(([key, creds]) => ({ key, creds, isActive: key === file.active }))
+        .sort((a, b) => {
+        if (a.isActive !== b.isActive)
+            return a.isActive ? -1 : 1;
+        return a.creds.app.name.localeCompare(b.creds.app.name);
+    });
+}
+/** Raised when a selector matches nothing, or matches more than one entry. */
+export class CredentialSelectorError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialSelectorError';
+    }
+}
+/**
+ * Find one stored credential by label, app id, or app name.
+ *
+ * Label first: users think in environments, not in 24-character object ids, and
+ * `--label` exists precisely so they can name one. App id is exact and always
+ * works. App name is last because two apps may share one.
+ *
+ * An ambiguous selector is an ERROR, never a first match. Picking one of two
+ * candidate apps silently is the whole failure mode this ticket is about.
+ */
+export function findCredential(selector) {
+    const needle = selector.trim();
+    if (!needle)
+        throw new CredentialSelectorError('Empty profile selector.');
+    const entries = listCredentials();
+    if (entries.length === 0) {
+        throw new CredentialSelectorError('No stored credentials. Run `bridge auth login` first.');
+    }
+    const lower = needle.toLowerCase();
+    const byLabel = entries.filter((e) => e.creds.label?.toLowerCase() === lower);
+    const byId = entries.filter((e) => e.key === needle);
+    const byName = entries.filter((e) => e.creds.app.name.toLowerCase() === lower);
+    for (const [what, matches] of [
+        ['label', byLabel],
+        ['app id', byId],
+        ['app name', byName],
+    ]) {
+        if (matches.length === 1)
+            return matches[0];
+        if (matches.length > 1) {
+            throw new CredentialSelectorError(`"${needle}" matches ${matches.length} stored credentials by ${what} ` +
+                `(${matches.map((m) => m.key).join(', ')}). Select by app id instead.`);
+        }
+    }
+    throw new CredentialSelectorError(`No stored credential matches "${needle}". Known: ` +
+        entries.map((e) => e.creds.label ?? e.creds.app.name).join(', ') +
+        '. Run `bridge auth status` to see them all.');
+}
+/**
+ * Upsert a credential by app id and make it active.
+ *
+ * Same name and signature as before: `bridge auth login` still ends with one
+ * call, and still leaves the app it just authorised in force.
  */
 export function writeCredentials(creds) {
+    const file = readCredentialsFileOrEmpty();
+    file.credentials[creds.app.id] = creds;
+    file.active = creds.app.id;
+    writeCredentialsFile(file);
+}
+/** Point the persisted default at an already-stored credential. Offline. */
+export function setActiveCredential(key) {
+    const file = readCredentialsFileOrEmpty();
+    if (!file.credentials[key]) {
+        throw new CredentialSelectorError(`No stored credential with app id ${key}.`);
+    }
+    file.active = key;
+    writeCredentialsFile(file);
+}
+/** Persist the store atomically with mode 0600, dir 0700. */
+export function writeCredentialsFile(file) {
     const filePath = credentialsPath();
     const dir = path.dirname(filePath);
     // Create dir with restrictive perms. mkdirSync `mode` is masked by umask, so
@@ -80,7 +215,7 @@ export function writeCredentials(creds) {
     const tmpPath = `${filePath}.${process.pid}.tmp`;
     const fd = fs.openSync(tmpPath, 'w', 0o600);
     try {
-        fs.writeFileSync(fd, JSON.stringify(creds, null, 2) + '\n');
+        fs.writeFileSync(fd, JSON.stringify(file, null, 2) + '\n');
     }
     finally {
         fs.closeSync(fd);
@@ -94,9 +229,28 @@ export function writeCredentials(creds) {
     fs.renameSync(tmpPath, filePath);
 }
 /**
- * Deletes the credentials file. No-op if it does not exist.
+ * Remove ONE credential. Deletes the file entirely when it was the last.
+ *
+ * Returns the remaining count so a caller can tell the user what is left.
+ * Removing the active one moves `active` to another entry rather than leaving a
+ * dangling pointer — with credentials still stored, "logged out of everything"
+ * would be a lie.
  */
-export function deleteCredentials() {
+export function removeCredential(key) {
+    const file = readCredentialsFileOrEmpty();
+    delete file.credentials[key];
+    const remaining = Object.keys(file.credentials);
+    if (remaining.length === 0) {
+        deleteAllCredentials();
+        return 0;
+    }
+    if (file.active === key)
+        file.active = remaining[0];
+    writeCredentialsFile(file);
+    return remaining.length;
+}
+/** Delete the whole credentials file. No-op if it does not exist. */
+export function deleteAllCredentials() {
     const filePath = credentialsPath();
     try {
         fs.unlinkSync(filePath);
@@ -107,6 +261,43 @@ export function deleteCredentials() {
         throw err;
     }
 }
+/**
+ * Back-compat alias for the single-app era: remove the active credential.
+ *
+ * @deprecated Prefer `removeCredential(key)` or `deleteAllCredentials()`, which
+ * say which of the two things they do.
+ */
+export function deleteCredentials() {
+    const file = readCredentialsFileOrEmpty();
+    if (file.active) {
+        removeCredential(file.active);
+        return;
+    }
+    deleteAllCredentials();
+}
+/** The store, or an empty one — for the write paths, which create on demand. */
+function readCredentialsFileOrEmpty() {
+    try {
+        return readCredentialsFile() ?? { version: 2, active: null, credentials: {} };
+    }
+    catch {
+        // A corrupt file must not wedge `login` — overwriting it is how the user
+        // gets unstuck, and the token in it is unusable anyway.
+        return { version: 2, active: null, credentials: {} };
+    }
+}
+function isCredentialsFile(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    if (v.version !== 2)
+        return false;
+    if (v.active !== null && typeof v.active !== 'string')
+        return false;
+    if (!v.credentials || typeof v.credentials !== 'object')
+        return false;
+    return Object.values(v.credentials).every(isStoredCredentials);
+}
 /**
  * True if the credentials' `expiresAt` is in the past relative to `now`.
  */

package/dist/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAmB9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,IAAI;QACd,OAAQ,CAAC,CAAC,GAA+B,CAAC,EAAE,KAAK,QAAQ;QACzD,OAAQ,CAAC,CAAC,GAA+B,CAAC,IAAI,KAAK,QAAQ;QAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAQ,CAAC,CAAC,IAAgC,CAAC,EAAE,KAAK,QAAQ;QAC1D,OAAQ,CAAC,CAAC,IAAgC,CAAC,KAAK,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAoC9B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,qBAAqB,CAAC,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAE7C,yEAAyE;IACzE,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YACrB,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvF,yEAAyE;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,yBAAyB;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;SACtE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAC/B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAE/E,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,OAAO,EAAE,OAAO,CAAC;QAClB,CAAC,QAAQ,EAAE,IAAI,CAAC;QAChB,CAAC,UAAU,EAAE,MAAM,CAAC;KACZ,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,aAAa,OAAO,CAAC,MAAM,0BAA0B,IAAI,GAAG;gBACpE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,uBAAuB,CAC/B,iCAAiC,MAAM,YAAY;QACjD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChE,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3B,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IAClB,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,IAAqB;IACxD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IAED,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,oBAAoB,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,SAAS,CAAC,MAAM,CAAC;AAC1B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,SAAS,0BAA0B;IACjC,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wDAAwD;QACxD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAsC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC5F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB,EAAE,MAAY,IAAI,IAAI,EAAE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,GAAG,KAAK,IAAI;QACd,OAAQ,CAAC,CAAC,GAA+B,CAAC,EAAE,KAAK,QAAQ;QACzD,OAAQ,CAAC,CAAC,GAA+B,CAAC,IAAI,KAAK,QAAQ;QAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAQ,CAAC,CAAC,IAAgC,CAAC,EAAE,KAAK,QAAQ;QAC1D,OAAQ,CAAC,CAAC,IAAgC,CAAC,KAAK,KAAK,QAAQ,CAC9D,CAAC;AACJ,CAAC"}

package/dist/prompts/billing/master.md

@@ -127,6 +127,9 @@ If any plan will have a price, connect Stripe **before** setting prices (so each
 bridge stripe status
 ```
 
+If it reports `webhookHealthy: false`, checkout still works but subscription changes, cancellations
+and payment failures will not sync. Tell the developer and follow the repair hint in `message`.
+
 If not connected, ask the developer for their Stripe keys (from `dashboard.stripe.com/apikeys`):
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-cli",
-  "version": "0.4.4",
+  "version": "0.5.1-beta.0",
   "description": "Bridge platform CLI for AI coding agents and developers",
   "author": "Nebulr Group",
   "license": "MIT",