@oneaddress/setup 1.6.0 → 1.6.2

package/dist/index.js

@@ -160,7 +160,7 @@ var require_picocolors = __commonJS({
 });
 
 // src/index.ts
-var import_node_fs7 = require("fs");
+var import_node_fs5 = require("fs");
 
 // node_modules/@clack/prompts/dist/index.mjs
 var import_node_util = require("util");
@@ -830,9 +830,9 @@ var Y2 = ({ indicator: t = "dots" } = {}) => {
 // src/prompts.ts
 var import_node_crypto5 = require("crypto");
 var import_node_net = require("net");
-var import_node_fs5 = require("fs");
+var import_node_fs3 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path5 = require("path");
+var import_node_path4 = require("path");
 
 // src/header.ts
 var R2 = "\x1B[0m";
@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "1.6.0" : "?";
+var WIZARD_VERSION = true ? "1.6.2" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -970,7 +970,7 @@ data.db-shm
     "test":  "tsx scripts/test.ts"
   },
   "dependencies": {
-    "@oneaddress/partner-sdk": "^1.6.3",
+    "@oneaddress/partner-sdk": "^1.8.0",
     "dotenv":  "^16.0.0",
     "express": "^4.18.0",
     "express-rate-limit": "^8.6.2"
@@ -1576,6 +1576,14 @@ async function confirmToOneAddress(dispatch: string, status: 'confirmed' | 'fail
 const app = express();
 app.disable('x-powered-by'); // don't fingerprint the framework
 
+// Trust the reverse proxy / tunnel in front of this server (Cloudflare Tunnel,
+// nginx, a load balancer). It sets X-Forwarded-For, and without this the rate
+// limiter below cannot read the real client IP: express-rate-limit throws
+// ERR_ERL_UNEXPECTED_X_FORWARDED_FOR on the first proxied request. '1' trusts a
+// single hop, which is the usual setup; raise it if you run more proxies in
+// front, or set specific proxy addresses for stricter handling.
+app.set('trust proxy', 1);
+
 // DoS backstop on the public webhook. The endpoint already rejects anything
 // without a valid HMAC (401), but a signature check still costs CPU, so a flood
 // of junk requests is worth bounding. The ceiling is deliberately GENEROUS \u2014
@@ -1590,9 +1598,13 @@ const webhookLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: 'Too many requests' },
 });
+// The limiter is attached ONCE, here on the route's middleware chain (the form
+// CodeQL's missing-rate-limiting query recognises). Do NOT also pass it to
+// app.post below: two references to the same limiter instance count every
+// request twice and silently halve the ceiling.
 app.use('/webhook', webhookLimiter, express.text({ type: 'application/json', limit: '1mb' }));
 
-app.post('/webhook', webhookLimiter, async (req: Request, res: Response) => {
+app.post('/webhook', async (req: Request, res: Response) => {
   const rawBody   = req.body    as string;
   const signature = req.headers['x-oneaddress-signature'] as string ?? '';
   const timestamp = req.headers['x-oneaddress-timestamp'] as string ?? '';
@@ -1667,6 +1679,18 @@ app.post('/webhook', webhookLimiter, async (req: Request, res: Response) => {
     return res.status(200).json({ status });
   }
 
+  // A valid signed request that carries no address payload \u2014 a conformance ping,
+  // or any event added after this receiver was generated \u2014 has already passed
+  // timestamp + signature above, which is exactly what such a probe tests.
+  // Acknowledge it here; only the real dispatch events below require decryption.
+  // A real address.updated that arrives WITHOUT a payload still falls through to
+  // the 422 below, because it IS a dispatch event.
+  const DISPATCH_EVENTS = ['address.updated', 'address.verify', 'address.test', 'address.test-dispatch'];
+  if (!DISPATCH_EVENTS.includes(event)) {
+    console.log(\`[webhook] "\${event}" acknowledged (no address payload to decrypt)\`);
+    return res.status(200).json({ ok: true, skipped: true });
+  }
+
   // 5. Decrypt the address payload. Two shapes possible, exactly one per event:
   //   (a) D5 (2026+): body.session_envelope + body.session_key_share. Under D5,
   //       address.updated no longer carries a cleartext \`customer\` block \u2014
@@ -2039,6 +2063,20 @@ the \`ONEADDRESS_CUSTOMERS\` env var, or point \`loadRoster\` at your real datab
       content: `OA_PARTNER_ID=%%PARTNER_ID%%
 OA_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
 OA_PRIVATE_KEY_PEM="%%PRIVATE_KEY%%"
+
+# Where the confirm callback is POSTed after you apply an address update. This is
+# the CUSTOMER app (oneaddress.io), NOT the partner portal \u2014 /api/confirm lives
+# on the former. Written by the setup wizard.
+ONEADDRESS_API=%%ONEADDRESS_API%%
+
+# Secret that signs the /api/confirm callback. Leave BLANK to reuse
+# OA_WEBHOOK_SECRET (correct for most partners); set it only if your partner has
+# a separate confirm secret in the portal Webhook screen.
+CONFIRM_SECRET=
+
+# Whether this receiver answers the pre-payment account.verify check. The wizard
+# writes your portal declaration here; set "true"/"false" to override.
+VERIFIES_ACCOUNT_REFERENCE=%%VERIFIES_ACCOUNT_REFERENCE%%
 `
     },
     {
@@ -2067,6 +2105,7 @@ Quick start:
   uvicorn app:app --port 3001
 """
 
+import asyncio
 import base64
 import hashlib
 import hmac as hmac_lib
@@ -2099,77 +2138,157 @@ WEBHOOK_SECRET = os.environ["OA_WEBHOOK_SECRET"]
 PRIVATE_KEY    = os.environ["OA_PRIVATE_KEY_PEM"].replace("\\\\n", "\\n")
 DB_PATH        = os.environ.get("DB_PATH", str(Path.cwd() / "data.db"))
 
+# Confirm-callback config. ONEADDRESS_API is the CUSTOMER app (/api/confirm lives
+# there, NOT the partner portal); CONFIRM_SECRET signs the callback and falls
+# back to the webhook secret, which is correct for most partners.
+ONEADDRESS_API = (os.environ.get("ONEADDRESS_API") or "https://oneaddress.io").rstrip("/")
+CONFIRM_SECRET = os.environ.get("CONFIRM_SECRET") or WEBHOOK_SECRET
+
+# Whether this receiver answers the pre-payment account.verify check. The setup
+# wizard bakes your portal declaration into the default below (the %% token
+# renders to the string "true"/"false"); the env var overrides it at runtime.
+_DEFAULT_VERIFIES_ACCOUNT_REFERENCE = ("%%VERIFIES_ACCOUNT_REFERENCE%%" == "true")
+VERIFIES_ACCOUNT_REFERENCE = (
+    os.environ["VERIFIES_ACCOUNT_REFERENCE"].strip().lower() == "true"
+    if os.environ.get("VERIFIES_ACCOUNT_REFERENCE")
+    else _DEFAULT_VERIFIES_ACCOUNT_REFERENCE
+)
+
 app = FastAPI()
 seen_dispatches: set[str] = set()
+# Keeps a reference to fire-and-forget confirm tasks so they aren't garbage-
+# collected before they run (asyncio only holds a weak reference to a task).
+_background_tasks: set[asyncio.Task[Any]] = set()
 
 # \u2500\u2500 SQLite store \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 #
-# Uses Python's stdlib sqlite3 \u2014 no extra package install needed. Two tables
-# mirror the TypeScript scaffold layout exactly so partners with mixed-stack
-# integrations can run the same query against either DB:
+# ROSTER-BASED, mirroring the Go / Java / TypeScript scaffolds. The handler calls
+# _verify_account (pre-payment account check), _verify_address (is your on-file
+# address current?) and _save_address (apply an update) with the identity it
+# DECRYPTED from the payload \u2014 under D5 there is NO cleartext customer block on
+# the wire, so we key on the decrypted account number / verified name, never a
+# cleartext email.
 #
-#   addresses        \u2014 one row per customer (UNIQUE on email); latest address only
+# Two tables:
+#
+#   customers        \u2014 your roster: account number, name, and the address you
+#                      hold on file today. Replace with YOUR customer table.
 #   address_history  \u2014 append-only audit trail of every address.updated event
 #
-# Replace these with your real database (Postgres, MySQL, internal API)
-# when ready to ship. The webhook handler below only calls _save_address()
-# and _verify_address() \u2014 point those at your DB and the rest stays the same.
+# Replace these with your real database (Postgres, MySQL, internal API) when
+# ready to ship. Uses Python's stdlib sqlite3 \u2014 no extra package to install.
 
 _db = sqlite3.connect(DB_PATH, check_same_thread=False, isolation_level=None)
 _db.execute("PRAGMA journal_mode = WAL")
 _db.execute("""
-    CREATE TABLE IF NOT EXISTS addresses (
-        email       TEXT PRIMARY KEY,
-        name        TEXT NOT NULL DEFAULT '',
-        address     TEXT NOT NULL DEFAULT '{}',
-        dispatch_id TEXT,
-        updated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+    CREATE TABLE IF NOT EXISTS customers (
+        account_number TEXT PRIMARY KEY,
+        name           TEXT NOT NULL DEFAULT '',
+        address        TEXT NOT NULL DEFAULT '{}',
+        updated_at     TEXT NOT NULL DEFAULT (datetime('now'))
     )
 """)
 _db.execute("""
     CREATE TABLE IF NOT EXISTS address_history (
-        id          INTEGER PRIMARY KEY AUTOINCREMENT,
-        email       TEXT NOT NULL,
-        name        TEXT NOT NULL DEFAULT '',
-        address     TEXT NOT NULL DEFAULT '{}',
-        dispatch_id TEXT,
-        recorded_at TEXT NOT NULL DEFAULT (datetime('now'))
+        id             INTEGER PRIMARY KEY AUTOINCREMENT,
+        account_number TEXT NOT NULL,
+        address        TEXT NOT NULL DEFAULT '{}',
+        dispatch_id    TEXT,
+        recorded_at    TEXT NOT NULL DEFAULT (datetime('now'))
     )
 """)
 print(f"[db] SQLite database ready -> {DB_PATH}")
 
-def _save_address(email: str, name: str, address: dict[str, Any], dispatch_id: str) -> None:
-    """Persist on address.updated. Upserts addresses + appends history."""
+# Seed a demo roster the first time, so a first update from OneAddress shows as a
+# real change (mismatch -> update -> match) rather than magically already
+# matching. Edit this to your customers, or point _find_customer at your real DB.
+_DEFAULT_ROSTER = [
+    {"account_number": "DEMO-0001", "name": "Test Customer",
+     "address": {"street": "1 Example Street", "suburb": "Sydney", "state": "NSW", "postcode": "2000"}},
+]
+if _db.execute("SELECT COUNT(*) FROM customers").fetchone()[0] == 0:
+    for _c in _DEFAULT_ROSTER:
+        _db.execute(
+            "INSERT INTO customers (account_number, name, address) VALUES (?, ?, ?)",
+            (_c["account_number"], _c["name"], json.dumps(_c["address"], sort_keys=True)))
+    print(f"[store] seeded {len(_DEFAULT_ROSTER)} demo customer(s)")
+
+def _canonical_address(a: dict[str, Any]) -> str:
+    """Order- and case-insensitive canonical form, so two addresses compare equal
+    iff they mean the same thing regardless of key order or casing."""
+    items = sorted(
+        (str(k).lower(), " ".join(str(v).strip().lower().split()))
+        for k, v in a.items()
+        if isinstance(v, str) and v.strip() != ""
+    )
+    return json.dumps(items)
+
+def _find_customer(account_number: str, name: str):
+    """Match on account number first (authoritative), then name. Returns the row
+    (account_number, name, address) or None."""
+    acct = (account_number or "").strip()
+    if acct:
+        row = _db.execute(
+            "SELECT account_number, name, address FROM customers WHERE account_number = ?", (acct,)
+        ).fetchone()
+        if row:
+            return row
+    n = (name or "").strip().lower()
+    if n:
+        row = _db.execute(
+            "SELECT account_number, name, address FROM customers WHERE LOWER(name) = ?", (n,)
+        ).fetchone()
+        if row:
+            return row
+    return None
+
+def _verify_account(account_number: str, name: str, known_names: list[str]) -> str:
+    """Pre-payment account check behind account.verify.
+      'match'      account number found and the name (or a known name) agrees
+      'no_match'   account number found but the name does not agree
+      'no_account' no such account number
+    """
+    acct = (account_number or "").strip()
+    if not acct:
+        return "no_account"
+    row = _db.execute("SELECT name FROM customers WHERE account_number = ?", (acct,)).fetchone()
+    if not row:
+        return "no_account"
+    stored = (row[0] or "").strip().lower()
+    candidates = [c for c in ((v or "").strip().lower() for v in [name, *known_names]) if c]
+    return "match" if stored in candidates else "no_match"
+
+def _save_address(account_number: str, name: str, address: dict[str, Any], dispatch_id: str) -> None:
+    """Persist on address.updated. Upserts the customer's on-file address (keyed
+    on the decrypted account number, falling back to name) + appends history."""
+    acct = (account_number or "").strip() or (name or "").strip()
     address_json = json.dumps(address, sort_keys=True)
     _db.execute("""
-        INSERT INTO addresses (email, name, address, dispatch_id, updated_at)
-        VALUES (?, ?, ?, ?, datetime('now'))
-        ON CONFLICT(email) DO UPDATE SET
-            name        = excluded.name,
-            address     = excluded.address,
-            dispatch_id = excluded.dispatch_id,
-            updated_at  = excluded.updated_at
-    """, (email, name, address_json, dispatch_id))
+        INSERT INTO customers (account_number, name, address, updated_at)
+        VALUES (?, ?, ?, datetime('now'))
+        ON CONFLICT(account_number) DO UPDATE SET
+            name       = excluded.name,
+            address    = excluded.address,
+            updated_at = excluded.updated_at
+    """, (acct, name, address_json))
     _db.execute("""
-        INSERT INTO address_history (email, name, address, dispatch_id, recorded_at)
-        VALUES (?, ?, ?, ?, datetime('now'))
-    """, (email, name, address_json, dispatch_id))
-
-def _verify_address(email: str, address: dict[str, Any]) -> str:
-    """Returns 'match' | 'mismatch' | 'not_found' for an address.verify event."""
-    row = _db.execute("SELECT address FROM addresses WHERE email = ?", (email,)).fetchone()
+        INSERT INTO address_history (account_number, address, dispatch_id, recorded_at)
+        VALUES (?, ?, ?, datetime('now'))
+    """, (acct, address_json, dispatch_id))
+
+def _verify_address(account_number: str, name: str, address: dict[str, Any]) -> str:
+    """Returns 'match' | 'mismatch' | 'not_found' for an address.verify event.
+    Compares the WHOLE address canonically against the on-file record. A customer
+    on your roster you have never updated returns 'mismatch' \u2014 you know them, you
+    just don't hold THIS address yet."""
+    row = _find_customer(account_number, name)
     if not row:
         return "not_found"
     try:
-        stored = json.loads(row[0])
+        stored = json.loads(row[2])
     except (json.JSONDecodeError, TypeError):
-        return "not_found"
-    # Compare all address fields the partner cares about. Address.verify
-    # ignores fields the consumer didn't supply (e.g. country missing on the
-    # incoming check is treated as "any country acceptable") \u2014 partners that
-    # need stricter matching should adjust this comparison.
-    matches = all(stored.get(k) == v for k, v in address.items())
-    return "match" if matches else "mismatch"
+        stored = {}
+    return "match" if _canonical_address(stored) == _canonical_address(address) else "mismatch"
 
 # \u2500\u2500 Crypto helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
@@ -2291,6 +2410,61 @@ def _decrypt_session(share: dict[str, Any], envelope_b64: str,
     plaintext = AESGCM(sk).decrypt(session_iv, session_ct, None)
     return json.loads(plaintext)  # type: ignore[return-value]
 
+# \u2500\u2500 Confirm callback \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+async def _confirm_to_oneaddress(dispatch: str, status: str) -> None:
+    """Close the loop after an address.updated apply, so the consumer's dashboard
+    flips the service to 'Confirmed'. Scheduled as a background task
+    (fire-and-forget) so a slow confirm never delays the webhook's own 200 \u2014 a
+    slow confirm must not make OneAddress time the DISPATCH out and mark it failed.
+
+    Only real dispatches carry a POSITIVE-INTEGER id in X-OneAddress-Dispatch;
+    probes (the go-live 'address.test') carry a non-numeric id and have nothing to
+    confirm, so they are skipped.
+
+    Auth for /api/confirm (all three required):
+      Authorization: Bearer <secret>
+      X-OneAddress-Timestamp: <unix seconds>
+      X-OneAddress-Signature: HMAC-SHA256(secret, "<timestamp>.<rawBody>")
+    The same secret signs the Bearer and the body, over the EXACT bytes POSTed.
+    """
+    d = (dispatch or "").strip()
+    if not d.isdigit() or int(d) <= 0:
+        return
+    dispatch_id = int(d)
+    body_str = json.dumps({
+        "dispatch_id": dispatch_id,
+        "partner_id":  PARTNER_ID,
+        "status":      status,
+        "note":        "Applied by the OneAddress webhook receiver",
+    })
+    ts  = str(int(time.time()))
+    sig = hmac_lib.new(CONFIRM_SECRET.encode(), f"{ts}.{body_str}".encode(), hashlib.sha256).hexdigest()
+    try:
+        async with httpx.AsyncClient(timeout=10) as client:
+            # content= sends these exact bytes \u2014 the ones we signed. Do NOT use
+            # json=, which would re-serialise and break the signature.
+            resp = await client.post(
+                f"{ONEADDRESS_API}/api/confirm",
+                content=body_str,
+                headers={
+                    "Content-Type": "application/json",
+                    "Authorization": f"Bearer {CONFIRM_SECRET}",
+                    "X-OneAddress-Timestamp": ts,
+                    "X-OneAddress-Signature": sig,
+                },
+            )
+        if resp.status_code // 100 == 2:
+            print(f"[confirm] dispatch {dispatch_id} -> {status}: acknowledged by OneAddress")
+        else:
+            print(f"[confirm] dispatch {dispatch_id} confirm FAILED \u2014 HTTP {resp.status_code}")
+            if resp.status_code == 401:
+                print("[confirm] 401 means the wrong secret. If your partner has a separate "
+                      "confirm secret, set CONFIRM_SECRET to it (from the portal Webhook screen); "
+                      "otherwise your webhook signing secret should work.")
+    except Exception as e:
+        print(f"[confirm] confirm request error: {e}")
+
 # \u2500\u2500 Webhook handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
 @app.post("/webhook")
@@ -2313,8 +2487,47 @@ async def webhook(request: Request) -> Response:
 
     if dispatch and dispatch in seen_dispatches:
         return Response(content='{"ok":true,"duplicate":true}', media_type="application/json")
-    if dispatch:
-        seen_dispatches.add(dispatch)
+    # A dispatch is remembered only AFTER it has been fully handled (see the
+    # success paths below), never here. Remembering on arrival would mark a
+    # dispatch that then fails to decrypt (422) as "seen", so OneAddress's retry
+    # after you fix the key would be dismissed as a duplicate and the update lost.
+    # The address.test probe is never remembered, so re-running go-live re-tests.
+
+    # \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    # Carries an encrypted CUSTOMER block { name, known_names, account_number } \u2014
+    # no address, no session envelope \u2014 handled HERE, ABOVE the payload-less
+    # acknowledge below (account.verify is not a dispatch event, so it would
+    # otherwise be acknowledged as "no payload" and never actually check).
+    if event == "account.verify":
+        if not VERIFIES_ACCOUNT_REFERENCE:
+            print("[webhook] account.verify -> skipped (VERIFIES_ACCOUNT_REFERENCE is false)")
+            return Response(content='{"ok":true,"skipped":true}', media_type="application/json")
+        enc_cust = body.get("customer_encrypted")
+        if not isinstance(enc_cust, dict):
+            return Response(status_code=400, content='{"error":"Missing customer_encrypted"}',
+                            media_type="application/json")
+        try:
+            cust = _decrypt_address(enc_cust, PRIVATE_KEY, PARTNER_ID)
+        except Exception as e:
+            print(f"[webhook] account.verify decryption failed \u2014 check OA_PRIVATE_KEY_PEM: {e}")
+            return Response(status_code=422, content='{"ok":false,"error":"decryption_failed"}',
+                            media_type="application/json")
+        acct  = str(cust.get("account_number") or "")
+        cname = str(cust.get("name") or "")
+        ckn   = cust.get("known_names") or []
+        ckn   = [str(k) for k in ckn] if isinstance(ckn, list) else []
+        status = _verify_account(acct, cname, ckn)
+        print(f"[webhook] account.verify -> {status} for account {acct or '(none)'}")
+        return Response(content=json.dumps({"status": status}), media_type="application/json")
+
+    # A valid signed request that carries no address payload \u2014 a conformance
+    # ping, or any event added after this receiver was generated \u2014 has already
+    # passed timestamp + signature above, which is exactly what such a probe
+    # tests. Acknowledge it here; only the real dispatch events below require
+    # decryption. A real address.updated with no payload still 422s below.
+    if event not in ("address.updated", "address.verify", "address.test", "address.test-dispatch"):
+        print(f"[webhook] '{event}' acknowledged (no address payload to decrypt)")
+        return Response(content='{"ok":true,"skipped":true}', media_type="application/json")
 
     # Two possible payload shapes:
     #   (a) D5  \u2014 body.session_envelope (str) + body.session_key_share (dict)
@@ -2325,15 +2538,20 @@ async def webhook(request: Request) -> Response:
     session_share    = body.get("session_key_share")
     legacy_enc       = body.get("address_encrypted")
 
-    # Decrypted display name, captured for the connection-verification probe
-    # below. Identity comes ONLY from decryption, never a cleartext wire field.
+    # Identity comes ONLY from decryption, never a cleartext wire field: under D5
+    # the name / account number / known names live INSIDE the decrypted payload.
     verified_name = ""
+    account_number = ""
+    known_names: list[str] = []
 
     if isinstance(session_envelope, str) and isinstance(session_share, dict):
         try:
             data = _decrypt_session(session_share, session_envelope, PRIVATE_KEY, PARTNER_ID)
             address = data.get("new_address", {})
             verified_name = data.get("verified_name", "") or ""
+            account_number = data.get("account_number", "") or ""
+            _kn = data.get("known_names", [])
+            known_names = [str(x) for x in _kn] if isinstance(_kn, list) else []
         except Exception as e:
             print(f"[webhook] D5 decryption failed \u2014 check OA_PRIVATE_KEY_PEM matches key_id "
                   f"{session_share.get('key_id', '?')}: {e}")
@@ -2343,6 +2561,9 @@ async def webhook(request: Request) -> Response:
         try:
             address = _decrypt_address(legacy_enc, PRIVATE_KEY, PARTNER_ID)
             verified_name = address.get("fullName", "") or ""
+            account_number = address.get("accountReference", "") or ""
+            _kn = address.get("knownNames", [])
+            known_names = [str(x) for x in _kn] if isinstance(_kn, list) else []
         except Exception as e:
             print(f"[webhook] Decryption error (check OA_PRIVATE_KEY_PEM): {e}")
             return Response(content='{"ok":false,"error":"decryption failed - partner key mismatch"}',
@@ -2352,18 +2573,24 @@ async def webhook(request: Request) -> Response:
                         media_type="application/json")
 
     if event == "address.updated":
-        customer = body.get("customer", {})
-        email = customer.get("email", "")
-        name  = customer.get("name", "")
-        # Log metadata only \u2014 never the decrypted address. stdout is captured
-        # by uvicorn / Docker / systemd-journal in production and writing PII
-        # to those streams turns every log reader into a data-exposure surface.
-        print(f"[webhook] address.updated for {email or '?'} (dispatch={dispatch})")
-        if email:
-            _save_address(email, name, address, dispatch)
+        # Identity comes ONLY from decryption \u2014 there is no cleartext customer
+        # block on the wire under D5. Log metadata only \u2014 never the decrypted
+        # address. stdout is captured by uvicorn / Docker / systemd-journal in
+        # production and writing PII there turns every log reader into a
+        # data-exposure surface.
+        print(f"[webhook] address.updated for {account_number or verified_name or '?'} (dispatch={dispatch})")
+        _save_address(account_number, verified_name, address, dispatch)
+        if dispatch:
+            seen_dispatches.add(dispatch)  # remember only after it is stored
+        # Close the loop back to OneAddress so the service flips to "Confirmed".
+        # Fire-and-forget so it never delays this 200 (keep a reference so the
+        # task isn't garbage-collected before it runs).
+        _t = asyncio.create_task(_confirm_to_oneaddress(dispatch, "confirmed"))
+        _background_tasks.add(_t)
+        _t.add_done_callback(_background_tasks.discard)
+        return Response(content='{"ok":true}', media_type="application/json")
 
     elif event == "address.verify":
-        customer      = body.get("customer", {})
         callback_url  = body["callback_url"]
         callback_token= body["callback_token"]
         batch_id      = body["batch_id"]
@@ -2379,17 +2606,16 @@ async def webhook(request: Request) -> Response:
                             content='{"error":"Invalid callback_url host"}',
                             media_type="application/json")
 
-        # Real DB lookup \u2014 mirrors the TypeScript scaffold's verifyAddress.
-        # Returns "not_found" for a fresh DB (no prior address.updated for
-        # this email), "match" / "mismatch" once the customer is on file.
-        email  = customer.get("email", "")
-        result = _verify_address(email, address) if email else "not_found"
-        print(f"[webhook] address.verify -> {result} for {email or '?'}")
+        # Real roster lookup \u2014 identity comes ONLY from decryption. "not_found"
+        # for a customer not on your roster, "match" / "mismatch" otherwise.
+        result = _verify_address(account_number, verified_name, address)
+        print(f"[webhook] address.verify -> {result} for {account_number or verified_name or '?'}")
 
         payload = {
+            # 2026.2 \u2014 no member_name echo; OneAddress keys the result on
+            # (batch_id, partner_id) and validates the opaque token alone.
             "batch_id":    batch_id,
             "partner_id":  PARTNER_ID,
-            "member_name": customer.get("name", ""),
             "result":      result,
             "token":       callback_token,
         }
@@ -2398,6 +2624,8 @@ async def webhook(request: Request) -> Response:
                 await client.post(callback_url, json=payload)
         except Exception as e:
             print(f"[webhook] Callback POST failed: {e}")
+        if dispatch:
+            seen_dispatches.add(dispatch)  # remember only after the callback posted
 
     elif event in ("address.test", "address.test-dispatch"):
         # OneAddress connection-verification probe. Reaching here means the D5
@@ -2445,24 +2673,27 @@ Your webhook endpoint: \`POST http://localhost:3001/webhook\`
 
 ## Events handled
 
+### account.verify (pre-payment account check)
+Receive \u2192 verify HMAC \u2192 decrypt the customer block \u2192 \`_verify_account\` \u2192
+answer \`match\` / \`no_match\` / \`no_account\`. Gated on \`VERIFIES_ACCOUNT_REFERENCE\`
+(the wizard writes your portal declaration): when off, the receiver answers
+\`{ "ok": true, "skipped": true }\` ("not checked").
+
 ### address.updated
-Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 \`_save_address\` (roster upsert + history) \u2192
+fire-and-forget \`/api/confirm\` callback so the consumer's dashboard flips the
+service to "Confirmed".
 
 ### address.verify
-Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to your records \u2192 POST callback_url.
-
-The stub in \`app.py\` always returns \`"match"\`. Replace it with a real DB lookup:
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 \`_verify_address\` against your roster \u2192 POST
+\`callback_url\`.
 
-\`\`\`python
-# In the address.verify branch of app.py, replace:
-result = "match"
-
-# With something like:
-record = db.get_customer(customer.get("email"))
-result = "not_found" if not record else (
-    "match" if addresses_match(record.address, address) else "mismatch"
-)
-\`\`\`
+\`app.py\` ships a **working roster store** (SQLite, seeded with one demo
+customer), not a stub \u2014 \`_verify_address\` does a real lookup and returns
+\`"match"\` / \`"mismatch"\` / \`"not_found"\`, keyed on the account number and name
+the payload was **decrypted** to (there is no cleartext customer block on the
+wire under D5). Point \`_find_customer\` / \`_save_address\` at your real customer
+database when you outgrow the file.
 
 Valid results: \`"match"\` | \`"mismatch"\` | \`"not_found"\`
 
@@ -2474,7 +2705,17 @@ npx @oneaddress/conformance test %%WEBHOOK_URL%%
 
 ## Configuration
 
-Credentials are in \`.env\` (written by the setup wizard). Never commit \`.env\` to source control.
+Credentials and config are in \`.env\` (written by the setup wizard). Never commit
+\`.env\` to source control.
+
+| Env var | Description |
+|---------|-------------|
+| \`OA_PARTNER_ID\` | Your partner UUID |
+| \`OA_WEBHOOK_SECRET\` | HMAC-SHA256 webhook signing secret |
+| \`OA_PRIVATE_KEY_PEM\` | PKCS#8 PEM key \u2014 \`\\n\` between PEM lines |
+| \`ONEADDRESS_API\` | Confirm-callback target \u2014 the customer app (default \`https://oneaddress.io\`), NOT the partner portal |
+| \`CONFIRM_SECRET\` | Signs the \`/api/confirm\` callback. Leave blank to reuse \`OA_WEBHOOK_SECRET\` |
+| \`VERIFIES_ACCOUNT_REFERENCE\` | Whether the receiver answers \`account.verify\` (\`true\`/\`false\`) |
 `
     }
   ],
@@ -2604,6 +2845,27 @@ public final class OneAddressVerifier {
         }
     }
 
+    /**
+     * HMAC-SHA256 of {@code payload} under {@code secret}, lowercase hex. Used to
+     * SIGN the /api/confirm callback, over "&lt;timestamp&gt;.&lt;rawBody&gt;" \u2014 the
+     * same construction {@link #verify} checks on the way in.
+     */
+    public static String sign(String payload, String secret) {
+        try {
+            Mac mac = Mac.getInstance("HmacSHA256");
+            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
+            byte[] out = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
+            StringBuilder sb = new StringBuilder(out.length * 2);
+            for (byte b : out) {
+                sb.append(Character.forDigit((b >> 4) & 0xF, 16));
+                sb.append(Character.forDigit(b & 0xF, 16));
+            }
+            return sb.toString();
+        } catch (Exception e) {
+            throw new IllegalStateException("HMAC signing failed", e);
+        }
+    }
+
     private static byte[] hexToBytes(String hex) {
         int len = hex.length();
         byte[] out = new byte[len / 2];
@@ -2861,9 +3123,19 @@ public class OneAddressWebhookController {
         this.store = store;
     }
 
+    // Baked in by the setup wizard from your portal declaration
+    // (partners.verifies_account_reference). Decides whether this receiver
+    // ANSWERS the pre-payment account.verify check. Override with the
+    // VERIFIES_ACCOUNT_REFERENCE env var ("true"/"false").
+    private static final boolean DEFAULT_VERIFIES_ACCOUNT_REFERENCE = %%VERIFIES_ACCOUNT_REFERENCE%%;
+
     private String webhookSecret;
     private String privateKeyPem;
     private String partnerId;
+    // Confirm-callback config.
+    private String oneAddressApi;
+    private String confirmSecret;
+    private boolean verifiesAccountReference;
 
     @PostConstruct
     void init() {
@@ -2879,6 +3151,22 @@ public class OneAddressWebhookController {
         partnerId = System.getenv("ONEADDRESS_PARTNER_ID");
         if (partnerId == null || partnerId.isBlank())
             throw new IllegalStateException("ONEADDRESS_PARTNER_ID is required");
+
+        // ONEADDRESS_API is the CUSTOMER app (/api/confirm lives there, NOT the
+        // partner portal); default to production.
+        String api = System.getenv("ONEADDRESS_API");
+        oneAddressApi = (api == null || api.isBlank()) ? "https://oneaddress.io" : api.trim();
+        while (oneAddressApi.endsWith("/")) oneAddressApi = oneAddressApi.substring(0, oneAddressApi.length() - 1);
+
+        // CONFIRM_SECRET signs the callback; falls back to the webhook secret,
+        // which is correct for most partners.
+        String cs = System.getenv("CONFIRM_SECRET");
+        confirmSecret = (cs == null || cs.isBlank()) ? webhookSecret : cs;
+
+        String vr = System.getenv("VERIFIES_ACCOUNT_REFERENCE");
+        verifiesAccountReference = (vr == null || vr.isBlank())
+            ? DEFAULT_VERIFIES_ACCOUNT_REFERENCE
+            : vr.equals("true");
     }
 
     @PostMapping("/oneaddress")
@@ -2903,6 +3191,44 @@ public class OneAddressWebhookController {
             Map<String, Object> body = MAPPER.readValue(rawBody, Map.class);
             String event = (String) body.get("event");
 
+            // \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+            // Carries an encrypted CUSTOMER block { name, known_names,
+            // account_number } \u2014 no address, no session envelope \u2014 handled HERE,
+            // before the address-decrypt section below (account.verify carries no
+            // address_encrypted, so it would otherwise fall to the "no encrypted
+            // payload" acknowledge and never actually check the account).
+            if ("account.verify".equals(event)) {
+                // Your portal declaration, baked in by the wizard. If you do not
+                // verify account references, answer "not checked".
+                if (!verifiesAccountReference) {
+                    log.info("[OneAddress] account.verify -> skipped (VERIFIES_ACCOUNT_REFERENCE is false)");
+                    return ResponseEntity.ok("{\\"ok\\":true,\\"skipped\\":true}");
+                }
+                @SuppressWarnings("unchecked")
+                Map<String, Object> custEnc = (body.get("customer_encrypted") instanceof Map cm)
+                    ? (Map<String, Object>) cm : null;
+                if (custEnc == null)
+                    return ResponseEntity.badRequest().body("{\\"error\\":\\"Missing customer_encrypted\\"}");
+                Map<String, Object> cust;
+                try {
+                    cust = OneAddressDecryptor.decrypt(custEnc, privateKeyPem, partnerId);
+                } catch (Exception e) {
+                    log.error("[OneAddress] account.verify decryption failed \u2014 check ONEADDRESS_PRIVATE_KEY", e);
+                    return ResponseEntity.unprocessableEntity().body("{\\"ok\\":false,\\"error\\":\\"decryption_failed\\"}");
+                }
+                String acct = cust.get("account_number") instanceof String an2 ? an2 : null;
+                String acctName = cust.get("name") instanceof String nm2 ? nm2 : "";
+                java.util.List<String> acctKnownNames = java.util.List.of();
+                if (cust.get("known_names") instanceof java.util.List<?> aknl) {
+                    java.util.ArrayList<String> tmp = new java.util.ArrayList<>();
+                    for (Object o : aknl) if (o != null) tmp.add(String.valueOf(o));
+                    acctKnownNames = tmp;
+                }
+                String accountStatus = store.verifyAccount(acct, acctName, acctKnownNames);
+                log.info("[OneAddress] account.verify -> {} for account {}", accountStatus, acct == null ? "(none)" : acct);
+                return ResponseEntity.ok("{\\"status\\":\\"" + accountStatus + "\\"}");
+            }
+
             // Two possible payload shapes:
             //   (a) D5  \u2014 body.session_envelope (String) + body.session_key_share (Map)
             //   (b) Legacy \u2014 body.address_encrypted (Map)
@@ -2971,6 +3297,10 @@ public class OneAddressWebhookController {
                 // will never retry.
                 String outcome = store.applyAddress(accountNumber, verifiedName, knownNames, address);
                 if (dispatchId != null && !dispatchId.isBlank()) store.markProcessed(dispatchId, outcome);
+                // Close the loop back to OneAddress so the service flips to
+                // "Confirmed". Fire-and-forget (async) so a slow confirm never
+                // delays this 200. Only when we actually applied the update.
+                if ("applied".equals(outcome)) confirmToOneAddress(dispatchId, "confirmed");
                 return ResponseEntity.ok("{\\"ok\\":true,\\"outcome\\":\\"" + outcome + "\\"}");
             } else if ("address.verify".equals(event)) {
                 handleAddressVerify(body, address, accountNumber, verifiedName, knownNames);
@@ -3049,6 +3379,67 @@ public class OneAddressWebhookController {
         }
     }
 
+    /**
+     * Close the loop after an address.updated is applied, so the consumer's
+     * dashboard flips the service to "Confirmed". Runs on a background thread
+     * (CompletableFuture.runAsync) so a slow confirm never delays the webhook's
+     * own 200 \u2014 a slow confirm must not make OneAddress time the DISPATCH out and
+     * mark it failed.
+     *
+     * Only real dispatches carry a POSITIVE-INTEGER id in X-OneAddress-Dispatch;
+     * probes (the go-live "address.test") carry a non-numeric id and have nothing
+     * to confirm, so they are skipped.
+     *
+     * Auth for /api/confirm (all three required):
+     *   Authorization: Bearer &lt;secret&gt;
+     *   X-OneAddress-Timestamp: &lt;unix seconds&gt;
+     *   X-OneAddress-Signature: HMAC-SHA256(secret, "&lt;timestamp&gt;.&lt;rawBody&gt;")
+     * The same secret signs the Bearer and the body, over the EXACT bytes POSTed.
+     */
+    private void confirmToOneAddress(String dispatch, String status) {
+        final long dispatchId;
+        try {
+            dispatchId = Long.parseLong(dispatch == null ? "" : dispatch.trim());
+        } catch (NumberFormatException e) {
+            return; // probe or non-numeric id \u2014 nothing to confirm
+        }
+        if (dispatchId <= 0) return;
+
+        java.util.concurrent.CompletableFuture.runAsync(() -> {
+            try {
+                java.util.Map<String, Object> confirmBody = new java.util.LinkedHashMap<>();
+                confirmBody.put("dispatch_id", dispatchId);
+                confirmBody.put("partner_id", partnerId);
+                confirmBody.put("status", status);
+                confirmBody.put("note", "Applied by the OneAddress webhook receiver");
+                String bodyStr = MAPPER.writeValueAsString(confirmBody);
+                String ts = String.valueOf(System.currentTimeMillis() / 1000L);
+                String sig = OneAddressVerifier.sign(ts + "." + bodyStr, confirmSecret);
+
+                HttpResponse<String> resp = HttpClient.newHttpClient().send(
+                    HttpRequest.newBuilder()
+                        .uri(URI.create(oneAddressApi + "/api/confirm"))
+                        .header("Content-Type", "application/json")
+                        .header("Authorization", "Bearer " + confirmSecret)
+                        .header("X-OneAddress-Timestamp", ts)
+                        .header("X-OneAddress-Signature", sig)
+                        .POST(HttpRequest.BodyPublishers.ofString(bodyStr))
+                        .build(),
+                    HttpResponse.BodyHandlers.ofString()
+                );
+                if (resp.statusCode() >= 200 && resp.statusCode() < 300) {
+                    log.info("[confirm] dispatch {} -> {}: acknowledged by OneAddress", dispatchId, status);
+                } else {
+                    log.error("[confirm] dispatch {} confirm FAILED \u2014 HTTP {}", dispatchId, resp.statusCode());
+                    if (resp.statusCode() == 401)
+                        log.error("[confirm] 401 means the wrong secret. If your partner has a separate confirm secret, set CONFIRM_SECRET to it (from the portal Webhook screen); otherwise your webhook signing secret should work.");
+                }
+            } catch (Exception e) {
+                log.error("[confirm] confirm request error", e);
+            }
+        });
+    }
+
     private static String getHeader(Map<String, String> headers, String name) {
         for (Map.Entry<String, String> entry : headers.entrySet())
             if (entry.getKey().equalsIgnoreCase(name)) return entry.getValue();
@@ -3290,6 +3681,24 @@ public class OneAddressStore {
         return same ? "match" : "mismatch";
     }
 
+    /**
+     * Pre-payment account check behind account.verify: confirm the typed
+     * account number is really one of yours and the name agrees, BEFORE the
+     * consumer pays.
+     *   "match"      account number found and the name (or a known name) agrees
+     *   "no_match"   account number found but the name does not agree
+     *   "no_account" no such account number
+     */
+    public String verifyAccount(String accountNumber, String verifiedName, List<String> knownNames) {
+        if (accountNumber == null || accountNumber.isBlank()) return "no_account";
+        List<Map<String, Object>> rows = jdbc.queryForList(
+            "SELECT full_name FROM customers WHERE account_number = ?", accountNumber.trim());
+        if (rows.isEmpty()) return "no_account";
+        String storedName = String.valueOf(rows.get(0).get("full_name"));
+        List<String> candidates = allNames(verifiedName, knownNames);
+        return candidates.stream().anyMatch(c -> c.equalsIgnoreCase(storedName)) ? "match" : "no_match";
+    }
+
     // \u2500\u2500 helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
     private static List<String> allNames(String verifiedName, List<String> knownNames) {
@@ -3414,6 +3823,23 @@ name matching needs maiden names, initials and word order \u2014 see
 | \`ONEADDRESS_WEBHOOK_SECRET\` | Webhook secret from the Partner Portal |
 | \`ONEADDRESS_PRIVATE_KEY\` | PKCS#8 PEM private key (use \`\\n\` between lines) |
 | \`ONEADDRESS_PARTNER_ID\` | Your partner UUID |
+| \`ONEADDRESS_API\` | Confirm-callback target \u2014 the customer app (default \`https://oneaddress.io\`), NOT the partner portal |
+| \`CONFIRM_SECRET\` | Signs the \`/api/confirm\` callback. Leave unset to reuse the webhook secret (correct for most partners) |
+| \`VERIFIES_ACCOUNT_REFERENCE\` | Override the wizard's baked-in \`account.verify\` declaration (\`true\`/\`false\`) |
+
+### account.verify
+
+If you verify account references, the receiver decrypts the pre-payment
+\`account.verify\` probe and answers \`match\` / \`no_match\` / \`no_account\` from your
+roster. If not, it answers \`{ "ok": true, "skipped": true }\` ("not checked").
+The setup wizard bakes your portal declaration in; \`VERIFIES_ACCOUNT_REFERENCE\`
+overrides it.
+
+### Confirm callback
+
+After applying an \`address.updated\`, the receiver POSTs \`/api/confirm\` on
+\`ONEADDRESS_API\` (fire-and-forget, HMAC-signed with \`CONFIRM_SECRET\`) so the
+consumer's dashboard flips the service to "Confirmed".
 
 ## Run conformance check
 
@@ -3639,6 +4065,32 @@ public sealed class OneAddressStore
         return same ? "match" : "mismatch";
     }
 
+    /// <summary>
+    /// Pre-payment account check behind account.verify: confirm the typed
+    /// account number is really one of yours and the name agrees, BEFORE the
+    /// consumer pays.
+    ///   "match"      account number found and the name (or a known name) agrees
+    ///   "no_match"   account number found but the name does not agree
+    ///   "no_account" no such account number
+    /// </summary>
+    public string VerifyAccount(string? accountNumber, string verifiedName, List<string> knownNames)
+    {
+        if (string.IsNullOrWhiteSpace(accountNumber)) return "no_account";
+        using var conn = Open();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = "SELECT full_name FROM customers WHERE account_number = $a";
+        cmd.Parameters.AddWithValue("$a", accountNumber.Trim());
+        var v = cmd.ExecuteScalar();
+        if (v is null or DBNull) return "no_account";
+        var storedName = Convert.ToString(v) ?? "";
+
+        var candidates = new List<string>();
+        if (!string.IsNullOrWhiteSpace(verifiedName)) candidates.Add(verifiedName.Trim());
+        candidates.AddRange(knownNames.Where(n => !string.IsNullOrWhiteSpace(n)).Select(n => n.Trim()));
+        return candidates.Any(c => string.Equals(c, storedName, StringComparison.OrdinalIgnoreCase))
+            ? "match" : "no_match";
+    }
+
     /// <summary>
     /// Account number first (authoritative), then name.
     ///
@@ -3729,6 +4181,22 @@ var privateKeyPem = (Environment.GetEnvironmentVariable("ONEADDRESS_PRIVATE_KEY"
     .Replace("\\\\n", "\\n");
 var partnerId = Environment.GetEnvironmentVariable("ONEADDRESS_PARTNER_ID") ?? "";
 
+// Confirm-callback config. ONEADDRESS_API is the CUSTOMER app (/api/confirm
+// lives there, NOT the partner portal); CONFIRM_SECRET signs the callback and
+// falls back to the webhook secret, which is correct for most partners.
+var oneAddressApiRaw = Environment.GetEnvironmentVariable("ONEADDRESS_API");
+var oneAddressApi = string.IsNullOrEmpty(oneAddressApiRaw) ? "https://oneaddress.io" : oneAddressApiRaw.TrimEnd('/');
+var confirmSecret = Environment.GetEnvironmentVariable("CONFIRM_SECRET");
+if (string.IsNullOrEmpty(confirmSecret)) confirmSecret = webhookSecret;
+
+// Whether this receiver answers the pre-payment account.verify check. The setup
+// wizard bakes your portal declaration into the default below; override it at
+// runtime with the VERIFIES_ACCOUNT_REFERENCE env var ("true"/"false").
+const bool DefaultVerifiesAccountReference = %%VERIFIES_ACCOUNT_REFERENCE%%;
+var verifiesAccountReference = Environment.GetEnvironmentVariable("VERIFIES_ACCOUNT_REFERENCE") is { } vr
+    ? vr == "true"
+    : DefaultVerifiesAccountReference;
+
 var builder = WebApplication.CreateBuilder(args);
 var app = builder.Build();
 
@@ -3763,6 +4231,45 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
 
     var eventType = body.TryGetProperty("event", out var evtEl) ? evtEl.GetString() : null;
 
+    // \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    // Carries an encrypted CUSTOMER block { name, known_names, account_number } \u2014
+    // no address, no session envelope \u2014 handled HERE, ABOVE the payload-less
+    // acknowledge below (account.verify is not a dispatch event, so it would
+    // otherwise be acknowledged as "no payload" and never checked). Answer
+    // synchronously with { status }.
+    if (eventType == "account.verify")
+    {
+        // You told the portal whether you verify account references; the wizard
+        // baked that into DefaultVerifiesAccountReference. If you do NOT, answer
+        // "not checked" rather than a match/no_match you don't compute.
+        if (!verifiesAccountReference)
+        {
+            app.Logger.LogInformation("[OneAddress] account.verify \u2192 skipped (VERIFIES_ACCOUNT_REFERENCE is false)");
+            return Results.Json(new { ok = true, skipped = true });
+        }
+        if (!body.TryGetProperty("customer_encrypted", out var custEnc) || custEnc.ValueKind != JsonValueKind.Object)
+            return Results.Json(new { error = "Missing customer_encrypted" }, statusCode: 400);
+        byte[] custPlain;
+        try { custPlain = DecryptAddress(custEnc, privateKeyPem, partnerId); }
+        catch (Exception ex)
+        {
+            app.Logger.LogError(ex, "[OneAddress] account.verify decryption failed \u2014 check ONEADDRESS_PRIVATE_KEY");
+            return Results.Json(new { ok = false, error = "decryption_failed" }, statusCode: 422);
+        }
+        var cust = JsonSerializer.Deserialize<JsonElement>(custPlain);
+        string? acct = cust.TryGetProperty("account_number", out var acctEl) && acctEl.ValueKind == JsonValueKind.String
+            ? acctEl.GetString() : null;
+        var acctName = cust.TryGetProperty("name", out var anmEl) && anmEl.ValueKind == JsonValueKind.String
+            ? anmEl.GetString() ?? "" : "";
+        var acctKnownNames = new List<string>();
+        if (cust.TryGetProperty("known_names", out var aknEl) && aknEl.ValueKind == JsonValueKind.Array)
+            foreach (var n in aknEl.EnumerateArray())
+                if (n.ValueKind == JsonValueKind.String) acctKnownNames.Add(n.GetString()!);
+        var accountStatus = store.VerifyAccount(acct, acctName, acctKnownNames);
+        app.Logger.LogInformation("[OneAddress] account.verify \u2192 {Status} for account {Acct}", accountStatus, acct ?? "(none)");
+        return Results.Json(new { status = accountStatus });
+    }
+
     // address.test / address.test-dispatch (the connection-verification probe)
     // must pass this guard so it reaches the decrypt below; a wrong key then
     // returns 422 and only a real decrypt reaches the verification answer.
@@ -3875,6 +4382,11 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
         // marks the dispatch delivered on a failure that is never retried.
         var outcome = store.ApplyAddress(accountNumber, verifiedName, knownNames, address);
         if (!string.IsNullOrEmpty(dispatchId)) store.MarkProcessed(dispatchId, outcome);
+        // Close the loop back to OneAddress so the service flips to "Confirmed".
+        // Fire-and-forget (discard the Task) so a slow confirm never delays this
+        // 200. Only when we actually applied the update.
+        if (outcome == "applied")
+            _ = ConfirmToOneAddress(oneAddressApi, confirmSecret, partnerId, dispatchId, "confirmed", app.Logger);
         return Results.Json(new { ok = true, outcome });
     }
     else // address.verify
@@ -3888,7 +4400,68 @@ app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
 
 app.MapGet("/health", () => Results.Ok(new { status = "ok" }));
 
-app.Run("http://localhost:3001");
+// PORT is read from the environment (default 3001) rather than hardcoded, so
+// the same build runs behind whatever port your tunnel / process manager sets.
+var port = Environment.GetEnvironmentVariable("PORT");
+if (string.IsNullOrEmpty(port)) port = "3001";
+app.Run($"http://localhost:{port}");
+
+// \u2500\u2500 Confirm callback \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+// Close the loop after an address.updated is applied, so the consumer's
+// dashboard flips the service to "Confirmed". Called with the Task discarded
+// (fire-and-forget) so a slow confirm never delays the webhook's own 200 \u2014 a
+// slow confirm must not make OneAddress time the DISPATCH out and mark it
+// failed.
+//
+// Only real dispatches carry a POSITIVE-INTEGER id in X-OneAddress-Dispatch.
+// Probes (the go-live "address.test") carry a non-numeric id and have nothing
+// to confirm, so they are skipped.
+//
+// Auth for /api/confirm (all three required):
+//   Authorization: Bearer <secret>
+//   X-OneAddress-Timestamp: <unix seconds>
+//   X-OneAddress-Signature: HMAC-SHA256(secret, "<timestamp>.<rawBody>")
+// The same secret signs the Bearer and the body, over the EXACT bytes POSTed.
+async Task ConfirmToOneAddress(string oneAddressApi, string confirmSecret, string pid,
+                               string? dispatch, string status, ILogger logger)
+{
+    if (!long.TryParse((dispatch ?? "").Trim(), out var dispatchId) || dispatchId <= 0) return;
+
+    var bodyStr = JsonSerializer.Serialize(new {
+        dispatch_id = dispatchId,
+        partner_id  = pid,
+        status,
+        note        = "Applied by the OneAddress webhook receiver",
+    });
+    var ts  = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
+    var sig = Convert.ToHexString(
+        HMACSHA256.HashData(Encoding.UTF8.GetBytes(confirmSecret), Encoding.UTF8.GetBytes($"{ts}.{bodyStr}"))
+    ).ToLowerInvariant();
+
+    try
+    {
+        using var http = new HttpClient();
+        using var content = new StringContent(bodyStr, Encoding.UTF8, "application/json");
+        using var req = new HttpRequestMessage(HttpMethod.Post, $"{oneAddressApi}/api/confirm") { Content = content };
+        req.Headers.TryAddWithoutValidation("Authorization", $"Bearer {confirmSecret}");
+        req.Headers.TryAddWithoutValidation("X-OneAddress-Timestamp", ts);
+        req.Headers.TryAddWithoutValidation("X-OneAddress-Signature", sig);
+        using var resp = await http.SendAsync(req);
+        if (resp.IsSuccessStatusCode)
+            logger.LogInformation("[confirm] dispatch {Id} \u2192 {Status}: acknowledged by OneAddress", dispatchId, status);
+        else
+        {
+            logger.LogError("[confirm] dispatch {Id} confirm FAILED \u2014 HTTP {Code}", dispatchId, (int)resp.StatusCode);
+            if ((int)resp.StatusCode == 401)
+                logger.LogError("[confirm] 401 means the wrong secret. If your partner has a separate confirm secret, set CONFIRM_SECRET to it (from the portal Webhook screen); otherwise your webhook signing secret should work.");
+        }
+    }
+    catch (Exception ex)
+    {
+        logger.LogError(ex, "[confirm] confirm request error");
+    }
+}
 
 // \u2500\u2500 Crypto helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
@@ -4155,6 +4728,24 @@ name matching needs maiden names, initials and word order \u2014 see
 | \`ONEADDRESS_WEBHOOK_SECRET\` | Webhook secret from the Partner Portal |
 | \`ONEADDRESS_PRIVATE_KEY\` | PKCS#8 PEM key \u2014 use \`\\n\` between PEM lines |
 | \`ONEADDRESS_PARTNER_ID\` | Your partner UUID |
+| \`ONEADDRESS_API\` | Confirm-callback target \u2014 the customer app (default \`https://oneaddress.io\`), NOT the partner portal |
+| \`CONFIRM_SECRET\` | Signs the \`/api/confirm\` callback. Leave unset to reuse the webhook secret (correct for most partners) |
+| \`VERIFIES_ACCOUNT_REFERENCE\` | Override the wizard's baked-in \`account.verify\` declaration (\`true\`/\`false\`) |
+| \`PORT\` | HTTP port (default \`3001\`) |
+
+### account.verify
+
+If you verify account references, the receiver decrypts the pre-payment
+\`account.verify\` probe and answers \`match\` / \`no_match\` / \`no_account\` from your
+roster. If not, it answers \`{ ok: true, skipped: true }\` ("not checked"). The
+setup wizard bakes your portal declaration in; \`VERIFIES_ACCOUNT_REFERENCE\`
+overrides it.
+
+### Confirm callback
+
+After applying an \`address.updated\`, the receiver POSTs \`/api/confirm\` on
+\`ONEADDRESS_API\` (fire-and-forget, HMAC-signed with \`CONFIRM_SECRET\`) so the
+consumer's dashboard flips the service to "Confirmed".
 
 ## Run conformance check
 
@@ -4172,6 +4763,21 @@ npx @oneaddress/conformance test http://localhost:3001/webhooks/oneaddress
 WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
 PARTNER_PRIVATE_KEY_PEM="%%PRIVATE_KEY%%"
 PORT=3001
+
+# Where the confirm callback is POSTed after you apply an address update. This
+# is the CUSTOMER app (oneaddress.io), NOT the partner portal \u2014 /api/confirm
+# lives on the former. Written by the setup wizard.
+ONEADDRESS_API=%%ONEADDRESS_API%%
+
+# Secret that signs the /api/confirm callback. Leave BLANK to reuse
+# WEBHOOK_SECRET (correct for most partners); set it only if your partner has a
+# separate confirm secret in the portal Webhook screen.
+CONFIRM_SECRET=
+
+# Whether this receiver answers the pre-payment account.verify check. The wizard
+# bakes your portal declaration into a default in main.go; set this to
+# "true"/"false" only to override that at runtime.
+# VERIFIES_ACCOUNT_REFERENCE=
 `
     },
     {
@@ -4192,6 +4798,15 @@ PARTNER_PRIVATE_KEY_PEM=
 
 # HTTP port (default 3001)
 PORT=3001
+
+# Confirm-callback target \u2014 the customer app, not the partner portal.
+ONEADDRESS_API=https://oneaddress.io
+
+# Secret signing the /api/confirm callback. Blank = reuse WEBHOOK_SECRET.
+CONFIRM_SECRET=
+
+# Override the wizard's baked-in account.verify declaration ("true"/"false").
+# VERIFIES_ACCOUNT_REFERENCE=
 `
     },
     {
@@ -4408,6 +5023,38 @@ func (s *Store) VerifyAddress(accountNumber, verifiedName string, knownNames []s
 	return "mismatch"
 }
 
+// VerifyAccount is the pre-payment account check behind account.verify: confirm
+// the typed account number is really one of yours and the name agrees, BEFORE
+// the consumer pays. The boundary that stops someone pushing an update to an
+// account that isn't theirs.
+//
+//	"match"      account number found and the name (or a known name) agrees
+//	"no_match"   account number found but the name does not agree
+//	"no_account" no such account number
+func (s *Store) VerifyAccount(accountNumber, verifiedName string, knownNames []string) string {
+	acct := strings.TrimSpace(accountNumber)
+	if acct == "" {
+		return "no_account"
+	}
+	var fullName string
+	err := s.db.QueryRow("SELECT full_name FROM customers WHERE account_number = ?", acct).Scan(&fullName)
+	if err != nil {
+		// sql.ErrNoRows or any read failure \u2192 we cannot confirm the account.
+		return "no_account"
+	}
+	candidates := []string{}
+	if strings.TrimSpace(verifiedName) != "" {
+		candidates = append(candidates, verifiedName)
+	}
+	candidates = append(candidates, knownNames...)
+	for _, c := range candidates {
+		if strings.TrimSpace(c) != "" && strings.EqualFold(strings.TrimSpace(c), strings.TrimSpace(fullName)) {
+			return "match"
+		}
+	}
+	return "no_match"
+}
+
 // findCustomerID matches on account number first (authoritative), then name.
 //
 // The name pass is deliberately simple. Real matching needs maiden names,
@@ -4527,6 +5174,12 @@ import (
 
 // \u2500\u2500 Config \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
+// defaultVerifiesAccountReference is baked in by the setup wizard from your
+// portal declaration (partners.verifies_account_reference). It decides whether
+// this receiver ANSWERS the pre-payment account.verify check or replies "not
+// checked". Override it at runtime with the VERIFIES_ACCOUNT_REFERENCE env var.
+const defaultVerifiesAccountReference = %%VERIFIES_ACCOUNT_REFERENCE%%
+
 func main() {
 	webhookSecret := os.Getenv("WEBHOOK_SECRET")
 	privateKeyPEM := strings.ReplaceAll(os.Getenv("PARTNER_PRIVATE_KEY_PEM"), \`\\n\`, "\\n")
@@ -4540,6 +5193,23 @@ func main() {
 		log.Fatal("[startup] Missing required env vars: WEBHOOK_SECRET, PARTNER_PRIVATE_KEY_PEM, PARTNER_ID")
 	}
 
+	// Confirm-callback config. ONEADDRESS_API is the customer app (/api/confirm
+	// lives there, NOT on the partner portal); CONFIRM_SECRET signs the callback
+	// and falls back to the webhook secret, which is correct for most partners.
+	oneAddressAPI := strings.TrimRight(os.Getenv("ONEADDRESS_API"), "/")
+	if oneAddressAPI == "" {
+		oneAddressAPI = "https://oneaddress.io"
+	}
+	confirmSecret := os.Getenv("CONFIRM_SECRET")
+	if confirmSecret == "" {
+		confirmSecret = webhookSecret
+	}
+	// Whether we answer account.verify \u2014 the wizard's default, env-overridable.
+	verifiesAccountReference := defaultVerifiesAccountReference
+	if v := os.Getenv("VERIFIES_ACCOUNT_REFERENCE"); v != "" {
+		verifiesAccountReference = v == "true"
+	}
+
 	// Durable store: schema, seed data, and the delivery log. Replaces the
 	// in-memory dedup map this scaffold used to carry \u2014 that was per-process
 	// (useless behind a load balancer), lost on restart, and marked on arrival,
@@ -4582,6 +5252,61 @@ func main() {
 
 		event, _ := parsed["event"].(string)
 
+		// \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+		// Carries an encrypted CUSTOMER block { name, known_names, account_number }
+		// \u2014 no address, no session envelope \u2014 so it is handled HERE, ABOVE the
+		// payload-less acknowledge switch below (account.verify is not a dispatch
+		// event, so it would otherwise fall through to "no payload \u2192 skipped" and
+		// never actually check the account). Answer synchronously with { status }.
+		if event == "account.verify" {
+			// You told the portal whether you verify account references; the wizard
+			// baked that into defaultVerifiesAccountReference. If you do NOT, answer
+			// "not checked" rather than a match/no_match you don't compute.
+			if !verifiesAccountReference {
+				log.Print("[webhook] account.verify \u2192 skipped (VERIFIES_ACCOUNT_REFERENCE is false)")
+				jsonResp(w, 200, map[string]any{"ok": true, "skipped": true})
+				return
+			}
+			encCust, ok := parsed["customer_encrypted"].(map[string]any)
+			if !ok {
+				jsonResp(w, 400, map[string]any{"error": "Missing customer_encrypted"})
+				return
+			}
+			cust, derr := decryptAddress(encCust, privateKeyPEM, partnerID)
+			if derr != nil {
+				log.Printf("[webhook] account.verify decryption failed \u2014 check PARTNER_PRIVATE_KEY_PEM: %v", derr)
+				jsonResp(w, 422, map[string]any{"ok": false, "error": "decryption_failed"})
+				return
+			}
+			acct, _ := cust["account_number"].(string)
+			name, _ := cust["name"].(string)
+			var knownNames []string
+			if raw, ok := cust["known_names"].([]any); ok {
+				for _, n := range raw {
+					if s, ok := n.(string); ok {
+						knownNames = append(knownNames, s)
+					}
+				}
+			}
+			status := store.VerifyAccount(acct, name, knownNames)
+			log.Printf("[webhook] account.verify \u2192 %s for account %s (%s)", status, acct, name)
+			jsonResp(w, 200, map[string]any{"status": status})
+			return
+		}
+
+		// A valid signed request that carries no address payload \u2014 a conformance
+		// ping, or any event added after this receiver was generated \u2014 has already
+		// passed timestamp + signature above, which is exactly what such a probe
+		// tests. Acknowledge it here; only the real dispatch events below require
+		// decryption. A real address.updated with no payload still 422s below.
+		switch event {
+		case "address.updated", "address.verify", "address.test", "address.test-dispatch":
+		default:
+			log.Printf("[webhook] %q acknowledged (no address payload to decrypt)", event)
+			jsonResp(w, 200, map[string]any{"ok": true, "skipped": true})
+			return
+		}
+
 		// Two possible payload shapes \u2014 D5 takes precedence when both fields
 		// are present. Production deployments holding multiple key rotations
 		// should look up the right private key by session_key_share.key_id;
@@ -4668,6 +5393,12 @@ func main() {
 			if dispatch != "" {
 				_ = store.MarkProcessed(dispatch, outcome)
 			}
+			// Close the loop back to OneAddress so the service flips to "Confirmed".
+			// Fire-and-forget in a goroutine: a slow confirm must not delay this 200
+			// (which acks the delivery). Only when we actually applied the update.
+			if outcome == "applied" {
+				go confirmToOneAddress(oneAddressAPI, confirmSecret, partnerID, dispatch, "confirmed")
+			}
 			jsonResp(w, 200, map[string]any{"ok": true, "outcome": outcome})
 			return
 
@@ -4760,6 +5491,67 @@ func main() {
 	log.Fatal(http.ListenAndServe(":"+port, nil))
 }
 
+// \u2500\u2500 Confirm callback \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+// confirmToOneAddress closes the loop after an address.updated is applied, so
+// the consumer's dashboard flips the service to "Confirmed". Called in a
+// goroutine (fire-and-forget) so it never delays the webhook's own 200 \u2014 a slow
+// confirm must not make OneAddress time the DISPATCH out and mark it failed.
+//
+// Only real dispatches carry a POSITIVE-INTEGER id in X-OneAddress-Dispatch.
+// Probes (the go-live "address.test") carry a non-numeric id and have nothing
+// to confirm, so they are skipped.
+//
+// Auth for /api/confirm (all three required):
+//
+//	Authorization: Bearer <secret>
+//	X-OneAddress-Timestamp: <unix seconds>
+//	X-OneAddress-Signature: HMAC-SHA256(secret, "<timestamp>.<rawBody>")
+//
+// The same secret signs the Bearer and the body, over the EXACT bytes POSTed.
+func confirmToOneAddress(oneAddressAPI, confirmSecret, partnerID, dispatch, status string) {
+	dispatchID, err := strconv.ParseInt(strings.TrimSpace(dispatch), 10, 64)
+	if err != nil || dispatchID <= 0 {
+		return
+	}
+	bodyBytes, _ := json.Marshal(map[string]any{
+		"dispatch_id": dispatchID,
+		"partner_id":  partnerID,
+		"status":      status,
+		"note":        "Applied by the OneAddress webhook receiver",
+	})
+	bodyStr := string(bodyBytes)
+	ts := strconv.FormatInt(time.Now().Unix(), 10)
+	mac := hmac.New(sha256.New, []byte(confirmSecret))
+	mac.Write([]byte(ts + "." + bodyStr))
+	sig := hex.EncodeToString(mac.Sum(nil))
+
+	req, err := http.NewRequest(http.MethodPost, oneAddressAPI+"/api/confirm", strings.NewReader(bodyStr))
+	if err != nil {
+		log.Printf("[confirm] request build error: %v", err)
+		return
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+confirmSecret)
+	req.Header.Set("X-OneAddress-Timestamp", ts)
+	req.Header.Set("X-OneAddress-Signature", sig)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Printf("[confirm] confirm request error: %v", err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+		log.Printf("[confirm] dispatch %d \u2192 %s: acknowledged by OneAddress", dispatchID, status)
+		return
+	}
+	log.Printf("[confirm] dispatch %d confirm FAILED \u2014 HTTP %d", dispatchID, resp.StatusCode)
+	if resp.StatusCode == 401 {
+		log.Print("[confirm] 401 means the wrong secret. If your partner has a separate confirm secret, set CONFIRM_SECRET in .env to it (from the portal Webhook screen); otherwise your webhook signing secret should work.")
+	}
+}
+
 // \u2500\u2500 Crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 
 func verifyHMAC(rawBody, signature, timestamp, secret string) bool {
@@ -5144,6 +5936,20 @@ Credentials are in \`.env\` (written by the setup wizard). Never commit \`.env\`
 OA_PARTNER_ID=%%PARTNER_ID%%
 OA_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
 OA_PRIVATE_KEY_PEM="%%PRIVATE_KEY%%"
+
+# Where the confirm callback is POSTed after you apply an address update. This is
+# the CUSTOMER app (oneaddress.io), NOT the partner portal \u2014 /api/confirm lives
+# on the former. Written by the setup wizard.
+ONEADDRESS_API=%%ONEADDRESS_API%%
+
+# Secret that signs the /api/confirm callback. Leave BLANK to reuse
+# OA_WEBHOOK_SECRET (correct for most partners); set it only if your partner has
+# a separate confirm secret in the portal Webhook screen.
+CONFIRM_SECRET=
+
+# Whether this receiver answers the pre-payment account.verify check. The wizard
+# writes your portal declaration here; set true/false to override.
+VERIFIES_ACCOUNT_REFERENCE=%%VERIFIES_ACCOUNT_REFERENCE%%
 `
     },
     {
@@ -5309,6 +6115,31 @@ class OneAddressStore
         return $same ? 'match' : 'mismatch';
     }
 
+    /**
+     * Pre-payment account check behind account.verify: confirm the typed account
+     * number is really one of yours and the name agrees, BEFORE the consumer pays.
+     *   'match'      account number found and the name (or a known name) agrees
+     *   'no_match'   account number found but the name does not agree
+     *   'no_account' no such account number
+     */
+    public function verifyAccount(?string $accountNumber, string $verifiedName, array $knownNames): string
+    {
+        if ($accountNumber === null || trim($accountNumber) === '') {
+            return 'no_account';
+        }
+        $row = DB::table('customers')->where('account_number', trim($accountNumber))->first();
+        if (!$row) {
+            return 'no_account';
+        }
+        $candidates = array_filter(array_merge([$verifiedName], $knownNames), fn ($n) => is_string($n) && trim($n) !== '');
+        foreach ($candidates as $name) {
+            if (strcasecmp(trim($name), $row->full_name) === 0) {
+                return 'match';
+            }
+        }
+        return 'no_match';
+    }
+
     /**
      * Account number first (authoritative), then name.
      *
@@ -5378,11 +6209,135 @@ class OneAddressStore
     }
 }
 
+/**
+ * Load a partner private key from a PEM (or bare base64 DER) string.
+ * Returns an OpenSSL key resource/object, or false on failure.
+ */
+function oaLoadPrivateKey(string $raw)
+{
+    $keyStr = trim($raw);
+    if (strpos($keyStr, '-----') === false) {
+        $keyStr = "-----BEGIN PRIVATE KEY-----\\n"
+            . chunk_split($keyStr, 64, "\\n")
+            . "-----END PRIVATE KEY-----";
+    }
+    return openssl_pkey_get_private($keyStr);
+}
+
+/**
+ * Legacy (non-D5) ECDH + HKDF-SHA256 + AES-256-GCM decrypt of a { ephemeralPublicKey,
+ * iv, ciphertext, hkdfSalt } block \u2014 the same primitive address_encrypted uses, and
+ * the shape account.verify's customer_encrypted block arrives in. Returns the decoded
+ * object, or null on any failure.
+ */
+function oaDecryptLegacy(array $enc, $privateKey, string $partnerId): ?array
+{
+    $b64 = fn (string $s): string => base64_decode(strtr($s, '-_', '+/'));
+    $spkiPrefix = "\\x30\\x59\\x30\\x13\\x06\\x07\\x2a\\x86\\x48\\xce\\x3d\\x02\\x01"
+                . "\\x06\\x08\\x2a\\x86\\x48\\xce\\x3d\\x03\\x01\\x07\\x03\\x42\\x00";
+
+    $ephRaw = $b64($enc['ephemeralPublicKey'] ?? '');
+    if (strlen($ephRaw) !== 65 || ord($ephRaw[0]) !== 0x04) {
+        return null;
+    }
+    $ephPem = "-----BEGIN PUBLIC KEY-----\\n"
+        . chunk_split(base64_encode($spkiPrefix . $ephRaw), 64, "\\n")
+        . "-----END PUBLIC KEY-----";
+    $ephKey = openssl_pkey_get_public($ephPem);
+    if (!$ephKey) {
+        return null;
+    }
+    $shared = openssl_pkey_derive($ephKey, $privateKey);
+    if ($shared === false) {
+        return null;
+    }
+    $saltB64 = $enc['hkdfSalt'] ?? null;
+    $salt    = $saltB64 ? $b64($saltB64) : str_repeat("\\x00", 32);
+    $aesKey  = hash_hkdf('sha256', $shared, 32, 'oneaddress:' . $partnerId, $salt);
+
+    $ctFull = $b64($enc['ciphertext'] ?? '');
+    $tag    = substr($ctFull, -16);
+    $ct     = substr($ctFull, 0, -16);
+    $plaintext = openssl_decrypt($ct, 'aes-256-gcm', $aesKey, OPENSSL_RAW_DATA, $b64($enc['iv'] ?? ''), $tag);
+    if ($plaintext === false) {
+        return null;
+    }
+    $data = json_decode($plaintext, true);
+    return is_array($data) ? $data : null;
+}
+
+/**
+ * Close the loop after an address.updated is applied, so the consumer's dashboard
+ * flips the service to "Confirmed".
+ *
+ * Only real dispatches carry a POSITIVE-INTEGER id in X-OneAddress-Dispatch;
+ * probes (the go-live "address.test") carry a non-numeric id and have nothing to
+ * confirm, so they are skipped. Never throws and never affects the webhook's own
+ * 200 \u2014 a confirm failure is logged, not surfaced. PHP-FPM has no true
+ * fire-and-forget without a queue; for high volume move this into a queued job
+ * (dispatch(...)->afterResponse()).
+ *
+ * Auth for /api/confirm (all three required):
+ *   Authorization: Bearer <secret>
+ *   X-OneAddress-Timestamp: <unix seconds>
+ *   X-OneAddress-Signature: HMAC-SHA256(secret, "<timestamp>.<rawBody>")
+ * The same secret signs the Bearer and the body, over the EXACT bytes POSTed.
+ */
+function oaConfirmToOneAddress(string $oneAddressApi, string $confirmSecret, string $partnerId, string $dispatch, string $status): void
+{
+    if (!ctype_digit($dispatch) || (int) $dispatch <= 0) {
+        return;
+    }
+    $bodyStr = json_encode([
+        'dispatch_id' => (int) $dispatch,
+        'partner_id'  => $partnerId,
+        'status'      => $status,
+        'note'        => 'Applied by the OneAddress webhook receiver',
+    ]);
+    $ts  = (string) time();
+    $sig = hash_hmac('sha256', $ts . '.' . $bodyStr, $confirmSecret);
+
+    $ch = curl_init($oneAddressApi . '/api/confirm');
+    curl_setopt_array($ch, [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_POST           => true,
+        CURLOPT_POSTFIELDS     => $bodyStr,
+        CURLOPT_HTTPHEADER     => [
+            'Content-Type: application/json',
+            'Authorization: Bearer ' . $confirmSecret,
+            'X-OneAddress-Timestamp: ' . $ts,
+            'X-OneAddress-Signature: ' . $sig,
+        ],
+        CURLOPT_TIMEOUT        => 10,
+    ]);
+    curl_exec($ch);
+    $code = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    curl_close($ch);
+
+    if ($code >= 200 && $code < 300) {
+        \\Log::info('[confirm] acknowledged by OneAddress', ['dispatch_id' => (int) $dispatch, 'status' => $status]);
+    } else {
+        \\Log::error('[confirm] confirm FAILED', ['dispatch_id' => (int) $dispatch, 'http' => $code]);
+        if ($code === 401) {
+            \\Log::error('[confirm] 401 means the wrong secret. If your partner has a separate confirm secret, set CONFIRM_SECRET to it (from the portal Webhook screen); otherwise your webhook signing secret should work.');
+        }
+    }
+}
+
 Route::post('/webhook', function (Request $request): Response {
     $partnerId     = env('OA_PARTNER_ID',      '%%PARTNER_ID%%');
     $webhookSecret = env('OA_WEBHOOK_SECRET',  '');
     $privateKeyB64 = env('OA_PRIVATE_KEY_PEM', '');
 
+    // Confirm-callback config. ONEADDRESS_API is the CUSTOMER app (/api/confirm
+    // lives there, NOT the partner portal); CONFIRM_SECRET signs the callback and
+    // falls back to the webhook secret, which is correct for most partners.
+    $oneAddressApi = rtrim(env('ONEADDRESS_API', 'https://oneaddress.io'), '/');
+    $confirmSecret = env('CONFIRM_SECRET') ?: $webhookSecret;
+    // Whether this receiver answers the pre-payment account.verify check. The
+    // wizard bakes your portal declaration into the default; env overrides it.
+    $verifiesAccountReference = filter_var(env('VERIFIES_ACCOUNT_REFERENCE', %%VERIFIES_ACCOUNT_REFERENCE%%), FILTER_VALIDATE_BOOLEAN);
+
     $rawBody   = $request->getContent();
     $timestamp = $request->header('X-OneAddress-Timestamp', '');
     $signature = $request->header('X-OneAddress-Signature', '');
@@ -5407,6 +6362,40 @@ Route::post('/webhook', function (Request $request): Response {
 
     $eventType = $body['event'] ?? '';
 
+    // \u2500\u2500 account.verify: pre-payment account check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    // Carries an encrypted CUSTOMER block { name, known_names, account_number } \u2014
+    // no address, no session envelope \u2014 handled HERE, ABOVE the payload-less
+    // acknowledge below (account.verify is not a dispatch event, so it would
+    // otherwise be acknowledged as "no payload" and never actually check).
+    if ($eventType === 'account.verify') {
+        // Your portal declaration, baked in by the wizard. If you do not verify
+        // account references, answer "not checked".
+        if (!$verifiesAccountReference) {
+            \\Log::info('[OneAddress] account.verify -> skipped (VERIFIES_ACCOUNT_REFERENCE is false)');
+            return response()->json(['ok' => true, 'skipped' => true]);
+        }
+        $custEnc = $body['customer_encrypted'] ?? null;
+        if (!is_array($custEnc)) {
+            return response()->json(['error' => 'Missing customer_encrypted'], 400);
+        }
+        $accountKey = oaLoadPrivateKey($privateKeyB64);
+        if (!$accountKey) {
+            \\Log::error('[OneAddress] account.verify: failed to load private key');
+            return response()->json(['ok' => false, 'error' => 'decryption_failed'], 422);
+        }
+        $cust = oaDecryptLegacy($custEnc, $accountKey, $partnerId);
+        if ($cust === null) {
+            \\Log::error('[OneAddress] account.verify decryption failed \u2014 check OA_PRIVATE_KEY_PEM');
+            return response()->json(['ok' => false, 'error' => 'decryption_failed'], 422);
+        }
+        $acct  = is_string($cust['account_number'] ?? null) ? $cust['account_number'] : null;
+        $name  = is_string($cust['name'] ?? null) ? $cust['name'] : '';
+        $known = is_array($cust['known_names'] ?? null) ? $cust['known_names'] : [];
+        $accountStatus = (new OneAddressStore())->verifyAccount($acct, $name, $known);
+        \\Log::info('[OneAddress] account.verify', ['status' => $accountStatus, 'account' => $acct ?? '(none)']);
+        return response()->json(['status' => $accountStatus]);
+    }
+
     // address.test / address.test-dispatch (the connection-verification probe)
     // must pass this guard so it reaches the decrypt below; a wrong key then
     // returns 422 and only a real decrypt reaches the verification answer.
@@ -5611,6 +6600,11 @@ Route::post('/webhook', function (Request $request): Response {
             'partner_id' => $partnerId,
             'outcome'    => $outcome,
         ]);
+        // Close the loop back to OneAddress so the service flips to "Confirmed",
+        // but only when we actually applied the update. Never affects this 200.
+        if ($outcome === 'applied') {
+            oaConfirmToOneAddress($oneAddressApi, $confirmSecret, $partnerId, $dispatchId, 'confirmed');
+        }
         return response()->json(['ok' => true, 'outcome' => $outcome]);
     } elseif ($eventType === 'address.verify') {
         $callbackUrl  = $body['callback_url']  ?? '';
@@ -5666,6 +6660,15 @@ Route::get('/health', function (): \\Illuminate\\Http\\JsonResponse {
 OA_PARTNER_ID=your-partner-uuid-here
 OA_WEBHOOK_SECRET=your-webhook-secret-here
 OA_PRIVATE_KEY_PEM=<paste PKCS8 PEM private key here - use \\n between lines>
+
+# Confirm-callback target \u2014 the customer app, NOT the partner portal.
+ONEADDRESS_API=https://oneaddress.io
+
+# Signs the /api/confirm callback. Blank = reuse OA_WEBHOOK_SECRET.
+CONFIRM_SECRET=
+
+# Whether the receiver answers the pre-payment account.verify check (true/false).
+VERIFIES_ACCOUNT_REFERENCE=false
 `
     },
     {
@@ -5695,8 +6698,16 @@ Your webhook endpoint: \`POST http://localhost:3001/api/webhook\`
 
 ## Events handled
 
+### account.verify (pre-payment account check)
+Receive \u2192 verify HMAC \u2192 decrypt the customer block \u2192 \`verifyAccount\` \u2192
+answer \`match\` / \`no_match\` / \`no_account\`. Gated on \`VERIFIES_ACCOUNT_REFERENCE\`
+(the wizard writes your portal declaration): when off, the receiver answers
+\`{ "ok": true, "skipped": true }\` ("not checked").
+
 ### address.updated
-Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB \u2192 POST \`/api/confirm\` on
+\`ONEADDRESS_API\` (HMAC-signed with \`CONFIRM_SECRET\`) so the consumer's dashboard
+flips the service to "Confirmed".
 
 ### address.verify
 Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to records \u2192 POST callback_url.
@@ -5746,6 +6757,9 @@ npx @oneaddress/conformance test %%WEBHOOK_URL%%
 | \`OA_PARTNER_ID\` | Your partner UUID |
 | \`OA_WEBHOOK_SECRET\` | HMAC-SHA256 signing secret |
 | \`OA_PRIVATE_KEY_PEM\` | PKCS#8 PEM private key (use \`\\\\n\` between lines) |
+| \`ONEADDRESS_API\` | Confirm-callback target \u2014 the customer app (default \`https://oneaddress.io\`), NOT the partner portal |
+| \`CONFIRM_SECRET\` | Signs the \`/api/confirm\` callback. Blank = reuse \`OA_WEBHOOK_SECRET\` |
+| \`VERIFIES_ACCOUNT_REFERENCE\` | Whether the receiver answers \`account.verify\` (\`true\`/\`false\`) |
 `
     }
   ]
@@ -5782,7 +6796,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto = require("crypto");
-var PKG_VERSION = true ? "1.6.0" : "dev";
+var PKG_VERSION = true ? "1.6.2" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
@@ -5973,7 +6987,6 @@ async function runDecryptCheck(webhookSecret, partnerId) {
 
 // src/install.ts
 var import_node_child_process = require("child_process");
-var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
 var COMMANDS = {
   "ts-node": { cmd: "npm", args: ["install"] },
@@ -5981,22 +6994,17 @@ var COMMANDS = {
   "go-http": { cmd: "go", args: ["mod", "tidy"] },
   "php-laravel": { cmd: "composer", args: ["install"] },
   "csharp-aspnet": { cmd: "dotnet", args: ["restore"] },
-  "java-spring": { cmd: "./mvnw", args: ["dependency:resolve", "-q"] }
+  // Use `mvn`, not `./mvnw` — the Java scaffold ships no Maven wrapper, so
+  // `./mvnw` fails ENOENT for every Java partner. A missing `mvn` on PATH is
+  // reported cleanly (ok=false) with the manual command, which is the honest
+  // failure rather than a cryptic one.
+  "java-spring": { cmd: "mvn", args: ["dependency:resolve", "-q"] }
 };
 function installDependencies(platform, outputDir) {
   const spec = COMMANDS[platform];
   if (!spec) {
     return { ok: true, output: "", manualCommand: "" };
   }
-  if (platform === "java-spring") {
-    const mvnw = (0, import_node_path2.join)(outputDir, "mvnw");
-    if ((0, import_node_fs2.existsSync)(mvnw)) {
-      try {
-        (0, import_node_fs2.chmodSync)(mvnw, 493);
-      } catch {
-      }
-    }
-  }
   const cwd = spec.cwd ? (0, import_node_path2.join)(outputDir, spec.cwd) : outputDir;
   const manualCommand = `cd ${outputDir} && ${spec.cmd} ${spec.args.join(" ")}`;
   const result = (0, import_node_child_process.spawnSync)(spec.cmd, spec.args, {
@@ -6017,15 +7025,14 @@ function installDependencies(platform, outputDir) {
 
 // src/autostart.ts
 var import_node_child_process2 = require("child_process");
-var import_node_path3 = require("path");
-var import_node_fs3 = require("fs");
 var COMMANDS2 = {
   "ts-node": { cmd: "npx", args: ["tsx", "src/server.ts"] },
   "python": { cmd: "uvicorn", args: ["app:app", "--port", "3001"] },
   "go-http": { cmd: "go", args: ["run", "."] },
   "php-laravel": { cmd: "php", args: ["artisan", "serve", "--port=3001"] },
   "csharp-aspnet": { cmd: "dotnet", args: ["run"] },
-  "java-spring": { cmd: "./mvnw", args: ["spring-boot:run"] }
+  "java-spring": { cmd: "mvn", args: ["spring-boot:run"] }
+  // no mvnw wrapper is scaffolded
 };
 var serverProcess = null;
 var serverOutput = "";
@@ -6072,20 +7079,11 @@ async function pollHealth(port, timeoutMs) {
   }
   return false;
 }
-async function startServer(platform, outputDir, port = 3001) {
+async function startServer(platform, outputDir, port = 3001, secrets = {}) {
   const spec = COMMANDS2[platform];
   if (!spec) {
     return { ok: false, output: `No start command defined for platform: ${platform}`, manualCommand: "" };
   }
-  if (platform === "java-spring") {
-    const mvnw = (0, import_node_path3.join)(outputDir, "mvnw");
-    if ((0, import_node_fs3.existsSync)(mvnw)) {
-      try {
-        (0, import_node_fs3.chmodSync)(mvnw, 493);
-      } catch {
-      }
-    }
-  }
   serverOutput = "";
   const manualCommand = `cd ${outputDir} && ${spec.cmd} ${spec.args.join(" ")}`;
   const PASSTHROUGH_KEYS = [
@@ -6123,6 +7121,9 @@ async function startServer(platform, outputDir, port = 3001) {
     const v2 = process.env[key];
     if (typeof v2 === "string") childEnv[key] = v2;
   }
+  for (const [key, value] of Object.entries(secrets)) {
+    if (value) childEnv[key] = value;
+  }
   const isWin = process.platform === "win32";
   serverProcess = (0, import_node_child_process2.spawn)(
     isWin ? "cmd.exe" : spec.cmd,
@@ -6152,9 +7153,9 @@ async function startServer(platform, outputDir, port = 3001) {
 // src/tunnel.ts
 var import_node_child_process3 = require("child_process");
 var import_promises2 = require("fs/promises");
-var import_node_fs4 = require("fs");
+var import_node_fs2 = require("fs");
 var import_node_crypto3 = require("crypto");
-var import_node_path4 = require("path");
+var import_node_path3 = require("path");
 var import_node_os = __toESM(require("os"));
 var tunnelProcess = null;
 function stopTunnel() {
@@ -6202,19 +7203,19 @@ async function downloadCloudflared() {
   if (!spec) {
     throw new Error(`No cloudflared asset known for ${key}. Install cloudflared manually or provide your own HTTPS URL when prompted.`);
   }
-  const cacheDir = (0, import_node_path4.join)(import_node_os.default.tmpdir(), `oneaddress-cloudflared-${CLOUDFLARED_VERSION}`);
+  const cacheDir = (0, import_node_path3.join)(import_node_os.default.tmpdir(), `oneaddress-cloudflared-${CLOUDFLARED_VERSION}`);
   const binaryName = process.platform === "win32" ? "cloudflared.exe" : "cloudflared";
-  const finalPath = (0, import_node_path4.join)(cacheDir, binaryName);
-  if (!spec.archive && (0, import_node_fs4.existsSync)(finalPath)) {
+  const finalPath = (0, import_node_path3.join)(cacheDir, binaryName);
+  if (!spec.archive && (0, import_node_fs2.existsSync)(finalPath)) {
     try {
       const cachedHash = await sha256File(finalPath);
       if (cachedHash === spec.sha256) return finalPath;
     } catch {
     }
   }
-  if (spec.archive && (0, import_node_fs4.existsSync)(finalPath)) return finalPath;
+  if (spec.archive && (0, import_node_fs2.existsSync)(finalPath)) return finalPath;
   await (0, import_promises2.mkdir)(cacheDir, { recursive: true });
-  const downloadPath = (0, import_node_path4.join)(cacheDir, spec.asset);
+  const downloadPath = (0, import_node_path3.join)(cacheDir, spec.asset);
   const url = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${spec.asset}`;
   const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
   if (!res.ok) throw new Error(`Failed to download cloudflared from ${url}: HTTP ${res.status}`);
@@ -6248,7 +7249,7 @@ Refusing to execute. Try re-running setup, or install cloudflared manually.`
       `cloudflared archive extraction failed (tar exit ${tarResult.status}): ${tarResult.stderr || tarResult.stdout || "no output"}`
     );
   }
-  if (!(0, import_node_fs4.existsSync)(finalPath)) {
+  if (!(0, import_node_fs2.existsSync)(finalPath)) {
     throw new Error(`cloudflared archive extracted but ${finalPath} not found \u2014 Cloudflare may have changed the tarball layout.`);
   }
   try {
@@ -6437,6 +7438,7 @@ async function registerWebhookUrl(partnerId, webhookSecret, webhookUrl) {
 
 // src/cli-gate.ts
 var MAX_ATTEMPTS = 3;
+var MAX_TRANSIENT_FAILURES = 5;
 var AUTH_URL = "https://partners.oneaddress.io/api/cli/auth";
 async function checkToken(token) {
   try {
@@ -6470,6 +7472,7 @@ async function checkToken(token) {
   }
 }
 async function cliGate() {
+  let transientFailures = 0;
   for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
     const token = await ge({
       message: attempt === 1 ? "OneAddress CLI token  (Profile \u2192 CLI Access in the portal)" : `OneAddress CLI token  (attempt ${attempt}/${MAX_ATTEMPTS})`,
@@ -6482,6 +7485,11 @@ async function cliGate() {
     const result = await checkToken(token);
     if (result.ok) return { partnerId: result.partnerId };
     if (result.retryable) {
+      transientFailures++;
+      if (transientFailures >= MAX_TRANSIENT_FAILURES) {
+        console.error("\n  \x1B[38;2;240;80;80m\u2717\x1B[0m  Could not reach the portal after several tries. Check your connection to partners.oneaddress.io and re-run.\n");
+        process.exit(1);
+      }
       M2.warn(`  ${result.reason}, retry the same token.`);
       attempt--;
       continue;
@@ -6580,9 +7588,9 @@ function normalisePrivateKey(raw) {
   const trimmed = raw.trim();
   const isPath = /^(\/|\.\/|\.\.\/|~\/|[A-Za-z]:[/\\])/.test(trimmed) || trimmed.endsWith(".pem");
   if (isPath) {
-    const abs = trimmed.startsWith("~/") ? (0, import_node_path5.resolve)((0, import_node_os2.homedir)(), trimmed.slice(2)) : (0, import_node_path5.resolve)(trimmed);
-    if (!(0, import_node_fs5.existsSync)(abs)) return { pem: "", error: `File not found: ${abs}` };
-    return normalisePrivateKey((0, import_node_fs5.readFileSync)(abs, "utf8"));
+    const abs = trimmed.startsWith("~/") ? (0, import_node_path4.resolve)((0, import_node_os2.homedir)(), trimmed.slice(2)) : (0, import_node_path4.resolve)(trimmed);
+    if (!(0, import_node_fs3.existsSync)(abs)) return { pem: "", error: `File not found: ${abs}` };
+    return normalisePrivateKey((0, import_node_fs3.readFileSync)(abs, "utf8"));
   }
   const unescaped = trimmed.replaceAll("\\n", "\n");
   if (unescaped.includes("-----BEGIN PRIVATE KEY-----")) {
@@ -6741,26 +7749,23 @@ async function main() {
     ]
   });
   assertNotCancelled(platform);
-  const outputDir = await he({
-    message: "Where to write the files?",
-    placeholder: "./oneaddress-webhook",
-    defaultValue: "./oneaddress-webhook"
-  });
-  assertNotCancelled(outputDir);
-  const outDir = outputDir.trim() || "./oneaddress-webhook";
-  if ((0, import_node_fs5.existsSync)(outDir)) {
-    const entries = (0, import_node_fs5.readdirSync)(outDir);
-    if (entries.length > 0) {
-      const overwrite = await ye({
-        message: `${outDir} already has files \u2014 overwrite?`,
-        initialValue: false
-      });
-      assertNotCancelled(overwrite);
-      if (!overwrite) {
-        xe("Choose a different output directory and run again.");
-        process.exit(0);
-      }
-    }
+  let outDir;
+  for (; ; ) {
+    const outputDir = await he({
+      message: "Where to write the files?",
+      placeholder: "./oneaddress-webhook",
+      defaultValue: "./oneaddress-webhook"
+    });
+    assertNotCancelled(outputDir);
+    outDir = outputDir.trim() || "./oneaddress-webhook";
+    if (!(0, import_node_fs3.existsSync)(outDir) || (0, import_node_fs3.readdirSync)(outDir).length === 0) break;
+    const overwrite = await ye({
+      message: `${outDir} already has files \u2014 overwrite?`,
+      initialValue: false
+    });
+    assertNotCancelled(overwrite);
+    if (overwrite) break;
+    M2.info(`Keeping the files in ${outDir}. Enter a different directory to write into.`);
   }
   let accountRefReason = "";
   const accountRefDeclaration = await getVerifiesAccountReference(pid, secret, (r2) => {
@@ -6831,7 +7836,12 @@ async function main() {
   const s3 = Y2();
   s3.start(`Starting server (waiting up to 15 s for /health on :${SERVER_PORT})`);
   onCleanup(stopServer);
-  const start = await startServer(platform, outDir, SERVER_PORT);
+  const start = await startServer(platform, outDir, SERVER_PORT, {
+    WEBHOOK_SECRET: secret,
+    PARTNER_ID: pid,
+    PARTNER_PRIVATE_KEY_PEM: privateKey,
+    VERIFIES_ACCOUNT_REFERENCE: String(verifiesAccountReference)
+  });
   let serverRunning = false;
   if (start.ok) {
     s3.stop(`Server is healthy on port ${SERVER_PORT}`);
@@ -7052,7 +8062,7 @@ ${DIM2}  Stopped.${R3}
 }
 
 // src/non-interactive.ts
-var import_node_fs6 = require("fs");
+var import_node_fs4 = require("fs");
 var PLATFORMS = [
   "ts-node",
   "python",
@@ -7105,7 +8115,7 @@ function parseArgs(argv2) {
   }
   return out;
 }
-function resolveConfig(args, env, normalisePrivateKey2, readFile2 = (p2) => (0, import_node_fs6.readFileSync)(p2, "utf8")) {
+function resolveConfig(args, env, normalisePrivateKey2, readFile2 = (p2) => (0, import_node_fs4.readFileSync)(p2, "utf8")) {
   const errors = [];
   for (const flag of args.secretFlagsUsed) {
     errors.push(
@@ -7207,7 +8217,7 @@ ${usage()}`);
     process.exit(1);
   }
   const { partnerId, secret, privateKey, platform, outDir, webhookUrl, force } = resolved.config;
-  if ((0, import_node_fs7.existsSync)(outDir) && (0, import_node_fs7.readdirSync)(outDir).length > 0 && !force) {
+  if ((0, import_node_fs5.existsSync)(outDir) && (0, import_node_fs5.readdirSync)(outDir).length > 0 && !force) {
     console.error(`[oneaddress/setup] ${outDir} is not empty. Pass --force to overwrite.`);
     process.exit(1);
   }