Summary

• stack add stripe --webhook-endpoint <url> [--events <e1,e2,...>] now calls POST /v1/webhook_endpoints, captures the whsec_… signing secret, and stores STRIPE_WEBHOOK_SECRET + STRIPE_WEBHOOK_ENDPOINT_ID in Phantom — fully agent-driveable with no Stripe dashboard copy-paste.
• Default event list (when --events is omitted): customer.subscription.{created,updated,deleted,trial_will_end} + invoice.payment_failed.
• --secret-key-from-vault skips the interactive sk_… paste and reuses the existing vault entry.
• ProviderContext gains an optional hints field so providers can inspect CLI flags during login() (not only during provision()), enabling the vault-bypass path.
• Plain stack add stripe (no webhook flag) is unchanged — regression-guarded by test (f).

Files changed

• packages/core/src/providers/stripe.ts — rewritten from makeApiKeyProvider factory to a hand-written Provider with full webhook flow
• packages/core/src/providers/_base.ts — ProviderContext.hints?: Record<string,unknown> added
• packages/core/src/pipeline.ts — threads opts.hints into ctx so login() can read it
• packages/cli/src/commands/add.ts — --webhook-endpoint, --events, --secret-key-from-vault flags + buildHints() helper
• packages/core/src/__tests__/stripe-webhook.test.ts — 8 new tests (all mock fetch, never hit real Stripe)
• README.md — doc snippet showing all three invocation forms

Test plan

• bun test in packages/core — 265 pass, 0 fail (includes 8 new stripe-webhook tests)
• bun run typecheck at repo root — clean
• Test (a): successful creation stores all 3 secrets in vault
• Test (b): custom --events forwarded to Stripe POST body
• Test (c): default events used when --events omitted
• Test (d): --secret-key-from-vault throws STRIPE_AUTH_REQUIRED when vault empty
• Test (e): Stripe 400 propagates as STRIPE_WEBHOOK_CREATE_FAILED
• Test (f): plain stack add stripe flow (no webhook) unchanged

🤖 Generated with Claude Code