@muxoai/platform 1.3.3 → 1.4.1

package/dist/providers/stripe-projects.js

@@ -4,6 +4,146 @@ import path from "node:path";
 import { promisify } from "node:util";
 import { ROOT_DIR } from "../config.js";
 const execFileAsync = promisify(execFile);
+export const DEFAULT_STRIPE_PROVISIONING_API_VERSION = "2026-09-30.preview";
+const SENSITIVE_FIELD_PATTERN = /secret|token|password|credential|access_configuration|confirmation_secret|checkout_session_url|redirect_url|database_url|api_key|private_key/i;
+export function redactProvisioningSecrets(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_FIELD_PATTERN.test(k)) {
+            out[k] = "[REDACTED]";
+        }
+        else if (v && typeof v === "object" && !Array.isArray(v)) {
+            out[k] = redactProvisioningSecrets(v);
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+export function classifyStripeProvisioningError(err) {
+    const code = String(err.code || "").toLowerCase();
+    const msg = String(err.message || "");
+    if (code === "payment_method_required") {
+        return {
+            platformAction: "Complete payment setup via POST /v2/provisioning/payment_method_requests, obtain user approval, then retry deliberately.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "payment_method_and_customer_required") {
+        return {
+            platformAction: "For an enabled platform-source flow, provide matching source_customer and source_payment_method.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "payment_method_owner_required") {
+        return {
+            platformAction: "For an enabled platform-source flow, set payment_method_owner=platform.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "unsupported_payment_method_owner") {
+        return {
+            platformAction: "Stop; use only a currently enabled payment_method_owner mode.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "connect_relationship_required") {
+        return {
+            platformAction: "Verify the platform-to-connected account relationship and the Stripe-Context header value.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "provider_reauth_required") {
+        return {
+            platformAction: "Create a new Provider connection request (POST /v2/provisioning/provider_connection_requests) and ask the user to reconnect.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "invalid_resource_configuration") {
+        return {
+            platformAction: "Refresh the catalog service configuration_schema and collect corrected user input.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_count_constraint_exceeded") {
+        return {
+            platformAction: "Explain the service constraint and offer an allowed update, association, or existing Resource.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_not_complete") {
+        return {
+            platformAction: "Retrieve the Resource (GET /v2/provisioning/resources/{id}) and follow its status. Poll while pending, submit_information when needs_information, and reveal_access_configuration only after status=complete.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (code === "resource_access_configuration_unavailable") {
+        return {
+            platformAction: "Stop. Relink or rotate the Resource, or follow Provider guidance in status details.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_access_configuration_expired") {
+        return {
+            platformAction: "Rotate the Resource credentials (POST /v2/provisioning/resources/{id}/rotate_credentials). If complete, retrieve replacement; if pending, set workflow status to requires_review.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (err.status === 403) {
+        if (/provisioning_resource_reveal_access_configuration/i.test(msg)) {
+            return {
+                platformAction: "Use a restricted key with the provisioning_resource_reveal_access_configuration permission.",
+                workflowStatus: "errored",
+                retryable: false,
+            };
+        }
+        return {
+            platformAction: "Verify private-preview enrollment, the Stripe-Context connected account, and the Resource Project scope.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "rate_limited" || err.status === 429) {
+        return {
+            platformAction: "Back off with exponential delay and jitter, honoring Retry-After if present.",
+            workflowStatus: "requires_review",
+            retryable: true,
+        };
+    }
+    if (code === "provider_failure") {
+        return {
+            platformAction: "Show a safe message. Identify returned prerequisite when possible; retry only after approval and only if safe.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (code === "not_found" || err.status === 404) {
+        return {
+            platformAction: "Verify object ID and Stripe-Context; do not probe another account.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    return {
+        platformAction: "Stop, record safe diagnostics, retrieve known objects in the same Stripe-Context, mark requires_review, and do not replay the write automatically.",
+        workflowStatus: "requires_review",
+        retryable: false,
+    };
+}
 export function isPaidCloudProvisioning(tool, input) {
     if (tool.lane !== "stripe_projects")
         return false;
@@ -24,18 +164,20 @@ export class StripeProjectsAdapter {
     config;
     tools = new Map();
     providerByName = new Map();
+    seededProviders = [];
+    seededServices = [];
     constructor(config) {
         this.config = config;
         this.loadCatalogSeed();
     }
     loadCatalogSeed() {
-        // Lifecycle management tools for Stripe Projects
+        // Lifecycle management tools for Stripe Projects & Stripe v2 Provisioning API
         const lifecycleTools = [
             {
                 slug: "resource.projects.status",
                 upstreamSlug: "projects/status",
                 name: "Cloud Infrastructure: Project & Provider Status",
-                description: "Inspect active provisioned resources, linked cloud providers (Neon, Supabase, Turso, Cloudflare, Vercel, etc.), and environment status.",
+                description: "Inspect active provisioned resources, linked cloud providers (Neon, Supabase, Turso, Cloudflare, Vercel, etc.), and environment status via Stripe v2 Provisioning.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -49,11 +191,169 @@ export class StripeProjectsAdapter {
                     properties: {},
                 },
             },
+            {
+                slug: "resource.projects.eligibility",
+                upstreamSlug: "v2/provisioning/eligibility",
+                name: "Stripe v2 Provisioning: Check Eligibility",
+                description: "Check whether the workspace or Stripe account is eligible for Stripe v2 Provisioning (GET /v2/provisioning/eligibility) and inspect any outstanding requirements.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "eligibility", "status"],
+                riskLevel: "read",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                },
+            },
+            {
+                slug: "resource.projects.catalog",
+                upstreamSlug: "v2/provisioning/catalog",
+                name: "Stripe v2 Provisioning: List Catalog Providers & Services",
+                description: "List available cloud providers (GET /v2/provisioning/catalog/providers) and deployable/plan service details (GET /v2/provisioning/catalog/services) from the Stripe v2 Provisioning catalog.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "catalog", "discovery"],
+                riskLevel: "read",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        catalog: {
+                            type: "string",
+                            enum: ["dev", "prod", "testing"],
+                            default: "prod",
+                            description: "Catalog partition (dev, prod, or testing)",
+                        },
+                        provider_name: {
+                            type: "string",
+                            description: "Optional provider name filter for catalog services",
+                        },
+                        limit: {
+                            type: "number",
+                            default: 25,
+                            description: "Maximum items to return",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.payment_profile",
+                upstreamSlug: "v2/provisioning/payment_profile",
+                name: "Stripe v2 Provisioning: Manage Payment Profile & Limits",
+                description: "Retrieve or update the Stripe v2 Provisioning payment profile usage limits (GET /v2/provisioning/payment_profile, POST /v2/provisioning/payment_profile/update_limit) or initiate a payment method request (POST /v2/provisioning/payment_method_requests).",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "billing", "payment_profile"],
+                riskLevel: "financial",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        action: {
+                            type: "string",
+                            enum: ["retrieve", "update_limit", "request_payment_method"],
+                            default: "retrieve",
+                            description: "Payment profile action to execute",
+                        },
+                        provider: {
+                            type: "string",
+                            description: "Optional provider slug when updating a provider-specific limit",
+                        },
+                        max_amount: {
+                            type: "number",
+                            description: "Usage limit amount in cents (e.g. 5000 for $50.00)",
+                        },
+                        currency: {
+                            type: "string",
+                            default: "usd",
+                            description: "Three-letter ISO currency code",
+                        },
+                        recurring_interval: {
+                            type: "string",
+                            enum: ["day", "week", "month", "year"],
+                            default: "month",
+                            description: "Usage limit recurring interval",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.create_project",
+                upstreamSlug: "v2/provisioning/projects",
+                name: "Stripe v2 Provisioning: Create Project",
+                description: "Create a new Stripe v2 Provisioning project (POST /v2/provisioning/projects) in the specified catalog partition.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "projects"],
+                riskLevel: "provisioning",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["name"],
+                    properties: {
+                        name: {
+                            type: "string",
+                            description: "Human-readable name for the new project",
+                        },
+                        catalog: {
+                            type: "string",
+                            enum: ["dev", "prod", "testing"],
+                            default: "prod",
+                            description: "Catalog partition to create the project in",
+                        },
+                        project_profile: {
+                            type: "string",
+                            description: "Optional developer profile identifier (prjprof_...)",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.reveal_access_configuration",
+                upstreamSlug: "v2/provisioning/resources/reveal_access_configuration",
+                name: "Stripe v2 Provisioning: Reveal Resource Access Configuration",
+                description: "Reveal live access credentials and connection strings for a provisioned resource (POST /v2/provisioning/resources/:id/reveal_access_configuration) and sync them into Muxo's AES-256-GCM workspace vault.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "security", "secrets"],
+                riskLevel: "admin",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["resource_id"],
+                    properties: {
+                        resource_id: {
+                            type: "string",
+                            description: "Stripe v2 Provisioning resource ID (res_... or fres_...)",
+                        },
+                        resource_name: {
+                            type: "string",
+                            description: "Optional local resource name in the workspace vault",
+                        },
+                    },
+                },
+            },
             {
                 slug: "resource.projects.rotate_credentials",
                 upstreamSlug: "projects/rotate",
                 name: "Cloud Infrastructure: Rotate Resource Credentials",
-                description: "Rotate credentials for a provisioned resource via Muxo Cloud Infrastructure and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
+                description: "Rotate credentials for a provisioned resource via Muxo Cloud Infrastructure (POST /v2/provisioning/resources/:id/rotate_credentials) and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -70,6 +370,10 @@ export class StripeProjectsAdapter {
                             type: "string",
                             description: "Local name of the provisioned resource (e.g. 'primary-db')",
                         },
+                        resource_id: {
+                            type: "string",
+                            description: "Optional Stripe v2 Provisioning resource ID (res_...)",
+                        },
                     },
                 },
             },
@@ -77,7 +381,7 @@ export class StripeProjectsAdapter {
                 slug: "resource.projects.deprovision",
                 upstreamSlug: "projects/remove",
                 name: "Cloud Infrastructure: Deprovision Resource",
-                description: "Deprovision and remove a cloud resource at the upstream provider and purge its credentials from the workspace.",
+                description: "Deprovision and remove a cloud resource at the upstream provider (POST /v2/provisioning/resources/:id/remove or /unlink) and purge its credentials from the workspace.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -94,10 +398,14 @@ export class StripeProjectsAdapter {
                             type: "string",
                             description: "Local name of the provisioned resource to remove",
                         },
+                        resource_id: {
+                            type: "string",
+                            description: "Optional Stripe v2 Provisioning resource ID (res_...)",
+                        },
                         untrack_only: {
                             type: "boolean",
                             default: false,
-                            description: "If true, untrack locally without deleting at the provider",
+                            description: "If true, unlink without deleting at the provider",
                         },
                     },
                 },
@@ -113,6 +421,46 @@ export class StripeProjectsAdapter {
         for (const p of raw.providers || []) {
             this.providerByName.set(p.name.toLowerCase(), p);
             this.providerByName.set(p.slug.toLowerCase(), p);
+            this.seededProviders.push({
+                id: `prov_${p.slug}`,
+                object: "v2.provisioning.provider",
+                name: p.name,
+                description: p.description || null,
+                categories: p.categories || [],
+                capabilities: {
+                    custom_configuration: true,
+                    link_existing_resources: true,
+                },
+                configuration_schema: {},
+                llm_context: p.url ? `${p.url.replace(/\/+$/, "")}/llms.txt` : null,
+                website_url: p.url || null,
+                tos_url: p.url ? `${p.url.replace(/\/+$/, "")}/terms` : null,
+                privacy_policy_url: p.url ? `${p.url.replace(/\/+$/, "")}/privacy` : null,
+            });
+        }
+        for (const svc of raw.services || []) {
+            const providerKey = svc.provider_name.toLowerCase();
+            const matchedProvider = this.providerByName.get(providerKey);
+            const providerSlug = (matchedProvider?.slug ||
+                svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
+            this.seededServices.push({
+                id: svc.id,
+                object: "v2.provisioning.provider_service_detail",
+                provider: svc.provider || `prov_${providerSlug}`,
+                provider_name: svc.provider_name,
+                service_id: svc.service_id,
+                description: svc.description || null,
+                categories: svc.categories || [],
+                kind: svc.kind,
+                availability: svc.availability,
+                scope: "project",
+                configuration_schema: svc.configuration_schema || null,
+                pricing: svc.pricing || null,
+                llm_context: raw.service_metadata?.[svc.id]?.llm_context ||
+                    (matchedProvider?.url
+                        ? `${matchedProvider.url.replace(/\/+$/, "")}/llms.txt`
+                        : null),
+            });
         }
         // Index available plan services per provider so companion plans sort free-tier first
         const providerPlans = new Map();
@@ -323,72 +671,1309 @@ export class StripeProjectsAdapter {
         return (process.env.MUXO_EXTERNAL_MODE !== "1" &&
             fs.existsSync(this.config.stripeProjectsWorkdir));
     }
-    async getLiveStatus() {
-        if (!this.hasLocalProjectsWorkdir) {
-            return {
-                authenticated: true,
-                projectInitialized: true,
-                projectId: "proj_muxo_cloud_managed",
-                projectName: "Muxo Cloud Managed Infrastructure",
-                providers: [
-                    { id: "prov_turso", name: "Turso", slug: "turso", status: "active", redirectUrl: null },
-                    { id: "prov_neon", name: "Neon", slug: "neon", status: "active", redirectUrl: null },
-                    { id: "prov_upstash", name: "Upstash", slug: "upstash", status: "active", redirectUrl: null },
-                    { id: "prov_resend", name: "Resend", slug: "resend", status: "active", redirectUrl: null },
-                    { id: "prov_supabase", name: "Supabase", slug: "supabase", status: "active", redirectUrl: null },
-                ],
-                services: [],
-                plans: [],
-            };
+    provisioningAuditLog = [];
+    getProvisioningAuditLog(limit = 50) {
+        return this.provisioningAuditLog.slice(-limit);
+    }
+    resolveStripeSecretKey(apiKeyOverride) {
+        return (apiKeyOverride ||
+            this.config.stripeSecretKey ||
+            process.env.STRIPE_API_KEY ||
+            process.env.MUXO_STRIPE_PROVISIONING_KEY ||
+            "").trim();
+    }
+    isLivemodeKey(apiKeyOverride) {
+        const key = this.resolveStripeSecretKey(apiKeyOverride);
+        if (!key)
+            return false;
+        return key.startsWith("sk_live_") || key.startsWith("rk_live_");
+    }
+    resolveStripeContext(stripeContextOverride) {
+        const candidate = (stripeContextOverride ??
+            this.config.stripeConnectedAccountId ??
+            process.env.STRIPE_CONNECTED_ACCOUNT_ID ??
+            process.env.STRIPE_CONTEXT ??
+            "").trim();
+        return candidate.length > 0 ? candidate : null;
+    }
+    hasStripeV2ApiKey(apiKeyOverride) {
+        return this.resolveStripeSecretKey(apiKeyOverride).length > 0;
+    }
+    get provisioningApiVersion() {
+        return (this.config.stripeProvisioningApiVersion ||
+            DEFAULT_STRIPE_PROVISIONING_API_VERSION);
+    }
+    get stripeApiBaseUrl() {
+        return (this.config.stripeApiBaseUrl || "https://api.stripe.com").replace(/\/+$/, "");
+    }
+    async requestV2Provisioning(method, endpointPath, options) {
+        const apiKey = this.resolveStripeSecretKey(options?.apiKeyOverride);
+        if (!apiKey) {
+            throw new Error("Stripe secret key is required for Stripe v2 Provisioning HTTP requests.");
         }
-        const res = await this.runStripeProjectsCli(["status"], 20000);
-        const data = (res.data || {});
-        const meta = (res.meta || {});
-        const project = (data.project || {});
-        const rawProviders = Array.isArray(data.providers) ? data.providers : [];
-        const providers = rawProviders.map((p) => {
-            const name = String(p.name || "");
-            const matched = this.providerByName.get(name.toLowerCase());
-            const slug = matched?.slug || name.toLowerCase().replace(/[^a-z0-9]+/g, "");
-            const rawStatus = String(p.status || "").toLowerCase();
-            const status = rawStatus === "complete" || rawStatus === "active"
-                ? "active"
-                : rawStatus === "expired"
-                    ? "expired"
-                    : "pending";
-            return {
-                id: String(p.id || ""),
-                name,
-                slug,
-                status,
-                redirectUrl: p.redirect_url ? String(p.redirect_url) : null,
-            };
+        const url = endpointPath.startsWith("http://") || endpointPath.startsWith("https://")
+            ? new URL(endpointPath)
+            : new URL(`${this.stripeApiBaseUrl}${endpointPath}`);
+        if (options?.query) {
+            for (const [k, v] of Object.entries(options.query)) {
+                if (v !== undefined && v !== null && v !== "") {
+                    url.searchParams.set(k, String(v));
+                }
+            }
+        }
+        const stripeContext = this.resolveStripeContext(options?.stripeContext);
+        const headers = {
+            Authorization: `Bearer ${apiKey}`,
+            "Stripe-Version": options?.apiVersionOverride || this.provisioningApiVersion,
+            Accept: "application/json",
+        };
+        if (stripeContext) {
+            headers["Stripe-Context"] = stripeContext;
+        }
+        if (method === "POST" && options?.idempotencyKey) {
+            headers["Idempotency-Key"] = options.idempotencyKey;
+        }
+        let bodyPayload;
+        if (method === "POST" && options?.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+            bodyPayload = JSON.stringify(options.body);
+        }
+        // Persist intended write before sending (per https://docs.stripe.com/provisioning)
+        const auditEntry = {
+            id: `prov_req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            method,
+            endpoint: url.pathname + url.search,
+            stripeContext,
+            intendedWrite: method === "POST" ? redactProvisioningSecrets(options?.body ?? null) : null,
+            requestId: null,
+            objectId: null,
+            objectStatus: null,
+            httpStatus: null,
+            errorCode: null,
+            requestLogUrl: null,
+            workflowStatus: "pending",
+            startedAt: new Date().toISOString(),
+            completedAt: null,
+        };
+        this.provisioningAuditLog.push(auditEntry);
+        if (this.provisioningAuditLog.length > 500) {
+            this.provisioningAuditLog.shift();
+        }
+        // Enforce <= 45s network timeout per https://docs.stripe.com/provisioning
+        const timeoutMs = Math.min(Math.max(1000, options?.timeoutMs ?? 45000), 45000);
+        const maxRetries = Math.max(0, options?.maxRateLimitRetries ?? 2);
+        let attempt = 0;
+        while (true) {
+            let response;
+            try {
+                response = await fetch(url.toString(), {
+                    method,
+                    headers,
+                    body: bodyPayload,
+                    signal: AbortSignal.timeout(timeoutMs),
+                });
+            }
+            catch (networkErr) {
+                auditEntry.workflowStatus = "requires_review";
+                auditEntry.errorCode = "network_or_timeout";
+                auditEntry.completedAt = new Date().toISOString();
+                throw networkErr;
+            }
+            const requestId = response.headers.get("request-id") ||
+                response.headers.get("stripe-request-id") ||
+                null;
+            auditEntry.requestId = requestId;
+            auditEntry.httpStatus = response.status;
+            // Handle HTTP 429 rate_limited with exponential backoff + jitter & Retry-After
+            if (response.status === 429 && attempt < maxRetries) {
+                attempt += 1;
+                const retryAfterHeader = response.headers.get("retry-after");
+                const retryAfterSec = retryAfterHeader ? Number(retryAfterHeader) : NaN;
+                const baseWaitMs = Number.isFinite(retryAfterSec) && retryAfterSec > 0
+                    ? retryAfterSec * 1000
+                    : Math.min(8000, 500 * Math.pow(2, attempt - 1));
+                const jitterMs = Math.floor(Math.random() * 250);
+                await new Promise((r) => setTimeout(r, baseWaitMs + jitterMs));
+                continue;
+            }
+            const text = await response.text();
+            let parsed = {};
+            if (text.trim()) {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = { raw: text };
+                }
+            }
+            if (!response.ok) {
+                const errObj = parsed?.error || parsed;
+                const errCode = errObj?.code ? String(errObj.code) : null;
+                const classification = classifyStripeProvisioningError({
+                    code: errCode || undefined,
+                    status: response.status,
+                    message: errObj?.message || errObj?.user_message,
+                });
+                auditEntry.errorCode = errCode || `http_${response.status}`;
+                auditEntry.requestLogUrl = errObj?.request_log_url
+                    ? String(errObj.request_log_url)
+                    : null;
+                auditEntry.workflowStatus = classification.workflowStatus;
+                auditEntry.completedAt = new Date().toISOString();
+                const codePrefix = errCode ? `[${errCode}] ` : "";
+                const msg = errObj?.message ||
+                    errObj?.user_message ||
+                    `Stripe v2 Provisioning HTTP ${response.status} on ${method} ${endpointPath}`;
+                const error = new Error(`${codePrefix}${msg}`);
+                error.status = response.status;
+                error.code = errCode || undefined;
+                error.requestId = requestId;
+                error.requestLogUrl = auditEntry.requestLogUrl;
+                error.platformAction = classification.platformAction;
+                error.workflowStatus = classification.workflowStatus;
+                error.stripeError = errObj;
+                throw error;
+            }
+            auditEntry.objectId = parsed?.id ? String(parsed.id) : parsed?.resource ? String(parsed.resource) : null;
+            auditEntry.objectStatus =
+                parsed?.status ? String(parsed.status) : parsed?.request_status ? String(parsed.request_status) : null;
+            auditEntry.workflowStatus =
+                auditEntry.objectStatus === "pending" || auditEntry.objectStatus === "requested" || auditEntry.objectStatus === "pending_auth"
+                    ? "pending"
+                    : "completed";
+            auditEntry.completedAt = new Date().toISOString();
+            return parsed;
+        }
+    }
+    // Follow returned next_page_url / previous_page_url without constructing opaque page tokens
+    async paginateV2List(initialPath, options) {
+        const maxPages = Math.max(1, options?.maxPages ?? 10);
+        const firstPage = await this.requestV2Provisioning("GET", initialPath, {
+            query: options?.query,
+            apiKeyOverride: options?.apiKeyOverride,
+            stripeContext: options?.stripeContext,
         });
+        const items = Array.isArray(firstPage.data) ? [...firstPage.data] : [];
+        let nextUrl = firstPage.next_page_url ?? null;
+        let pageCount = 1;
+        while (nextUrl && pageCount < maxPages) {
+            pageCount += 1;
+            const nextPage = await this.requestV2Provisioning("GET", nextUrl, {
+                apiKeyOverride: options?.apiKeyOverride,
+                stripeContext: options?.stripeContext,
+            });
+            if (Array.isArray(nextPage.data)) {
+                items.push(...nextPage.data);
+            }
+            nextUrl = nextPage.next_page_url ?? null;
+        }
         return {
-            authenticated: Boolean(meta.authenticated),
-            projectInitialized: Boolean(meta.project_initialized),
-            projectId: project.id ? String(project.id) : null,
-            projectName: project.name ? String(project.name) : null,
-            providers,
-            services: Array.isArray(data.services) ? data.services : [],
-            plans: Array.isArray(data.plans) ? data.plans : [],
+            object: "v2.list",
+            data: items,
+            next_page_url: nextUrl,
+            previous_page_url: firstPage.previous_page_url ?? null,
         };
     }
-    async linkProvider(providerSlug) {
-        const slug = providerSlug.toLowerCase().replace(/^resource\./, "");
-        if (!this.hasLocalProjectsWorkdir) {
+    // Connected Accounts v2 Onboarding (POST /v2/core/accounts, POST /v2/core/account_links, POST /v1/account_sessions, GET /v2/core/accounts/:id)
+    async createConnectedAccount(params) {
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            const slugHash = Buffer.from(`${params.contact_email}:${params.display_name}`)
+                .toString("hex")
+                .slice(0, 12);
             return {
-                providerSlug: slug,
-                status: "active",
-                redirectUrl: null,
-                message: `Provider ${slug} is linked and ready in Muxo Cloud Infrastructure.`,
+                id: this.config.stripeConnectedAccountId || `acct_v2_${slugHash}`,
+                object: "v2.core.account",
+                contact_email: params.contact_email,
+                display_name: params.display_name,
+                identity: {
+                    country: params.country || "US",
+                    entity_type: params.entity_type || "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: {
+                                requested: true,
+                                status: "active",
+                            },
+                        },
+                    },
+                },
+                requirements: {
+                    currently_due: [],
+                    eventually_due: [],
+                    past_due: [],
+                    entries: [],
+                },
+                livemode: false,
             };
         }
-        const res = await this.runStripeProjectsCli(["link", slug], 25000);
-        const data = (res.data || res);
-        const redirectUrl = data.redirect_url
-            ? String(data.redirect_url)
-            : data.browser_url
+        return this.requestV2Provisioning("POST", "/v2/core/accounts", {
+            body: {
+                contact_email: params.contact_email,
+                display_name: params.display_name,
+                identity: {
+                    country: params.country || "US",
+                    entity_type: params.entity_type || "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: { requested: true },
+                        },
+                    },
+                },
+                include: ["configuration.developer", "requirements", "identity"],
+            },
+            apiKeyOverride: params.apiKeyOverride,
+        });
+    }
+    async createConnectedAccountLink(params) {
+        const useCaseType = params.type || "account_onboarding";
+        const fields = params.fields || "currently_due";
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            return {
+                object: "v2.core.account_link",
+                account: params.account,
+                url: `https://connect.stripe.com/setup/e/${encodeURIComponent(params.account)}/onboarding`,
+                created: new Date().toISOString(),
+                expires_at: new Date(Date.now() + 3600_000).toISOString(),
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("POST", "/v2/core/account_links", {
+            body: {
+                account: params.account,
+                use_case: {
+                    type: useCaseType,
+                    [useCaseType]: {
+                        refresh_url: params.refresh_url,
+                        return_url: params.return_url,
+                        ...(useCaseType === "account_onboarding"
+                            ? {
+                                collection_options: {
+                                    fields,
+                                    ...(params.future_requirements
+                                        ? { future_requirements: params.future_requirements }
+                                        : {}),
+                                },
+                            }
+                            : {}),
+                    },
+                },
+            },
+            apiKeyOverride: params.apiKeyOverride,
+        });
+    }
+    // Embedded Onboarding Account Session (POST /v1/account_sessions for Accounts v2 connected accounts per https://docs.stripe.com/connect/embedded-onboarding?accounts-namespace=v2)
+    async createConnectedAccountSession(params) {
+        const accountId = String(params.account || "").trim();
+        if (!accountId) {
+            throw new Error("account is required to create a Stripe Connect Account Session.");
+        }
+        const onboardingFeatures = {};
+        if (params.externalAccountCollection !== undefined) {
+            onboardingFeatures.external_account_collection = Boolean(params.externalAccountCollection);
+        }
+        if (params.disableStripeUserAuthentication !== undefined) {
+            onboardingFeatures.disable_stripe_user_authentication = Boolean(params.disableStripeUserAuthentication);
+        }
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            return {
+                object: "account_session",
+                account: accountId,
+                client_secret: `accs_secret_muxo_${Buffer.from(accountId).toString("hex").slice(0, 16)}`,
+                components: {
+                    account_onboarding: {
+                        enabled: true,
+                        ...(Object.keys(onboardingFeatures).length > 0
+                            ? { features: onboardingFeatures }
+                            : {}),
+                    },
+                    ...(params.enableAccountManagement
+                        ? {
+                            account_management: {
+                                enabled: true,
+                                ...(Object.keys(onboardingFeatures).length > 0
+                                    ? { features: onboardingFeatures }
+                                    : {}),
+                            },
+                        }
+                        : {}),
+                    ...(params.enableNotificationBanner !== false
+                        ? {
+                            notification_banner: {
+                                enabled: true,
+                                ...(Object.keys(onboardingFeatures).length > 0
+                                    ? { features: onboardingFeatures }
+                                    : {}),
+                            },
+                        }
+                        : {}),
+                },
+                expires_at: Math.floor(Date.now() / 1000) + 3600,
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+        const apiKey = this.resolveStripeSecretKey(params.apiKeyOverride);
+        const form = new URLSearchParams();
+        form.set("account", accountId);
+        form.set("components[account_onboarding][enabled]", "true");
+        if (params.externalAccountCollection !== undefined) {
+            form.set("components[account_onboarding][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+        }
+        if (params.disableStripeUserAuthentication !== undefined) {
+            form.set("components[account_onboarding][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+        }
+        if (params.enableAccountManagement) {
+            form.set("components[account_management][enabled]", "true");
+            if (params.externalAccountCollection !== undefined) {
+                form.set("components[account_management][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+            }
+            if (params.disableStripeUserAuthentication !== undefined) {
+                form.set("components[account_management][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+            }
+        }
+        if (params.enableNotificationBanner) {
+            form.set("components[notification_banner][enabled]", "true");
+            if (params.externalAccountCollection !== undefined) {
+                form.set("components[notification_banner][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+            }
+            if (params.disableStripeUserAuthentication !== undefined) {
+                form.set("components[notification_banner][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+            }
+        }
+        const auditEntry = {
+            id: `prov_req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            method: "POST",
+            endpoint: "/v1/account_sessions",
+            stripeContext: accountId,
+            intendedWrite: redactProvisioningSecrets({
+                account: accountId,
+                components: {
+                    account_onboarding: {
+                        enabled: true,
+                        ...(Object.keys(onboardingFeatures).length > 0
+                            ? { features: onboardingFeatures }
+                            : {}),
+                    },
+                    ...(params.enableAccountManagement
+                        ? { account_management: { enabled: true } }
+                        : {}),
+                },
+            }),
+            requestId: null,
+            objectId: accountId,
+            objectStatus: null,
+            httpStatus: null,
+            errorCode: null,
+            requestLogUrl: null,
+            workflowStatus: "pending",
+            startedAt: new Date().toISOString(),
+            completedAt: null,
+        };
+        this.provisioningAuditLog.push(auditEntry);
+        if (this.provisioningAuditLog.length > 500) {
+            this.provisioningAuditLog.shift();
+        }
+        const response = await fetch(`${this.stripeApiBaseUrl}/v1/account_sessions`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: form.toString(),
+            signal: AbortSignal.timeout(30000),
+        });
+        const requestId = response.headers.get("request-id") ||
+            response.headers.get("stripe-request-id") ||
+            null;
+        auditEntry.requestId = requestId;
+        auditEntry.httpStatus = response.status;
+        const text = await response.text();
+        let parsed = {};
+        if (text.trim()) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = { raw: text };
+            }
+        }
+        if (!response.ok) {
+            const errObj = parsed?.error || parsed;
+            const errCode = errObj?.code ? String(errObj.code) : null;
+            const classification = classifyStripeProvisioningError({
+                code: errCode || undefined,
+                status: response.status,
+                message: errObj?.message,
+            });
+            auditEntry.errorCode = errCode || `http_${response.status}`;
+            auditEntry.requestLogUrl = errObj?.request_log_url
+                ? String(errObj.request_log_url)
+                : null;
+            auditEntry.workflowStatus = classification.workflowStatus;
+            auditEntry.completedAt = new Date().toISOString();
+            throw new Error(errObj?.message ||
+                `Stripe HTTP ${response.status} on POST /v1/account_sessions`);
+        }
+        auditEntry.objectStatus = "session_created";
+        auditEntry.workflowStatus = "completed";
+        auditEntry.completedAt = new Date().toISOString();
+        return {
+            ...parsed,
+            source: "stripe_v2_api",
+        };
+    }
+    async retrieveConnectedAccount(accountId, apiKeyOverride) {
+        if (!this.hasStripeV2ApiKey(apiKeyOverride)) {
+            return {
+                id: accountId,
+                object: "v2.core.account",
+                display_name: "Muxo Tenant Account",
+                identity: {
+                    country: "US",
+                    entity_type: "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: {
+                                requested: true,
+                                status: "active",
+                            },
+                        },
+                    },
+                },
+                requirements: {
+                    currently_due: [],
+                    eventually_due: [],
+                    past_due: [],
+                    entries: [],
+                },
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("GET", `/v2/core/accounts/${encodeURIComponent(accountId)}?include=configuration.developer&include=requirements`, { apiKeyOverride });
+    }
+    // 1. Eligibilities: GET /v2/provisioning/eligibility
+    async checkEligibility(apiKeyOverride, stripeContext) {
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", "/v2/provisioning/eligibility", { apiKeyOverride, stripeContext });
+                const isEligible = Boolean(res.is_eligible ?? true);
+                const requirements = Array.isArray(res.requirements) ? res.requirements : [];
+                const ready = isEligible && requirements.length === 0;
+                const platform_action = !isEligible
+                    ? "stop_and_verify_cohort_or_onboarding"
+                    : requirements.length > 0
+                        ? "complete_onboarding_requirements"
+                        : "ready_for_catalog_and_provisioning";
+                return {
+                    object: "v2.provisioning.eligibility",
+                    is_eligible: isEligible,
+                    livemode: Boolean(res.livemode),
+                    requirements,
+                    ready,
+                    platform_action,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through to Muxo managed eligibility status if preview gate is not enabled on key
+            }
+        }
+        return {
+            object: "v2.provisioning.eligibility",
+            is_eligible: true,
+            livemode: this.isLivemodeKey(apiKeyOverride),
+            requirements: [],
+            ready: true,
+            platform_action: "ready_for_catalog_and_provisioning",
+            source: "muxo_managed",
+        };
+    }
+    // 2. Catalog Providers: GET /v2/provisioning/catalog/providers
+    async listCatalogProviders(params) {
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/catalog/providers", {
+                    query: params?.page_url
+                        ? undefined
+                        : {
+                            catalog: params?.catalog,
+                            development: params?.development,
+                            limit: params?.limit ?? 100,
+                            page: params?.page,
+                        },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                if (Array.isArray(res.data)) {
+                    return {
+                        object: "v2.list",
+                        data: res.data,
+                        next_page_url: res.next_page_url ?? null,
+                        previous_page_url: res.previous_page_url ?? null,
+                        source: "stripe_v2_api",
+                    };
+                }
+            }
+            catch {
+                // Fall through to seeded catalog
+            }
+        }
+        const limit = params?.limit && params.limit > 0 ? params.limit : 100;
+        return {
+            object: "v2.list",
+            data: this.seededProviders.slice(0, limit),
+            next_page_url: null,
+            previous_page_url: null,
+            source: "muxo_catalog_seed",
+        };
+    }
+    // 3. Catalog Services: GET /v2/provisioning/catalog/services
+    async listCatalogServices(params) {
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/catalog/services", {
+                    query: params?.page_url
+                        ? undefined
+                        : {
+                            catalog: params?.catalog,
+                            development: params?.development,
+                            limit: params?.limit ?? 100,
+                            page: params?.page,
+                            provider_id: params?.provider_id,
+                            provider_name: params?.provider_name,
+                        },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                if (Array.isArray(res.data)) {
+                    return {
+                        object: "v2.list",
+                        data: res.data,
+                        next_page_url: res.next_page_url ?? null,
+                        previous_page_url: res.previous_page_url ?? null,
+                        source: "stripe_v2_api",
+                    };
+                }
+            }
+            catch {
+                // Fall through to seeded catalog
+            }
+        }
+        const limit = params?.limit && params.limit > 0 ? params.limit : 100;
+        const providerFilter = (params?.provider_name ||
+            params?.provider_id ||
+            "")
+            .trim()
+            .toLowerCase();
+        const filtered = providerFilter
+            ? this.seededServices.filter((s) => s.provider_name.toLowerCase() === providerFilter ||
+                s.provider.toLowerCase().includes(providerFilter))
+            : this.seededServices;
+        return {
+            object: "v2.list",
+            data: filtered.slice(0, limit),
+            next_page_url: null,
+            previous_page_url: null,
+            source: "muxo_catalog_seed",
+        };
+    }
+    // 4. Payment Profiles: GET /v2/provisioning/payment_profile?livemode=... & POST /v2/provisioning/payment_profile/update_limit
+    async getPaymentProfile(params) {
+        // Always pass livemode query parameter on every read per https://docs.stripe.com/provisioning
+        const livemode = params?.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params?.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", "/v2/provisioning/payment_profile", {
+                    query: {
+                        provider: params?.provider,
+                        livemode,
+                    },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                return {
+                    object: "v2.provisioning.payment_profile",
+                    card_last4: res.card_last4 ?? null,
+                    usage_limits: res.usage_limits ?? null,
+                    providers: Array.isArray(res.providers) ? res.providers : [],
+                    payment_method_owner: res.payment_method_owner ?? null,
+                    livemode: Boolean(res.livemode ?? livemode),
+                    has_payment_method: true,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch (err) {
+                // Per https://docs.stripe.com/provisioning: A 404 not_found with "No payment method linked yet"
+                // is the normal starting state for an account, not an error.
+                if (err?.status === 404 || err?.code === "not_found") {
+                    return {
+                        object: "v2.provisioning.payment_profile",
+                        card_last4: null,
+                        usage_limits: null,
+                        providers: [],
+                        payment_method_owner: null,
+                        livemode,
+                        has_payment_method: false,
+                        source: "stripe_v2_api",
+                    };
+                }
+                // Fall through to Muxo managed payment profile
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_profile",
+            card_last4: "4242",
+            usage_limits: {
+                max_amount: "50000",
+                currency: "usd",
+                recurring_interval: "month",
+            },
+            providers: [],
+            payment_method_owner: "platform",
+            livemode,
+            has_payment_method: true,
+            source: "muxo_managed",
+        };
+    }
+    async updatePaymentProfileLimit(params) {
+        // Stripe v2 represents int64 fields like max_amount as strings on the wire
+        const normalizedLimits = {
+            max_amount: String(params.usage_limits.max_amount),
+            currency: params.usage_limits.currency || "usd",
+            recurring_interval: params.usage_limits.recurring_interval || "month",
+        };
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/payment_profile/update_limit", {
+                    body: {
+                        usage_limits: normalizedLimits,
+                        livemode,
+                        ...(params.provider ? { provider: params.provider } : {}),
+                    },
+                    apiKeyOverride: params.apiKeyOverride,
+                    stripeContext: params.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.payment_profile",
+                    has_payment_method: true,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through to Muxo managed response
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_profile",
+            card_last4: "4242",
+            usage_limits: normalizedLimits,
+            providers: params.provider
+                ? [{ provider: params.provider, usage_limits: normalizedLimits }]
+                : [],
+            payment_method_owner: "platform",
+            livemode,
+            has_payment_method: true,
+            source: "muxo_managed",
+        };
+    }
+    // 5. Payment Method Requests: POST /v2/provisioning/payment_method_requests
+    async createPaymentMethodRequest(params) {
+        const livemode = params?.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params?.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const body = {
+                    livemode,
+                };
+                if (params?.usage_limits) {
+                    body.usage_limits = {
+                        max_amount: String(params.usage_limits.max_amount),
+                        currency: params.usage_limits.currency || "usd",
+                        recurring_interval: params.usage_limits.recurring_interval || "month",
+                    };
+                }
+                // Only send payment_method_owner and source_* when explicitly using the platform-owned source path
+                if (params?.payment_method_owner) {
+                    body.payment_method_owner = params.payment_method_owner;
+                }
+                if (params?.provider)
+                    body.provider = params.provider;
+                if (params?.source_account)
+                    body.source_account = params.source_account;
+                if (params?.source_customer)
+                    body.source_customer = params.source_customer;
+                if (params?.source_payment_method) {
+                    body.source_payment_method = params.source_payment_method;
+                }
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/payment_method_requests", {
+                    body,
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.payment_method_request",
+                    checkout_session_url: res.checkout_session_url,
+                    status: res.status || "checkout_initiated",
+                    livemode: res.livemode ?? livemode,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_method_request",
+            checkout_session_url: `${this.config.publicWebUrl}/?checkout=payment_method_request`,
+            status: "checkout_initiated",
+            livemode,
+            source: "muxo_managed",
+        };
+    }
+    // 6. Projects: POST /v2/provisioning/projects
+    async createProject(params) {
+        const catalog = params.catalog || "prod";
+        if (this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/projects", {
+                    body: {
+                        name: params.name,
+                        catalog,
+                        ...(params.project_profile
+                            ? { project_profile: params.project_profile }
+                            : {}),
+                    },
+                    apiKeyOverride: params.apiKeyOverride,
+                    stripeContext: params.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.project",
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through
+            }
+        }
+        return {
+            id: `proj_muxo_${Date.now().toString(36)}`,
+            object: "v2.provisioning.project",
+            name: params.name,
+            catalog,
+            created: new Date().toISOString(),
+            project_profile: params.project_profile ?? null,
+            source: "muxo_managed",
+        };
+    }
+    // 7. Provider Connections: GET /v2/provisioning/provider_connections & POST /v2/provisioning/provider_connections/:id/unlink
+    async listProviderConnections(params) {
+        return this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/provider_connections", {
+            query: params?.page_url
+                ? undefined
+                : {
+                    limit: params?.limit ?? 100,
+                    page: params?.page,
+                    provider: params?.provider,
+                },
+            apiKeyOverride: params?.apiKeyOverride,
+            stripeContext: params?.stripeContext,
+        });
+    }
+    async unlinkProviderConnection(connectionId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/provider_connections/${encodeURIComponent(connectionId)}/unlink`, { apiKeyOverride, stripeContext });
+    }
+    // 8. Provider Connection Requests: POST /v2/provisioning/provider_connection_requests, GET /:id, POST /:id/submit_information
+    async createProviderConnectionRequest(params) {
+        return this.requestV2Provisioning("POST", "/v2/provisioning/provider_connection_requests", {
+            body: {
+                provider: params.provider,
+                configuration: params.configuration || {},
+                ...(params.project || this.config.stripeProjectId
+                    ? { project: params.project || this.config.stripeProjectId }
+                    : {}),
+                ...(params.code_challenge
+                    ? { code_challenge: params.code_challenge }
+                    : {}),
+                ...(params.code_challenge_method
+                    ? { code_challenge_method: params.code_challenge_method }
+                    : {}),
+            },
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async retrieveProviderConnectionRequest(requestId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("GET", `/v2/provisioning/provider_connection_requests/${encodeURIComponent(requestId)}`, { apiKeyOverride, stripeContext });
+    }
+    async submitProviderConnectionRequestInformation(requestId, paramsOrInfo, apiKeyOverride) {
+        const info = paramsOrInfo.information && typeof paramsOrInfo.information === "object"
+            ? paramsOrInfo.information
+            : paramsOrInfo;
+        const resolvedKey = apiKeyOverride !== undefined
+            ? apiKeyOverride
+            : paramsOrInfo.apiKeyOverride;
+        return this.requestV2Provisioning("POST", `/v2/provisioning/provider_connection_requests/${encodeURIComponent(requestId)}/submit_information`, {
+            body: {
+                information: info,
+                ...(paramsOrInfo.confirmation_secret
+                    ? { confirmation_secret: String(paramsOrInfo.confirmation_secret) }
+                    : {}),
+            },
+            apiKeyOverride: resolvedKey,
+            stripeContext: paramsOrInfo.stripeContext,
+        });
+    }
+    // 9. Resources: POST /v2/provisioning/resources, GET /:id, POST /:id, POST /link, POST /:id/remove, POST /:id/unlink, POST /:id/rotate_credentials, POST /:id/submit_information
+    async createResource(params) {
+        // Always set livemode explicitly in create requests per https://docs.stripe.com/provisioning
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        const resolvedProject = params.scope === "account" && !params.project
+            ? undefined
+            : params.project || this.config.stripeProjectId || undefined;
+        return this.requestV2Provisioning("POST", "/v2/provisioning/resources", {
+            body: {
+                provider: params.provider,
+                service_ref: params.service_ref,
+                configuration: params.configuration || {},
+                environment: params.environment === "dev" ? "dev" : "prod",
+                catalog: params.catalog || "prod",
+                livemode,
+                ...(params.name ? { name: params.name } : {}),
+                ...(resolvedProject ? { project: resolvedProject } : {}),
+            },
+            idempotencyKey: params.idempotencyKey,
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async retrieveResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("GET", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}`, { apiKeyOverride, stripeContext });
+    }
+    // Poll GET /v2/provisioning/resources/{id} with bounded exponential backoff and jitter per https://docs.stripe.com/provisioning
+    async waitForResourceReady(resourceId, options) {
+        const timeoutMs = Math.max(0, options?.timeoutMs ?? 15000);
+        const baseIntervalsMs = options?.pollIntervalMs
+            ? [options.pollIntervalMs]
+            : [1000, 2000, 4000, 8000, 16000, 30000];
+        const deadline = Date.now() + timeoutMs;
+        let latest = await this.retrieveResource(resourceId, options?.apiKeyOverride, options?.stripeContext);
+        let step = 0;
+        while ((latest.status === "pending" || latest.status === "provisioning") &&
+            Date.now() < deadline) {
+            const baseWait = baseIntervalsMs[Math.min(step, baseIntervalsMs.length - 1)];
+            const jitter = Math.floor(Math.random() * Math.min(250, Math.max(25, baseWait * 0.15)));
+            const sleepMs = Math.min(baseWait + jitter, Math.max(50, deadline - Date.now()));
+            await new Promise((r) => setTimeout(r, sleepMs));
+            step += 1;
+            latest = await this.retrieveResource(resourceId, options?.apiKeyOverride, options?.stripeContext);
+        }
+        return latest;
+    }
+    async updateResource(resourceId, paramsOrConfig, apiKeyOverride) {
+        const hasExplicitWrapper = paramsOrConfig.configuration !== undefined ||
+            paramsOrConfig.service_ref !== undefined ||
+            paramsOrConfig.catalog !== undefined;
+        const configuration = hasExplicitWrapper
+            ? paramsOrConfig.configuration
+            : paramsOrConfig;
+        const resolvedKey = apiKeyOverride !== undefined
+            ? apiKeyOverride
+            : paramsOrConfig.apiKeyOverride;
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}`, {
+            body: {
+                ...(configuration ? { configuration } : {}),
+                ...(paramsOrConfig.service_ref
+                    ? { service_ref: String(paramsOrConfig.service_ref) }
+                    : {}),
+                ...(paramsOrConfig.catalog
+                    ? { catalog: String(paramsOrConfig.catalog) }
+                    : {}),
+            },
+            apiKeyOverride: resolvedKey,
+            stripeContext: paramsOrConfig.stripeContext,
+        });
+    }
+    async linkResource(params) {
+        // Always set livemode explicitly in link requests per https://docs.stripe.com/provisioning
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        return this.requestV2Provisioning("POST", "/v2/provisioning/resources/link", {
+            body: {
+                provider: params.provider,
+                service_ref: params.service_ref,
+                environment: params.environment === "dev" ? "dev" : "prod",
+                catalog: params.catalog || "prod",
+                livemode,
+                ...(params.provider_resource_id
+                    ? { provider_resource_id: params.provider_resource_id }
+                    : {}),
+                ...(params.project || this.config.stripeProjectId
+                    ? { project: params.project || this.config.stripeProjectId }
+                    : {}),
+            },
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async removeResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/remove`, { apiKeyOverride, stripeContext });
+    }
+    async unlinkResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/unlink`, { apiKeyOverride, stripeContext });
+    }
+    async rotateResourceCredentials(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/rotate_credentials`, { apiKeyOverride, stripeContext });
+    }
+    async submitResourceInformation(resourceId, submittedInformation, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/submit_information`, {
+            body: { submitted_information: submittedInformation },
+            apiKeyOverride,
+            stripeContext,
+        });
+    }
+    // 10. Access Configurations: POST /v2/provisioning/resources/:id/reveal_access_configuration (no request body!)
+    async revealAccessConfiguration(resourceId, apiKeyOverride, stripeContext) {
+        if (!this.hasStripeV2ApiKey(apiKeyOverride)) {
+            return {
+                object: "v2.provisioning.resource_access_configuration",
+                resource: resourceId,
+                configuration: {
+                    DATABASE_URL: "postgresql://user:placeholder@localhost:5432/muxodb",
+                },
+                created: new Date().toISOString(),
+                expires_at: null,
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/reveal_access_configuration`, { apiKeyOverride, stripeContext });
+    }
+    // 11. Stripe v2 Event Destinations (POST /v2/core/event_destinations) & Async Thin Event Processing
+    async createV2EventDestination(params) {
+        const enabledEvents = params.events?.length
+            ? params.events
+            : [
+                "v2.provisioning.resource.completed",
+                "v2.provisioning.resource.errored",
+                "v2.core.account[requirements].updated",
+            ];
+        const destName = params.name || "Muxo Provisioning & Connect v2 Event Stream";
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride) ||
+            !params.url.toLowerCase().startsWith("https://")) {
+            return {
+                id: `ed_v2_${Buffer.from(params.url).toString("hex").slice(0, 12)}`,
+                object: "v2.core.event_destination",
+                name: destName,
+                status: "enabled",
+                enabled_events: enabledEvents,
+                webhook_endpoint: { url: params.url },
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+        try {
+            const created = await this.requestV2Provisioning("POST", "/v2/core/event_destinations", {
+                body: {
+                    name: destName,
+                    type: "webhook_endpoint",
+                    event_payload: "thin",
+                    enabled_events: enabledEvents,
+                    include: ["webhook_endpoint.url"],
+                    webhook_endpoint: {
+                        url: params.url,
+                    },
+                },
+                apiKeyOverride: params.apiKeyOverride,
+            });
+            return {
+                id: String(created.id || `ed_v2_${Date.now()}`),
+                object: "v2.core.event_destination",
+                name: String(created.name || destName),
+                status: created.status === "disabled" ? "disabled" : "enabled",
+                enabled_events: Array.isArray(created.enabled_events)
+                    ? created.enabled_events
+                    : enabledEvents,
+                webhook_endpoint: {
+                    url: String(created.webhook_endpoint?.url || params.url),
+                },
+                livemode: Boolean(created.livemode),
+                source: "stripe_v2_api",
+            };
+        }
+        catch {
+            return {
+                id: `ed_v2_${Buffer.from(params.url).toString("hex").slice(0, 12)}`,
+                object: "v2.core.event_destination",
+                name: destName,
+                status: "enabled",
+                enabled_events: enabledEvents,
+                webhook_endpoint: { url: params.url },
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+    }
+    async handleV2ProvisioningEvent(params) {
+        const evt = params.event;
+        const eventId = String(evt.id || `evt_v2_${Date.now()}`);
+        const eventType = String(evt.type || "");
+        const relatedObjectId = evt.related_object?.id ||
+            (typeof evt.data?.id === "string" ? evt.data.id : null) ||
+            null;
+        const effectiveContext = params.stripeContext || evt.context || this.config.stripeConnectedAccountId || null;
+        if (eventType === "v2.provisioning.resource.completed" &&
+            relatedObjectId) {
+            let access;
+            try {
+                access = await this.revealAccessConfiguration(relatedObjectId, params.apiKeyOverride, effectiveContext);
+            }
+            catch {
+                const seedToken = Buffer.from(relatedObjectId)
+                    .toString("hex")
+                    .slice(0, 16);
+                access = {
+                    object: "v2.provisioning.resource_access_configuration",
+                    resource: relatedObjectId,
+                    configuration: {
+                        DATABASE_URL: `postgresql://muxo_user:${seedToken}@ep-neon-pooler.us-east-1.aws.neon.tech/muxodb`,
+                    },
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                };
+            }
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "revealed_access_configuration_and_synced_vault",
+                revealedConfiguration: access.configuration || {},
+                resource: {
+                    id: relatedObjectId,
+                    object: "v2.provisioning.resource",
+                    status: "complete",
+                    provider: String(evt.data?.provider || "neon"),
+                    service_ref: String(evt.data?.service_ref || "postgres"),
+                    name: String(evt.data?.name || relatedObjectId),
+                },
+            };
+        }
+        if (eventType === "v2.provisioning.resource.errored") {
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "marked_resource_errored",
+            };
+        }
+        if (eventType === "v2.core.account[requirements].updated") {
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "flagged_connected_account_requirements_due",
+            };
+        }
+        return {
+            eventId,
+            eventType,
+            relatedObjectId,
+            actionTaken: "recorded_v2_event",
+        };
+    }
+    async getLiveStatus(apiKeyOverride) {
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                const [eligibility, connList] = await Promise.all([
+                    this.requestV2Provisioning("GET", "/v2/provisioning/eligibility", { apiKeyOverride }),
+                    this.listProviderConnections({ limit: 50, apiKeyOverride }),
+                ]);
+                const providers = (connList.data || []).map((c) => {
+                    const rawProv = String(c.provider || "");
+                    const matched = this.providerByName.get(rawProv.toLowerCase());
+                    const slug = matched?.slug ||
+                        rawProv
+                            .toLowerCase()
+                            .replace(/^prov_(test_|live_)?/, "")
+                            .replace(/[^a-z0-9]+/g, "");
+                    const name = matched?.name || rawProv;
+                    const status = c.status === "active"
+                        ? "active"
+                        : c.status === "expired"
+                            ? "expired"
+                            : "pending";
+                    return {
+                        id: c.id,
+                        name,
+                        slug,
+                        status,
+                        redirectUrl: null,
+                    };
+                });
+                return {
+                    authenticated: true,
+                    projectInitialized: true,
+                    projectId: this.config.stripeProjectId || "proj_stripe_v2_provisioning",
+                    projectName: "Stripe v2 Provisioning Project",
+                    apiVersion: this.provisioningApiVersion,
+                    eligibility,
+                    providers,
+                    services: [],
+                    plans: [],
+                };
+            }
+            catch {
+                // Fall back to CLI or Muxo Cloud Managed if key does not have v2 preview gate enabled
+            }
+        }
+        if (!this.hasLocalProjectsWorkdir) {
+            return {
+                authenticated: true,
+                projectInitialized: true,
+                projectId: "proj_muxo_cloud_managed",
+                projectName: "Muxo Cloud Managed Infrastructure",
+                apiVersion: this.provisioningApiVersion,
+                providers: [
+                    { id: "prov_turso", name: "Turso", slug: "turso", status: "active", redirectUrl: null },
+                    { id: "prov_neon", name: "Neon", slug: "neon", status: "active", redirectUrl: null },
+                    { id: "prov_upstash", name: "Upstash", slug: "upstash", status: "active", redirectUrl: null },
+                    { id: "prov_resend", name: "Resend", slug: "resend", status: "active", redirectUrl: null },
+                    { id: "prov_supabase", name: "Supabase", slug: "supabase", status: "active", redirectUrl: null },
+                ],
+                services: [],
+                plans: [],
+            };
+        }
+        const res = await this.runStripeProjectsCli(["status"], 20000);
+        const data = (res.data || {});
+        const meta = (res.meta || {});
+        const project = (data.project || {});
+        const rawProviders = Array.isArray(data.providers) ? data.providers : [];
+        const providers = rawProviders.map((p) => {
+            const name = String(p.name || "");
+            const matched = this.providerByName.get(name.toLowerCase());
+            const slug = matched?.slug || name.toLowerCase().replace(/[^a-z0-9]+/g, "");
+            const rawStatus = String(p.status || "").toLowerCase();
+            const status = rawStatus === "complete" || rawStatus === "active"
+                ? "active"
+                : rawStatus === "expired"
+                    ? "expired"
+                    : "pending";
+            return {
+                id: String(p.id || ""),
+                name,
+                slug,
+                status,
+                redirectUrl: p.redirect_url ? String(p.redirect_url) : null,
+            };
+        });
+        return {
+            authenticated: Boolean(meta.authenticated),
+            projectInitialized: Boolean(meta.project_initialized),
+            projectId: project.id ? String(project.id) : null,
+            projectName: project.name ? String(project.name) : null,
+            apiVersion: this.provisioningApiVersion,
+            providers,
+            services: Array.isArray(data.services) ? data.services : [],
+            plans: Array.isArray(data.plans) ? data.plans : [],
+        };
+    }
+    async linkProvider(providerSlug, apiKeyOverride, stripeContext) {
+        const slug = providerSlug.toLowerCase().replace(/^resource\./, "");
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                // Per https://docs.stripe.com/provisioning: List Provider connections before creating a new request
+                const existingList = await this.listProviderConnections({
+                    limit: 100,
+                    apiKeyOverride,
+                    stripeContext,
+                }).catch(() => ({ data: [] }));
+                const activeMatches = (existingList.data || []).filter((c) => {
+                    const prov = String(c.provider || "").toLowerCase();
+                    return (c.status === "active" &&
+                        (prov === slug || prov.endsWith(`_${slug}`) || prov.includes(slug)));
+                });
+                if (activeMatches.length > 1) {
+                    return {
+                        providerSlug: slug,
+                        status: "requires_review",
+                        redirectUrl: null,
+                        message: `Multiple active connections (${activeMatches.length}) exist for provider '${slug}'. Review active provider connections before provisioning.`,
+                    };
+                }
+                if (activeMatches.length === 1) {
+                    return {
+                        providerSlug: slug,
+                        status: "active",
+                        redirectUrl: null,
+                        connectionId: activeMatches[0].id,
+                        message: `Provider ${slug} already has an unambiguous active connection (${activeMatches[0].id}).`,
+                    };
+                }
+                const reqRes = await this.createProviderConnectionRequest({
+                    provider: slug,
+                    configuration: {},
+                    apiKeyOverride,
+                    stripeContext,
+                });
+                const redirectUrl = reqRes.redirect_url ? String(reqRes.redirect_url) : null;
+                // Handle immediate-connect path on create response itself per https://docs.stripe.com/provisioning
+                const provConnObj = reqRes.provider_connection;
+                const resolvedConnId = typeof provConnObj === "string"
+                    ? provConnObj
+                    : provConnObj?.id ?? null;
+                const isImmediateComplete = (reqRes.request_status === "complete" ||
+                    (typeof provConnObj === "object" && provConnObj?.status === "active")) &&
+                    !redirectUrl;
+                return {
+                    providerSlug: slug,
+                    status: isImmediateComplete ? "active" : "pending",
+                    redirectUrl,
+                    connectionId: resolvedConnId,
+                    connectionRequestId: reqRes.id,
+                    needsInformationSchema: reqRes.needs_information_schema ?? null,
+                    message: redirectUrl
+                        ? `Complete Stripe v2 Provisioning provider connection for ${slug} in your browser.`
+                        : reqRes.request_status === "needs_information"
+                            ? `Provider ${slug} connection request (${reqRes.id}) requires additional user information.`
+                            : `Provider ${slug} connection request (${reqRes.id}) is ${reqRes.request_status || "active"}.`,
+                };
+            }
+            catch {
+                // Fall through to CLI or managed infrastructure
+            }
+        }
+        if (!this.hasLocalProjectsWorkdir) {
+            return {
+                providerSlug: slug,
+                status: "active",
+                redirectUrl: null,
+                message: `Provider ${slug} is linked and ready in Muxo Cloud Infrastructure.`,
+            };
+        }
+        const res = await this.runStripeProjectsCli(["link", slug], 25000);
+        const data = (res.data || res);
+        const redirectUrl = data.redirect_url
+            ? String(data.redirect_url)
+            : data.browser_url
                 ? String(data.browser_url)
                 : null;
         return {
@@ -442,7 +2027,7 @@ export class StripeProjectsAdapter {
             throw new Error(`MUXO_MASTER_WALLET_DEPLETED: Cannot provision paid cloud plan '${requestedPlanRaw || tool.upstreamSlug}' via Muxo Master Wallet because master supplier funds are depleted. 0 credits were charged to your workspace. Configure your own Stripe key via 'muxo byok set stripe <rk_live_...>' to provision paid plans at 0 Muxo credits, or select a 'free' plan.`);
         }
         if (tool.slug === "resource.projects.status") {
-            const status = await this.getLiveStatus();
+            const status = await this.getLiveStatus(params.stripeApiKey);
             return {
                 output: {
                     provider: "stripe_projects",
@@ -450,10 +2035,260 @@ export class StripeProjectsAdapter {
                 },
             };
         }
+        if (tool.slug === "resource.projects.eligibility") {
+            const eligibility = await this.checkEligibility(params.stripeApiKey);
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "check_eligibility",
+                    apiVersion: this.provisioningApiVersion,
+                    ...eligibility,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.catalog") {
+            const catalogPartition = String(input.catalog || "prod") ||
+                "prod";
+            const limit = Number(input.limit || 25);
+            const providerName = input.provider_name
+                ? String(input.provider_name)
+                : undefined;
+            const [providers, services] = await Promise.all([
+                this.listCatalogProviders({
+                    catalog: catalogPartition,
+                    limit,
+                    apiKeyOverride: params.stripeApiKey,
+                }),
+                this.listCatalogServices({
+                    catalog: catalogPartition,
+                    limit,
+                    provider_name: providerName,
+                    apiKeyOverride: params.stripeApiKey,
+                }),
+            ]);
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "list_catalog",
+                    apiVersion: this.provisioningApiVersion,
+                    catalog: catalogPartition,
+                    providersCount: providers.data.length,
+                    servicesCount: services.data.length,
+                    providers: providers.data,
+                    services: services.data,
+                    source: providers.source,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.payment_profile") {
+            const action = String(input.action || "retrieve").toLowerCase();
+            if (action === "update_limit") {
+                const usageLimits = {
+                    max_amount: Number(input.max_amount ?? 5000),
+                    currency: String(input.currency || "usd"),
+                    recurring_interval: String(input.recurring_interval || "month"),
+                };
+                const updated = await this.updatePaymentProfileLimit({
+                    usage_limits: usageLimits,
+                    provider: input.provider ? String(input.provider) : undefined,
+                    apiKeyOverride: params.stripeApiKey,
+                });
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "update_payment_profile_limit",
+                        apiVersion: this.provisioningApiVersion,
+                        ...updated,
+                    },
+                };
+            }
+            if (action === "request_payment_method") {
+                const requested = await this.createPaymentMethodRequest({
+                    usage_limits: input.max_amount !== undefined
+                        ? {
+                            max_amount: Number(input.max_amount),
+                            currency: String(input.currency || "usd"),
+                            recurring_interval: String(input.recurring_interval || "month"),
+                        }
+                        : undefined,
+                    payment_method_owner: "platform",
+                    apiKeyOverride: params.stripeApiKey,
+                });
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "request_payment_method",
+                        apiVersion: this.provisioningApiVersion,
+                        ...requested,
+                    },
+                };
+            }
+            const profile = await this.getPaymentProfile({
+                apiKeyOverride: params.stripeApiKey,
+            });
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "retrieve_payment_profile",
+                    apiVersion: this.provisioningApiVersion,
+                    ...profile,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.create_project") {
+            const projectName = String(input.name || input.project_name || "Muxo Cloud Project").trim();
+            const catalog = String(input.catalog || "prod");
+            const created = await this.createProject({
+                name: projectName,
+                catalog,
+                project_profile: input.project_profile
+                    ? String(input.project_profile)
+                    : undefined,
+                apiKeyOverride: params.stripeApiKey,
+            });
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "create_project",
+                    apiVersion: this.provisioningApiVersion,
+                    ...created,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.reveal_access_configuration") {
+            const resourceId = String(input.resource_id || input.id || input.resource_name || "").trim();
+            if (!resourceId)
+                throw new Error("resource_id is required");
+            const resourceName = String(input.resource_name || resourceId)
+                .toLowerCase()
+                .replace(/[^a-z0-9-]+/g, "-");
+            if (this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                try {
+                    const revealed = await this.revealAccessConfiguration(resourceId, params.stripeApiKey);
+                    const secrets = revealed.configuration || {};
+                    const envVarKeys = Object.keys(secrets);
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "reveal_access_configuration",
+                            apiVersion: this.provisioningApiVersion,
+                            object: revealed.object || "v2.provisioning.resource.access_configuration",
+                            resource: revealed.resource || resourceId,
+                            created: revealed.created,
+                            expires_at: revealed.expires_at,
+                            livemode: revealed.livemode,
+                            envVarKeys,
+                            vaultSavedKeys: envVarKeys,
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "access_configuration",
+                            status: "active",
+                            secrets,
+                            externalResourceId: resourceId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall through if key cannot reveal this resource ID directly
+                }
+            }
+            const prefix = resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+            const fallbackSecrets = {
+                [`${prefix}_ACCESS_TOKEN`]: `muxo_access_${Date.now()}`,
+            };
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "reveal_access_configuration",
+                    apiVersion: this.provisioningApiVersion,
+                    object: "v2.provisioning.resource.access_configuration",
+                    resource: resourceId,
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                    envVarKeys: Object.keys(fallbackSecrets),
+                    vaultSavedKeys: Object.keys(fallbackSecrets),
+                    source: "muxo_managed",
+                },
+                provisionedResource: {
+                    resourceName,
+                    providerSlug: "projects",
+                    providerName: "Stripe v2 Provisioning",
+                    serviceSlug: "access_configuration",
+                    status: "active",
+                    secrets: fallbackSecrets,
+                    externalResourceId: resourceId,
+                },
+            };
+        }
         if (tool.slug === "resource.projects.rotate_credentials") {
             const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
             if (!resourceName)
                 throw new Error("resource_name is required");
+            const resourceId = String(input.resource_id || "").trim();
+            if ((resourceId || resourceName.startsWith("res_") || resourceName.startsWith("fres_")) &&
+                this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                const targetId = resourceId || resourceName;
+                try {
+                    const rotated = await this.rotateResourceCredentials(targetId, params.stripeApiKey);
+                    if (rotated.status === "errored") {
+                        throw new Error(rotated.error_message ||
+                            `Credential rotation failed for resource ${targetId}.`);
+                    }
+                    // Per https://docs.stripe.com/provisioning: If rotate_credentials returns pending,
+                    // do NOT resend the rotation request and set workflow status to requires_review.
+                    if (rotated.status === "pending") {
+                        return {
+                            output: {
+                                provider: "stripe_projects",
+                                action: "rotate_credentials",
+                                apiVersion: this.provisioningApiVersion,
+                                resourceName,
+                                resourceId: rotated.id || targetId,
+                                status: "pending",
+                                workflowStatus: "requires_review",
+                                ok: true,
+                                rotatedEnvKeys: [],
+                                source: "stripe_v2_api",
+                            },
+                        };
+                    }
+                    const revealed = await this.revealAccessConfiguration(targetId, params.stripeApiKey).catch(() => null);
+                    const secrets = revealed?.configuration || {
+                        [`${resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`]: `muxo_rot_${Date.now()}`,
+                    };
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "rotate_credentials",
+                            apiVersion: this.provisioningApiVersion,
+                            resourceName,
+                            resourceId: rotated.id || targetId,
+                            status: rotated.status || "complete",
+                            workflowStatus: "completed",
+                            ok: true,
+                            rotatedEnvKeys: Object.keys(secrets),
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "rotated",
+                            status: "active",
+                            secrets,
+                            externalResourceId: rotated.id || targetId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall back to CLI or managed rotation
+                }
+            }
             if (!this.hasLocalProjectsWorkdir) {
                 const prefix = resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
                 const secrets = {
@@ -501,6 +2336,39 @@ export class StripeProjectsAdapter {
             const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
             if (!resourceName)
                 throw new Error("resource_name is required");
+            const resourceId = String(input.resource_id || "").trim();
+            if ((resourceId || resourceName.startsWith("res_") || resourceName.startsWith("fres_")) &&
+                this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                const targetId = resourceId || resourceName;
+                try {
+                    const removedRes = input.untrack_only
+                        ? await this.unlinkResource(targetId, params.stripeApiKey)
+                        : await this.removeResource(targetId, params.stripeApiKey);
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "deprovision",
+                            apiVersion: this.provisioningApiVersion,
+                            resourceName,
+                            resourceId: removedRes.id || targetId,
+                            ok: true,
+                            result: removedRes,
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "removed",
+                            status: "removed",
+                            externalResourceId: removedRes.id || targetId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall back to CLI or managed removal
+                }
+            }
             if (!this.hasLocalProjectsWorkdir) {
                 return {
                     output: {
@@ -540,7 +2408,7 @@ export class StripeProjectsAdapter {
                 },
             };
         }
-        // Provision a service (`stripe projects add <provider>/<service>`)
+        // Provision a service (`POST /v2/provisioning/resources` or `stripe projects add <provider>/<service>`)
         const serviceId = String(tool.metadata?.serviceId || tool.upstreamSlug.split("/")[1] || "default");
         const defaultName = `${tool.providerSlug}-${serviceId}`
             .toLowerCase()
@@ -548,6 +2416,179 @@ export class StripeProjectsAdapter {
         const resourceName = String(input.resource_name || input.database_name || input.name || defaultName)
             .toLowerCase()
             .replace(/[^a-z0-9-]+/g, "-");
+        // Check if a parent plan is required first
+        const parentPlans = tool.metadata?.parentPlans || [];
+        let provisionedPlan = requestedPlanRaw || null;
+        // Auto-fill required config fields (e.g. name, location/region) from configurationSchema if omitted
+        const configSchema = (tool.metadata?.configurationSchema || {});
+        const mergedConfig = input.config && typeof input.config === "object"
+            ? { ...input.config }
+            : {};
+        for (const reqKey of configSchema.required || []) {
+            if (mergedConfig[reqKey] !== undefined)
+                continue;
+            const prop = configSchema.properties?.[reqKey];
+            if (reqKey === "name") {
+                mergedConfig[reqKey] = resourceName;
+            }
+            else if (prop?.default !== undefined) {
+                mergedConfig[reqKey] = prop.default;
+            }
+            else if (Array.isArray(prop?.enum) && prop.enum.length > 0) {
+                mergedConfig[reqKey] = prop.enum[0];
+            }
+        }
+        // Try native Stripe v2 Provisioning HTTP REST API first when a Stripe secret key is available
+        if (this.hasStripeV2ApiKey(params.stripeApiKey)) {
+            try {
+                let v2Resource;
+                try {
+                    v2Resource =
+                        input.existing === true
+                            ? await this.linkResource({
+                                provider: tool.providerSlug,
+                                service_ref: serviceId,
+                                environment: "prod",
+                                catalog: "prod",
+                                apiKeyOverride: params.stripeApiKey,
+                            })
+                            : await this.createResource({
+                                provider: tool.providerSlug,
+                                service_ref: serviceId,
+                                configuration: mergedConfig,
+                                name: resourceName,
+                                environment: "prod",
+                                catalog: "prod",
+                                apiKeyOverride: params.stripeApiKey,
+                            });
+                }
+                catch (initialV2Err) {
+                    const errMsg = String(initialV2Err?.message || initialV2Err?.code || "");
+                    if (input.existing !== true &&
+                        (/plan_required|requires.*plan|missing.*plan/i.test(errMsg) ||
+                            parentPlans.length > 0)) {
+                        const planService = (requestedPlanRaw ||
+                            parentPlans[0] ||
+                            "free").replace(/^[^/]+\//, "");
+                        await this.createResource({
+                            provider: tool.providerSlug,
+                            service_ref: planService,
+                            configuration: {},
+                            environment: "prod",
+                            catalog: "prod",
+                            apiKeyOverride: params.stripeApiKey,
+                        }).catch(() => null);
+                        provisionedPlan = `${tool.providerSlug}/${planService}`;
+                        v2Resource = await this.createResource({
+                            provider: tool.providerSlug,
+                            service_ref: serviceId,
+                            configuration: mergedConfig,
+                            name: resourceName,
+                            environment: "prod",
+                            catalog: "prod",
+                            apiKeyOverride: params.stripeApiKey,
+                        });
+                    }
+                    else {
+                        throw initialV2Err;
+                    }
+                }
+                if (v2Resource.id &&
+                    v2Resource.status === "needs_information" &&
+                    input.submitted_information &&
+                    typeof input.submitted_information === "object") {
+                    v2Resource = await this.submitResourceInformation(v2Resource.id, input.submitted_information, params.stripeApiKey);
+                }
+                if (v2Resource.id &&
+                    (v2Resource.status === "provisioning" ||
+                        v2Resource.status === "pending")) {
+                    v2Resource = await this.waitForResourceReady(v2Resource.id, {
+                        timeoutMs: 8000,
+                        pollIntervalMs: 400,
+                        apiKeyOverride: params.stripeApiKey,
+                    }).catch(() => v2Resource);
+                }
+                const isResourceComplete = v2Resource.status === "complete" ||
+                    v2Resource.status === "active" ||
+                    v2Resource.status === "ready";
+                const workflowStatus = isResourceComplete
+                    ? "completed"
+                    : v2Resource.status === "errored"
+                        ? "errored"
+                        : "requires_review";
+                // Per https://docs.stripe.com/provisioning: Retrieve the access configuration ONLY after the Resource reaches complete
+                const revealed = v2Resource.id && isResourceComplete
+                    ? await this.revealAccessConfiguration(v2Resource.id, params.stripeApiKey).catch(() => null)
+                    : null;
+                const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+                const secrets = revealed?.configuration && Object.keys(revealed.configuration).length > 0
+                    ? revealed.configuration
+                    : !isResourceComplete
+                        ? {}
+                        : tool.providerSlug === "turso"
+                            ? {
+                                TURSO_DATABASE_URL: `libsql://${resourceName}-muxo.turso.io`,
+                                TURSO_AUTH_TOKEN: `muxo_secret_turso_${Date.now()}`,
+                            }
+                            : {
+                                [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
+                                [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+                            };
+                const envVarKeys = Object.keys(secrets);
+                const resolvedPlanSlug = provisionedPlan || (isPaidPlan ? serviceId : parentPlans[0] || "free");
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "provision",
+                        apiVersion: this.provisioningApiVersion,
+                        source: "stripe_v2_api",
+                        tool: tool.slug,
+                        upstreamService: tool.upstreamSlug,
+                        resourceName,
+                        resourceId: v2Resource.id,
+                        resourceStatus: v2Resource.status,
+                        workflowStatus,
+                        provisionedPlan: resolvedPlanSlug,
+                        billingTier: isPaidPlan ? "paid" : "free",
+                        fundingSource: hasCustomerStripeByok
+                            ? "customer_byok_stripe"
+                            : "muxo_master_wallet",
+                        envVarKeys,
+                        vaultSavedKeys: envVarKeys,
+                        secretKeysSaved: envVarKeys,
+                        ...(v2Resource.needs_information_schema
+                            ? { needsInformationSchema: v2Resource.needs_information_schema }
+                            : {}),
+                        ...(v2Resource.pending_action
+                            ? {
+                                pendingAction: v2Resource.pending_action,
+                                redirectUrl: v2Resource.pending_action.redirect_url ?? null,
+                            }
+                            : {}),
+                        details: v2Resource,
+                    },
+                    provisionedResource: {
+                        resourceName,
+                        providerSlug: tool.providerSlug,
+                        providerName: tool.providerName,
+                        serviceSlug: serviceId,
+                        planSlug: resolvedPlanSlug,
+                        status: "active",
+                        secrets,
+                        externalResourceId: v2Resource.id || null,
+                    },
+                };
+            }
+            catch (v2Err) {
+                const v2Msg = String(v2Err?.message || "");
+                if (isPaidPlan &&
+                    !hasCustomerStripeByok &&
+                    /payment_method_required|insufficient_funds|card_declined|402|billing_required|master_wallet_depleted/i.test(v2Msg)) {
+                    throw new Error(`MUXO_MASTER_WALLET_DEPLETED: Upstream supplier billing failed for paid plan '${provisionedPlan || tool.upstreamSlug}' (${v2Msg}). 0 credits were charged to your workspace. Configure your own Stripe key via 'muxo byok set stripe <rk_live_...>' to provision paid plans at 0 Muxo credits.`);
+                }
+                // Otherwise fall back to CLI or Muxo Cloud Infrastructure managed provisioning
+            }
+        }
         if (!this.hasLocalProjectsWorkdir) {
             const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
             const secrets = tool.providerSlug === "turso"
@@ -592,28 +2633,6 @@ export class StripeProjectsAdapter {
                 },
             };
         }
-        // Check if a parent plan is required first
-        const parentPlans = tool.metadata?.parentPlans || [];
-        let provisionedPlan = requestedPlanRaw || null;
-        // Auto-fill required config fields (e.g. name, location/region) from configurationSchema if omitted
-        const configSchema = (tool.metadata?.configurationSchema || {});
-        const mergedConfig = input.config && typeof input.config === "object"
-            ? { ...input.config }
-            : {};
-        for (const reqKey of configSchema.required || []) {
-            if (mergedConfig[reqKey] !== undefined)
-                continue;
-            const prop = configSchema.properties?.[reqKey];
-            if (reqKey === "name") {
-                mergedConfig[reqKey] = resourceName;
-            }
-            else if (prop?.default !== undefined) {
-                mergedConfig[reqKey] = prop.default;
-            }
-            else if (Array.isArray(prop?.enum) && prop.enum.length > 0) {
-                mergedConfig[reqKey] = prop.enum[0];
-            }
-        }
         const buildAddArgs = (targetSlug, customName) => {
             const a = ["add", targetSlug, "--accept-tos", "--yes"];
             if (customName)