@nebulr-group/bridge-cli 0.5.0 → 0.5.1-beta.0

package/README.md

@@ -319,10 +319,20 @@ bridge event list --type USER_CREATED --since 24h --limit 50
 
 ```bash
 bridge setup sso --provider google --client-id <id> --client-secret <secret>
+bridge setup sso --provider azure --client-id <id> --client-secret <secret> --tenant-id <entra-directory-id>
 bridge setup payments --stripe-key sk_test_xxx
-bridge setup communication --provider sendgrid --api-key <key> --from-address noreply@acme.com
+bridge setup communication --from-address noreply@acme.com --from-name "Acme"
 ```
 
+`setup sso` supports google, github, linkedin, facebook and azure (azure also
+needs the Entra ID Directory (tenant) ID). SAML and OIDC are not supported by
+the Bridge API; set them up in the Bridge admin UI. The command prints the
+callback URL to register in the provider's console.
+
+`setup communication` sets only the sender name and address. Bridge sends all
+email through its own provider, so there is no provider or API key to
+configure. A new sender address is verified by email before Bridge uses it.
+
 ### Info (context for AI agents)
 
 ```bash

package/dist/commands/setup.command.d.ts

@@ -1,3 +1,63 @@
 import { Command } from 'commander';
+export declare const SSO_PROVIDERS: {
+    readonly google: {
+        readonly clientId: "googleClientId";
+        readonly clientSecret: "googleClientSecret";
+        readonly enable: "googleSsoEnabled";
+    };
+    readonly github: {
+        readonly clientId: "githubClientId";
+        readonly clientSecret: "githubClientSecret";
+        readonly enable: "githubSsoEnabled";
+    };
+    readonly linkedin: {
+        readonly clientId: "linkedinClientId";
+        readonly clientSecret: "linkedinClientSecret";
+        readonly enable: "linkedinSsoEnabled";
+    };
+    readonly facebook: {
+        readonly clientId: "facebookClientId";
+        readonly clientSecret: "facebookClientSecret";
+        readonly enable: "facebookSsoEnabled";
+    };
+    readonly azure: {
+        readonly clientId: "microsoftAzureADClientId";
+        readonly clientSecret: "microsoftAzureADClientSecret";
+        readonly tenantId: "microsoftAzureADTenantId";
+        readonly enable: "azureAdSsoEnabled";
+    };
+};
+export type SupportedSsoProvider = keyof typeof SSO_PROVIDERS;
+/** Carries a machine-readable `code`, which `outputError` reports. */
+export declare class SetupError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export interface SetupSsoOptions {
+    provider: string;
+    clientId?: string;
+    clientSecret?: string;
+    tenantId?: string;
+    metadataUrl?: string;
+    discoveryUrl?: string;
+}
+export declare function setupSso(opts: SetupSsoOptions): Promise<{
+    provider: "google" | "github" | "linkedin" | "facebook" | "azure";
+    enabled: boolean;
+    callbackUrl: string;
+    app: import("@nebulr-group/bridge-auth-core").AppResponse;
+}>;
+export interface SetupCommunicationOptions {
+    fromAddress?: string;
+    fromName?: string;
+    provider?: string;
+    apiKey?: string;
+}
+export declare function setupCommunication(opts: SetupCommunicationOptions): Promise<{
+    configured: boolean;
+    emailSenderEmail: string | null;
+    emailSenderName: string | null;
+    app: import("@nebulr-group/bridge-auth-core").AppResponse;
+}>;
 export declare function registerSetupCommands(program: Command): void;
 //# sourceMappingURL=setup.command.d.ts.map

package/dist/commands/setup.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.command.d.ts","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuD5D"}
+{"version":3,"file":"setup.command.d.ts","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAuB5C,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWhB,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,aAAa,CAAC;AAS9D,sEAAsE;AACtE,qBAAa,UAAW,SAAQ,KAAK;IACN,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAtC,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAInD;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe;;;;;GA4CnD;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB;;;;;GA+BvE;AAKD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC5D"}

package/dist/commands/setup.command.js

@@ -1,25 +1,133 @@
+import { Option } from 'commander';
 import { getManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
+/*
+ * TBP-663 — `setup sso` and `setup communication` talk to the app service
+ * (`app.updateCredentials` / `app.update` / `app.get`) directly instead of
+ * `workflows.setupSSO` / `workflows.setupCommunication`.
+ *
+ * Why not the workflows: in auth-core <= 0.7.0-beta.0 they send fields the
+ * API rejects under forbidNonWhitelisted — azure as `azureClientId`, saml/oidc
+ * as `samlMetadataUrl` / `oidcDiscoveryUrl`, email as `sendgridApiKey` — so
+ * both commands 400'd. auth-core main (#34) fixed them but changed their
+ * signatures and throws on the options this CLI used to pass. The app service
+ * has the same shape in both, so calling it with the server's own field names
+ * behaves identically whichever auth-core is installed.
+ *
+ * Field names are the server's: bridge-api
+ * microservices/account/nebulr-api/app/dto/update-credentials-request.dto.ts
+ * and update-app-request.dto.ts. Same table as auth-core's `setupSSO` and the
+ * MCP `setup_sso` tool. `setup-command.test.ts` pins them to those DTOs.
+ */
+export const SSO_PROVIDERS = {
+    google: { clientId: 'googleClientId', clientSecret: 'googleClientSecret', enable: 'googleSsoEnabled' },
+    github: { clientId: 'githubClientId', clientSecret: 'githubClientSecret', enable: 'githubSsoEnabled' },
+    linkedin: { clientId: 'linkedinClientId', clientSecret: 'linkedinClientSecret', enable: 'linkedinSsoEnabled' },
+    facebook: { clientId: 'facebookClientId', clientSecret: 'facebookClientSecret', enable: 'facebookSsoEnabled' },
+    azure: {
+        clientId: 'microsoftAzureADClientId',
+        clientSecret: 'microsoftAzureADClientSecret',
+        tenantId: 'microsoftAzureADTenantId',
+        enable: 'azureAdSsoEnabled',
+    },
+};
+const SUPPORTED = Object.keys(SSO_PROVIDERS).join(', ');
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Carries a machine-readable `code`, which `outputError` reports. */
+export class SetupError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'SetupError';
+    }
+}
+const NOT_SAVED = ' Nothing was saved.';
+const invalid = (message) => new SetupError(message + NOT_SAVED, 'INVALID_ARGUMENT');
+function isSupported(provider) {
+    return Object.prototype.hasOwnProperty.call(SSO_PROVIDERS, provider);
+}
+export async function setupSso(opts) {
+    const provider = String(opts.provider).toLowerCase();
+    if (!isSupported(provider)) {
+        throw new SetupError(provider === 'saml' || provider === 'oidc'
+            ? `SSO provider "${provider}" is not supported by the Bridge API: it has no fields for SAML or OIDC ` +
+                `connections. Set them up in the Bridge admin UI. Supported here: ${SUPPORTED}.${NOT_SAVED}`
+            : `Unknown SSO provider "${provider}". Supported: ${SUPPORTED}.${NOT_SAVED}`, 'SSO_PROVIDER_NOT_SUPPORTED');
+    }
+    for (const [flag, value] of [['--metadata-url', opts.metadataUrl], ['--discovery-url', opts.discoveryUrl]]) {
+        if (value !== undefined) {
+            throw new SetupError(`${flag} was removed: the Bridge API has no field for it (SAML and OIDC are set up in the Bridge admin UI).${NOT_SAVED}`, 'SSO_PROVIDER_NOT_SUPPORTED');
+        }
+    }
+    if (!opts.clientId || !opts.clientSecret) {
+        throw invalid('--client-id and --client-secret are required (from the provider console).');
+    }
+    const fields = SSO_PROVIDERS[provider];
+    const credentials = {
+        [fields.clientId]: opts.clientId,
+        [fields.clientSecret]: opts.clientSecret,
+    };
+    if ('tenantId' in fields) {
+        if (!opts.tenantId) {
+            throw invalid('azure needs --tenant-id: the Directory (tenant) ID from the Entra ID app registration.');
+        }
+        credentials[fields.tenantId] = opts.tenantId;
+    }
+    else if (opts.tenantId !== undefined) {
+        throw invalid(`--tenant-id applies to azure only, not "${provider}".`);
+    }
+    const mgmt = getManagementClient();
+    await mgmt.app.updateCredentials(credentials);
+    const enable = { [fields.enable]: true };
+    await mgmt.app.update(enable);
+    const app = await mgmt.app.get();
+    return { provider, enabled: true, callbackUrl: app.defaultCallbackUri, app };
+}
+export async function setupCommunication(opts) {
+    if (opts.provider !== undefined || opts.apiKey !== undefined) {
+        throw new SetupError('--provider and --api-key were removed: Bridge sends all email through its own provider, so there is ' +
+            'no provider or API key to configure (the Bridge API has never accepted one). ' +
+            `Pass only --from-address and/or --from-name.${NOT_SAVED}`, 'EMAIL_PROVIDER_NOT_SUPPORTED');
+    }
+    const { fromAddress, fromName } = opts;
+    if (fromAddress === undefined && fromName === undefined) {
+        throw invalid('Nothing to set: pass --from-address, --from-name, or both.');
+    }
+    if (fromAddress !== undefined && !EMAIL.test(fromAddress)) {
+        throw invalid('--from-address must be an email address, e.g. "no-reply@example.com".');
+    }
+    if (fromName !== undefined && fromName.trim() === '') {
+        throw invalid('--from-name must not be empty.');
+    }
+    const update = {};
+    if (fromAddress !== undefined)
+        update.emailSenderEmail = fromAddress;
+    if (fromName !== undefined)
+        update.emailSenderName = fromName;
+    const app = await getManagementClient().app.update(update);
+    return {
+        configured: true,
+        emailSenderEmail: app.emailSenderEmail ?? null,
+        emailSenderName: app.emailSenderName ?? null,
+        app,
+    };
+}
+/** Accepted only to refuse it with an explanation instead of commander's bare "unknown option". */
+const removed = (flags, description) => new Option(flags, description).hideHelp();
 export function registerSetupCommands(program) {
     const setup = program.command('setup').description('Run setup workflows (multi-step operations)');
     setup.command('sso')
-        .description('Enable an SSO provider and get callback URL')
-        .requiredOption('--provider <provider>', 'SSO provider: google, azure, github, linkedin, facebook, saml, oidc')
-        .option('--client-id <id>', 'OAuth client ID')
-        .option('--client-secret <secret>', 'OAuth client secret')
-        .option('--metadata-url <url>', 'SAML metadata URL')
-        .option('--discovery-url <url>', 'OIDC discovery URL')
+        .description('Enable an SSO login provider and get the callback URL to register with it')
+        .requiredOption('--provider <provider>', `SSO provider: ${SUPPORTED} (SAML/OIDC are set up in the Bridge admin UI)`)
+        .requiredOption('--client-id <id>', 'OAuth client ID from the provider console')
+        .requiredOption('--client-secret <secret>', 'OAuth client secret from the provider console')
+        .option('--tenant-id <id>', 'azure only, required: Entra ID Directory (tenant) ID (not a Bridge tenant)')
+        .addOption(removed('--metadata-url <url>', 'removed: SAML is not supported by the Bridge API'))
+        .addOption(removed('--discovery-url <url>', 'removed: OIDC is not supported by the Bridge API'))
         .action(async (opts) => {
         try {
-            outputSuccess(await getManagementClient().workflows.setupSSO({
-                provider: opts.provider,
-                config: {
-                    clientId: opts.clientId,
-                    clientSecret: opts.clientSecret,
-                    metadataUrl: opts.metadataUrl,
-                    discoveryUrl: opts.discoveryUrl,
-                },
-            }));
+            outputSuccess(await setupSso(opts));
         }
         catch (err) {
             outputError(err);
@@ -41,21 +149,14 @@ export function registerSetupCommands(program) {
         }
     });
     setup.command('communication')
-        .description('Configure email/communication provider')
-        .requiredOption('--provider <provider>', 'Provider name (e.g., sendgrid)')
-        .requiredOption('--api-key <key>', 'Provider API key')
-        .option('--from-address <email>', 'Sender email address')
-        .option('--from-name <name>', 'Sender name')
+        .description("Set the sender name and address of your app's emails (sent through Bridge's own email provider)")
+        .option('--from-address <email>', 'Sender email address. A new address is verified by email before Bridge uses it')
+        .option('--from-name <name>', 'Sender display name')
+        .addOption(removed('--provider <provider>', 'removed: email goes through Bridge\'s own provider'))
+        .addOption(removed('--api-key <key>', 'removed: email goes through Bridge\'s own provider'))
         .action(async (opts) => {
         try {
-            outputSuccess(await getManagementClient().workflows.setupCommunication({
-                provider: opts.provider,
-                config: {
-                    apiKey: opts.apiKey,
-                    fromAddress: opts.fromAddress,
-                    fromName: opts.fromName,
-                },
-            }));
+            outputSuccess(await setupCommunication(opts));
         }
         catch (err) {
             outputError(err);

package/dist/commands/setup.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.command.js","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG1D,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC;IAElG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;SACjB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,cAAc,CAAC,uBAAuB,EAAE,qEAAqE,CAAC;SAC9G,MAAM,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;SACnD,MAAM,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC3D,QAAQ,EAAE,IAAI,CAAC,QAAuB;gBACtC,MAAM,EAAE;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;aACF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SACtB,WAAW,CAAC,4CAA4C,CAAC;SACzD,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACzD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC;gBAChE,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;SAC3B,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;SACzE,cAAc,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SACrD,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;SACxD,MAAM,CAAC,oBAAoB,EAAE,aAAa,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC;gBACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE;oBACN,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB;aACF,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"setup.command.js","sourceRoot":"","sources":["../../src/commands/setup.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,MAAM,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACtG,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAC9G,QAAQ,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAC9G,KAAK,EAAE;QACL,QAAQ,EAAE,0BAA0B;QACpC,YAAY,EAAE,8BAA8B;QAC5C,QAAQ,EAAE,0BAA0B;QACpC,MAAM,EAAE,mBAAmB;KAC5B;CACO,CAAC;AAQX,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxD,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAE3C,sEAAsE;AACtE,MAAM,OAAO,UAAW,SAAQ,KAAK;IACG;IAAtC,YAAY,OAAe,EAAW,IAAY;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAQ;QAEhD,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;AACxC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAE7F,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACvE,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAqB;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;YACxC,CAAC,CAAC,iBAAiB,QAAQ,0EAA0E;gBACnG,oEAAoE,SAAS,IAAI,SAAS,EAAE;YAC9F,CAAC,CAAC,yBAAyB,QAAQ,iBAAiB,SAAS,IAAI,SAAS,EAAE,EAC9E,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAU,EAAE,CAAC;QACpH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,GAAG,IAAI,sGAAsG,SAAS,EAAE,EACxH,4BAA4B,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,CAAC,2EAA2E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,WAAW,GAA6C;QAC5D,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ;QAChC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY;KACzC,CAAC;IACF,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,OAAO,CAAC,wFAAwF,CAAC,CAAC;QAC1G,CAAC;QACD,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,CAAC,2CAA2C,QAAQ,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAA6C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACnF,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAEjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,UAAU,CAClB,sGAAsG;YACpG,+EAA+E;YAC/E,+CAA+C,SAAS,EAAE,EAC5D,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACvC,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,MAAM,OAAO,CAAC,uEAAuE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,OAAO,CAAC,gCAAgC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAA4D,EAAE,CAAC;IAC3E,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,gBAAgB,GAAG,WAAW,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3D,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,IAAI;QAC9C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AAElG,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,6CAA6C,CAAC,CAAC;IAElG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;SACjB,WAAW,CAAC,2EAA2E,CAAC;SACxF,cAAc,CAAC,uBAAuB,EAAE,iBAAiB,SAAS,gDAAgD,CAAC;SACnH,cAAc,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SAC/E,cAAc,CAAC,0BAA0B,EAAE,+CAA+C,CAAC;SAC3F,MAAM,CAAC,kBAAkB,EAAE,4EAA4E,CAAC;SACxG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,kDAAkD,CAAC,CAAC;SAC9F,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,kDAAkD,CAAC,CAAC;SAC/F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;SACtB,WAAW,CAAC,4CAA4C,CAAC;SACzD,cAAc,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACzD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC;gBAChE,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;SAC3B,WAAW,CAAC,iGAAiG,CAAC;SAC9G,MAAM,CAAC,wBAAwB,EAAE,gFAAgF,CAAC;SAClH,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACnD,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,oDAAoD,CAAC,CAAC;SACjG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;SAC3F,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/stripe.command.d.ts

@@ -1,3 +1,39 @@
 import { Command } from 'commander';
+export interface ServerCredentialsState {
+    stripeCredentialsAdded: boolean;
+    /** TBP-658. Optional: older account APIs do not send it. */
+    stripeWebhookConfigured?: boolean;
+    azureMarketplaceCredentialsAdded: boolean;
+    azureAdSsoCredentialsAdded: boolean;
+    linkedinSsoCredentialsAdded: boolean;
+    googleSsoCredentialsAdded: boolean;
+    appleSsoCredentialsAdded: boolean;
+    githubSsoCredentialsAdded: boolean;
+    facebookSsoCredentialsAdded: boolean;
+}
+/** Webhook health fields on the app response (TBP-658). All optional: older APIs omit them. */
+export interface ServerAppStripeState {
+    stripeSetupStatus?: 'pending' | 'completed' | 'failed' | null;
+    stripeSetupError?: string | null;
+    stripeLastWebhookAt?: string | null;
+    stripeLastWebhookRejectedAt?: string | null;
+    stripeLastWebhookRejectionReason?: string | null;
+}
+/** `true` only when the server confirms stored Stripe keys; never undefined. */
+export declare function stripeConnectedFrom(state: unknown): boolean;
+/** `null` when the API does not report it (older account API), so absence is not read as broken. */
+export declare function stripeWebhookConfiguredFrom(state: unknown): boolean | null;
+export interface StripeStatus {
+    connected: boolean;
+    webhookConfigured: boolean | null;
+    webhookHealthy: boolean | null;
+    lastWebhookAt: string | null;
+    lastWebhookRejectedAt: string | null;
+    lastWebhookRejectionReason: string | null;
+    setupStatus: string | null;
+    setupError: string | null;
+    message: string;
+}
+export declare function stripeStatusFrom(state: unknown, app: unknown): StripeStatus;
 export declare function registerStripeCommands(program: Command): void;
 //# sourceMappingURL=stripe.command.d.ts.map

package/dist/commands/stripe.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.command.d.ts","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmC7D"}
+{"version":3,"file":"stripe.command.d.ts","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,MAAM,WAAW,sBAAsB;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,4DAA4D;IAC5D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gCAAgC,EAAE,OAAO,CAAC;IAC1C,0BAA0B,EAAE,OAAO,CAAC;IACpC,2BAA2B,EAAE,OAAO,CAAC;IACrC,yBAAyB,EAAE,OAAO,CAAC;IACnC,wBAAwB,EAAE,OAAO,CAAC;IAClC,yBAAyB,EAAE,OAAO,CAAC;IACnC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC;IAC9D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,gCAAgC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClD;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,oGAAoG;AACpG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAG1E;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,YAAY,CAuB3E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqC7D"}

package/dist/commands/stripe.command.js

@@ -1,18 +1,71 @@
 import { getManagementClient } from '../config.js';
 import { outputSuccess, outputError } from '../output.js';
+/** `true` only when the server confirms stored Stripe keys; never undefined. */
+export function stripeConnectedFrom(state) {
+    return state?.stripeCredentialsAdded === true;
+}
+/** `null` when the API does not report it (older account API), so absence is not read as broken. */
+export function stripeWebhookConfiguredFrom(state) {
+    const value = state?.stripeWebhookConfigured;
+    return typeof value === 'boolean' ? value : null;
+}
+const CONNECT_HINT = 'run: bridge stripe connect --secret-key sk_... --publishable-key pk_...';
+const REPAIR_HINT = 'Checkout still works, but subscription changes, cancellations and payment failures are not ' +
+    'reaching Bridge. Repair: re-run `bridge setup payments` with the same keys, or use "Repair ' +
+    'webhook" in the Bridge admin payment settings.';
+/*
+ * Mirrors bridge-api's `AppService._stripeWebhookUnhealthy` plus the two
+ * explicit failure signals. `null` = the API gave us nothing to judge by.
+ */
+function webhookHealthy(configured, app) {
+    if (configured === false || app.stripeSetupStatus === 'failed')
+        return false;
+    const rejectedAt = app.stripeLastWebhookRejectedAt;
+    if (rejectedAt) {
+        const lastAt = app.stripeLastWebhookAt;
+        if (!lastAt || new Date(rejectedAt).getTime() > new Date(lastAt).getTime())
+            return false;
+    }
+    return configured;
+}
+export function stripeStatusFrom(state, app) {
+    const a = (app ?? {});
+    const connected = stripeConnectedFrom(state);
+    const webhookConfigured = stripeWebhookConfiguredFrom(state);
+    const healthy = connected ? webhookHealthy(webhookConfigured, a) : null;
+    let message;
+    if (!connected)
+        message = `Stripe is not connected — ${CONNECT_HINT}`;
+    else if (healthy === false)
+        message = `Stripe is connected, but its webhook is not working. ${REPAIR_HINT}`;
+    else if (healthy === null)
+        message = 'Stripe is connected (webhook health not reported by this API)';
+    else
+        message = 'Stripe is connected and its webhook is configured';
+    return {
+        connected,
+        webhookConfigured,
+        webhookHealthy: healthy,
+        lastWebhookAt: a.stripeLastWebhookAt ?? null,
+        lastWebhookRejectedAt: a.stripeLastWebhookRejectedAt ?? null,
+        lastWebhookRejectionReason: a.stripeLastWebhookRejectionReason ?? null,
+        setupStatus: a.stripeSetupStatus ?? null,
+        setupError: a.stripeSetupError ?? null,
+        message,
+    };
+}
 export function registerStripeCommands(program) {
     const stripe = program.command('stripe').description('Manage Stripe integration');
     stripe.command('status')
-        .description('Show whether Stripe credentials are configured')
+        .description('Show whether Stripe credentials are configured and whether its webhook works')
         .action(async () => {
         try {
-            const state = await getManagementClient().app.getCredentialsState();
-            outputSuccess({
-                connected: state.hasStripeCredentials,
-                message: state.hasStripeCredentials
-                    ? 'Stripe is connected'
-                    : 'Stripe is not connected — run: bridge stripe connect --secret-key sk_... --publishable-key pk_...',
-            });
+            const client = getManagementClient();
+            const [state, app] = await Promise.all([
+                client.app.getCredentialsState(),
+                client.app.get(),
+            ]);
+            outputSuccess(stripeStatusFrom(state, app));
         }
         catch (err) {
             outputError(err);
@@ -28,12 +81,15 @@ export function registerStripeCommands(program) {
                 stripeSecretKey: opts.secretKey,
                 stripePublicKey: opts.publishableKey,
             });
-            outputSuccess({
-                connected: state.hasStripeCredentials,
-                message: state.hasStripeCredentials
-                    ? 'Stripe connected successfully'
-                    : 'Credentials saved but Stripe did not confirm — check your keys and try again',
-            });
+            const connected = stripeConnectedFrom(state);
+            const webhookConfigured = stripeWebhookConfiguredFrom(state);
+            let message = connected
+                ? 'Stripe connected successfully'
+                : 'Credentials saved but Stripe did not confirm — check your keys and try again';
+            if (connected && webhookConfigured === false) {
+                message += '. Warning: the Stripe webhook is not configured — run `bridge stripe status` for details';
+            }
+            outputSuccess({ connected, webhookConfigured, message });
         }
         catch (err) {
             outputError(err);

package/dist/commands/stripe.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"stripe.command.js","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE1D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACrB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YACpE,aAAa,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,oBAAoB;gBACrC,OAAO,EAAE,KAAK,CAAC,oBAAoB;oBACjC,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,mGAAmG;aACxG,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtB,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;SACtF,cAAc,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9D,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,aAAa,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,oBAAoB;gBACrC,OAAO,EAAE,KAAK,CAAC,oBAAoB;oBACjC,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,8EAA8E;aACnF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"stripe.command.js","sourceRoot":"","sources":["../../src/commands/stripe.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAmC1D,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAQ,KAA4D,EAAE,sBAAsB,KAAK,IAAI,CAAC;AACxG,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,KAAK,GAAI,KAA4D,EAAE,uBAAuB,CAAC;IACrG,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAcD,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAC/F,MAAM,WAAW,GACf,6FAA6F;IAC7F,6FAA6F;IAC7F,gDAAgD,CAAC;AAEnD;;;GAGG;AACH,SAAS,cAAc,CACrB,UAA0B,EAC1B,GAAyB;IAEzB,IAAI,UAAU,KAAK,KAAK,IAAI,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,UAAU,GAAG,GAAG,CAAC,2BAA2B,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,GAAY;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAyB,CAAC;IAC9C,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAExE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,6BAA6B,YAAY,EAAE,CAAC;SACjE,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,GAAG,wDAAwD,WAAW,EAAE,CAAC;SACvG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,GAAG,+DAA+D,CAAC;;QAChG,OAAO,GAAG,mDAAmD,CAAC;IAEnE,OAAO;QACL,SAAS;QACT,iBAAiB;QACjB,cAAc,EAAE,OAAO;QACvB,aAAa,EAAE,CAAC,CAAC,mBAAmB,IAAI,IAAI;QAC5C,qBAAqB,EAAE,CAAC,CAAC,2BAA2B,IAAI,IAAI;QAC5D,0BAA0B,EAAE,CAAC,CAAC,gCAAgC,IAAI,IAAI;QACtE,WAAW,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QACxC,UAAU,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;QACtC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAElF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACrB,WAAW,CAAC,8EAA8E,CAAC;SAC3F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;aACjB,CAAC,CAAC;YACH,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;SACtB,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;SACtF,cAAc,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9D,eAAe,EAAE,IAAI,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,iBAAiB,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,OAAO,GAAG,SAAS;gBACrB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,8EAA8E,CAAC;YACnF,IAAI,SAAS,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;gBAC7C,OAAO,IAAI,0FAA0F,CAAC;YACxG,CAAC;YACD,aAAa,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/prompts/billing/master.md

@@ -127,6 +127,9 @@ If any plan will have a price, connect Stripe **before** setting prices (so each
 bridge stripe status
 ```
 
+If it reports `webhookHealthy: false`, checkout still works but subscription changes, cancellations
+and payment failures will not sync. Tell the developer and follow the repair hint in `message`.
+
 If not connected, ask the developer for their Stripe keys (from `dashboard.stripe.com/apikeys`):
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-cli",
-  "version": "0.5.0",
+  "version": "0.5.1-beta.0",
   "description": "Bridge platform CLI for AI coding agents and developers",
   "author": "Nebulr Group",
   "license": "MIT",