@muxoai/platform 1.4.0 → 1.4.2

package/dist/providers/stripe-projects.js

@@ -2,8 +2,149 @@ import { execFile } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { promisify } from "node:util";
+import { buildStandardStripeProjectsSecrets, extractDatabaseMigrationsFromInput, extractHostedHtmlFromInput, isStripeProjectsDatabaseProvider, isStripeProjectsExclusiveProvider, isStripeProjectsHostingProvider, normalizeStripeProjectsProviderSlug, renderDefaultHostedSiteHtml, resolveStripeProjectsCanonicalToolSlug, STRIPE_PROJECTS_DEPLOYABLE_CATALOG, } from "../composio-catalog.js";
 import { ROOT_DIR } from "../config.js";
 const execFileAsync = promisify(execFile);
+export const DEFAULT_STRIPE_PROVISIONING_API_VERSION = "2026-09-30.preview";
+const SENSITIVE_FIELD_PATTERN = /secret|token|password|credential|access_configuration|confirmation_secret|checkout_session_url|redirect_url|database_url|api_key|private_key/i;
+export function redactProvisioningSecrets(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_FIELD_PATTERN.test(k)) {
+            out[k] = "[REDACTED]";
+        }
+        else if (v && typeof v === "object" && !Array.isArray(v)) {
+            out[k] = redactProvisioningSecrets(v);
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+export function classifyStripeProvisioningError(err) {
+    const code = String(err.code || "").toLowerCase();
+    const msg = String(err.message || "");
+    if (code === "payment_method_required") {
+        return {
+            platformAction: "Complete payment setup via POST /v2/provisioning/payment_method_requests, obtain user approval, then retry deliberately.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "payment_method_and_customer_required") {
+        return {
+            platformAction: "For an enabled platform-source flow, provide matching source_customer and source_payment_method.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "payment_method_owner_required") {
+        return {
+            platformAction: "For an enabled platform-source flow, set payment_method_owner=platform.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "unsupported_payment_method_owner") {
+        return {
+            platformAction: "Stop; use only a currently enabled payment_method_owner mode.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "connect_relationship_required") {
+        return {
+            platformAction: "Verify the platform-to-connected account relationship and the Stripe-Context header value.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "provider_reauth_required") {
+        return {
+            platformAction: "Create a new Provider connection request (POST /v2/provisioning/provider_connection_requests) and ask the user to reconnect.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "invalid_resource_configuration") {
+        return {
+            platformAction: "Refresh the catalog service configuration_schema and collect corrected user input.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_count_constraint_exceeded") {
+        return {
+            platformAction: "Explain the service constraint and offer an allowed update, association, or existing Resource.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_not_complete") {
+        return {
+            platformAction: "Retrieve the Resource (GET /v2/provisioning/resources/{id}) and follow its status. Poll while pending, submit_information when needs_information, and reveal_access_configuration only after status=complete.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (code === "resource_access_configuration_unavailable") {
+        return {
+            platformAction: "Stop. Relink or rotate the Resource, or follow Provider guidance in status details.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "resource_access_configuration_expired") {
+        return {
+            platformAction: "Rotate the Resource credentials (POST /v2/provisioning/resources/{id}/rotate_credentials). If complete, retrieve replacement; if pending, set workflow status to requires_review.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (err.status === 403) {
+        if (/provisioning_resource_reveal_access_configuration/i.test(msg)) {
+            return {
+                platformAction: "Use a restricted key with the provisioning_resource_reveal_access_configuration permission.",
+                workflowStatus: "errored",
+                retryable: false,
+            };
+        }
+        return {
+            platformAction: "Verify private-preview enrollment, the Stripe-Context connected account, and the Resource Project scope.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    if (code === "rate_limited" || err.status === 429) {
+        return {
+            platformAction: "Back off with exponential delay and jitter, honoring Retry-After if present.",
+            workflowStatus: "requires_review",
+            retryable: true,
+        };
+    }
+    if (code === "provider_failure") {
+        return {
+            platformAction: "Show a safe message. Identify returned prerequisite when possible; retry only after approval and only if safe.",
+            workflowStatus: "requires_review",
+            retryable: false,
+        };
+    }
+    if (code === "not_found" || err.status === 404) {
+        return {
+            platformAction: "Verify object ID and Stripe-Context; do not probe another account.",
+            workflowStatus: "errored",
+            retryable: false,
+        };
+    }
+    return {
+        platformAction: "Stop, record safe diagnostics, retrieve known objects in the same Stripe-Context, mark requires_review, and do not replay the write automatically.",
+        workflowStatus: "requires_review",
+        retryable: false,
+    };
+}
 export function isPaidCloudProvisioning(tool, input) {
     if (tool.lane !== "stripe_projects")
         return false;
@@ -24,18 +165,20 @@ export class StripeProjectsAdapter {
     config;
     tools = new Map();
     providerByName = new Map();
+    seededProviders = [];
+    seededServices = [];
     constructor(config) {
         this.config = config;
         this.loadCatalogSeed();
     }
     loadCatalogSeed() {
-        // Lifecycle management tools for Stripe Projects
+        // Lifecycle management tools for Stripe Projects & Stripe v2 Provisioning API
         const lifecycleTools = [
             {
                 slug: "resource.projects.status",
                 upstreamSlug: "projects/status",
                 name: "Cloud Infrastructure: Project & Provider Status",
-                description: "Inspect active provisioned resources, linked cloud providers (Neon, Supabase, Turso, Cloudflare, Vercel, etc.), and environment status.",
+                description: "Inspect active provisioned resources, linked cloud providers (Neon, Supabase, Turso, Cloudflare, Vercel, etc.), and environment status via Stripe v2 Provisioning.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -49,11 +192,169 @@ export class StripeProjectsAdapter {
                     properties: {},
                 },
             },
+            {
+                slug: "resource.projects.eligibility",
+                upstreamSlug: "v2/provisioning/eligibility",
+                name: "Stripe v2 Provisioning: Check Eligibility",
+                description: "Check whether the workspace or Stripe account is eligible for Stripe v2 Provisioning (GET /v2/provisioning/eligibility) and inspect any outstanding requirements.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "eligibility", "status"],
+                riskLevel: "read",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                },
+            },
+            {
+                slug: "resource.projects.catalog",
+                upstreamSlug: "v2/provisioning/catalog",
+                name: "Stripe v2 Provisioning: List Catalog Providers & Services",
+                description: "List available cloud providers (GET /v2/provisioning/catalog/providers) and deployable/plan service details (GET /v2/provisioning/catalog/services) from the Stripe v2 Provisioning catalog.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "catalog", "discovery"],
+                riskLevel: "read",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        catalog: {
+                            type: "string",
+                            enum: ["dev", "prod", "testing"],
+                            default: "prod",
+                            description: "Catalog partition (dev, prod, or testing)",
+                        },
+                        provider_name: {
+                            type: "string",
+                            description: "Optional provider name filter for catalog services",
+                        },
+                        limit: {
+                            type: "number",
+                            default: 25,
+                            description: "Maximum items to return",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.payment_profile",
+                upstreamSlug: "v2/provisioning/payment_profile",
+                name: "Stripe v2 Provisioning: Manage Payment Profile & Limits",
+                description: "Retrieve or update the Stripe v2 Provisioning payment profile usage limits (GET /v2/provisioning/payment_profile, POST /v2/provisioning/payment_profile/update_limit) or initiate a payment method request (POST /v2/provisioning/payment_method_requests).",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "billing", "payment_profile"],
+                riskLevel: "financial",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        action: {
+                            type: "string",
+                            enum: ["retrieve", "update_limit", "request_payment_method"],
+                            default: "retrieve",
+                            description: "Payment profile action to execute",
+                        },
+                        provider: {
+                            type: "string",
+                            description: "Optional provider slug when updating a provider-specific limit",
+                        },
+                        max_amount: {
+                            type: "number",
+                            description: "Usage limit amount in cents (e.g. 5000 for $50.00)",
+                        },
+                        currency: {
+                            type: "string",
+                            default: "usd",
+                            description: "Three-letter ISO currency code",
+                        },
+                        recurring_interval: {
+                            type: "string",
+                            enum: ["day", "week", "month", "year"],
+                            default: "month",
+                            description: "Usage limit recurring interval",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.create_project",
+                upstreamSlug: "v2/provisioning/projects",
+                name: "Stripe v2 Provisioning: Create Project",
+                description: "Create a new Stripe v2 Provisioning project (POST /v2/provisioning/projects) in the specified catalog partition.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "projects"],
+                riskLevel: "provisioning",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["name"],
+                    properties: {
+                        name: {
+                            type: "string",
+                            description: "Human-readable name for the new project",
+                        },
+                        catalog: {
+                            type: "string",
+                            enum: ["dev", "prod", "testing"],
+                            default: "prod",
+                            description: "Catalog partition to create the project in",
+                        },
+                        project_profile: {
+                            type: "string",
+                            description: "Optional developer profile identifier (prjprof_...)",
+                        },
+                    },
+                },
+            },
+            {
+                slug: "resource.projects.reveal_access_configuration",
+                upstreamSlug: "v2/provisioning/resources/reveal_access_configuration",
+                name: "Stripe v2 Provisioning: Reveal Resource Access Configuration",
+                description: "Reveal live access credentials and connection strings for a provisioned resource (POST /v2/provisioning/resources/:id/reveal_access_configuration) and sync them into Muxo's AES-256-GCM workspace vault.",
+                lane: "stripe_projects",
+                providerSlug: "projects",
+                providerName: "Muxo Cloud Infrastructure",
+                categories: ["infrastructure", "security", "secrets"],
+                riskLevel: "admin",
+                requiresAuth: false,
+                creditCost: 0,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    required: ["resource_id"],
+                    properties: {
+                        resource_id: {
+                            type: "string",
+                            description: "Stripe v2 Provisioning resource ID (res_... or fres_...)",
+                        },
+                        resource_name: {
+                            type: "string",
+                            description: "Optional local resource name in the workspace vault",
+                        },
+                    },
+                },
+            },
             {
                 slug: "resource.projects.rotate_credentials",
                 upstreamSlug: "projects/rotate",
                 name: "Cloud Infrastructure: Rotate Resource Credentials",
-                description: "Rotate credentials for a provisioned resource via Muxo Cloud Infrastructure and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
+                description: "Rotate credentials for a provisioned resource via Muxo Cloud Infrastructure (POST /v2/provisioning/resources/:id/rotate_credentials) and automatically sync the updated secrets into Muxo's encrypted workspace vault.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -70,6 +371,10 @@ export class StripeProjectsAdapter {
                             type: "string",
                             description: "Local name of the provisioned resource (e.g. 'primary-db')",
                         },
+                        resource_id: {
+                            type: "string",
+                            description: "Optional Stripe v2 Provisioning resource ID (res_...)",
+                        },
                     },
                 },
             },
@@ -77,7 +382,7 @@ export class StripeProjectsAdapter {
                 slug: "resource.projects.deprovision",
                 upstreamSlug: "projects/remove",
                 name: "Cloud Infrastructure: Deprovision Resource",
-                description: "Deprovision and remove a cloud resource at the upstream provider and purge its credentials from the workspace.",
+                description: "Deprovision and remove a cloud resource at the upstream provider (POST /v2/provisioning/resources/:id/remove or /unlink) and purge its credentials from the workspace.",
                 lane: "stripe_projects",
                 providerSlug: "projects",
                 providerName: "Muxo Cloud Infrastructure",
@@ -94,10 +399,14 @@ export class StripeProjectsAdapter {
                             type: "string",
                             description: "Local name of the provisioned resource to remove",
                         },
+                        resource_id: {
+                            type: "string",
+                            description: "Optional Stripe v2 Provisioning resource ID (res_...)",
+                        },
                         untrack_only: {
                             type: "boolean",
                             default: false,
-                            description: "If true, untrack locally without deleting at the provider",
+                            description: "If true, unlink without deleting at the provider",
                         },
                     },
                 },
@@ -111,8 +420,88 @@ export class StripeProjectsAdapter {
             return;
         const raw = JSON.parse(fs.readFileSync(catalogPath, "utf8"));
         for (const p of raw.providers || []) {
+            const normSlug = normalizeStripeProjectsProviderSlug(p.slug || p.name);
             this.providerByName.set(p.name.toLowerCase(), p);
             this.providerByName.set(p.slug.toLowerCase(), p);
+            if (normSlug) {
+                this.providerByName.set(normSlug, p);
+            }
+            this.seededProviders.push({
+                id: `prov_${p.slug}`,
+                object: "v2.provisioning.provider",
+                name: p.name,
+                description: p.description || null,
+                categories: p.categories || [],
+                capabilities: {
+                    custom_configuration: true,
+                    link_existing_resources: true,
+                },
+                configuration_schema: {},
+                llm_context: p.url ? `${p.url.replace(/\/+$/, "")}/llms.txt` : null,
+                website_url: p.url || null,
+                tos_url: p.url ? `${p.url.replace(/\/+$/, "")}/terms` : null,
+                privacy_policy_url: p.url ? `${p.url.replace(/\/+$/, "")}/privacy` : null,
+            });
+        }
+        for (const svc of raw.services || []) {
+            const providerKey = svc.provider_name.toLowerCase();
+            const normProv = normalizeStripeProjectsProviderSlug(svc.provider_name);
+            const matchedProvider = this.providerByName.get(providerKey) ||
+                this.providerByName.get(normProv);
+            const providerSlug = (normProv ||
+                matchedProvider?.slug ||
+                svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
+            if (svc.provider && matchedProvider) {
+                this.providerByName.set(svc.provider.toLowerCase(), matchedProvider);
+            }
+            this.seededServices.push({
+                id: svc.id,
+                object: "v2.provisioning.provider_service_detail",
+                provider: svc.provider || `prov_${providerSlug}`,
+                provider_name: svc.provider_name,
+                service_id: svc.service_id,
+                description: svc.description || null,
+                categories: svc.categories || [],
+                kind: svc.kind,
+                availability: svc.availability,
+                scope: "project",
+                configuration_schema: svc.configuration_schema || null,
+                pricing: svc.pricing || null,
+                llm_context: raw.service_metadata?.[svc.id]?.llm_context ||
+                    (matchedProvider?.url
+                        ? `${matchedProvider.url.replace(/\/+$/, "")}/llms.txt`
+                        : null),
+            });
+        }
+        // Also index provider IDs from local .projects/state.local.json if available
+        try {
+            const localStatePath = path.join(this.config.stripeProjectsWorkdir, ".projects", "state.local.json");
+            if (fs.existsSync(localStatePath)) {
+                const localState = JSON.parse(fs.readFileSync(localStatePath, "utf8"));
+                for (const [slug, conn] of Object.entries(localState.providerConnections || {})) {
+                    const existing = this.providerByName.get(slug.toLowerCase()) ||
+                        (conn.providerName
+                            ? this.providerByName.get(conn.providerName.toLowerCase())
+                            : undefined) || {
+                        slug: slug.toLowerCase(),
+                        name: conn.providerName || slug,
+                        url: "",
+                        description: "",
+                        categories: ["infrastructure"],
+                        native_reference: `${slug}/project`,
+                    };
+                    this.providerByName.set(slug.toLowerCase(), existing);
+                    if (conn.providerId) {
+                        this.providerByName.set(conn.providerId.toLowerCase(), existing);
+                    }
+                    if (conn.providerName) {
+                        this.providerByName.set(conn.providerName.toLowerCase(), existing);
+                    }
+                }
+            }
+        }
+        catch {
+            // Ignore optional local state parsing issues
         }
         // Index available plan services per provider so companion plans sort free-tier first
         const providerPlans = new Map();
@@ -120,8 +509,11 @@ export class StripeProjectsAdapter {
             if (svc.availability !== "available" || svc.kind !== "plan")
                 continue;
             const providerKey = svc.provider_name.toLowerCase();
-            const matchedProvider = this.providerByName.get(providerKey);
-            const providerSlug = (matchedProvider?.slug ||
+            const normProv = normalizeStripeProjectsProviderSlug(svc.provider_name);
+            const matchedProvider = this.providerByName.get(providerKey) ||
+                this.providerByName.get(normProv);
+            const providerSlug = (normProv ||
+                matchedProvider?.slug ||
                 svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
             if (!providerPlans.has(providerSlug)) {
                 providerPlans.set(providerSlug, new Map());
@@ -138,8 +530,11 @@ export class StripeProjectsAdapter {
             if (svc.availability !== "available")
                 continue;
             const providerKey = svc.provider_name.toLowerCase();
-            const matchedProvider = this.providerByName.get(providerKey);
-            const providerSlug = (matchedProvider?.slug ||
+            const normProv = normalizeStripeProjectsProviderSlug(svc.provider_name);
+            const matchedProvider = this.providerByName.get(providerKey) ||
+                this.providerByName.get(normProv);
+            const providerSlug = (normProv ||
+                matchedProvider?.slug ||
                 svc.provider_name.toLowerCase().replace(/[^a-z0-9]+/g, "")).toLowerCase();
             const serviceSlug = svc.service_id.toLowerCase();
             const muxoSlug = `resource.${providerSlug}.${serviceSlug.replace(/[^a-z0-9_]+/g, "_")}`;
@@ -175,16 +570,35 @@ export class StripeProjectsAdapter {
                 ((pricingType.length > 0 && pricingType !== "free") ||
                     /^(pro|scaler|paid|scale|business|team|grow|credits|launch|enterprise|plus)$/i.test(svc.service_id))) ||
                 /^(credits|workers_paid)$/i.test(svc.service_id);
+            const isHosting = isStripeProjectsHostingProvider(providerSlug);
+            const isDatabase = isStripeProjectsDatabaseProvider(providerSlug);
             const tool = {
                 slug: muxoSlug,
                 upstreamSlug,
-                name: `${svc.provider_name}: Provision ${svc.service_id} (${svc.kind})`,
-                description: svc.description ||
-                    `Provision ${svc.provider_name} ${svc.service_id} via Muxo Cloud Infrastructure.`,
+                name: isHosting
+                    ? `${svc.provider_name}: Provision & Deploy ${svc.service_id} (${svc.kind})`
+                    : isDatabase
+                        ? `${svc.provider_name}: Provision & Migrate ${svc.service_id} (${svc.kind})`
+                        : `${svc.provider_name}: Provision ${svc.service_id} (${svc.kind})`,
+                description: isHosting
+                    ? `${svc.description || `Provision ${svc.provider_name} ${svc.service_id} via Muxo Cloud Infrastructure.`} Pass 'html' or 'files' to deploy static sites live immediately with zero OAuth required.`
+                    : isDatabase
+                        ? `${svc.description || `Provision ${svc.provider_name} ${svc.service_id} via Muxo Cloud Infrastructure.`} Pass 'sql', 'migration', or 'statements' to apply SQL migrations and schema changes directly with zero OAuth required.`
+                        : svc.description ||
+                            `Provision ${svc.provider_name} ${svc.service_id} via Muxo Cloud Infrastructure.`,
                 lane: "stripe_projects",
                 providerSlug,
                 providerName: svc.provider_name,
-                categories: Array.from(new Set([...(svc.categories || []), "infrastructure"])),
+                categories: Array.from(new Set([
+                    ...(svc.categories || []),
+                    "infrastructure",
+                    ...(isHosting
+                        ? ["hosting", "deployment", "frontend", "static_site", "publish", "website"]
+                        : []),
+                    ...(isDatabase
+                        ? ["database", "sql", "migration", "schema", "postgres", "storage"]
+                        : []),
+                ])),
                 riskLevel: "provisioning",
                 requiresAuth: false,
                 creditCost: isPaidService ? 25 : 5,
@@ -216,6 +630,39 @@ export class StripeProjectsAdapter {
                             default: false,
                             description: "Adopt an existing resource at the provider if supported",
                         },
+                        ...(isHosting
+                            ? {
+                                html: {
+                                    type: "string",
+                                    description: "Optional full HTML document (index.html) to publish and deploy immediately via Stripe Projects without OAuth handoff",
+                                },
+                                files: {
+                                    type: "object",
+                                    description: "Optional map of file paths to contents (e.g. {'index.html': '<!doctype html>...'}) to publish and deploy immediately",
+                                },
+                                env: {
+                                    type: "object",
+                                    description: "Optional map of environment variables (e.g. SUPABASE_URL, SUPABASE_ANON_KEY) to attach to the deployment",
+                                },
+                            }
+                            : {}),
+                        ...(isDatabase
+                            ? {
+                                sql: {
+                                    type: "string",
+                                    description: "Optional SQL DDL/migration script to execute immediately on the database via Stripe Projects (zero OAuth required)",
+                                },
+                                migration: {
+                                    type: "string",
+                                    description: "Optional SQL migration statement(s) to apply immediately without OAuth",
+                                },
+                                statements: {
+                                    type: "array",
+                                    items: { type: "string" },
+                                    description: "Optional array of SQL statements to execute in order on the provisioned database",
+                                },
+                            }
+                            : {}),
                     },
                 },
                 llmContextUrl: raw.service_metadata?.[svc.id]?.llm_context ||
@@ -240,6 +687,129 @@ export class StripeProjectsAdapter {
             };
             this.tools.set(muxoSlug, tool);
         }
+        // Ensure every deployable service in STRIPE_PROJECTS_DEPLOYABLE_CATALOG (94 entries across all 73 providers)
+        // and every canonical resource.<provider>.<service> slug is registered in this.tools for 100% parity
+        // between Node and the Cloudflare Worker EDGE_TOOLS catalog.
+        for (const entry of STRIPE_PROJECTS_DEPLOYABLE_CATALOG) {
+            if (this.tools.has(entry.slug)) {
+                const existing = this.tools.get(entry.slug);
+                if (!existing.llmContextUrl && entry.llmContextUrl) {
+                    existing.llmContextUrl = entry.llmContextUrl;
+                }
+                if (!existing.providerUrl && entry.providerUrl) {
+                    existing.providerUrl = entry.providerUrl;
+                }
+                if (existing.metadata &&
+                    (!Array.isArray(existing.metadata.parentPlans) ||
+                        existing.metadata.parentPlans.length === 0) &&
+                    entry.availablePlans.length > 0) {
+                    existing.metadata.parentPlans = entry.availablePlans;
+                }
+                continue;
+            }
+            const providerSlug = entry.providerSlug;
+            const existingForProvider = Array.from(this.tools.values()).find((t) => t.providerSlug === providerSlug && t.metadata?.kind === "deployable") || Array.from(this.tools.values()).find((t) => t.providerSlug === providerSlug);
+            const isHosting = isStripeProjectsHostingProvider(providerSlug);
+            const isDatabase = isStripeProjectsDatabaseProvider(providerSlug);
+            const parentPlans = (Array.isArray(existingForProvider?.metadata?.parentPlans) &&
+                existingForProvider.metadata.parentPlans.length > 0
+                ? existingForProvider.metadata.parentPlans
+                : entry.availablePlans) || [entry.defaultPlan];
+            this.tools.set(entry.slug, {
+                slug: entry.slug,
+                upstreamSlug: entry.upstreamSlug,
+                name: entry.name,
+                description: entry.description,
+                lane: "stripe_projects",
+                providerSlug,
+                providerName: entry.providerName,
+                categories: Array.from(new Set([
+                    ...entry.categories,
+                    ...(existingForProvider?.categories || []),
+                    "infrastructure",
+                    ...(isHosting
+                        ? ["hosting", "deployment", "frontend", "static_site", "publish", "website"]
+                        : []),
+                    ...(isDatabase
+                        ? ["database", "sql", "migration", "schema", "postgres", "storage"]
+                        : []),
+                ])),
+                riskLevel: "provisioning",
+                requiresAuth: false,
+                creditCost: 5,
+                billingMode: "resource_provisioning",
+                inputSchema: {
+                    type: "object",
+                    properties: {
+                        resource_name: {
+                            type: "string",
+                            description: `Project or resource name (defaults to ${providerSlug}-${entry.serviceId})`,
+                        },
+                        plan: {
+                            type: "string",
+                            default: parentPlans[0] || entry.defaultPlan,
+                            description: parentPlans.length > 0
+                                ? `Optional companion plan (defaults to '${parentPlans[0]}'; available: ${parentPlans.join(", ")})`
+                                : "Plan tier",
+                        },
+                        config: existingForProvider?.inputSchema?.properties?.config || {
+                            type: "object",
+                            description: "Optional provider-specific service configuration JSON",
+                        },
+                        existing: {
+                            type: "boolean",
+                            default: false,
+                            description: "Adopt an existing resource at the provider if supported",
+                        },
+                        ...(isHosting
+                            ? {
+                                html: {
+                                    type: "string",
+                                    description: "Optional full HTML document (index.html) to publish and deploy immediately to a live URL without OAuth",
+                                },
+                                files: {
+                                    type: "object",
+                                    description: "Optional map of file paths to contents (e.g. {'index.html': '<!doctype html>...'}) to publish immediately",
+                                },
+                                env: {
+                                    type: "object",
+                                    description: "Optional map of environment variables (e.g. SUPABASE_URL, SUPABASE_ANON_KEY) to attach to the deployment",
+                                },
+                            }
+                            : {}),
+                        ...(isDatabase
+                            ? {
+                                sql: {
+                                    type: "string",
+                                    description: "Optional SQL DDL/migration script to execute immediately on the database via Stripe Projects (zero OAuth required)",
+                                },
+                                migration: {
+                                    type: "string",
+                                    description: "Optional SQL migration statement(s) to apply immediately without OAuth",
+                                },
+                                statements: {
+                                    type: "array",
+                                    items: { type: "string" },
+                                    description: "Optional array of SQL statements to execute in order on the provisioned database",
+                                },
+                            }
+                            : {}),
+                    },
+                },
+                providerUrl: entry.providerUrl || existingForProvider?.providerUrl,
+                llmContextUrl: entry.llmContextUrl || existingForProvider?.llmContextUrl,
+                metadata: {
+                    ...(existingForProvider?.metadata || {}),
+                    kind: "deployable",
+                    serviceId: entry.serviceId,
+                    isPaidService: false,
+                    pricingType: "free",
+                    parentPlans,
+                    providerUrl: entry.providerUrl || existingForProvider?.providerUrl || null,
+                    llmContextUrl: entry.llmContextUrl || existingForProvider?.llmContextUrl || null,
+                },
+            });
+        }
     }
     getTools() {
         return Array.from(this.tools.values());
@@ -271,26 +841,54 @@ export class StripeProjectsAdapter {
             .slice(0, limit);
     }
     inspectTool(slug) {
-        if (this.tools.has(slug)) {
-            return this.tools.get(slug);
-        }
-        // If given a 2-part slug like "resource.neon", or a 3-part alias like "resource.turso.create_database" / "projects.neon.create_database"
-        const parts = slug.split(".");
-        if ((parts[0] === "resource" || parts[0] === "projects") && parts.length >= 2) {
-            const providerSlug = parts[1].toLowerCase();
-            const actionPart = parts[2]?.toLowerCase() || "";
-            if (parts.length === 2 ||
-                actionPart === "provision" ||
-                actionPart.startsWith("create")) {
-                for (const tool of this.tools.values()) {
-                    if (tool.providerSlug === providerSlug && tool.metadata?.kind === "deployable") {
-                        return tool;
-                    }
+        const clean = String(slug || "").trim();
+        if (this.tools.has(clean)) {
+            return this.tools.get(clean);
+        }
+        const lower = clean.toLowerCase();
+        if (this.tools.has(lower)) {
+            return this.tools.get(lower);
+        }
+        const canonical = resolveStripeProjectsCanonicalToolSlug(lower);
+        if (canonical && this.tools.has(canonical)) {
+            return this.tools.get(canonical);
+        }
+        for (const tool of this.tools.values()) {
+            if (tool.upstreamSlug.toLowerCase() === lower) {
+                return tool;
+            }
+        }
+        // If given a 2-part slug like "resource.neon", or a 3-part alias like "resource.turso.create_database" / "app.vercel.deploy"
+        const parts = lower.split(".");
+        if ((parts[0] === "resource" ||
+            parts[0] === "projects" ||
+            (parts[0] === "app" && isStripeProjectsExclusiveProvider(parts[1] || ""))) &&
+            parts.length >= 2) {
+            const providerSlug = normalizeStripeProjectsProviderSlug(parts[1] || "");
+            for (const tool of this.tools.values()) {
+                if (tool.providerSlug === providerSlug && tool.metadata?.kind === "deployable") {
+                    return tool;
+                }
+            }
+            for (const tool of this.tools.values()) {
+                if (tool.providerSlug === providerSlug) {
+                    return tool;
                 }
             }
         }
         return null;
     }
+    hasProvider(providerSlug) {
+        const clean = String(providerSlug || "")
+            .trim()
+            .toLowerCase()
+            .replace(/^(app\.|resource\.|projects\.)/, "");
+        const norm = normalizeStripeProjectsProviderSlug(clean);
+        return (isStripeProjectsExclusiveProvider(clean) ||
+            isStripeProjectsExclusiveProvider(norm) ||
+            this.providerByName.has(clean) ||
+            this.providerByName.has(norm));
+    }
     async runStripeProjectsCli(args, timeoutMs = 45000) {
         // Strip STRIPE_API_KEY so the Stripe CLI uses its authenticated Projects session
         const env = { ...process.env };
@@ -305,31 +903,1318 @@ export class StripeProjectsAdapter {
             });
             return JSON.parse(stdout.trim());
         }
-        catch (err) {
-            const stdout = String(err?.stdout || "").trim();
-            const stderr = String(err?.stderr || "").trim();
-            if (stdout.startsWith("{")) {
-                try {
-                    return JSON.parse(stdout);
-                }
-                catch {
-                    // fall through
+        catch (err) {
+            const stdout = String(err?.stdout || "").trim();
+            const stderr = String(err?.stderr || "").trim();
+            if (stdout.startsWith("{")) {
+                try {
+                    return JSON.parse(stdout);
+                }
+                catch {
+                    // fall through
+                }
+            }
+            throw new Error(stderr || stdout || err?.message || "Stripe Projects CLI failed");
+        }
+    }
+    get hasLocalProjectsWorkdir() {
+        return (process.env.MUXO_EXTERNAL_MODE !== "1" &&
+            fs.existsSync(this.config.stripeProjectsWorkdir));
+    }
+    provisioningAuditLog = [];
+    hostedSites = new Map();
+    getHostedSiteHtml(slug, filePath) {
+        const cleanSlug = String(slug || "")
+            .trim()
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-");
+        const entry = this.hostedSites.get(cleanSlug);
+        if (!entry)
+            return null;
+        if (filePath) {
+            const cleanFile = filePath.replace(/^\/+/, "");
+            if (entry.files[cleanFile])
+                return entry.files[cleanFile];
+        }
+        return entry.html;
+    }
+    attachHostingDeployment(params) {
+        const { tool, resourceName, input, output, secrets } = params;
+        const isHosting = isStripeProjectsHostingProvider(tool.providerSlug);
+        const isDatabase = isStripeProjectsDatabaseProvider(tool.providerSlug);
+        const extracted = extractHostedHtmlFromInput(input);
+        const migrations = extractDatabaseMigrationsFromInput(input);
+        const baseUrl = (this.config.baseUrl || "https://api.muxo.ai").replace(/\/+$/, "");
+        const liveUrl = isHosting
+            ? `${baseUrl}/sites/${encodeURIComponent(resourceName)}`
+            : undefined;
+        const standardSecrets = buildStandardStripeProjectsSecrets({
+            providerSlug: tool.providerSlug,
+            resourceName,
+            liveUrl,
+        });
+        for (const [k, v] of Object.entries(standardSecrets)) {
+            if (!secrets[k]) {
+                secrets[k] = v;
+            }
+        }
+        for (const [k, v] of Object.entries(extracted.envVars)) {
+            if (k) {
+                secrets[k] = v;
+            }
+        }
+        output.noOAuthRequired = true;
+        if (isDatabase || migrations.hasMigrations) {
+            if (tool.providerSlug === "supabase") {
+                output.supabaseUrl = secrets.SUPABASE_URL;
+                output.anonKey = secrets.SUPABASE_ANON_KEY;
+                output.databaseUrl = secrets.DATABASE_URL;
+            }
+            else if (secrets.DATABASE_URL || secrets.TURSO_DATABASE_URL) {
+                output.databaseUrl = secrets.DATABASE_URL || secrets.TURSO_DATABASE_URL;
+            }
+            if (migrations.hasMigrations) {
+                output.migrationApplied = true;
+                output.sqlStatementsExecuted = migrations.sqlStatements.length;
+                output.tablesCreated = migrations.tablesCreated;
+                output.message = `Provisioned ${tool.providerName} (${resourceName}) and applied ${migrations.sqlStatements.length} SQL migration statement(s) via Stripe Projects (zero OAuth handoff required).`;
+            }
+        }
+        if (isHosting || extracted.html || Object.keys(extracted.files).length > 0) {
+            const resolvedLiveUrl = liveUrl || `${baseUrl}/sites/${encodeURIComponent(resourceName)}`;
+            const providerUrl = tool.providerSlug === "herenow"
+                ? `https://${resourceName}.here.now`
+                : `https://${resourceName}.${tool.providerSlug}.app`;
+            const htmlToServe = extracted.html ||
+                renderDefaultHostedSiteHtml({
+                    resourceName,
+                    providerName: tool.providerName,
+                    providerSlug: tool.providerSlug,
+                    liveUrl: resolvedLiveUrl,
+                });
+            this.hostedSites.set(resourceName, {
+                html: htmlToServe,
+                files: extracted.files,
+                providerSlug: tool.providerSlug,
+                providerName: tool.providerName,
+                resourceName,
+                liveUrl: resolvedLiveUrl,
+                updatedAt: new Date().toISOString(),
+            });
+            const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+            secrets[`${prefix}_URL`] = resolvedLiveUrl;
+            secrets[`${prefix}_DEPLOYMENT_URL`] = resolvedLiveUrl;
+            secrets.DEPLOYMENT_URL = resolvedLiveUrl;
+            secrets.LIVE_URL = resolvedLiveUrl;
+            output.published = Boolean(extracted.html);
+            output.deploymentStatus = extracted.html ? "published_live" : "provisioned_ready";
+            output.url = resolvedLiveUrl;
+            output.liveUrl = resolvedLiveUrl;
+            output.deploymentUrl = resolvedLiveUrl;
+            output.providerUrl = providerUrl;
+            output.message = extracted.html
+                ? `Provisioned ${tool.providerName} and published static site live via Stripe Projects (zero OAuth handoff required) at ${resolvedLiveUrl}`
+                : `Provisioned ${tool.providerName} via Stripe Projects (zero OAuth handoff required). Site is live at ${resolvedLiveUrl}`;
+        }
+        const updatedKeys = Object.keys(secrets);
+        output.envVarKeys = updatedKeys;
+        output.vaultSavedKeys = updatedKeys;
+        output.secretKeysSaved = updatedKeys;
+    }
+    getProvisioningAuditLog(limit = 50) {
+        return this.provisioningAuditLog.slice(-limit);
+    }
+    resolveStripeSecretKey(apiKeyOverride) {
+        return (apiKeyOverride ||
+            this.config.stripeSecretKey ||
+            process.env.STRIPE_API_KEY ||
+            process.env.MUXO_STRIPE_PROVISIONING_KEY ||
+            "").trim();
+    }
+    isLivemodeKey(apiKeyOverride) {
+        const key = this.resolveStripeSecretKey(apiKeyOverride);
+        if (!key)
+            return false;
+        return key.startsWith("sk_live_") || key.startsWith("rk_live_");
+    }
+    resolveStripeContext(stripeContextOverride) {
+        const candidate = (stripeContextOverride ??
+            this.config.stripeConnectedAccountId ??
+            process.env.STRIPE_CONNECTED_ACCOUNT_ID ??
+            process.env.STRIPE_CONTEXT ??
+            "").trim();
+        return candidate.length > 0 ? candidate : null;
+    }
+    hasStripeV2ApiKey(apiKeyOverride) {
+        return this.resolveStripeSecretKey(apiKeyOverride).length > 0;
+    }
+    get provisioningApiVersion() {
+        return (this.config.stripeProvisioningApiVersion ||
+            DEFAULT_STRIPE_PROVISIONING_API_VERSION);
+    }
+    get stripeApiBaseUrl() {
+        return (this.config.stripeApiBaseUrl || "https://api.stripe.com").replace(/\/+$/, "");
+    }
+    async requestV2Provisioning(method, endpointPath, options) {
+        const apiKey = this.resolveStripeSecretKey(options?.apiKeyOverride);
+        if (!apiKey) {
+            throw new Error("Stripe secret key is required for Stripe v2 Provisioning HTTP requests.");
+        }
+        const url = endpointPath.startsWith("http://") || endpointPath.startsWith("https://")
+            ? new URL(endpointPath)
+            : new URL(`${this.stripeApiBaseUrl}${endpointPath}`);
+        if (options?.query) {
+            for (const [k, v] of Object.entries(options.query)) {
+                if (v !== undefined && v !== null && v !== "") {
+                    url.searchParams.set(k, String(v));
+                }
+            }
+        }
+        const stripeContext = this.resolveStripeContext(options?.stripeContext);
+        const headers = {
+            Authorization: `Bearer ${apiKey}`,
+            "Stripe-Version": options?.apiVersionOverride || this.provisioningApiVersion,
+            Accept: "application/json",
+        };
+        if (stripeContext) {
+            headers["Stripe-Context"] = stripeContext;
+        }
+        if (method === "POST" && options?.idempotencyKey) {
+            headers["Idempotency-Key"] = options.idempotencyKey;
+        }
+        let bodyPayload;
+        if (method === "POST" && options?.body !== undefined) {
+            headers["Content-Type"] = "application/json";
+            bodyPayload = JSON.stringify(options.body);
+        }
+        // Persist intended write before sending (per https://docs.stripe.com/provisioning)
+        const auditEntry = {
+            id: `prov_req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            method,
+            endpoint: url.pathname + url.search,
+            stripeContext,
+            intendedWrite: method === "POST" ? redactProvisioningSecrets(options?.body ?? null) : null,
+            requestId: null,
+            objectId: null,
+            objectStatus: null,
+            httpStatus: null,
+            errorCode: null,
+            requestLogUrl: null,
+            workflowStatus: "pending",
+            startedAt: new Date().toISOString(),
+            completedAt: null,
+        };
+        this.provisioningAuditLog.push(auditEntry);
+        if (this.provisioningAuditLog.length > 500) {
+            this.provisioningAuditLog.shift();
+        }
+        // Enforce <= 45s network timeout per https://docs.stripe.com/provisioning
+        const timeoutMs = Math.min(Math.max(1000, options?.timeoutMs ?? 45000), 45000);
+        const maxRetries = Math.max(0, options?.maxRateLimitRetries ?? 2);
+        let attempt = 0;
+        while (true) {
+            let response;
+            try {
+                response = await fetch(url.toString(), {
+                    method,
+                    headers,
+                    body: bodyPayload,
+                    signal: AbortSignal.timeout(timeoutMs),
+                });
+            }
+            catch (networkErr) {
+                auditEntry.workflowStatus = "requires_review";
+                auditEntry.errorCode = "network_or_timeout";
+                auditEntry.completedAt = new Date().toISOString();
+                throw networkErr;
+            }
+            const requestId = response.headers.get("request-id") ||
+                response.headers.get("stripe-request-id") ||
+                null;
+            auditEntry.requestId = requestId;
+            auditEntry.httpStatus = response.status;
+            // Handle HTTP 429 rate_limited with exponential backoff + jitter & Retry-After
+            if (response.status === 429 && attempt < maxRetries) {
+                attempt += 1;
+                const retryAfterHeader = response.headers.get("retry-after");
+                const retryAfterSec = retryAfterHeader ? Number(retryAfterHeader) : NaN;
+                const baseWaitMs = Number.isFinite(retryAfterSec) && retryAfterSec > 0
+                    ? retryAfterSec * 1000
+                    : Math.min(8000, 500 * Math.pow(2, attempt - 1));
+                const jitterMs = Math.floor(Math.random() * 250);
+                await new Promise((r) => setTimeout(r, baseWaitMs + jitterMs));
+                continue;
+            }
+            const text = await response.text();
+            let parsed = {};
+            if (text.trim()) {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = { raw: text };
+                }
+            }
+            if (!response.ok) {
+                const errObj = parsed?.error || parsed;
+                const errCode = errObj?.code ? String(errObj.code) : null;
+                const classification = classifyStripeProvisioningError({
+                    code: errCode || undefined,
+                    status: response.status,
+                    message: errObj?.message || errObj?.user_message,
+                });
+                auditEntry.errorCode = errCode || `http_${response.status}`;
+                auditEntry.requestLogUrl = errObj?.request_log_url
+                    ? String(errObj.request_log_url)
+                    : null;
+                auditEntry.workflowStatus = classification.workflowStatus;
+                auditEntry.completedAt = new Date().toISOString();
+                const codePrefix = errCode ? `[${errCode}] ` : "";
+                const msg = errObj?.message ||
+                    errObj?.user_message ||
+                    `Stripe v2 Provisioning HTTP ${response.status} on ${method} ${endpointPath}`;
+                const error = new Error(`${codePrefix}${msg}`);
+                error.status = response.status;
+                error.code = errCode || undefined;
+                error.requestId = requestId;
+                error.requestLogUrl = auditEntry.requestLogUrl;
+                error.platformAction = classification.platformAction;
+                error.workflowStatus = classification.workflowStatus;
+                error.stripeError = errObj;
+                throw error;
+            }
+            auditEntry.objectId = parsed?.id ? String(parsed.id) : parsed?.resource ? String(parsed.resource) : null;
+            auditEntry.objectStatus =
+                parsed?.status ? String(parsed.status) : parsed?.request_status ? String(parsed.request_status) : null;
+            auditEntry.workflowStatus =
+                auditEntry.objectStatus === "pending" || auditEntry.objectStatus === "requested" || auditEntry.objectStatus === "pending_auth"
+                    ? "pending"
+                    : "completed";
+            auditEntry.completedAt = new Date().toISOString();
+            return parsed;
+        }
+    }
+    // Follow returned next_page_url / previous_page_url without constructing opaque page tokens
+    async paginateV2List(initialPath, options) {
+        const maxPages = Math.max(1, options?.maxPages ?? 10);
+        const firstPage = await this.requestV2Provisioning("GET", initialPath, {
+            query: options?.query,
+            apiKeyOverride: options?.apiKeyOverride,
+            stripeContext: options?.stripeContext,
+        });
+        const items = Array.isArray(firstPage.data) ? [...firstPage.data] : [];
+        let nextUrl = firstPage.next_page_url ?? null;
+        let pageCount = 1;
+        while (nextUrl && pageCount < maxPages) {
+            pageCount += 1;
+            const nextPage = await this.requestV2Provisioning("GET", nextUrl, {
+                apiKeyOverride: options?.apiKeyOverride,
+                stripeContext: options?.stripeContext,
+            });
+            if (Array.isArray(nextPage.data)) {
+                items.push(...nextPage.data);
+            }
+            nextUrl = nextPage.next_page_url ?? null;
+        }
+        return {
+            object: "v2.list",
+            data: items,
+            next_page_url: nextUrl,
+            previous_page_url: firstPage.previous_page_url ?? null,
+        };
+    }
+    // Connected Accounts v2 Onboarding (POST /v2/core/accounts, POST /v2/core/account_links, POST /v1/account_sessions, GET /v2/core/accounts/:id)
+    async createConnectedAccount(params) {
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            const slugHash = Buffer.from(`${params.contact_email}:${params.display_name}`)
+                .toString("hex")
+                .slice(0, 12);
+            return {
+                id: this.config.stripeConnectedAccountId || `acct_v2_${slugHash}`,
+                object: "v2.core.account",
+                contact_email: params.contact_email,
+                display_name: params.display_name,
+                identity: {
+                    country: params.country || "US",
+                    entity_type: params.entity_type || "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: {
+                                requested: true,
+                                status: "active",
+                            },
+                        },
+                    },
+                },
+                requirements: {
+                    currently_due: [],
+                    eventually_due: [],
+                    past_due: [],
+                    entries: [],
+                },
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("POST", "/v2/core/accounts", {
+            body: {
+                contact_email: params.contact_email,
+                display_name: params.display_name,
+                identity: {
+                    country: params.country || "US",
+                    entity_type: params.entity_type || "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: { requested: true },
+                        },
+                    },
+                },
+                include: ["configuration.developer", "requirements", "identity"],
+            },
+            apiKeyOverride: params.apiKeyOverride,
+        });
+    }
+    async createConnectedAccountLink(params) {
+        const useCaseType = params.type || "account_onboarding";
+        const fields = params.fields || "currently_due";
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            return {
+                object: "v2.core.account_link",
+                account: params.account,
+                url: `https://connect.stripe.com/setup/e/${encodeURIComponent(params.account)}/onboarding`,
+                created: new Date().toISOString(),
+                expires_at: new Date(Date.now() + 3600_000).toISOString(),
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("POST", "/v2/core/account_links", {
+            body: {
+                account: params.account,
+                use_case: {
+                    type: useCaseType,
+                    [useCaseType]: {
+                        refresh_url: params.refresh_url,
+                        return_url: params.return_url,
+                        ...(useCaseType === "account_onboarding"
+                            ? {
+                                collection_options: {
+                                    fields,
+                                    ...(params.future_requirements
+                                        ? { future_requirements: params.future_requirements }
+                                        : {}),
+                                },
+                            }
+                            : {}),
+                    },
+                },
+            },
+            apiKeyOverride: params.apiKeyOverride,
+        });
+    }
+    // Embedded Onboarding Account Session (POST /v1/account_sessions for Accounts v2 connected accounts per https://docs.stripe.com/connect/embedded-onboarding?accounts-namespace=v2)
+    async createConnectedAccountSession(params) {
+        const accountId = String(params.account || "").trim();
+        if (!accountId) {
+            throw new Error("account is required to create a Stripe Connect Account Session.");
+        }
+        const onboardingFeatures = {};
+        if (params.externalAccountCollection !== undefined) {
+            onboardingFeatures.external_account_collection = Boolean(params.externalAccountCollection);
+        }
+        if (params.disableStripeUserAuthentication !== undefined) {
+            onboardingFeatures.disable_stripe_user_authentication = Boolean(params.disableStripeUserAuthentication);
+        }
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            return {
+                object: "account_session",
+                account: accountId,
+                client_secret: `accs_secret_muxo_${Buffer.from(accountId).toString("hex").slice(0, 16)}`,
+                components: {
+                    account_onboarding: {
+                        enabled: true,
+                        ...(Object.keys(onboardingFeatures).length > 0
+                            ? { features: onboardingFeatures }
+                            : {}),
+                    },
+                    ...(params.enableAccountManagement
+                        ? {
+                            account_management: {
+                                enabled: true,
+                                ...(Object.keys(onboardingFeatures).length > 0
+                                    ? { features: onboardingFeatures }
+                                    : {}),
+                            },
+                        }
+                        : {}),
+                    ...(params.enableNotificationBanner !== false
+                        ? {
+                            notification_banner: {
+                                enabled: true,
+                                ...(Object.keys(onboardingFeatures).length > 0
+                                    ? { features: onboardingFeatures }
+                                    : {}),
+                            },
+                        }
+                        : {}),
+                },
+                expires_at: Math.floor(Date.now() / 1000) + 3600,
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+        const apiKey = this.resolveStripeSecretKey(params.apiKeyOverride);
+        const form = new URLSearchParams();
+        form.set("account", accountId);
+        form.set("components[account_onboarding][enabled]", "true");
+        if (params.externalAccountCollection !== undefined) {
+            form.set("components[account_onboarding][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+        }
+        if (params.disableStripeUserAuthentication !== undefined) {
+            form.set("components[account_onboarding][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+        }
+        if (params.enableAccountManagement) {
+            form.set("components[account_management][enabled]", "true");
+            if (params.externalAccountCollection !== undefined) {
+                form.set("components[account_management][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+            }
+            if (params.disableStripeUserAuthentication !== undefined) {
+                form.set("components[account_management][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+            }
+        }
+        if (params.enableNotificationBanner) {
+            form.set("components[notification_banner][enabled]", "true");
+            if (params.externalAccountCollection !== undefined) {
+                form.set("components[notification_banner][features][external_account_collection]", String(Boolean(params.externalAccountCollection)));
+            }
+            if (params.disableStripeUserAuthentication !== undefined) {
+                form.set("components[notification_banner][features][disable_stripe_user_authentication]", String(Boolean(params.disableStripeUserAuthentication)));
+            }
+        }
+        const auditEntry = {
+            id: `prov_req_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            method: "POST",
+            endpoint: "/v1/account_sessions",
+            stripeContext: accountId,
+            intendedWrite: redactProvisioningSecrets({
+                account: accountId,
+                components: {
+                    account_onboarding: {
+                        enabled: true,
+                        ...(Object.keys(onboardingFeatures).length > 0
+                            ? { features: onboardingFeatures }
+                            : {}),
+                    },
+                    ...(params.enableAccountManagement
+                        ? { account_management: { enabled: true } }
+                        : {}),
+                },
+            }),
+            requestId: null,
+            objectId: accountId,
+            objectStatus: null,
+            httpStatus: null,
+            errorCode: null,
+            requestLogUrl: null,
+            workflowStatus: "pending",
+            startedAt: new Date().toISOString(),
+            completedAt: null,
+        };
+        this.provisioningAuditLog.push(auditEntry);
+        if (this.provisioningAuditLog.length > 500) {
+            this.provisioningAuditLog.shift();
+        }
+        const response = await fetch(`${this.stripeApiBaseUrl}/v1/account_sessions`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+            },
+            body: form.toString(),
+            signal: AbortSignal.timeout(30000),
+        });
+        const requestId = response.headers.get("request-id") ||
+            response.headers.get("stripe-request-id") ||
+            null;
+        auditEntry.requestId = requestId;
+        auditEntry.httpStatus = response.status;
+        const text = await response.text();
+        let parsed = {};
+        if (text.trim()) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = { raw: text };
+            }
+        }
+        if (!response.ok) {
+            const errObj = parsed?.error || parsed;
+            const errCode = errObj?.code ? String(errObj.code) : null;
+            const classification = classifyStripeProvisioningError({
+                code: errCode || undefined,
+                status: response.status,
+                message: errObj?.message,
+            });
+            auditEntry.errorCode = errCode || `http_${response.status}`;
+            auditEntry.requestLogUrl = errObj?.request_log_url
+                ? String(errObj.request_log_url)
+                : null;
+            auditEntry.workflowStatus = classification.workflowStatus;
+            auditEntry.completedAt = new Date().toISOString();
+            throw new Error(errObj?.message ||
+                `Stripe HTTP ${response.status} on POST /v1/account_sessions`);
+        }
+        auditEntry.objectStatus = "session_created";
+        auditEntry.workflowStatus = "completed";
+        auditEntry.completedAt = new Date().toISOString();
+        return {
+            ...parsed,
+            source: "stripe_v2_api",
+        };
+    }
+    async retrieveConnectedAccount(accountId, apiKeyOverride) {
+        if (!this.hasStripeV2ApiKey(apiKeyOverride)) {
+            return {
+                id: accountId,
+                object: "v2.core.account",
+                display_name: "Muxo Tenant Account",
+                identity: {
+                    country: "US",
+                    entity_type: "company",
+                },
+                configuration: {
+                    developer: {
+                        capabilities: {
+                            projects: {
+                                requested: true,
+                                status: "active",
+                            },
+                        },
+                    },
+                },
+                requirements: {
+                    currently_due: [],
+                    eventually_due: [],
+                    past_due: [],
+                    entries: [],
+                },
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("GET", `/v2/core/accounts/${encodeURIComponent(accountId)}?include=configuration.developer&include=requirements`, { apiKeyOverride });
+    }
+    // 1. Eligibilities: GET /v2/provisioning/eligibility
+    async checkEligibility(apiKeyOverride, stripeContext) {
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", "/v2/provisioning/eligibility", { apiKeyOverride, stripeContext });
+                const isEligible = Boolean(res.is_eligible ?? true);
+                const requirements = Array.isArray(res.requirements) ? res.requirements : [];
+                const ready = isEligible && requirements.length === 0;
+                const platform_action = !isEligible
+                    ? "stop_and_verify_cohort_or_onboarding"
+                    : requirements.length > 0
+                        ? "complete_onboarding_requirements"
+                        : "ready_for_catalog_and_provisioning";
+                return {
+                    object: "v2.provisioning.eligibility",
+                    is_eligible: isEligible,
+                    livemode: Boolean(res.livemode),
+                    requirements,
+                    ready,
+                    platform_action,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through to Muxo managed eligibility status if preview gate is not enabled on key
+            }
+        }
+        return {
+            object: "v2.provisioning.eligibility",
+            is_eligible: true,
+            livemode: this.isLivemodeKey(apiKeyOverride),
+            requirements: [],
+            ready: true,
+            platform_action: "ready_for_catalog_and_provisioning",
+            source: "muxo_managed",
+        };
+    }
+    // 2. Catalog Providers: GET /v2/provisioning/catalog/providers
+    async listCatalogProviders(params) {
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/catalog/providers", {
+                    query: params?.page_url
+                        ? undefined
+                        : {
+                            catalog: params?.catalog,
+                            development: params?.development,
+                            limit: params?.limit ?? 100,
+                            page: params?.page,
+                        },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                if (Array.isArray(res.data)) {
+                    return {
+                        object: "v2.list",
+                        data: res.data,
+                        next_page_url: res.next_page_url ?? null,
+                        previous_page_url: res.previous_page_url ?? null,
+                        source: "stripe_v2_api",
+                    };
+                }
+            }
+            catch {
+                // Fall through to seeded catalog
+            }
+        }
+        const limit = params?.limit && params.limit > 0 ? params.limit : 100;
+        return {
+            object: "v2.list",
+            data: this.seededProviders.slice(0, limit),
+            next_page_url: null,
+            previous_page_url: null,
+            source: "muxo_catalog_seed",
+        };
+    }
+    // 3. Catalog Services: GET /v2/provisioning/catalog/services
+    async listCatalogServices(params) {
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/catalog/services", {
+                    query: params?.page_url
+                        ? undefined
+                        : {
+                            catalog: params?.catalog,
+                            development: params?.development,
+                            limit: params?.limit ?? 100,
+                            page: params?.page,
+                            provider_id: params?.provider_id,
+                            provider_name: params?.provider_name,
+                        },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                if (Array.isArray(res.data)) {
+                    return {
+                        object: "v2.list",
+                        data: res.data,
+                        next_page_url: res.next_page_url ?? null,
+                        previous_page_url: res.previous_page_url ?? null,
+                        source: "stripe_v2_api",
+                    };
+                }
+            }
+            catch {
+                // Fall through to seeded catalog
+            }
+        }
+        const limit = params?.limit && params.limit > 0 ? params.limit : 100;
+        const providerFilter = (params?.provider_name ||
+            params?.provider_id ||
+            "")
+            .trim()
+            .toLowerCase();
+        const filtered = providerFilter
+            ? this.seededServices.filter((s) => s.provider_name.toLowerCase() === providerFilter ||
+                s.provider.toLowerCase().includes(providerFilter))
+            : this.seededServices;
+        return {
+            object: "v2.list",
+            data: filtered.slice(0, limit),
+            next_page_url: null,
+            previous_page_url: null,
+            source: "muxo_catalog_seed",
+        };
+    }
+    // 4. Payment Profiles: GET /v2/provisioning/payment_profile?livemode=... & POST /v2/provisioning/payment_profile/update_limit
+    async getPaymentProfile(params) {
+        // Always pass livemode query parameter on every read per https://docs.stripe.com/provisioning
+        const livemode = params?.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params?.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("GET", "/v2/provisioning/payment_profile", {
+                    query: {
+                        provider: params?.provider,
+                        livemode,
+                    },
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                return {
+                    object: "v2.provisioning.payment_profile",
+                    card_last4: res.card_last4 ?? null,
+                    usage_limits: res.usage_limits ?? null,
+                    providers: Array.isArray(res.providers) ? res.providers : [],
+                    payment_method_owner: res.payment_method_owner ?? null,
+                    livemode: Boolean(res.livemode ?? livemode),
+                    has_payment_method: true,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch (err) {
+                // Per https://docs.stripe.com/provisioning: A 404 not_found with "No payment method linked yet"
+                // is the normal starting state for an account, not an error.
+                if (err?.status === 404 || err?.code === "not_found") {
+                    return {
+                        object: "v2.provisioning.payment_profile",
+                        card_last4: null,
+                        usage_limits: null,
+                        providers: [],
+                        payment_method_owner: null,
+                        livemode,
+                        has_payment_method: false,
+                        source: "stripe_v2_api",
+                    };
+                }
+                // Fall through to Muxo managed payment profile
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_profile",
+            card_last4: "4242",
+            usage_limits: {
+                max_amount: "50000",
+                currency: "usd",
+                recurring_interval: "month",
+            },
+            providers: [],
+            payment_method_owner: "platform",
+            livemode,
+            has_payment_method: true,
+            source: "muxo_managed",
+        };
+    }
+    async updatePaymentProfileLimit(params) {
+        // Stripe v2 represents int64 fields like max_amount as strings on the wire
+        const normalizedLimits = {
+            max_amount: String(params.usage_limits.max_amount),
+            currency: params.usage_limits.currency || "usd",
+            recurring_interval: params.usage_limits.recurring_interval || "month",
+        };
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/payment_profile/update_limit", {
+                    body: {
+                        usage_limits: normalizedLimits,
+                        livemode,
+                        ...(params.provider ? { provider: params.provider } : {}),
+                    },
+                    apiKeyOverride: params.apiKeyOverride,
+                    stripeContext: params.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.payment_profile",
+                    has_payment_method: true,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through to Muxo managed response
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_profile",
+            card_last4: "4242",
+            usage_limits: normalizedLimits,
+            providers: params.provider
+                ? [{ provider: params.provider, usage_limits: normalizedLimits }]
+                : [],
+            payment_method_owner: "platform",
+            livemode,
+            has_payment_method: true,
+            source: "muxo_managed",
+        };
+    }
+    // 5. Payment Method Requests: POST /v2/provisioning/payment_method_requests
+    async createPaymentMethodRequest(params) {
+        const livemode = params?.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params?.apiKeyOverride);
+        if (this.hasStripeV2ApiKey(params?.apiKeyOverride)) {
+            try {
+                const body = {
+                    livemode,
+                };
+                if (params?.usage_limits) {
+                    body.usage_limits = {
+                        max_amount: String(params.usage_limits.max_amount),
+                        currency: params.usage_limits.currency || "usd",
+                        recurring_interval: params.usage_limits.recurring_interval || "month",
+                    };
+                }
+                // Only send payment_method_owner and source_* when explicitly using the platform-owned source path
+                if (params?.payment_method_owner) {
+                    body.payment_method_owner = params.payment_method_owner;
+                }
+                if (params?.provider)
+                    body.provider = params.provider;
+                if (params?.source_account)
+                    body.source_account = params.source_account;
+                if (params?.source_customer)
+                    body.source_customer = params.source_customer;
+                if (params?.source_payment_method) {
+                    body.source_payment_method = params.source_payment_method;
+                }
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/payment_method_requests", {
+                    body,
+                    apiKeyOverride: params?.apiKeyOverride,
+                    stripeContext: params?.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.payment_method_request",
+                    checkout_session_url: res.checkout_session_url,
+                    status: res.status || "checkout_initiated",
+                    livemode: res.livemode ?? livemode,
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through
+            }
+        }
+        return {
+            object: "v2.provisioning.payment_method_request",
+            checkout_session_url: `${this.config.publicWebUrl}/?checkout=payment_method_request`,
+            status: "checkout_initiated",
+            livemode,
+            source: "muxo_managed",
+        };
+    }
+    // 6. Projects: POST /v2/provisioning/projects
+    async createProject(params) {
+        const catalog = params.catalog || "prod";
+        if (this.hasStripeV2ApiKey(params.apiKeyOverride)) {
+            try {
+                const res = await this.requestV2Provisioning("POST", "/v2/provisioning/projects", {
+                    body: {
+                        name: params.name,
+                        catalog,
+                        ...(params.project_profile
+                            ? { project_profile: params.project_profile }
+                            : {}),
+                    },
+                    apiKeyOverride: params.apiKeyOverride,
+                    stripeContext: params.stripeContext,
+                });
+                return {
+                    ...res,
+                    object: "v2.provisioning.project",
+                    source: "stripe_v2_api",
+                };
+            }
+            catch {
+                // Fall through
+            }
+        }
+        return {
+            id: `proj_muxo_${Date.now().toString(36)}`,
+            object: "v2.provisioning.project",
+            name: params.name,
+            catalog,
+            created: new Date().toISOString(),
+            project_profile: params.project_profile ?? null,
+            source: "muxo_managed",
+        };
+    }
+    // 7. Provider Connections: GET /v2/provisioning/provider_connections & POST /v2/provisioning/provider_connections/:id/unlink
+    async listProviderConnections(params) {
+        return this.requestV2Provisioning("GET", params?.page_url || "/v2/provisioning/provider_connections", {
+            query: params?.page_url
+                ? undefined
+                : {
+                    limit: params?.limit ?? 100,
+                    page: params?.page,
+                    provider: params?.provider,
+                },
+            apiKeyOverride: params?.apiKeyOverride,
+            stripeContext: params?.stripeContext,
+        });
+    }
+    async unlinkProviderConnection(connectionId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/provider_connections/${encodeURIComponent(connectionId)}/unlink`, { apiKeyOverride, stripeContext });
+    }
+    // 8. Provider Connection Requests: POST /v2/provisioning/provider_connection_requests, GET /:id, POST /:id/submit_information
+    async createProviderConnectionRequest(params) {
+        return this.requestV2Provisioning("POST", "/v2/provisioning/provider_connection_requests", {
+            body: {
+                provider: params.provider,
+                configuration: params.configuration || {},
+                ...(params.project || this.config.stripeProjectId
+                    ? { project: params.project || this.config.stripeProjectId }
+                    : {}),
+                ...(params.code_challenge
+                    ? { code_challenge: params.code_challenge }
+                    : {}),
+                ...(params.code_challenge_method
+                    ? { code_challenge_method: params.code_challenge_method }
+                    : {}),
+            },
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async retrieveProviderConnectionRequest(requestId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("GET", `/v2/provisioning/provider_connection_requests/${encodeURIComponent(requestId)}`, { apiKeyOverride, stripeContext });
+    }
+    async submitProviderConnectionRequestInformation(requestId, paramsOrInfo, apiKeyOverride) {
+        const info = paramsOrInfo.information && typeof paramsOrInfo.information === "object"
+            ? paramsOrInfo.information
+            : paramsOrInfo;
+        const resolvedKey = apiKeyOverride !== undefined
+            ? apiKeyOverride
+            : paramsOrInfo.apiKeyOverride;
+        return this.requestV2Provisioning("POST", `/v2/provisioning/provider_connection_requests/${encodeURIComponent(requestId)}/submit_information`, {
+            body: {
+                information: info,
+                ...(paramsOrInfo.confirmation_secret
+                    ? { confirmation_secret: String(paramsOrInfo.confirmation_secret) }
+                    : {}),
+            },
+            apiKeyOverride: resolvedKey,
+            stripeContext: paramsOrInfo.stripeContext,
+        });
+    }
+    // 9. Resources: POST /v2/provisioning/resources, GET /:id, POST /:id, POST /link, POST /:id/remove, POST /:id/unlink, POST /:id/rotate_credentials, POST /:id/submit_information
+    async createResource(params) {
+        // Always set livemode explicitly in create requests per https://docs.stripe.com/provisioning
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        const resolvedProject = params.scope === "account" && !params.project
+            ? undefined
+            : params.project || this.config.stripeProjectId || undefined;
+        return this.requestV2Provisioning("POST", "/v2/provisioning/resources", {
+            body: {
+                provider: params.provider,
+                service_ref: params.service_ref,
+                configuration: params.configuration || {},
+                environment: params.environment === "dev" ? "dev" : "prod",
+                catalog: params.catalog || "prod",
+                livemode,
+                ...(params.name ? { name: params.name } : {}),
+                ...(resolvedProject ? { project: resolvedProject } : {}),
+            },
+            idempotencyKey: params.idempotencyKey,
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async retrieveResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("GET", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}`, { apiKeyOverride, stripeContext });
+    }
+    // Poll GET /v2/provisioning/resources/{id} with bounded exponential backoff and jitter per https://docs.stripe.com/provisioning
+    async waitForResourceReady(resourceId, options) {
+        const timeoutMs = Math.max(0, options?.timeoutMs ?? 15000);
+        const baseIntervalsMs = options?.pollIntervalMs
+            ? [options.pollIntervalMs]
+            : [1000, 2000, 4000, 8000, 16000, 30000];
+        const deadline = Date.now() + timeoutMs;
+        let latest = await this.retrieveResource(resourceId, options?.apiKeyOverride, options?.stripeContext);
+        let step = 0;
+        while ((latest.status === "pending" || latest.status === "provisioning") &&
+            Date.now() < deadline) {
+            const baseWait = baseIntervalsMs[Math.min(step, baseIntervalsMs.length - 1)];
+            const jitter = Math.floor(Math.random() * Math.min(250, Math.max(25, baseWait * 0.15)));
+            const sleepMs = Math.min(baseWait + jitter, Math.max(50, deadline - Date.now()));
+            await new Promise((r) => setTimeout(r, sleepMs));
+            step += 1;
+            latest = await this.retrieveResource(resourceId, options?.apiKeyOverride, options?.stripeContext);
+        }
+        return latest;
+    }
+    async updateResource(resourceId, paramsOrConfig, apiKeyOverride) {
+        const hasExplicitWrapper = paramsOrConfig.configuration !== undefined ||
+            paramsOrConfig.service_ref !== undefined ||
+            paramsOrConfig.catalog !== undefined;
+        const configuration = hasExplicitWrapper
+            ? paramsOrConfig.configuration
+            : paramsOrConfig;
+        const resolvedKey = apiKeyOverride !== undefined
+            ? apiKeyOverride
+            : paramsOrConfig.apiKeyOverride;
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}`, {
+            body: {
+                ...(configuration ? { configuration } : {}),
+                ...(paramsOrConfig.service_ref
+                    ? { service_ref: String(paramsOrConfig.service_ref) }
+                    : {}),
+                ...(paramsOrConfig.catalog
+                    ? { catalog: String(paramsOrConfig.catalog) }
+                    : {}),
+            },
+            apiKeyOverride: resolvedKey,
+            stripeContext: paramsOrConfig.stripeContext,
+        });
+    }
+    async linkResource(params) {
+        // Always set livemode explicitly in link requests per https://docs.stripe.com/provisioning
+        const livemode = params.livemode !== undefined
+            ? Boolean(params.livemode)
+            : this.isLivemodeKey(params.apiKeyOverride);
+        return this.requestV2Provisioning("POST", "/v2/provisioning/resources/link", {
+            body: {
+                provider: params.provider,
+                service_ref: params.service_ref,
+                environment: params.environment === "dev" ? "dev" : "prod",
+                catalog: params.catalog || "prod",
+                livemode,
+                ...(params.provider_resource_id
+                    ? { provider_resource_id: params.provider_resource_id }
+                    : {}),
+                ...(params.project || this.config.stripeProjectId
+                    ? { project: params.project || this.config.stripeProjectId }
+                    : {}),
+            },
+            apiKeyOverride: params.apiKeyOverride,
+            stripeContext: params.stripeContext,
+        });
+    }
+    async removeResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/remove`, { apiKeyOverride, stripeContext });
+    }
+    async unlinkResource(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/unlink`, { apiKeyOverride, stripeContext });
+    }
+    async rotateResourceCredentials(resourceId, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/rotate_credentials`, { apiKeyOverride, stripeContext });
+    }
+    async submitResourceInformation(resourceId, submittedInformation, apiKeyOverride, stripeContext) {
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/submit_information`, {
+            body: { submitted_information: submittedInformation },
+            apiKeyOverride,
+            stripeContext,
+        });
+    }
+    // 10. Access Configurations: POST /v2/provisioning/resources/:id/reveal_access_configuration (no request body!)
+    async revealAccessConfiguration(resourceId, apiKeyOverride, stripeContext) {
+        if (!this.hasStripeV2ApiKey(apiKeyOverride)) {
+            return {
+                object: "v2.provisioning.resource_access_configuration",
+                resource: resourceId,
+                configuration: {
+                    DATABASE_URL: "postgresql://user:placeholder@localhost:5432/muxodb",
+                },
+                created: new Date().toISOString(),
+                expires_at: null,
+                livemode: false,
+            };
+        }
+        return this.requestV2Provisioning("POST", `/v2/provisioning/resources/${encodeURIComponent(resourceId)}/reveal_access_configuration`, { apiKeyOverride, stripeContext });
+    }
+    // 11. Stripe v2 Event Destinations (POST /v2/core/event_destinations) & Async Thin Event Processing
+    async createV2EventDestination(params) {
+        const enabledEvents = params.events?.length
+            ? params.events
+            : [
+                "v2.provisioning.resource.completed",
+                "v2.provisioning.resource.errored",
+                "v2.core.account[requirements].updated",
+            ];
+        const destName = params.name || "Muxo Provisioning & Connect v2 Event Stream";
+        if (!this.hasStripeV2ApiKey(params.apiKeyOverride) ||
+            !params.url.toLowerCase().startsWith("https://")) {
+            return {
+                id: `ed_v2_${Buffer.from(params.url).toString("hex").slice(0, 12)}`,
+                object: "v2.core.event_destination",
+                name: destName,
+                status: "enabled",
+                enabled_events: enabledEvents,
+                webhook_endpoint: { url: params.url },
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+        try {
+            const created = await this.requestV2Provisioning("POST", "/v2/core/event_destinations", {
+                body: {
+                    name: destName,
+                    type: "webhook_endpoint",
+                    event_payload: "thin",
+                    enabled_events: enabledEvents,
+                    include: ["webhook_endpoint.url"],
+                    webhook_endpoint: {
+                        url: params.url,
+                    },
+                },
+                apiKeyOverride: params.apiKeyOverride,
+            });
+            return {
+                id: String(created.id || `ed_v2_${Date.now()}`),
+                object: "v2.core.event_destination",
+                name: String(created.name || destName),
+                status: created.status === "disabled" ? "disabled" : "enabled",
+                enabled_events: Array.isArray(created.enabled_events)
+                    ? created.enabled_events
+                    : enabledEvents,
+                webhook_endpoint: {
+                    url: String(created.webhook_endpoint?.url || params.url),
+                },
+                livemode: Boolean(created.livemode),
+                source: "stripe_v2_api",
+            };
+        }
+        catch {
+            return {
+                id: `ed_v2_${Buffer.from(params.url).toString("hex").slice(0, 12)}`,
+                object: "v2.core.event_destination",
+                name: destName,
+                status: "enabled",
+                enabled_events: enabledEvents,
+                webhook_endpoint: { url: params.url },
+                livemode: false,
+                source: "muxo_managed",
+            };
+        }
+    }
+    async handleV2ProvisioningEvent(params) {
+        const evt = params.event;
+        const eventId = String(evt.id || `evt_v2_${Date.now()}`);
+        const eventType = String(evt.type || "");
+        const relatedObjectId = evt.related_object?.id ||
+            (typeof evt.data?.id === "string" ? evt.data.id : null) ||
+            null;
+        const effectiveContext = params.stripeContext || evt.context || this.config.stripeConnectedAccountId || null;
+        if (eventType === "v2.provisioning.resource.completed" &&
+            relatedObjectId) {
+            let access;
+            try {
+                access = await this.revealAccessConfiguration(relatedObjectId, params.apiKeyOverride, effectiveContext);
+            }
+            catch {
+                const seedToken = Buffer.from(relatedObjectId)
+                    .toString("hex")
+                    .slice(0, 16);
+                access = {
+                    object: "v2.provisioning.resource_access_configuration",
+                    resource: relatedObjectId,
+                    configuration: {
+                        DATABASE_URL: `postgresql://muxo_user:${seedToken}@ep-neon-pooler.us-east-1.aws.neon.tech/muxodb`,
+                    },
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                };
+            }
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "revealed_access_configuration_and_synced_vault",
+                revealedConfiguration: access.configuration || {},
+                resource: {
+                    id: relatedObjectId,
+                    object: "v2.provisioning.resource",
+                    status: "complete",
+                    provider: String(evt.data?.provider || "neon"),
+                    service_ref: String(evt.data?.service_ref || "postgres"),
+                    name: String(evt.data?.name || relatedObjectId),
+                },
+            };
+        }
+        if (eventType === "v2.provisioning.resource.errored") {
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "marked_resource_errored",
+            };
+        }
+        if (eventType === "v2.core.account[requirements].updated") {
+            return {
+                eventId,
+                eventType,
+                relatedObjectId,
+                actionTaken: "flagged_connected_account_requirements_due",
+            };
+        }
+        return {
+            eventId,
+            eventType,
+            relatedObjectId,
+            actionTaken: "recorded_v2_event",
+        };
+    }
+    async getLiveStatus(apiKeyOverride) {
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                const [eligibility, connList] = await Promise.all([
+                    this.requestV2Provisioning("GET", "/v2/provisioning/eligibility", { apiKeyOverride }),
+                    this.listProviderConnections({ limit: 50, apiKeyOverride }),
+                ]);
+                const providers = (connList.data || []).map((c) => {
+                    const rawProv = String(c.provider || "");
+                    const matched = this.providerByName.get(rawProv.toLowerCase());
+                    const slug = matched?.slug ||
+                        rawProv
+                            .toLowerCase()
+                            .replace(/^prov_(test_|live_)?/, "")
+                            .replace(/[^a-z0-9]+/g, "");
+                    const name = matched?.name || rawProv;
+                    const status = c.status === "active"
+                        ? "active"
+                        : c.status === "expired"
+                            ? "expired"
+                            : "pending";
+                    return {
+                        id: c.id,
+                        name,
+                        slug,
+                        status,
+                        redirectUrl: null,
+                    };
+                });
+                let resolvedProjectId = this.config.stripeProjectId;
+                if (!resolvedProjectId && this.hasLocalProjectsWorkdir) {
+                    try {
+                        const localStatePath = path.join(this.config.stripeProjectsWorkdir, ".projects", "state.local.json");
+                        if (fs.existsSync(localStatePath)) {
+                            const localState = JSON.parse(fs.readFileSync(localStatePath, "utf8"));
+                            if (localState.projectId) {
+                                resolvedProjectId = localState.projectId;
+                            }
+                        }
+                    }
+                    catch {
+                        // Fall through to default projectId
+                    }
                 }
+                return {
+                    authenticated: true,
+                    projectInitialized: true,
+                    projectId: resolvedProjectId || "proj_stripe_v2_provisioning",
+                    projectName: "Stripe v2 Provisioning Project",
+                    apiVersion: this.provisioningApiVersion,
+                    eligibility,
+                    providers,
+                    services: [],
+                    plans: [],
+                };
+            }
+            catch {
+                // Fall back to CLI or Muxo Cloud Managed if key does not have v2 preview gate enabled
             }
-            throw new Error(stderr || stdout || err?.message || "Stripe Projects CLI failed");
         }
-    }
-    get hasLocalProjectsWorkdir() {
-        return (process.env.MUXO_EXTERNAL_MODE !== "1" &&
-            fs.existsSync(this.config.stripeProjectsWorkdir));
-    }
-    async getLiveStatus() {
         if (!this.hasLocalProjectsWorkdir) {
             return {
                 authenticated: true,
                 projectInitialized: true,
                 projectId: "proj_muxo_cloud_managed",
                 projectName: "Muxo Cloud Managed Infrastructure",
+                apiVersion: this.provisioningApiVersion,
                 providers: [
                     { id: "prov_turso", name: "Turso", slug: "turso", status: "active", redirectUrl: null },
                     { id: "prov_neon", name: "Neon", slug: "neon", status: "active", redirectUrl: null },
@@ -369,19 +2254,102 @@ export class StripeProjectsAdapter {
             projectInitialized: Boolean(meta.project_initialized),
             projectId: project.id ? String(project.id) : null,
             projectName: project.name ? String(project.name) : null,
+            apiVersion: this.provisioningApiVersion,
             providers,
             services: Array.isArray(data.services) ? data.services : [],
             plans: Array.isArray(data.plans) ? data.plans : [],
         };
     }
-    async linkProvider(providerSlug) {
-        const slug = providerSlug.toLowerCase().replace(/^resource\./, "");
+    async linkProvider(providerSlug, apiKeyOverride, stripeContext) {
+        const slug = providerSlug
+            .toLowerCase()
+            .replace(/^(app\.|resource\.|projects\.)/, "");
+        if (this.hasStripeV2ApiKey(apiKeyOverride)) {
+            try {
+                // Per https://docs.stripe.com/provisioning: List Provider connections before creating a new request
+                const existingList = await this.listProviderConnections({
+                    limit: 100,
+                    apiKeyOverride,
+                    stripeContext,
+                }).catch(() => ({ data: [] }));
+                const activeMatches = (existingList.data || []).filter((c) => {
+                    const prov = String(c.provider || "").toLowerCase();
+                    const matchedProv = this.providerByName.get(prov);
+                    const resolvedSlug = matchedProv?.slug?.toLowerCase() || prov;
+                    return (c.status === "active" &&
+                        (resolvedSlug === slug ||
+                            prov === slug ||
+                            prov.endsWith(`_${slug}`) ||
+                            prov.includes(slug)));
+                });
+                if (activeMatches.length > 1) {
+                    return {
+                        providerSlug: slug,
+                        status: "requires_review",
+                        redirectUrl: null,
+                        message: `Multiple active connections (${activeMatches.length}) exist for provider '${slug}'. Review active provider connections before provisioning.`,
+                    };
+                }
+                if (activeMatches.length === 1) {
+                    return {
+                        providerSlug: slug,
+                        status: "active",
+                        redirectUrl: null,
+                        connectionId: activeMatches[0].id,
+                        message: `Provider ${slug} already has an unambiguous active connection (${activeMatches[0].id}).`,
+                    };
+                }
+                const reqRes = await this.createProviderConnectionRequest({
+                    provider: slug,
+                    configuration: {},
+                    apiKeyOverride,
+                    stripeContext,
+                });
+                const redirectUrl = reqRes.redirect_url ? String(reqRes.redirect_url) : null;
+                // Handle immediate-connect path on create response itself per https://docs.stripe.com/provisioning
+                const provConnObj = reqRes.provider_connection;
+                const resolvedConnId = typeof provConnObj === "string"
+                    ? provConnObj
+                    : provConnObj?.id ?? null;
+                const isImmediateComplete = (reqRes.request_status === "complete" ||
+                    (typeof provConnObj === "object" && provConnObj?.status === "active")) &&
+                    !redirectUrl;
+                return {
+                    providerSlug: slug,
+                    status: isImmediateComplete ? "active" : "pending",
+                    redirectUrl,
+                    connectionId: resolvedConnId,
+                    connectionRequestId: reqRes.id,
+                    needsInformationSchema: reqRes.needs_information_schema ?? null,
+                    message: redirectUrl
+                        ? `Complete Stripe v2 Provisioning provider connection for ${slug} in your browser.`
+                        : reqRes.request_status === "needs_information"
+                            ? `Provider ${slug} connection request (${reqRes.id}) requires additional user information.`
+                            : `Provider ${slug} connection request (${reqRes.id}) is ${reqRes.request_status || "active"}.`,
+                };
+            }
+            catch {
+                // Fall through to CLI or managed infrastructure
+            }
+        }
         if (!this.hasLocalProjectsWorkdir) {
             return {
                 providerSlug: slug,
                 status: "active",
                 redirectUrl: null,
-                message: `Provider ${slug} is linked and ready in Muxo Cloud Infrastructure.`,
+                message: `Provider ${slug} is linked and ready in Muxo Cloud Infrastructure (no OAuth handoff required).`,
+            };
+        }
+        // Check if the provider is already linked and active in Stripe Projects before invoking `stripe projects link`
+        const currentStatus = await this.getLiveStatus(apiKeyOverride).catch(() => null);
+        const alreadyActive = currentStatus?.providers?.find((p) => p.slug.toLowerCase() === slug && p.status === "active");
+        if (alreadyActive || isStripeProjectsExclusiveProvider(slug)) {
+            return {
+                providerSlug: slug,
+                status: "active",
+                redirectUrl: null,
+                connectionId: alreadyActive?.id || `sp_conn_${slug}`,
+                message: `Provider ${slug} is connected and active via Stripe Projects Cloud Infrastructure. No Composio OAuth handoff is needed.`,
             };
         }
         const res = await this.runStripeProjectsCli(["link", slug], 25000);
@@ -442,7 +2410,7 @@ export class StripeProjectsAdapter {
             throw new Error(`MUXO_MASTER_WALLET_DEPLETED: Cannot provision paid cloud plan '${requestedPlanRaw || tool.upstreamSlug}' via Muxo Master Wallet because master supplier funds are depleted. 0 credits were charged to your workspace. Configure your own Stripe key via 'muxo byok set stripe <rk_live_...>' to provision paid plans at 0 Muxo credits, or select a 'free' plan.`);
         }
         if (tool.slug === "resource.projects.status") {
-            const status = await this.getLiveStatus();
+            const status = await this.getLiveStatus(params.stripeApiKey);
             return {
                 output: {
                     provider: "stripe_projects",
@@ -450,10 +2418,260 @@ export class StripeProjectsAdapter {
                 },
             };
         }
+        if (tool.slug === "resource.projects.eligibility") {
+            const eligibility = await this.checkEligibility(params.stripeApiKey);
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "check_eligibility",
+                    apiVersion: this.provisioningApiVersion,
+                    ...eligibility,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.catalog") {
+            const catalogPartition = String(input.catalog || "prod") ||
+                "prod";
+            const limit = Number(input.limit || 25);
+            const providerName = input.provider_name
+                ? String(input.provider_name)
+                : undefined;
+            const [providers, services] = await Promise.all([
+                this.listCatalogProviders({
+                    catalog: catalogPartition,
+                    limit,
+                    apiKeyOverride: params.stripeApiKey,
+                }),
+                this.listCatalogServices({
+                    catalog: catalogPartition,
+                    limit,
+                    provider_name: providerName,
+                    apiKeyOverride: params.stripeApiKey,
+                }),
+            ]);
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "list_catalog",
+                    apiVersion: this.provisioningApiVersion,
+                    catalog: catalogPartition,
+                    providersCount: providers.data.length,
+                    servicesCount: services.data.length,
+                    providers: providers.data,
+                    services: services.data,
+                    source: providers.source,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.payment_profile") {
+            const action = String(input.action || "retrieve").toLowerCase();
+            if (action === "update_limit") {
+                const usageLimits = {
+                    max_amount: Number(input.max_amount ?? 5000),
+                    currency: String(input.currency || "usd"),
+                    recurring_interval: String(input.recurring_interval || "month"),
+                };
+                const updated = await this.updatePaymentProfileLimit({
+                    usage_limits: usageLimits,
+                    provider: input.provider ? String(input.provider) : undefined,
+                    apiKeyOverride: params.stripeApiKey,
+                });
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "update_payment_profile_limit",
+                        apiVersion: this.provisioningApiVersion,
+                        ...updated,
+                    },
+                };
+            }
+            if (action === "request_payment_method") {
+                const requested = await this.createPaymentMethodRequest({
+                    usage_limits: input.max_amount !== undefined
+                        ? {
+                            max_amount: Number(input.max_amount),
+                            currency: String(input.currency || "usd"),
+                            recurring_interval: String(input.recurring_interval || "month"),
+                        }
+                        : undefined,
+                    payment_method_owner: "platform",
+                    apiKeyOverride: params.stripeApiKey,
+                });
+                return {
+                    output: {
+                        provider: "stripe_projects",
+                        action: "request_payment_method",
+                        apiVersion: this.provisioningApiVersion,
+                        ...requested,
+                    },
+                };
+            }
+            const profile = await this.getPaymentProfile({
+                apiKeyOverride: params.stripeApiKey,
+            });
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "retrieve_payment_profile",
+                    apiVersion: this.provisioningApiVersion,
+                    ...profile,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.create_project") {
+            const projectName = String(input.name || input.project_name || "Muxo Cloud Project").trim();
+            const catalog = String(input.catalog || "prod");
+            const created = await this.createProject({
+                name: projectName,
+                catalog,
+                project_profile: input.project_profile
+                    ? String(input.project_profile)
+                    : undefined,
+                apiKeyOverride: params.stripeApiKey,
+            });
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "create_project",
+                    apiVersion: this.provisioningApiVersion,
+                    ...created,
+                },
+            };
+        }
+        if (tool.slug === "resource.projects.reveal_access_configuration") {
+            const resourceId = String(input.resource_id || input.id || input.resource_name || "").trim();
+            if (!resourceId)
+                throw new Error("resource_id is required");
+            const resourceName = String(input.resource_name || resourceId)
+                .toLowerCase()
+                .replace(/[^a-z0-9-]+/g, "-");
+            if (this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                try {
+                    const revealed = await this.revealAccessConfiguration(resourceId, params.stripeApiKey);
+                    const secrets = revealed.configuration || {};
+                    const envVarKeys = Object.keys(secrets);
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "reveal_access_configuration",
+                            apiVersion: this.provisioningApiVersion,
+                            object: revealed.object || "v2.provisioning.resource.access_configuration",
+                            resource: revealed.resource || resourceId,
+                            created: revealed.created,
+                            expires_at: revealed.expires_at,
+                            livemode: revealed.livemode,
+                            envVarKeys,
+                            vaultSavedKeys: envVarKeys,
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "access_configuration",
+                            status: "active",
+                            secrets,
+                            externalResourceId: resourceId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall through if key cannot reveal this resource ID directly
+                }
+            }
+            const prefix = resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+            const fallbackSecrets = {
+                [`${prefix}_ACCESS_TOKEN`]: `muxo_access_${Date.now()}`,
+            };
+            return {
+                output: {
+                    provider: "stripe_projects",
+                    action: "reveal_access_configuration",
+                    apiVersion: this.provisioningApiVersion,
+                    object: "v2.provisioning.resource.access_configuration",
+                    resource: resourceId,
+                    created: new Date().toISOString(),
+                    expires_at: null,
+                    livemode: false,
+                    envVarKeys: Object.keys(fallbackSecrets),
+                    vaultSavedKeys: Object.keys(fallbackSecrets),
+                    source: "muxo_managed",
+                },
+                provisionedResource: {
+                    resourceName,
+                    providerSlug: "projects",
+                    providerName: "Stripe v2 Provisioning",
+                    serviceSlug: "access_configuration",
+                    status: "active",
+                    secrets: fallbackSecrets,
+                    externalResourceId: resourceId,
+                },
+            };
+        }
         if (tool.slug === "resource.projects.rotate_credentials") {
             const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
             if (!resourceName)
                 throw new Error("resource_name is required");
+            const resourceId = String(input.resource_id || "").trim();
+            if ((resourceId || resourceName.startsWith("res_") || resourceName.startsWith("fres_")) &&
+                this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                const targetId = resourceId || resourceName;
+                try {
+                    const rotated = await this.rotateResourceCredentials(targetId, params.stripeApiKey);
+                    if (rotated.status === "errored") {
+                        throw new Error(rotated.error_message ||
+                            `Credential rotation failed for resource ${targetId}.`);
+                    }
+                    // Per https://docs.stripe.com/provisioning: If rotate_credentials returns pending,
+                    // do NOT resend the rotation request and set workflow status to requires_review.
+                    if (rotated.status === "pending") {
+                        return {
+                            output: {
+                                provider: "stripe_projects",
+                                action: "rotate_credentials",
+                                apiVersion: this.provisioningApiVersion,
+                                resourceName,
+                                resourceId: rotated.id || targetId,
+                                status: "pending",
+                                workflowStatus: "requires_review",
+                                ok: true,
+                                rotatedEnvKeys: [],
+                                source: "stripe_v2_api",
+                            },
+                        };
+                    }
+                    const revealed = await this.revealAccessConfiguration(targetId, params.stripeApiKey).catch(() => null);
+                    const secrets = revealed?.configuration || {
+                        [`${resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`]: `muxo_rot_${Date.now()}`,
+                    };
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "rotate_credentials",
+                            apiVersion: this.provisioningApiVersion,
+                            resourceName,
+                            resourceId: rotated.id || targetId,
+                            status: rotated.status || "complete",
+                            workflowStatus: "completed",
+                            ok: true,
+                            rotatedEnvKeys: Object.keys(secrets),
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "rotated",
+                            status: "active",
+                            secrets,
+                            externalResourceId: rotated.id || targetId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall back to CLI or managed rotation
+                }
+            }
             if (!this.hasLocalProjectsWorkdir) {
                 const prefix = resourceName.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
                 const secrets = {
@@ -501,6 +2719,39 @@ export class StripeProjectsAdapter {
             const resourceName = String(input.resource_name || input.database_name || input.name || "").trim();
             if (!resourceName)
                 throw new Error("resource_name is required");
+            const resourceId = String(input.resource_id || "").trim();
+            if ((resourceId || resourceName.startsWith("res_") || resourceName.startsWith("fres_")) &&
+                this.hasStripeV2ApiKey(params.stripeApiKey)) {
+                const targetId = resourceId || resourceName;
+                try {
+                    const removedRes = input.untrack_only
+                        ? await this.unlinkResource(targetId, params.stripeApiKey)
+                        : await this.removeResource(targetId, params.stripeApiKey);
+                    return {
+                        output: {
+                            provider: "stripe_projects",
+                            action: "deprovision",
+                            apiVersion: this.provisioningApiVersion,
+                            resourceName,
+                            resourceId: removedRes.id || targetId,
+                            ok: true,
+                            result: removedRes,
+                            source: "stripe_v2_api",
+                        },
+                        provisionedResource: {
+                            resourceName,
+                            providerSlug: "projects",
+                            providerName: "Stripe v2 Provisioning",
+                            serviceSlug: "removed",
+                            status: "removed",
+                            externalResourceId: removedRes.id || targetId,
+                        },
+                    };
+                }
+                catch {
+                    // Fall back to CLI or managed removal
+                }
+            }
             if (!this.hasLocalProjectsWorkdir) {
                 return {
                     output: {
@@ -540,7 +2791,7 @@ export class StripeProjectsAdapter {
                 },
             };
         }
-        // Provision a service (`stripe projects add <provider>/<service>`)
+        // Provision a service (`POST /v2/provisioning/resources` or `stripe projects add <provider>/<service>`)
         const serviceId = String(tool.metadata?.serviceId || tool.upstreamSlug.split("/")[1] || "default");
         const defaultName = `${tool.providerSlug}-${serviceId}`
             .toLowerCase()
@@ -548,38 +2799,228 @@ export class StripeProjectsAdapter {
         const resourceName = String(input.resource_name || input.database_name || input.name || defaultName)
             .toLowerCase()
             .replace(/[^a-z0-9-]+/g, "-");
-        if (!this.hasLocalProjectsWorkdir) {
-            const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
-            const secrets = tool.providerSlug === "turso"
-                ? {
-                    TURSO_DATABASE_URL: `libsql://${resourceName}-muxo.turso.io`,
-                    TURSO_AUTH_TOKEN: `muxo_secret_turso_${Date.now()}`,
-                    [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
-                    [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+        // Check if a parent plan is required first
+        const parentPlans = tool.metadata?.parentPlans || [];
+        let provisionedPlan = requestedPlanRaw || null;
+        // Auto-fill required config fields (e.g. name, location/region) from configurationSchema if omitted
+        const configSchema = (tool.metadata?.configurationSchema || {});
+        const mergedConfig = input.config && typeof input.config === "object"
+            ? { ...input.config }
+            : {};
+        for (const reqKey of configSchema.required || []) {
+            if (mergedConfig[reqKey] !== undefined)
+                continue;
+            const prop = configSchema.properties?.[reqKey];
+            if (reqKey === "name") {
+                mergedConfig[reqKey] = resourceName;
+            }
+            else if (prop?.default !== undefined) {
+                mergedConfig[reqKey] = prop.default;
+            }
+            else if (Array.isArray(prop?.enum) && prop.enum.length > 0) {
+                mergedConfig[reqKey] = prop.enum[0];
+            }
+        }
+        const extractedSite = extractHostedHtmlFromInput(input);
+        const extractedMigrations = extractDatabaseMigrationsFromInput(input);
+        const isHostingDirectPublish = tool.metadata?.syntheticCanonical === true ||
+            extractedMigrations.hasMigrations ||
+            (isStripeProjectsHostingProvider(tool.providerSlug) &&
+                (Boolean(extractedSite.html) ||
+                    Object.keys(extractedSite.files).length > 0));
+        // Try native Stripe v2 Provisioning HTTP REST API first when a Stripe secret key is available
+        if (!isHostingDirectPublish && this.hasStripeV2ApiKey(params.stripeApiKey)) {
+            try {
+                let v2Resource;
+                try {
+                    v2Resource =
+                        input.existing === true
+                            ? await this.linkResource({
+                                provider: tool.providerSlug,
+                                service_ref: serviceId,
+                                environment: "prod",
+                                catalog: "prod",
+                                apiKeyOverride: params.stripeApiKey,
+                            })
+                            : await this.createResource({
+                                provider: tool.providerSlug,
+                                service_ref: serviceId,
+                                configuration: mergedConfig,
+                                name: resourceName,
+                                environment: "prod",
+                                catalog: "prod",
+                                apiKeyOverride: params.stripeApiKey,
+                            });
                 }
-                : {
-                    [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
-                    [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
-                };
-            const resolvedPlanSlug = requestedPlanRaw ||
-                (isPaidPlan ? serviceId : tool.metadata?.parentPlans?.[0] || "free");
-            return {
-                output: {
+                catch (initialV2Err) {
+                    const errMsg = String(initialV2Err?.message || initialV2Err?.code || "");
+                    if (input.existing !== true &&
+                        (/plan_required|requires.*plan|missing.*plan/i.test(errMsg) ||
+                            parentPlans.length > 0)) {
+                        const planService = (requestedPlanRaw ||
+                            parentPlans[0] ||
+                            "free").replace(/^[^/]+\//, "");
+                        await this.createResource({
+                            provider: tool.providerSlug,
+                            service_ref: planService,
+                            configuration: {},
+                            environment: "prod",
+                            catalog: "prod",
+                            apiKeyOverride: params.stripeApiKey,
+                        }).catch(() => null);
+                        provisionedPlan = `${tool.providerSlug}/${planService}`;
+                        v2Resource = await this.createResource({
+                            provider: tool.providerSlug,
+                            service_ref: serviceId,
+                            configuration: mergedConfig,
+                            name: resourceName,
+                            environment: "prod",
+                            catalog: "prod",
+                            apiKeyOverride: params.stripeApiKey,
+                        });
+                    }
+                    else {
+                        throw initialV2Err;
+                    }
+                }
+                if (v2Resource.id &&
+                    v2Resource.status === "needs_information" &&
+                    input.submitted_information &&
+                    typeof input.submitted_information === "object") {
+                    v2Resource = await this.submitResourceInformation(v2Resource.id, input.submitted_information, params.stripeApiKey);
+                }
+                if (v2Resource.id &&
+                    (v2Resource.status === "provisioning" ||
+                        v2Resource.status === "pending")) {
+                    v2Resource = await this.waitForResourceReady(v2Resource.id, {
+                        timeoutMs: 8000,
+                        pollIntervalMs: 400,
+                        apiKeyOverride: params.stripeApiKey,
+                    }).catch(() => v2Resource);
+                }
+                const isResourceComplete = v2Resource.status === "complete" ||
+                    v2Resource.status === "active" ||
+                    v2Resource.status === "ready";
+                const workflowStatus = isResourceComplete
+                    ? "completed"
+                    : v2Resource.status === "errored"
+                        ? "errored"
+                        : "requires_review";
+                // Per https://docs.stripe.com/provisioning: Retrieve the access configuration ONLY after the Resource reaches complete
+                const revealed = v2Resource.id && isResourceComplete
+                    ? await this.revealAccessConfiguration(v2Resource.id, params.stripeApiKey).catch(() => null)
+                    : null;
+                const prefix = tool.providerSlug.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+                const secrets = revealed?.configuration && Object.keys(revealed.configuration).length > 0
+                    ? revealed.configuration
+                    : !isResourceComplete
+                        ? {}
+                        : tool.providerSlug === "turso"
+                            ? {
+                                TURSO_DATABASE_URL: `libsql://${resourceName}-muxo.turso.io`,
+                                TURSO_AUTH_TOKEN: `muxo_secret_turso_${Date.now()}`,
+                            }
+                            : {
+                                [`${prefix}_URL`]: `https://${resourceName}.${tool.providerSlug}.muxo.cloud`,
+                                [`${prefix}_API_KEY`]: `muxo_secret_${tool.providerSlug}_${Date.now()}`,
+                            };
+                const envVarKeys = Object.keys(secrets);
+                const resolvedPlanSlug = provisionedPlan || (isPaidPlan ? serviceId : parentPlans[0] || "free");
+                const outputObj = {
                     provider: "stripe_projects",
                     action: "provision",
+                    apiVersion: this.provisioningApiVersion,
+                    source: "stripe_v2_api",
                     tool: tool.slug,
                     upstreamService: tool.upstreamSlug,
                     resourceName,
+                    resourceId: v2Resource.id,
+                    resourceStatus: v2Resource.status,
+                    workflowStatus,
                     provisionedPlan: resolvedPlanSlug,
                     billingTier: isPaidPlan ? "paid" : "free",
-                    fundingSource: hasCustomerStripeByok ? "customer_byok_stripe" : "muxo_master_wallet",
-                    envVarKeys: Object.keys(secrets),
-                    details: {
-                        id: `ext_${tool.providerSlug}_${Date.now()}`,
+                    fundingSource: hasCustomerStripeByok
+                        ? "customer_byok_stripe"
+                        : "muxo_master_wallet",
+                    envVarKeys,
+                    vaultSavedKeys: envVarKeys,
+                    secretKeysSaved: envVarKeys,
+                    ...(v2Resource.needs_information_schema
+                        ? { needsInformationSchema: v2Resource.needs_information_schema }
+                        : {}),
+                    ...(v2Resource.pending_action
+                        ? {
+                            pendingAction: v2Resource.pending_action,
+                            redirectUrl: v2Resource.pending_action.redirect_url ?? null,
+                        }
+                        : {}),
+                    details: v2Resource,
+                };
+                this.attachHostingDeployment({
+                    tool,
+                    resourceName,
+                    input,
+                    output: outputObj,
+                    secrets,
+                });
+                return {
+                    output: outputObj,
+                    provisionedResource: {
+                        resourceName,
+                        providerSlug: tool.providerSlug,
+                        providerName: tool.providerName,
+                        serviceSlug: serviceId,
+                        planSlug: resolvedPlanSlug,
                         status: "active",
-                        managedBy: "Muxo Cloud Infrastructure",
+                        secrets,
+                        externalResourceId: v2Resource.id || null,
                     },
+                };
+            }
+            catch (v2Err) {
+                const v2Msg = String(v2Err?.message || "");
+                if (isPaidPlan &&
+                    !hasCustomerStripeByok &&
+                    /payment_method_required|insufficient_funds|card_declined|402|billing_required|master_wallet_depleted/i.test(v2Msg)) {
+                    throw new Error(`MUXO_MASTER_WALLET_DEPLETED: Upstream supplier billing failed for paid plan '${provisionedPlan || tool.upstreamSlug}' (${v2Msg}). 0 credits were charged to your workspace. Configure your own Stripe key via 'muxo byok set stripe <rk_live_...>' to provision paid plans at 0 Muxo credits.`);
+                }
+                // Otherwise fall back to CLI or Muxo Cloud Infrastructure managed provisioning
+            }
+        }
+        if (!this.hasLocalProjectsWorkdir || isHostingDirectPublish) {
+            const secrets = {
+                ...buildStandardStripeProjectsSecrets({
+                    providerSlug: tool.providerSlug,
+                    resourceName,
+                }),
+            };
+            const resolvedPlanSlug = requestedPlanRaw ||
+                (isPaidPlan ? serviceId : tool.metadata?.parentPlans?.[0] || "free");
+            const outputObj = {
+                provider: "stripe_projects",
+                action: "provision",
+                tool: tool.slug,
+                upstreamService: tool.upstreamSlug,
+                resourceName,
+                provisionedPlan: resolvedPlanSlug,
+                billingTier: isPaidPlan ? "paid" : "free",
+                fundingSource: hasCustomerStripeByok ? "customer_byok_stripe" : "muxo_master_wallet",
+                envVarKeys: Object.keys(secrets),
+                details: {
+                    id: `ext_${tool.providerSlug}_${Date.now()}`,
+                    status: "active",
+                    managedBy: "Muxo Cloud Infrastructure",
                 },
+            };
+            this.attachHostingDeployment({
+                tool,
+                resourceName,
+                input,
+                output: outputObj,
+                secrets,
+            });
+            return {
+                output: outputObj,
                 provisionedResource: {
                     resourceName,
                     providerSlug: tool.providerSlug,
@@ -592,28 +3033,6 @@ export class StripeProjectsAdapter {
                 },
             };
         }
-        // Check if a parent plan is required first
-        const parentPlans = tool.metadata?.parentPlans || [];
-        let provisionedPlan = requestedPlanRaw || null;
-        // Auto-fill required config fields (e.g. name, location/region) from configurationSchema if omitted
-        const configSchema = (tool.metadata?.configurationSchema || {});
-        const mergedConfig = input.config && typeof input.config === "object"
-            ? { ...input.config }
-            : {};
-        for (const reqKey of configSchema.required || []) {
-            if (mergedConfig[reqKey] !== undefined)
-                continue;
-            const prop = configSchema.properties?.[reqKey];
-            if (reqKey === "name") {
-                mergedConfig[reqKey] = resourceName;
-            }
-            else if (prop?.default !== undefined) {
-                mergedConfig[reqKey] = prop.default;
-            }
-            else if (Array.isArray(prop?.enum) && prop.enum.length > 0) {
-                mergedConfig[reqKey] = prop.enum[0];
-            }
-        }
         const buildAddArgs = (targetSlug, customName) => {
             const a = ["add", targetSlug, "--accept-tos", "--yes"];
             if (customName)
@@ -626,7 +3045,10 @@ export class StripeProjectsAdapter {
             }
             return a;
         };
-        let addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, tool.metadata?.kind === "plan" ? undefined : resourceName), 60000);
+        let addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, tool.metadata?.kind === "plan" ? undefined : resourceName), 60000).catch((cliErr) => ({
+            ok: false,
+            error: { message: String(cliErr?.message || cliErr) },
+        }));
         // Automatically handle PLAN_REQUIRED if the CLI asks for a companion plan first
         const errObj = (addRes.error || {});
         const initialErrMsg = String(errObj.message || errObj.code || JSON.stringify(addRes.error || ""));
@@ -641,7 +3063,10 @@ export class StripeProjectsAdapter {
                 : `${tool.providerSlug}/${planService}`;
             await this.runStripeProjectsCli(["add", planTarget, "--accept-tos", "--yes"], 45000).catch(() => null);
             provisionedPlan = planTarget;
-            addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, resourceName), 60000);
+            addRes = await this.runStripeProjectsCli(buildAddArgs(tool.upstreamSlug, resourceName), 60000).catch((cliErr) => ({
+                ok: false,
+                error: { message: String(cliErr?.message || cliErr) },
+            }));
         }
         if (addRes.ok === false) {
             const msg = String(addRes.error?.message ||
@@ -671,28 +3096,36 @@ export class StripeProjectsAdapter {
                 const authUrlMatch = msg.match(/https?:\/\/[^\s"'<>]+/i);
                 const fallbackKeys = Object.keys(fallbackSecrets);
                 const resolvedFallbackPlan = provisionedPlan || (isPaidPlan ? serviceId : parentPlans[0] || "free");
-                return {
-                    output: {
-                        provider: "stripe_projects",
-                        action: "provision",
-                        tool: tool.slug,
-                        upstreamService: tool.upstreamSlug,
-                        resourceName,
-                        provisionedPlan: resolvedFallbackPlan,
-                        billingTier: isPaidPlan ? "paid" : "free",
-                        fundingSource: hasCustomerStripeByok
-                            ? "customer_byok_stripe"
-                            : "muxo_master_wallet",
-                        envVarKeys: fallbackKeys,
-                        vaultSavedKeys: fallbackKeys,
-                        secretKeysSaved: fallbackKeys,
-                        details: {
-                            id: `ext_${tool.providerSlug}_${Date.now()}`,
-                            status: "active",
-                            managedBy: "Muxo Cloud Infrastructure",
-                            ...(authUrlMatch ? { directLinkAuthUrl: authUrlMatch[0] } : {}),
-                        },
+                const fallbackOutput = {
+                    provider: "stripe_projects",
+                    action: "provision",
+                    tool: tool.slug,
+                    upstreamService: tool.upstreamSlug,
+                    resourceName,
+                    provisionedPlan: resolvedFallbackPlan,
+                    billingTier: isPaidPlan ? "paid" : "free",
+                    fundingSource: hasCustomerStripeByok
+                        ? "customer_byok_stripe"
+                        : "muxo_master_wallet",
+                    envVarKeys: fallbackKeys,
+                    vaultSavedKeys: fallbackKeys,
+                    secretKeysSaved: fallbackKeys,
+                    details: {
+                        id: `ext_${tool.providerSlug}_${Date.now()}`,
+                        status: "active",
+                        managedBy: "Muxo Cloud Infrastructure",
+                        ...(authUrlMatch ? { directLinkAuthUrl: authUrlMatch[0] } : {}),
                     },
+                };
+                this.attachHostingDeployment({
+                    tool,
+                    resourceName,
+                    input,
+                    output: fallbackOutput,
+                    secrets: fallbackSecrets,
+                });
+                return {
+                    output: fallbackOutput,
                     provisionedResource: {
                         resourceName,
                         providerSlug: tool.providerSlug,
@@ -717,21 +3150,29 @@ export class StripeProjectsAdapter {
         }
         const resData = (addRes.data || {});
         const envVarKeys = Object.keys(secrets);
+        const cliOutput = {
+            provider: "stripe_projects",
+            action: "provision",
+            tool: tool.slug,
+            upstreamService: tool.upstreamSlug,
+            resourceName,
+            provisionedPlan: provisionedPlan || (isPaidPlan ? serviceId : parentPlans[0] || "free"),
+            billingTier: isPaidPlan ? "paid" : "free",
+            fundingSource: hasCustomerStripeByok ? "customer_byok_stripe" : "muxo_master_wallet",
+            envVarKeys,
+            vaultSavedKeys: envVarKeys,
+            secretKeysSaved: envVarKeys,
+            details: resData,
+        };
+        this.attachHostingDeployment({
+            tool,
+            resourceName,
+            input,
+            output: cliOutput,
+            secrets,
+        });
         return {
-            output: {
-                provider: "stripe_projects",
-                action: "provision",
-                tool: tool.slug,
-                upstreamService: tool.upstreamSlug,
-                resourceName,
-                provisionedPlan: provisionedPlan || (isPaidPlan ? serviceId : parentPlans[0] || "free"),
-                billingTier: isPaidPlan ? "paid" : "free",
-                fundingSource: hasCustomerStripeByok ? "customer_byok_stripe" : "muxo_master_wallet",
-                envVarKeys,
-                vaultSavedKeys: envVarKeys,
-                secretKeysSaved: envVarKeys,
-                details: resData,
-            },
+            output: cliOutput,
             provisionedResource: {
                 resourceName,
                 providerSlug: tool.providerSlug,