@stackbone/cli 0.4.1 → 0.5.1

package/main.js

@@ -695,7 +695,17 @@ var init_contract$1 = __esmMin((() => {
 		}),
 		runtimeUrl: z.url().nullable().optional()
 	});
-})), deploymentStatusSchema, deploymentResponseSchema;
+}));
+//#endregion
+//#region ../../libs/shared/validators/src/lib/agents/deployments.ts
+function protocolOf(raw) {
+	try {
+		return new URL(raw).protocol;
+	} catch {
+		return null;
+	}
+}
+var deploymentStatusSchema, deploymentUrlSchema, deploymentResponseSchema;
 var init_deployments = __esmMin((() => {
 	init_organizations();
 	deploymentStatusSchema = z.enum([
@@ -704,11 +714,15 @@ var init_deployments = __esmMin((() => {
 		"ready",
 		"failed"
 	]);
+	deploymentUrlSchema = z.url().refine((raw) => {
+		const protocol = protocolOf(raw);
+		return protocol === null || protocol === "https:";
+	}, { error: (issue) => `scheme "${protocolOf(String(issue.input))}" is not supported — register the box by its https:// address` });
 	z.object({
 		organizationSlug: organizationSlugSchema,
 		agentSlug: agentSlugSchema,
 		installationId: z.uuid(),
-		url: z.url(),
+		url: deploymentUrlSchema,
 		hmacSecret: z.string().min(1),
 		imageTag: z.string().min(1).max(200).optional()
 	});
@@ -9720,9 +9734,11 @@ var init_connector_invoker = __esmMin((() => {
 * @param connector The connect connector id registered in Studio.
 * @param operation The operation / tool id to run on that connector.
 * @param args      The operation arguments (path/query/body params). Defaults `{}`.
-* @param opts      Optional `{ principal, idempotent }`. `principal` defaults to
-*                  `{ type: 'app' }`; `idempotent` is UNSET by default and only
-*                  an explicit `false` changes how a failure is retried.
+* @param opts      Optional `{ principal, idempotent, echoPath }`. `principal`
+*                  defaults to `{ type: 'app' }`; `idempotent` is UNSET by
+*                  default and only an explicit `false` changes how a failure is
+*                  retried; `echoPath` records what this write returned so a
+*                  later delivery of it can be recognised as our own.
 */
 async function callConnector(connector, operation, args, opts) {
 	return (await getConnectorInvoker().invoke({
@@ -9730,7 +9746,8 @@ async function callConnector(connector, operation, args, opts) {
 		operation,
 		...args !== void 0 ? { args } : {},
 		...opts?.principal !== void 0 ? { principal: opts.principal } : {},
-		...opts?.idempotent !== void 0 ? { idempotent: opts.idempotent } : {}
+		...opts?.idempotent !== void 0 ? { idempotent: opts.idempotent } : {},
+		...opts?.echoPath !== void 0 ? { echoPath: opts.echoPath } : {}
 	})).output;
 }
 var connectorHandle, connection;
@@ -14368,6 +14385,29 @@ var createInvocationsStore = (opts) => {
 			]);
 			return rows[0]?.id ?? null;
 		},
+		async findEchoRecord(input) {
+			assertOpen();
+			const args = [
+				input.connector,
+				input.value,
+				input.windowMs
+			];
+			let markerScope = "";
+			if (input.workflowName !== null) {
+				args.push(input.workflowName);
+				markerScope = ` AND (input->>'workflowName' = $${args.length} OR input->>'workflowName' IS NULL)`;
+			}
+			const { rows } = await readPool.query(`SELECT bool_or(input->>'echo' = $2) AS matched,
+                bool_or(input->>'echoUnresolved' = 'true'${markerScope}) AS unresolved
+           FROM stackbone_platform.run_steps
+          WHERE type = 'connection'
+            AND input->>'connector' = $1
+            AND created_at > now() - ($3::bigint * interval '1 millisecond')`, args);
+			return {
+				matched: rows[0]?.matched === true,
+				unresolved: rows[0]?.unresolved === true
+			};
+		},
 		async annotatePromptUse(input) {
 			if (!isUuid(input.runId)) return;
 			assertOpen();
@@ -15699,7 +15739,7 @@ var emulatorCors = (allowlist) => cors({
 var STACKBONE_CLI_BUILD_VERSION, EMULATOR_CAPABILITY_ROUTES, EMULATOR_CAPABILITIES, buildContractResponse;
 var init_contract = __esmMin((() => {
 	init_src$19();
-	STACKBONE_CLI_BUILD_VERSION = "0.4.1";
+	STACKBONE_CLI_BUILD_VERSION = "0.5.1";
 	EMULATOR_CAPABILITY_ROUTES = {
 		"database.postgres_direct": "/api/db",
 		"rag.basic": "/api/rag",
@@ -30724,6 +30764,37 @@ var init_types$1 = __esmMin((() => {
 		requestBodySchema: z.unknown().optional(),
 		/** Original Swagger body parameter name; allows body values alongside query filters. */
 		bodyArgName: z.string().optional(),
+		/**
+		* SEND THIS OPERATION'S BODY AS A FORM, not as JSON. The executor then encodes
+		* the same payload as `application/x-www-form-urlencoded` in the bracket
+		* dialect (`metadata[plan]=pro`, `items[0][price]=p_1`). Absent — the case for
+		* every operation of every other connector — the body is JSON, byte for byte
+		* as before.
+		*
+		* Declared on a document as `x-stackbone-body-encoding: form`, the fifth of the
+		* `x-stackbone-*` extensions and read by the same rules: a per-operation
+		* literal, ignored rather than coerced when it is anything else.
+		*
+		* EXPLICIT, NEVER INFERRED FROM THE SPEC'S CONTENT TYPE. A document that
+		* declares `application/x-www-form-urlencoded` under `requestBody.content` is
+		* saying what the provider ACCEPTS, and plenty of specs list several media
+		* types or the wrong one. Switching the serialisation on that reading would
+		* make a spec edit silently change what goes on the wire, which is the
+		* data-corruption class `openapi-introspector.ts` refuses everywhere else.
+		*
+		* ONE declared value rather than a `json` / `form` pair, because a second
+		* spelling of today's default is a second thing that can be got wrong for no
+		* gain: absent already means JSON and always has.
+		*
+		* Per-OPERATION, like the flags above. Stripe is the first provider we want it
+		* for and its API is form-encoded end to end, but a provider that takes a form
+		* on one endpoint and JSON on the next must not have the whole connector
+		* switched over.
+		*
+		* MULTIPART IS NOT HERE. A body of arbitrary bytes with a caller-chosen
+		* content type is what `rawBody` already does.
+		*/
+		bodyEncoding: z.literal("form").optional(),
 		responseSchema: z.unknown().optional(),
 		/**
 		* This operation's body is BYTES, not JSON. The executor then resolves the
@@ -30980,7 +31051,7 @@ function hasTopLevelAlternation(pattern) {
 	}
 	return false;
 }
-var argTargetSchema, triggerCursorSchema, triggerScopeParamSchema, unanchoredPatternReason, triggerListStepSchema, triggerItemStepSchema, declarativePollSchema, strategyPollSchema, pollSpecSchema, triggerDescriptorSchema;
+var argTargetSchema, triggerCursorSchema, compileAnchored, triggerScopeParamSchema, unanchoredPatternReason, triggerListStepSchema, triggerItemStepSchema, declarativePollSchema, strategyPollSchema, pollSpecSchema, triggerDescriptorSchema;
 var init_trigger_descriptor = __esmMin((() => {
 	init_paths();
 	argTargetSchema = z.union([z.string(), z.array(z.string()).min(1)], { error: "must be a parameter name (one literal key, dots included) or a non-empty array of path segments to nest it under" });
@@ -31054,7 +31125,25 @@ var init_trigger_descriptor = __esmMin((() => {
 		* that is a definition promising a margin the data cannot honour, and a
 		* failed tick on the row beats a protection that silently is not there.
 		*/
-		lookbackMs: z.number().int().positive().optional()
+		lookbackMs: z.number().int().positive().optional(),
+		/**
+		* The unit this cursor's stamps are counted in, when they are not ISO date
+		* strings. Stripe is the case: an event's `created` is seconds from the
+		* epoch and the list filter takes the same integer.
+		*
+		* DECLARED, never inferred from the value, and that is the whole point of
+		* the field. `timestamp` already admits numbers — a Supabase
+		* `{cursorColumn}` may resolve to an integer `id` — so reading a 10-digit
+		* number as seconds because it looks like seconds would turn those ids into
+		* instants: the future check would start barring them and the lookback
+		* would start subtracting from them, both silently.
+		*
+		* Absent is every trigger written before this, unchanged: the stamp reader
+		* takes the two ISO shapes and nothing else. Its arithmetic lives in
+		* `parseStamp` / `formatStamp` (`stamps.ts`) and nowhere else — the refine
+		* below names the value only to refuse a margin finer than one tick of it.
+		*/
+		unit: z.enum(["unix-seconds"]).optional()
 	}), z.object({
 		kind: z.literal("opaque"),
 		/** Dot-path in the list response to the next opaque token. */
@@ -31071,6 +31160,13 @@ var init_trigger_descriptor = __esmMin((() => {
 		*/
 		lookbackMs: z.never({ error: "lookbackMs is only meaningful on a timestamp cursor: an opaque cursor is a token the provider minted, and there is no instant to move back from" }).optional()
 	})]);
+	compileAnchored = (pattern) => {
+		try {
+			return new RegExp(`^(?:${pattern})$`);
+		} catch {
+			return;
+		}
+	};
 	triggerScopeParamSchema = z.object({
 		/**
 		* The list arg the value is written into, and the key the subscription stores
@@ -31108,6 +31204,23 @@ var init_trigger_descriptor = __esmMin((() => {
 		/** Placeholder for the field — a real example, not a shape. */
 		example: z.string().optional(),
 		/**
+		* Values Studio offers while the operator types. SUGGESTIONS, not options:
+		* the field stays free text and anything `pattern` accepts is still valid.
+		*
+		* The distinction is the whole point. Stripe's `type` takes any of the many
+		* event names its API emits, plus a wildcard family — a closed dropdown could
+		* not express `charge.*` and would be a list too long to read either way.
+		* What an operator actually needs is to be shown that `charge.succeeded`
+		* exists before typing `charge.suceeded`, which passes every pattern anyone
+		* would write and then polls green forever, delivering nothing.
+		*
+		* So this is a spelling aid for a value nothing else can check. A connector
+		* whose scope really IS a closed set should say so with a `pattern` that
+		* alternates over it; that refusal happens at register time, where a refusal
+		* belongs, and this field is not a substitute for it.
+		*/
+		suggestions: z.array(z.string()).optional(),
+		/**
 		* A poll cannot run without a required value, so the register endpoint refuses
 		* the link rather than arming one that would fail every tick. An OPTIONAL one
 		* left blank is simply not sent, which is how a caller asks for the provider's
@@ -31142,6 +31255,15 @@ var init_trigger_descriptor = __esmMin((() => {
 			}
 		}, { message: "pattern must be a compilable regular expression" }).optional()
 	}).superRefine((param, ctx) => {
+		if (param.pattern !== void 0 && param.suggestions !== void 0) {
+			const anchored = compileAnchored(param.pattern);
+			const refused = anchored === void 0 ? [] : param.suggestions.filter((value) => !anchored.test(value));
+			if (refused.length > 0) ctx.addIssue({
+				code: "custom",
+				path: ["suggestions"],
+				message: `every suggestion must satisfy this param's own \`pattern\` (${param.pattern}), or the field offers a value its register endpoint refuses: ${refused.join(", ")}`
+			});
+		}
 		if (param.template === void 0) return;
 		if (param.pattern === void 0) {
 			ctx.addIssue({
@@ -31191,6 +31313,27 @@ var init_trigger_descriptor = __esmMin((() => {
 		* because this is how EVERY GraphQL provider answers, not a Linear quirk.
 		*/
 		errorsPath: z.string().optional(),
+		/**
+		* WHICH END OF THE FEED THIS OPERATION RETURNS FIRST (PLA-1510).
+		*
+		* Documentation only: the engine never sorts, and it delivers `items` in
+		* whatever order the provider gave them. What this changes is the sentence
+		* `scripts/generate-trigger-reference.ts` prints on a trigger's public page,
+		* and through it what an operator planning a backlog drain expects.
+		*
+		* DECLARED, NEVER INFERRED, and never defaulted. The generator used to print
+		* `oldest first` as a literal for every timestamp cursor, which was false for
+		* five of the nine declarative triggers in this catalog — Stripe's event
+		* feed, GitHub's commits and all three Linear triggers come back newest
+		* first. A default would put that same false sentence on any trigger whose
+		* author did not think about it, which is the failure this field exists to
+		* end. Absent, the page says nothing about order, which is the only honest
+		* thing to say about an order nobody established.
+		*
+		* The order matters because the per-tick ceiling is real: a walk that gets
+		* cut off keeps the end it read and passes over the other one.
+		*/
+		order: z.enum(["oldest-first", "newest-first"]).optional(),
 		/** Page-walk wiring: the request arg that carries the page token + where the
 		*  next token is read from. Absent for non-paged list operations. */
 		pageToken: z.object({
@@ -31260,7 +31403,73 @@ var init_trigger_descriptor = __esmMin((() => {
 			*  stops on `items.length < stride`, and it also ADVANCES by this, so `0`
 			*  would re-request page one until the bound (PLA-1142). */
 			stride: z.number().int().positive()
-		}).optional()
+		}).optional(),
+		/**
+		* Paging by the LAST ITEM THE CALLER ALREADY HOLDS: the next page is
+		* addressed by the data, not by a token the provider hands back. Stripe is
+		* the case — `starting_after` takes the id of the last item on the page just
+		* read — and it is the common shape for anything that paginates a
+		* time-ordered feed.
+		*
+		* The engine reads `itemPath` off the LAST element of the page and sends it
+		* as `param` on the next request. Page 0 carries neither, exactly as
+		* `pageToken` sends no token on its first call.
+		*
+		* `hasMorePath` IS REQUIRED HERE, unlike inside `pageToken`, and the
+		* difference is not an oversight. A token walk has the token itself as a
+		* second end signal: a provider that nulls it on the last page ends the walk
+		* with no flag at all. This shape has no such signal — the last item's id is
+		* always there, on the final page as much as on the first — so without a
+		* flag the walk would run to `MAX_PAGES` against the provider's rate limit on
+		* every tick, or stop on an empty page one call too late. A required flag is
+		* also reversible into an optional one; the reverse is not.
+		*
+		* A declared flag that comes back neither `true` nor `false` breaks the walk
+		* WITHOUT draining it, the same rule the token walk follows: the provider
+		* failed to answer, and reading that as "no more" advances the cursor past
+		* pages nobody read.
+		*
+		* Mutually exclusive with the other three shapes.
+		*/
+		pageLastId: z.object({
+			/** Request arg carrying the last item's id, e.g. `starting_after`. */
+			param: argTargetSchema,
+			/**
+			* Dot-path, ON AN ITEM, to the value that fills `param` — `id` for
+			* Stripe. Non-empty, because `getPath(item, '')` is the whole item, which
+			* is never a page address.
+			*/
+			itemPath: z.string().min(1),
+			/**
+			* Dot-path to the boolean saying another page exists — Stripe's
+			* `has_more`. Read BEFORE asking for the next page, and only `true`
+			* continues the walk.
+			*/
+			hasMorePath: z.string().min(1)
+		}).optional(),
+		/**
+		* Where the provider says another page exists, for a list step the engine
+		* CANNOT page — no token in the response, no offset in the request, and no
+		* addressable last item. Stripe USED to be the case here, before `pageLastId`
+		* above existed; it is kept because a provider that reports `has_more` and
+		* exposes no way at all to ask for the next page is still expressible.
+		*
+		* Without this the walk reads one page and reports itself DRAINED, because
+		* the null-token rule is what ends an unpaged walk. The items below that
+		* page are then under the marker the cursor just advanced to, never listed
+		* again, with no warning and a green row — the failure `pageToken`'s own
+		* `hasMorePath` doc calls the worst the intake can have. Declared here, a
+		* page that answers `true` breaks the walk WITHOUT draining it, so the tick
+		* reports it cut off and the loss is at least visible.
+		*
+		* Only for a list step that declares no paging shape: `pageToken` and
+		* `pageLastId` carry their own `hasMorePath`, and `pageNumber` / `pageSkip`
+		* end their walk on a short page and never read this. All are refused below.
+		*
+		* A non-empty path, because `getPath(value, '')` is the whole response —
+		* never a boolean, so an empty path would cut off every tick forever.
+		*/
+		hasMorePath: z.string().min(1).optional()
 	}).superRefine((list, ctx) => {
 		const params = (list.scopeParams ?? []).map((param) => param.param);
 		const duplicated = [...new Set(params.filter((name, i) => params.indexOf(name) !== i))];
@@ -31272,13 +31481,23 @@ var init_trigger_descriptor = __esmMin((() => {
 		const declared = [
 			"pageToken",
 			"pageNumber",
-			"pageSkip"
+			"pageSkip",
+			"pageLastId"
 		].filter((shape) => list[shape] !== void 0);
 		if (declared.length > 1) ctx.addIssue({
 			code: "custom",
 			path: [declared[1] ?? "pageNumber"],
 			message: `a list step declares ONE paging shape, and this one declares ${declared.length} (${declared.join(", ")}): the engine would silently use ${declared[0]} and ignore the rest`
 		});
+		if (list.hasMorePath !== void 0 && declared.length > 0) {
+			const shape = declared[0];
+			const ownsAFlag = shape === "pageToken" || shape === "pageLastId";
+			ctx.addIssue({
+				code: "custom",
+				path: ["hasMorePath"],
+				message: ownsAFlag ? `this list step declares ${shape}, which reads its own hasMorePath and never this one — move the flag inside ${shape}, or drop the paging shape` : `this list step declares ${shape}, which ends its walk on a short page and never reads hasMorePath — drop one of the two`
+			});
+		}
 	});
 	triggerItemStepSchema = z.object({
 		/** The OpenAPI `operationId` that fetches one item's full detail. */
@@ -31312,6 +31531,11 @@ var init_trigger_descriptor = __esmMin((() => {
 		*  absent, the event payload is the raw item verbatim. */
 		map: z.record(z.string(), z.string()).optional()
 	}).superRefine((spec, ctx) => {
+		if (spec.cursor.kind === "timestamp" && spec.cursor.unit === "unix-seconds" && spec.cursor.lookbackMs !== void 0 && spec.cursor.lookbackMs % 1e3 !== 0) ctx.addIssue({
+			code: "custom",
+			path: ["cursor", "lookbackMs"],
+			message: `a unix-seconds cursor carries whole seconds, so a lookback of ${spec.cursor.lookbackMs}ms floors to ${Math.floor(spec.cursor.lookbackMs / 1e3)}s on the wire — declare a multiple of 1000`
+		});
 		const cursor = spec.cursor;
 		const cursorParam = cursor.kind === "timestamp" ? cursor.param : cursor.requestParam;
 		const clash = spec.list.scopeParams?.find((param) => sameArgTarget([param.param], cursorParam));
@@ -32303,8 +32527,8 @@ var init_github_connector = __esmMin((() => {
 		triggers: [{
 			id: "commit-pushed",
 			displayName: "New commit by date",
-			description: "Starts one run per commit whose committer date is newer than this link’s cursor. This follows commit dates, not push times: pushing an older local commit or merging existing commits without changing their committer dates can leave them undetected. A poll reads up to 10,000 commits; a larger window can skip its oldest commits. CAUTION: a workflow that writes a file to the watched branch can create a commit that re-triggers itself. Each new commit has a new SHA, so deduplication cannot stop the loop. Guard inside the workflow body: identify commits your workflow created and return without writing, or write to a separate branch that this link does not watch. A trigger mapping cannot skip an event.",
-			docs: "Watches commits on the selected branch, or the repository’s default branch when Branch is blank. Starts one run per commit whose committer date is newer than the saved cursor.\n\nThe cursor starts at the time you turn the link on. Push time is not recorded: commits created earlier and pushed later, including existing commits added by a fast-forward merge, can be skipped. Rebasing or squashing can assign new committer dates.\n\nEach poll reads up to 10,000 commits. If more commits match, the oldest may be skipped.\n\nCAUTION: a workflow that writes a file to the watched branch can create a commit that re-triggers itself. Each new commit has a new SHA, so deduplication cannot stop the loop. Guard inside the workflow body: identify commits your workflow created and return without writing, or write to a separate branch that this link does not watch. A trigger mapping cannot skip an event.",
+			description: "Starts one run per commit whose committer date is newer than this link’s cursor. This follows commit dates, not push times: pushing an older local commit or merging existing commits without changing their committer dates can leave them undetected. A poll reads up to 10,000 commits; a larger window can skip its oldest commits. CAUTION: a workflow that writes a file to the watched branch can create a commit that re-triggers itself. Each new commit has a new SHA, so deduplication cannot stop the loop. THIS CONNECTOR EXPOSES NO WRITE OPERATION, so the `isOwnEcho` guard has nothing to compare against and the workaround is the branch: write to a separate branch that this link does not watch. A trigger mapping cannot skip an event.",
+			docs: "Watches commits on the selected branch, or the repository’s default branch when Branch is blank. Starts one run per commit whose committer date is newer than the saved cursor.\n\nThe cursor starts at the time you turn the link on. Push time is not recorded: commits created earlier and pushed later, including existing commits added by a fast-forward merge, can be skipped. Rebasing or squashing can assign new committer dates.\n\nEach poll reads up to 10,000 commits. If more commits match, the oldest may be skipped.\n\nCAUTION: a workflow that writes a file to the watched branch can create a commit that re-triggers itself. Each new commit has a new SHA, so deduplication cannot stop the loop. This connector exposes no write operation, so the `isOwnEcho` guard has nothing to compare against, and the workaround is the branch: write to a separate branch that this link does not watch. A trigger mapping cannot skip an event.",
 			sampleData: {
 				sha: "11589d462dc2b29714240e03ce310e7b15aa94c3",
 				url: "https://github.com/stackbone/stackbone/commit/11589d462dc2b29714240e03ce310e7b15aa94c3",
@@ -32336,6 +32560,7 @@ var init_github_connector = __esmMin((() => {
 				kind: "declarative",
 				list: {
 					operationId: "listCommits",
+					order: "newest-first",
 					args: { "X-GitHub-Api-Version": "2022-11-28" },
 					pageNumber: {
 						param: "page",
@@ -32385,8 +32610,8 @@ var init_github_connector = __esmMin((() => {
 		}, {
 			id: "issue-updated",
 			displayName: "Issue updated",
-			description: "Fires on every change to an issue in the repository after the link was turned on, following `updated_at`. CLOSED ISSUES ARE INCLUDED — the link asks for `state=all`, so resolving an issue is a change you receive. PULL REQUESTS ARRIVE HERE TOO: GitHub models every pull request as an issue and this endpoint returns both, and only a `pullRequest` object on the payload tells them apart — it is absent on a real issue. A newly opened issue arrives as well, with `createdAt` equal to `updatedAt`. CAUTION: a workflow that writes back to the issue it received — a comment, a label, a close — bumps `updated_at` and re-triggers itself, and the delivery journal cannot stop it. GitHub sends nothing that says who made a change (`author` is who OPENED the issue), so the guard is for your workflow to remember the `updated_at` its own write returned and skip a delivery carrying that value. A trigger mapping cannot skip an item; every delivered event starts a run.",
-			docs: "Starts a run on every change to an issue in the repository, from the moment the link is turned on. Closed issues count: resolving one is a change you receive. Pull requests arrive here too, because GitHub models each one as an issue. A `pullRequest` object on the event is what tells them apart, and it is absent on a real issue. A newly opened issue arrives as well, with `createdAt` equal to `updatedAt`.\n\nCAUTION: a workflow that writes back to the issue it received (a comment, a label, a close) bumps `updatedAt` and starts itself again. Nothing on the platform stops that loop, and GitHub sends no field saying who made a change (`author` is whoever opened the issue). Have your workflow remember the `updatedAt` its own write returned, and skip a delivery carrying that value. A mapping cannot skip an event: every delivery starts a run.",
+			description: "Fires on every change to an issue in the repository after the link was turned on, following `updated_at`. CLOSED ISSUES ARE INCLUDED — the link asks for `state=all`, so resolving an issue is a change you receive. PULL REQUESTS ARRIVE HERE TOO: GitHub models every pull request as an issue and this endpoint returns both, and only a `pullRequest` object on the payload tells them apart — it is absent on a real issue. A newly opened issue arrives as well, with `createdAt` equal to `updatedAt`. CAUTION: a workflow that writes back to the issue it received — a comment, a label, a close — bumps `updated_at` and re-triggers itself, and the delivery journal cannot stop it. GitHub sends nothing that says who made a change (`author` is who OPENED the issue), and THIS CONNECTOR EXPOSES NO WRITE OPERATION, so the `isOwnEcho` guard has nothing to compare against: whatever wrote the issue did not go through here. Until a write lands on this connector the workaround is outside it. A trigger mapping cannot skip an item; every delivered event starts a run.",
+			docs: "Starts a run on every change to an issue in the repository, from the moment the link is turned on. Closed issues count: resolving one is a change you receive. Pull requests arrive here too, because GitHub models each one as an issue. A `pullRequest` object on the event is what tells them apart, and it is absent on a real issue. A newly opened issue arrives as well, with `createdAt` equal to `updatedAt`.\n\nCAUTION: a workflow that writes back to the issue it received (a comment, a label, a close) bumps `updatedAt` and starts itself again. Nothing on the platform stops that loop, and GitHub sends no field saying who made a change (`author` is whoever opened the issue). This connector exposes no write operation, so the `isOwnEcho` guard has nothing to compare against: whatever wrote the issue did not go through here. Until a write lands on this connector, the workaround is outside it. A mapping cannot skip an event: every delivery starts a run.",
 			sampleData: {
 				issueId: 5320382826,
 				number: 14317,
@@ -32455,6 +32680,7 @@ var init_github_connector = __esmMin((() => {
 				kind: "declarative",
 				list: {
 					operationId: "listIssues",
+					order: "oldest-first",
 					args: {
 						"X-GitHub-Api-Version": "2022-11-28",
 						state: "all",
@@ -32782,7 +33008,7 @@ var init_google_drive_connector = __esmMin((() => {
 						post: {
 							operationId: "drive.files.create",
 							summary: "Create a folder, or a file with metadata but no content",
-							description: "Metadata only — this sends JSON, never bytes. A folder is `mimeType: \"application/vnd.google-apps.folder\"`. To create a file WITH content use `drive.files.upload`, which sends the bytes from object storage against Google's upload host; this operation creates the file empty. If a workflow of yours also watches the destination folder, ask for `modifiedTime` in `fields` — otherwise the response carries no version and nothing can tell your own file from one a person dropped in.",
+							description: "Metadata only — this sends JSON, never bytes. A folder is `mimeType: \"application/vnd.google-apps.folder\"`. To create a file WITH content use `drive.files.upload`, which sends the bytes from object storage against Google's upload host; this operation creates the file empty. If a workflow of yours also watches the destination folder, ask for `id` in `fields` and declare `echoPath: 'id'` on the call, then open that workflow with `isOwnEcho('google-drive', event.fileId)`. The trigger keys on the file ID, so the ID is the value to compare — a `modifiedTime` echo would never match it.",
 							"x-stackbone-version-path": "modifiedTime",
 							parameters: [FIELDS_PARAM, SUPPORTS_ALL_DRIVES_PARAM],
 							requestBody: {
@@ -32852,7 +33078,7 @@ var init_google_drive_connector = __esmMin((() => {
 						patch: {
 							operationId: "drive.files.update",
 							summary: "Rename a file, move it between folders, or set its metadata",
-							description: "The move is the two QUERY parameters, not the body: `addParents` and `removeParents`. `name` goes in the JSON body. Both in one call is how a file gets named and filed at once. If a workflow of yours also watches this folder, ask for `modifiedTime` in `fields` — otherwise the response carries no version and nothing can tell your own change from somebody else's.",
+							description: "The move is the two QUERY parameters, not the body: `addParents` and `removeParents`. `name` goes in the JSON body. Both in one call is how a file gets named and filed at once. This one does NOT re-trigger `file-added-to-folder`: that trigger fires once per file, so an edit to a file it already delivered starts nothing. The self-write loop to guard is the one the CREATE and UPLOAD operations open, not this one.",
 							"x-stackbone-version-path": "modifiedTime",
 							parameters: [
 								{
@@ -33160,8 +33386,8 @@ var init_google_drive_connector = __esmMin((() => {
 		triggers: [{
 			id: "file-added-to-folder",
 			displayName: "File added to folder",
-			description: "Starts a run the first time a file in one Drive folder arrives or changes — once per file, so later edits to a file already delivered start nothing. Watches the folder itself, not its subfolders. CAUTION: a file this connector uploads to the watched folder can re-trigger the workflow. Each upload creates a new file id, so deduplication cannot stop the loop. Guard inside the workflow body: identify files your workflow uploaded and return without writing, or use separate input and output folders. A trigger mapping cannot skip an event.",
-			docs: "Starts a run the first time a file in one Drive folder arrives or changes. Once per file: a later edit to a file already delivered starts nothing. It watches the folder itself, not its subfolders.\n\nCAUTION: a file this connector uploads to the watched folder can re-trigger the workflow. Each upload creates a new file id, so deduplication cannot stop the loop. Guard inside the workflow body: identify files your workflow uploaded and return without writing, or use separate input and output folders. A trigger mapping cannot skip an event.",
+			description: "Starts a run the first time a file in one Drive folder arrives or changes — once per file, so later edits to a file already delivered start nothing. Watches the folder itself, not its subfolders. CAUTION: a file this connector uploads to the watched folder can re-trigger the workflow. Each upload creates a new file id, so deduplication cannot stop the loop. Guard INSIDE THE WORKFLOW BODY with `isOwnEcho`, for a file the workflow creates by calling `drive.files.create` or `drive.files.upload` ITSELF: pass `fields: 'id'` and `echoPath: 'id'` on that call, then open the workflow with `if (await isOwnEcho('google-drive', event.fileId)) return;`. NAME `fields` FOR WHATEVER THE ECHO PATH POINTS AT, because Drive answers a partial response by default and a path onto a field it left out resolves to nothing, which makes the guard throw rather than answer. THE `drive.file-write` OUTPUT WRITER CANNOT CARRY AN ECHO PATH, so a workflow that files its output through it is not covered and still needs separate input and output folders. A trigger mapping cannot skip an event.",
+			docs: "Starts a run the first time a file in one Drive folder arrives or changes. Once per file: a later edit to a file already delivered starts nothing. It watches the folder itself, not its subfolders.\n\nCAUTION: a file this connector uploads to the watched folder starts the workflow again. Each upload creates a new file id, so deduplication cannot stop the loop. Guard inside the workflow body with `isOwnEcho`, for a file the workflow creates by calling Drive's own `create` or `upload` operation itself: pass `fields: 'id'` and `echoPath: 'id'` on that call, then open the workflow with `if (await isOwnEcho('google-drive', event.fileId)) return;`. Name `fields` for whatever the echo path points at, because Drive answers a partial response by default, and a path onto a field it left out resolves to nothing, which makes the guard throw rather than answer. The `drive.file-write` output writer cannot carry an echo path, so a workflow that files its output through it is not covered and still needs separate input and output folders. A mapping cannot skip an event: every delivery starts a run.",
 			sampleData: {
 				fileId: "1a2B3cD4eF5gH6iJ7kL8mN9oP",
 				name: "Weekly sync 2026-08-25.pdf",
@@ -33200,6 +33426,7 @@ var init_google_drive_connector = __esmMin((() => {
 				kind: "declarative",
 				list: {
 					operationId: "drive.files.list",
+					order: "oldest-first",
 					scopeParams: [{
 						param: "q",
 						displayName: "Folder ID",
@@ -33381,8 +33608,8 @@ var init_linear_connector = __esmMin((() => {
 			{
 				id: "issue-created",
 				displayName: "Issue created",
-				description: "Fires once per issue created in the workspace after the link was turned on, following `createdAt`. CAUTION: a workflow that creates an issue in this workspace can re-trigger itself. Each new issue has a new id, so deduplication cannot stop the loop. Guard inside the workflow body: mark issues you create in their title or description, and return without writing when an incoming issue carries that marker. A trigger mapping cannot skip an event.",
-				docs: "Starts one run per issue created in the workspace, from the moment the link is turned on.\n\nCAUTION: a workflow that creates an issue in this workspace can re-trigger itself. Each new issue has a new id, so deduplication cannot stop the loop. Guard inside the workflow body: mark issues you create in their title or description, and return without writing when an incoming issue carries that marker. A trigger mapping cannot skip an event.",
+				description: "Fires once per issue created in the workspace after the link was turned on, following `createdAt`. CAUTION: a workflow that creates an issue in this workspace can re-trigger itself. Each new issue has a new id, so deduplication cannot stop the loop. Guard INSIDE THE WORKFLOW BODY with `isOwnEcho`: have the `issueCreate` mutation select `issue { id }`, declare `echoPath: 'data.issueCreate.issue.id'` on the write, then open the workflow with `if (await isOwnEcho('linear', event.issueId)) return;`. It compares the id your own write returned against the one delivered. The connector id you pass is the one you passed to `connection()`. A trigger mapping cannot skip an event.",
+				docs: "Starts one run per issue created in the workspace, from the moment the link is turned on.\n\nCAUTION: a workflow that creates an issue in this workspace starts itself again. Each new issue has a new id, so deduplication cannot stop the loop. Guard inside the workflow body with `isOwnEcho`. The `issueCreate` mutation has to select `issue { id }`, because the guard can only record a value the response carries. Declare `echoPath: 'data.issueCreate.issue.id'` on the write, then open the workflow with `if (await isOwnEcho('linear', event.issueId)) return;`. That compares the id your own write returned against the one you were handed. The connector id you pass to `isOwnEcho` is the same one you passed to `connection()`. A mapping cannot skip an event: every delivery starts a run.",
 				sampleData: {
 					issueId: "a1b2c3d4-0000-0000-0000-000000000000",
 					identifier: "PLA-812",
@@ -33436,6 +33663,7 @@ var init_linear_connector = __esmMin((() => {
 					kind: "declarative",
 					list: {
 						operationId: "graphql",
+						order: "newest-first",
 						args: {
 							query: ISSUE_CREATED_DOCUMENT,
 							variables: { first: 50 }
@@ -33471,8 +33699,8 @@ var init_linear_connector = __esmMin((() => {
 			{
 				id: "comment-created",
 				displayName: "Comment created",
-				description: "Fires once per comment posted on any issue in the workspace after the link was turned on, following `createdAt`. CAUTION: a workflow that replies by posting a comment in this workspace can re-trigger itself. Each new comment has a new id, so deduplication cannot stop the loop. Guard inside the workflow body: mark comments you post in their body, and return without writing when an incoming comment carries that marker. A trigger mapping cannot skip an event.",
-				docs: "Starts one run per comment posted on any issue in the workspace, from the moment the link is turned on.\n\nCAUTION: a workflow that replies by posting a comment in this workspace can re-trigger itself. Each new comment has a new id, so deduplication cannot stop the loop. Guard inside the workflow body: mark comments you post in their body, and return without writing when an incoming comment carries that marker. A trigger mapping cannot skip an event.",
+				description: "Fires once per comment posted on any issue in the workspace after the link was turned on, following `createdAt`. CAUTION: a workflow that replies by posting a comment in this workspace can re-trigger itself. Each new comment has a new id, so deduplication cannot stop the loop. Guard INSIDE THE WORKFLOW BODY with `isOwnEcho`: have the `commentCreate` mutation select `comment { id }`, declare `echoPath: 'data.commentCreate.comment.id'` on the write, then open the workflow with `if (await isOwnEcho('linear', event.commentId)) return;`. It compares the id your own write returned against the one delivered. A trigger mapping cannot skip an event.",
+				docs: "Starts one run per comment posted on any issue in the workspace, from the moment the link is turned on.\n\nCAUTION: a workflow that replies by posting a comment in this workspace starts itself again. Each new comment has a new id, so deduplication cannot stop the loop. Guard inside the workflow body with `isOwnEcho`. The `commentCreate` mutation has to select `comment { id }`, because the guard can only record a value the response carries. Declare `echoPath: 'data.commentCreate.comment.id'` on the write, then open the workflow with `if (await isOwnEcho('linear', event.commentId)) return;`. That compares the id your own write returned against the one you were handed. A mapping cannot skip an event: every delivery starts a run.",
 				sampleData: {
 					commentId: "e5f6a7b8-0000-0000-0000-000000000000",
 					body: "Shipped on `next`, closing.",
@@ -33533,6 +33761,7 @@ var init_linear_connector = __esmMin((() => {
 					kind: "declarative",
 					list: {
 						operationId: "graphql",
+						order: "newest-first",
 						args: {
 							query: COMMENT_CREATED_DOCUMENT,
 							variables: { first: 50 }
@@ -33564,8 +33793,8 @@ var init_linear_connector = __esmMin((() => {
 			{
 				id: "issue-updated",
 				displayName: "Issue updated",
-				description: "Fires on every change to an issue in the workspace after the link was turned on, following `updatedAt`. A newly created issue arrives here too — compare `createdAt` with `updatedAt` to tell a birth from an edit. `lastActor` / `lastBotActor` carry the actor of the issue's NEWEST HISTORY ENTRY — a `User` when a personal API key made the change, a bot when an OAuth app did. That is the best available signal for who caused a change, not a guarantee that it is: either can arrive null, and an `updatedAt` bump that minted no history entry leaves the previous change's actor in place. CAUTION: a workflow that writes back to the issue it received bumps `updatedAt` and re-triggers itself, and the delivery journal cannot stop it. Guard INSIDE THE WORKFLOW BODY — return without writing when `lastActor` is your own account, and decide deliberately what to do when it is absent rather than dereferencing it. A trigger mapping cannot skip an item; every delivered event starts a run. Write-back can also overwrite a human edit made since the event was read: issueUpdate exposes no version or expected-value precondition. Write only fields reserved for the workflow; reading again before writing does not make the update atomic. Archiving is not delivered, because an archived issue stops matching.",
-				docs: "Starts a run on every change to an issue in the workspace, from the moment the link is turned on. A newly created issue arrives here too, so compare `createdAt` with `updatedAt` to tell a birth from an edit. Archiving is not delivered, because an archived issue stops matching.\n\n`lastActor` and `lastBotActor` carry whoever made the newest change: `lastActor` when a personal API key did it, `lastBotActor` when an OAuth app did. Treat them as the best signal available rather than a guarantee. Either can arrive null, and a change that minted no history entry leaves the previous actor in place.\n\nCAUTION: a workflow that writes back to the issue it received bumps `updatedAt` and starts itself again. Nothing on the platform stops that loop. Guard inside the workflow body: return without writing when `lastActor` is your own account, and decide what to do when it is absent instead of reading through it. A mapping cannot skip an event: every delivery starts a run.\n\nWrite-back can also overwrite a human edit made since the event was read. `issueUpdate` exposes no version or expected-value precondition. Write only fields reserved for the workflow; reading again before writing does not make the update atomic.",
+				description: "Fires on every change to an issue in the workspace after the link was turned on, following `updatedAt`. A newly created issue arrives here too — compare `createdAt` with `updatedAt` to tell a birth from an edit. `lastActor` / `lastBotActor` carry the actor of the issue's NEWEST HISTORY ENTRY — a `User` when a personal API key made the change, a bot when an OAuth app did. Use them to answer who touched this, for instance to ignore every bot's edits; they are not a self-write guard, because either can arrive null and an `updatedAt` bump that minted no history entry leaves the previous change's actor in place. CAUTION: a workflow that writes back to the issue it received bumps `updatedAt` and re-triggers itself, and the delivery journal cannot stop it. Guard INSIDE THE WORKFLOW BODY with `isOwnEcho`: declare `echoPath: 'data.issueUpdate.issue.updatedAt'` on the write, then open the workflow with `if (await isOwnEcho('linear', event.updatedAt)) return;`. It compares the value your own write returned against the one delivered, so it does not depend on an actor field being fresh. A trigger mapping cannot skip an item; every delivered event starts a run. Write-back can also overwrite a human edit made since the event was read: issueUpdate exposes no version or expected-value precondition. Write only fields reserved for the workflow; reading again before writing does not make the update atomic. Archiving is not delivered, because an archived issue stops matching.",
+				docs: "Starts a run on every change to an issue in the workspace, from the moment the link is turned on. A newly created issue arrives here too, so compare `createdAt` with `updatedAt` to tell a birth from an edit. Archiving is not delivered, because an archived issue stops matching.\n\n`lastActor` and `lastBotActor` carry whoever made the newest change: `lastActor` when a personal API key did it, `lastBotActor` when an OAuth app did. They answer who touched this, which is useful on its own, for instance to ignore edits made by bots. They are not the self-write guard: either can arrive null, and a change that minted no history entry leaves the previous actor in place.\n\nCAUTION: a workflow that writes back to the issue it received bumps `updatedAt` and starts itself again. Nothing on the platform stops that loop. Guard inside the workflow body with `isOwnEcho`. Declare where your write reports the new version, `echoPath: 'data.issueUpdate.issue.updatedAt'`, then open the workflow with `if (await isOwnEcho('linear', event.updatedAt)) return;`. That compares the value your own write returned against the one you were handed, so it holds whether or not an actor field is fresh. A mapping cannot skip an event: every delivery starts a run.\n\nWrite-back can also overwrite a human edit made since the event was read. `issueUpdate` exposes no version or expected-value precondition. Write only fields reserved for the workflow; reading again before writing does not make the update atomic.",
 				sampleData: {
 					issueId: "a1b2c3d4-0000-0000-0000-000000000000",
 					identifier: "PLA-812",
@@ -33643,6 +33872,7 @@ var init_linear_connector = __esmMin((() => {
 					kind: "declarative",
 					list: {
 						operationId: "graphql",
+						order: "newest-first",
 						args: {
 							query: ISSUE_UPDATED_DOCUMENT,
 							variables: { first: 50 }
@@ -33905,6 +34135,1020 @@ var init_outlook_app_only_connector = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region ../../libs/shared/connect-registry/src/lib/catalog/stripe/stripe.connector.ts
+var IDEMPOTENCY_KEY_PARAM, CHARGE_SCHEMA, STRIPE_CONNECTOR;
+var init_stripe_connector = __esmMin((() => {
+	IDEMPOTENCY_KEY_PARAM = {
+		name: "Idempotency-Key",
+		in: "header",
+		required: false,
+		description: "A caller-chosen key that stays the same on every retry of the same call — a message id, a run id — and different for a genuinely new one. Stripe replays the first response for 24 hours instead of performing the operation again, and refuses a reused key whose arguments changed. Omitted, a retry is a second write.",
+		schema: { type: "string" }
+	};
+	CHARGE_SCHEMA = {
+		type: "object",
+		properties: {
+			id: { type: "string" },
+			object: { type: "string" },
+			amount: {
+				type: "integer",
+				description: "What was charged, in the smallest unit of `currency`."
+			},
+			amount_captured: { type: "integer" },
+			amount_refunded: { type: "integer" },
+			currency: { type: "string" },
+			customer: {
+				type: ["string", "null"],
+				description: "The customer id, or null for a charge made without one."
+			},
+			description: { type: ["string", "null"] },
+			failure_code: { type: ["string", "null"] },
+			failure_message: { type: ["string", "null"] },
+			paid: { type: "boolean" },
+			refunded: { type: "boolean" },
+			receipt_url: { type: ["string", "null"] },
+			payment_intent: { type: ["string", "null"] },
+			status: {
+				type: "string",
+				description: "One of `succeeded`, `pending` or `failed`."
+			},
+			created: { type: "integer" },
+			livemode: { type: "boolean" },
+			metadata: {
+				type: "object",
+				additionalProperties: true
+			}
+		},
+		required: [
+			"id",
+			"object",
+			"amount",
+			"amount_captured",
+			"amount_refunded",
+			"currency",
+			"created",
+			"livemode",
+			"metadata",
+			"paid",
+			"refunded",
+			"status"
+		]
+	};
+	STRIPE_CONNECTOR = {
+		id: "stripe",
+		displayName: "Stripe",
+		description: "Read a Stripe account — its event feed, its charges, one payment intent, one invoice, one subscription, the dispute on a charge, the balance — and write two things: a payment intent, and a refund. Exposes an `event-received` trigger.",
+		credentialNote: "Create a restricted key (`rk_…`) in your Stripe dashboard with read permission on Events, Charges, Customers, Payment Intents, Balance, Invoices, Subscriptions and Disputes. Tick only the resources your workflows read: a key missing one answers that operation with a 403 and leaves the rest working. If a workflow also creates payment intents or issues refunds, that key needs WRITE on Payment Intents and Refunds too — a read-only key answers those two with a 403.\n\nA full secret key (`sk_…`) works for everything and is the account’s master credential, so it can do a great deal more than this connector asks for.\n\nTwo of the reads follow fields Stripe moved in a recent API version: the subscription behind an invoice, and a subscription’s billing period. Nothing here pins a version, so the account’s own pinned version decides which shape arrives. Check it in the dashboard under Developers before you map those two.\n\nStart with a test-mode key while you wire a workflow up. Test mode and live mode are separate accounts of everything — events, charges, balance — and an event carries `livemode` so a workflow can tell which one it came from.\n\nThe key is held by the broker. It never reaches a workspace or a browser.",
+		logoUrl: "https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=https://stripe.com/&size=64",
+		category: "productivity",
+		protocol: "openapi",
+		baseUrl: "https://api.stripe.com",
+		authMode: "api_key",
+		placement: { kind: "bearer" },
+		scopes: [],
+		specSource: {
+			kind: "inline",
+			document: {
+				openapi: "3.1.0",
+				info: {
+					title: "Stripe API (subset)",
+					version: "2026-08-26.dahlia"
+				},
+				servers: [{ url: "https://api.stripe.com" }],
+				paths: {
+					"/v1/events": { get: {
+						operationId: "listEvents",
+						summary: "List the account's events, newest first",
+						description: "The list endpoint behind the `event-received` trigger. Newest first, and Stripe keeps events for 30 days, so this is a recent window and never the account’s whole history. `created[gte]` is the bracketed spelling of Stripe’s `created` range filter and takes seconds from the epoch rather than an ISO string, the same unit every `created` field in this API is measured in. `type` takes one event name or a family with a `*` wildcard; Stripe also accepts a `types` array, which this document does not declare because one query parameter here carries one value.",
+						parameters: [
+							{
+								name: "created[gte]",
+								in: "query",
+								required: false,
+								description: "Only events created at or after this instant, in seconds from the epoch. Inclusive on purpose — the trigger below explains why the strict `created[gt]` is the wrong filter for a whole-second stamp.",
+								schema: { type: "integer" }
+							},
+							{
+								name: "type",
+								in: "query",
+								required: false,
+								description: "One event name (`charge.succeeded`), or a family with a wildcard (`charge.*`). Omitted, every type the account emits is listed.",
+								schema: { type: "string" }
+							},
+							{
+								name: "limit",
+								in: "query",
+								required: false,
+								description: "Events per page, 1 to 100. Stripe sends 10 when this is absent, so a caller that wants a full page has to ask.",
+								schema: { type: "integer" }
+							},
+							{
+								name: "starting_after",
+								in: "query",
+								required: false,
+								description: "The id of the last event on the previous page. Stripe pages by the id you already hold rather than by a token it hands back, which is why `has_more` is the only thing the response says about a next page.",
+								schema: { type: "string" }
+							}
+						],
+						responses: { "200": {
+							description: "One page of events, newest first.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									object: { type: "string" },
+									url: { type: "string" },
+									has_more: {
+										type: "boolean",
+										description: "Another page exists after this one. Stripe names no next cursor: the caller sends the last id as `starting_after`."
+									},
+									data: {
+										type: "array",
+										items: {
+											type: "object",
+											description: "One event envelope. `data.object` is the API resource the event is about, and its shape follows `type` — a charge for `charge.succeeded`, an invoice for `invoice.created`.",
+											properties: {
+												id: { type: "string" },
+												object: { type: "string" },
+												api_version: { type: ["string", "null"] },
+												created: {
+													type: "integer",
+													description: "Seconds from the epoch. The trigger cursor reads this."
+												},
+												livemode: { type: "boolean" },
+												pending_webhooks: { type: "integer" },
+												type: { type: "string" },
+												request: {
+													type: ["object", "null"],
+													properties: {
+														id: { type: ["string", "null"] },
+														idempotency_key: { type: ["string", "null"] }
+													}
+												},
+												data: {
+													type: "object",
+													properties: {
+														object: {
+															type: "object",
+															additionalProperties: true
+														},
+														previous_attributes: {
+															type: "object",
+															additionalProperties: true,
+															description: "The attributes as they were before the change, on a `*.updated` event only."
+														}
+													},
+													required: ["object"]
+												}
+											},
+											required: [
+												"id",
+												"object",
+												"created",
+												"livemode",
+												"pending_webhooks",
+												"type",
+												"data"
+											]
+										}
+									}
+								},
+								required: [
+									"object",
+									"data",
+									"has_more",
+									"url"
+								]
+							} } }
+						} }
+					} },
+					"/v1/customers": { get: {
+						operationId: "listCustomers",
+						summary: "List customers, filtered by email address",
+						description: "Customers, newest first, and the one hop from a person to their payments: every other read here is keyed by a Stripe id, so a workflow that starts from a mail, a form or a chat message has nothing to look up. Feed an id from here to `listCharges`’ `customer` filter.\n\nA LIST and not a lookup, because an email is not unique on a Stripe account: the same address can sit on several customers, created by different integrations or by a checkout that made a new one each time. A caller that reads `data[0]` and acts on it is refunding whichever row Stripe happened to return first. Zero rows is a normal answer too — the sender may simply not be a customer.\n\nOnly exact addresses match. Stripe does not do partial or case-insensitive matching on this filter; its Search API is a different endpoint with its own query language and is not declared here.",
+						parameters: [
+							{
+								name: "email",
+								in: "query",
+								required: false,
+								description: "Only customers whose address is exactly this one. Omitted, the answer is every customer, newest first.",
+								schema: { type: "string" }
+							},
+							{
+								name: "limit",
+								in: "query",
+								required: false,
+								description: "Customers per page, 1 to 100. Stripe defaults it to 10.",
+								schema: { type: "integer" }
+							},
+							{
+								name: "starting_after",
+								in: "query",
+								required: false,
+								description: "The id of the last customer on the previous page.",
+								schema: { type: "string" }
+							}
+						],
+						responses: { "200": {
+							description: "One page of customers, newest first.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									object: { type: "string" },
+									url: { type: "string" },
+									has_more: { type: "boolean" },
+									data: {
+										type: "array",
+										items: {
+											type: "object",
+											properties: {
+												id: { type: "string" },
+												object: { type: "string" },
+												email: { type: ["string", "null"] },
+												name: { type: ["string", "null"] },
+												created: { type: "integer" },
+												livemode: { type: "boolean" }
+											},
+											required: [
+												"id",
+												"object",
+												"created",
+												"livemode"
+											]
+										}
+									}
+								},
+								required: [
+									"object",
+									"data",
+									"has_more",
+									"url"
+								]
+							} } }
+						} }
+					} },
+					"/v1/charges": { get: {
+						operationId: "listCharges",
+						summary: "List the account's charges, newest first",
+						description: "Charges, newest first. Amounts are in the currency’s smallest unit — 4900 in `eur` is 49.00 euros, and a zero-decimal currency like `jpy` has no such factor at all, so nothing may divide by 100 unconditionally. `created[gte]` takes seconds from the epoch, as everywhere else in this API.",
+						parameters: [
+							{
+								name: "created[gte]",
+								in: "query",
+								required: false,
+								description: "Only charges created at or after this instant, in seconds from the epoch.",
+								schema: { type: "integer" }
+							},
+							{
+								name: "customer",
+								in: "query",
+								required: false,
+								description: "Only charges for this customer id (`cus_…`).",
+								schema: { type: "string" }
+							},
+							{
+								name: "payment_intent",
+								in: "query",
+								required: false,
+								description: "Only charges belonging to this payment intent (`pi_…`).",
+								schema: { type: "string" }
+							},
+							{
+								name: "limit",
+								in: "query",
+								required: false,
+								description: "Charges per page, 1 to 100. Stripe defaults it to 10.",
+								schema: { type: "integer" }
+							},
+							{
+								name: "starting_after",
+								in: "query",
+								required: false,
+								description: "The id of the last charge on the previous page.",
+								schema: { type: "string" }
+							}
+						],
+						responses: { "200": {
+							description: "One page of charges, newest first.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									object: { type: "string" },
+									url: { type: "string" },
+									has_more: { type: "boolean" },
+									data: {
+										type: "array",
+										items: CHARGE_SCHEMA
+									}
+								},
+								required: [
+									"object",
+									"data",
+									"has_more",
+									"url"
+								]
+							} } }
+						} }
+					} },
+					"/v1/charges/{charge}": { get: {
+						operationId: "getCharge",
+						summary: "Retrieve one charge by id",
+						description: "One charge, by the `ch_…` a workflow already holds. The alternative is walking `listCharges` and matching client-side, which works on a quiet account and stops working on a busy one: the charge falls off the page and the caller reports no amount for a charge that exists. The path parameter is named `charge` because that is what Stripe’s own document calls it.\n\nThe body is the same shape `listCharges` returns as a page item, down to the nullable fields — it is one declaration, so a field readable from the list is readable here.",
+						parameters: [{
+							name: "charge",
+							in: "path",
+							required: true,
+							description: "The charge id, e.g. `ch_3PqR2sC0mNqLxYzA0kL1mN2o`.",
+							schema: { type: "string" }
+						}],
+						responses: { "200": {
+							description: "The charge.",
+							content: { "application/json": { schema: CHARGE_SCHEMA } }
+						} }
+					} },
+					"/v1/payment_intents/{intent}": { get: {
+						operationId: "getPaymentIntent",
+						summary: "Retrieve one payment intent by id",
+						description: "One payment intent. The path parameter is named `intent` because that is what Stripe’s own document calls it; the value is the `pi_…` id.\n\n`client_secret` is left out of the schema below, and that is a note rather than a filter: Stripe returns it on every read of an intent and the broker hands the body back as it arrived. It is the value a browser uses to confirm the payment, so a workflow that keeps it has put a bearer credential for one payment into its own output. Leaving it undeclared says do not reach for it; nothing stops you.",
+						parameters: [{
+							name: "intent",
+							in: "path",
+							required: true,
+							description: "The payment intent id, e.g. `pi_3PqR2sC0mNqLxYzA1cD2eF3g`.",
+							schema: { type: "string" }
+						}],
+						responses: { "200": {
+							description: "The payment intent.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									amount: {
+										type: "integer",
+										description: "What was asked for, in the smallest unit of `currency`."
+									},
+									amount_received: { type: "integer" },
+									currency: { type: "string" },
+									customer: { type: ["string", "null"] },
+									description: { type: ["string", "null"] },
+									capture_method: { type: "string" },
+									confirmation_method: { type: "string" },
+									status: {
+										type: "string",
+										description: "One of `requires_payment_method`, `requires_confirmation`, `requires_action`, `processing`, `requires_capture`, `canceled` or `succeeded`."
+									},
+									created: { type: "integer" },
+									livemode: { type: "boolean" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"created",
+									"livemode",
+									"status"
+								]
+							} } }
+						} }
+					} },
+					"/v1/balance": { get: {
+						operationId: "getBalance",
+						summary: "Retrieve the account balance",
+						description: "The balance, as arrays and not as one number: `available` and `pending` carry an entry per currency, because a Stripe account can hold several at once. An account that takes only euros still answers a one-element array, so a caller reads the entry whose `currency` it wants rather than the first one.",
+						parameters: [],
+						responses: { "200": {
+							description: "The account balance, one entry per currency.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									object: { type: "string" },
+									livemode: { type: "boolean" },
+									available: {
+										type: "array",
+										description: "Funds that can be paid out now, one entry per currency.",
+										items: {
+											type: "object",
+											properties: {
+												amount: { type: "integer" },
+												currency: { type: "string" }
+											},
+											required: ["amount", "currency"]
+										}
+									},
+									pending: {
+										type: "array",
+										description: "Funds not settled yet, one entry per currency.",
+										items: {
+											type: "object",
+											properties: {
+												amount: { type: "integer" },
+												currency: { type: "string" }
+											},
+											required: ["amount", "currency"]
+										}
+									}
+								},
+								required: [
+									"object",
+									"available",
+									"pending"
+								]
+							} } }
+						} }
+					} },
+					"/v1/invoices/{invoice}": { get: {
+						operationId: "getInvoice",
+						summary: "Retrieve one invoice by id",
+						description: "One invoice, by the `in_…` an event or a workflow already holds. Read it when the snapshot on the event is not enough: an invoice moves through `draft`, `open`, `paid`, `uncollectible` and `void`, and a run that started on `invoice.payment_failed` may be looking at one that has since been paid.\n\nTHE SUBSCRIPTION BEHIND AN INVOICE IS NOT A TOP-LEVEL FIELD. It is `parent.subscription_details.subscription`, and `parent` is null on an invoice nobody subscribed for. THIS DEPENDS ON THE ACCOUNT’S API VERSION: nothing here sends a `Stripe-Version` header, so Stripe serves whatever version the account is pinned to, and an account pinned before `parent` existed answers a top-level `subscription` instead. Read the version in the Stripe dashboard under Developers, and expect the older shape on an account nobody has upgraded. A workflow that wants the subscription reads that path and then calls `getSubscription`.\n\n`lines` is one page of up to ten entries, which is what a read of the invoice returns; an invoice with more has them behind its own endpoint, which this connector does not expose. A workflow that adds up `lines.data` on a longer invoice under-counts, and nothing errors, so check `lines.has_more` before you total anything.",
+						parameters: [{
+							name: "invoice",
+							in: "path",
+							required: true,
+							description: "The invoice id, e.g. `in_1PqR2sC0mNqLxYzA3bC4dE5f`.",
+							schema: { type: "string" }
+						}],
+						responses: { "200": {
+							description: "The invoice.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									number: {
+										type: ["string", "null"],
+										description: "The reference a customer sees. Null until the invoice is finalized."
+									},
+									status: {
+										type: ["string", "null"],
+										description: "One of `draft`, `open`, `paid`, `uncollectible` or `void`."
+									},
+									amount_due: {
+										type: "integer",
+										description: "In the smallest unit of `currency`, like every amount here."
+									},
+									amount_paid: { type: "integer" },
+									amount_remaining: { type: "integer" },
+									total: { type: "integer" },
+									subtotal: { type: "integer" },
+									currency: { type: "string" },
+									customer: { type: ["string", "null"] },
+									customer_email: { type: ["string", "null"] },
+									customer_name: { type: ["string", "null"] },
+									description: { type: ["string", "null"] },
+									collection_method: {
+										type: "string",
+										description: "Either `charge_automatically` or `send_invoice`."
+									},
+									hosted_invoice_url: {
+										type: ["string", "null"],
+										description: "The Stripe-hosted page for this invoice. Null while it is a draft."
+									},
+									invoice_pdf: { type: ["string", "null"] },
+									due_date: { type: ["integer", "null"] },
+									period_start: { type: "integer" },
+									period_end: { type: "integer" },
+									created: { type: "integer" },
+									livemode: { type: "boolean" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									},
+									parent: {
+										type: ["object", "null"],
+										description: "What generated this invoice. Null when nothing did.",
+										properties: {
+											type: { type: "string" },
+											subscription_details: {
+												type: ["object", "null"],
+												properties: { subscription: {
+													type: "string",
+													description: "The `sub_…` this invoice bills, which `getSubscription` takes."
+												} }
+											}
+										}
+									},
+									lines: {
+										type: "object",
+										description: "One page of line items, up to ten.",
+										properties: {
+											object: { type: "string" },
+											has_more: { type: "boolean" },
+											data: {
+												type: "array",
+												items: {
+													type: "object",
+													properties: {
+														id: { type: "string" },
+														object: { type: "string" },
+														description: { type: ["string", "null"] },
+														amount: { type: "integer" },
+														currency: { type: "string" },
+														quantity: { type: ["integer", "null"] }
+													},
+													required: [
+														"id",
+														"object",
+														"amount",
+														"currency"
+													]
+												}
+											}
+										},
+										required: [
+											"object",
+											"data",
+											"has_more"
+										]
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"amount_due",
+									"amount_paid",
+									"amount_remaining",
+									"total",
+									"subtotal",
+									"currency",
+									"collection_method",
+									"period_start",
+									"period_end",
+									"created",
+									"livemode",
+									"lines"
+								]
+							} } }
+						} }
+					} },
+					"/v1/subscriptions/{subscription_exposed_id}": { get: {
+						operationId: "getSubscription",
+						summary: "Retrieve one subscription by id",
+						description: "One subscription, by the `sub_…` an event, an invoice or a workflow already holds. The path parameter is named `subscription_exposed_id` because that is what Stripe’s own document calls it; the value is still the `sub_…` id. Read it to answer whether a customer is still paying: `status` is one of `active`, `trialing`, `past_due`, `unpaid`, `canceled`, `incomplete`, `incomplete_expired` or `paused`.\n\nTHE BILLING PERIOD IS ON EACH ITEM, NOT ON THE SUBSCRIPTION. Stripe moved `current_period_start` and `current_period_end` onto the subscription items, because one subscription can bill several prices on different clocks. THIS TOO DEPENDS ON THE ACCOUNT’S API VERSION, for the same reason the invoice’s `parent` does: an account pinned to a version from before the move answers the period on the subscription itself and nothing on the items. A workflow that wants the period reads `items.data[0].current_period_end`, and it should say out loud that it is taking the first item.\n\n`items` IS ONE PAGE. Stripe answers a page of subscription items with `has_more` beside them, and the rest sit behind their own endpoint, which this connector does not expose. A workflow that adds up `items.data` on a subscription carrying more than one page under-counts, and nothing errors, so check `items.has_more` before you total anything.\n\n`cancel_at_period_end` is the field that says a cancellation is scheduled. A subscription with it set is still `active` and still collecting, which is why reading `status` alone answers the wrong question.",
+						parameters: [{
+							name: "subscription_exposed_id",
+							in: "path",
+							required: true,
+							description: "The subscription id, e.g. `sub_1PqR2sC0mNqLxYzA6gH7iJ8k`.",
+							schema: { type: "string" }
+						}],
+						responses: { "200": {
+							description: "The subscription.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									customer: { type: "string" },
+									status: { type: "string" },
+									currency: { type: "string" },
+									collection_method: { type: "string" },
+									description: { type: ["string", "null"] },
+									cancel_at_period_end: { type: "boolean" },
+									cancel_at: { type: ["integer", "null"] },
+									canceled_at: { type: ["integer", "null"] },
+									ended_at: { type: ["integer", "null"] },
+									trial_start: { type: ["integer", "null"] },
+									trial_end: { type: ["integer", "null"] },
+									start_date: { type: "integer" },
+									created: { type: "integer" },
+									latest_invoice: {
+										type: ["string", "null"],
+										description: "The `in_…` of the most recent invoice, which `getInvoice` takes."
+									},
+									livemode: { type: "boolean" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									},
+									items: {
+										type: "object",
+										description: "The priced items this subscription bills, and where the billing period lives.",
+										properties: {
+											object: { type: "string" },
+											has_more: { type: "boolean" },
+											data: {
+												type: "array",
+												items: {
+													type: "object",
+													properties: {
+														id: { type: "string" },
+														object: { type: "string" },
+														quantity: { type: "integer" },
+														current_period_start: { type: "integer" },
+														current_period_end: { type: "integer" },
+														price: {
+															type: "object",
+															properties: {
+																id: { type: "string" },
+																currency: { type: "string" },
+																unit_amount: {
+																	type: ["integer", "null"],
+																	description: "Null on a tiered or metered price, where no single amount exists."
+																},
+																recurring: {
+																	type: ["object", "null"],
+																	properties: {
+																		interval: {
+																			type: "string",
+																			description: "One of `day`, `week`, `month` or `year`."
+																		},
+																		interval_count: { type: "integer" }
+																	}
+																}
+															},
+															required: ["id", "currency"]
+														}
+													},
+													required: [
+														"id",
+														"object",
+														"current_period_start",
+														"current_period_end",
+														"price"
+													]
+												}
+											}
+										},
+										required: [
+											"object",
+											"data",
+											"has_more"
+										]
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"customer",
+									"status",
+									"currency",
+									"collection_method",
+									"cancel_at_period_end",
+									"start_date",
+									"created",
+									"livemode",
+									"items"
+								]
+							} } }
+						} }
+					} },
+					"/v1/charges/{charge}/dispute": { get: {
+						operationId: "getChargeDispute",
+						summary: "Retrieve the dispute on a charge",
+						description: "The dispute a cardholder raised against a charge, by the `ch_…` the charge event carried. A dispute hangs off its charge rather than standing alone, which is why this reads through the charge and takes no dispute id.\n\nON A `charge.dispute.*` EVENT THE OBJECT IS THE DISPUTE, so the id this operation wants is `data.object.charge` and never `data.object.id`. The latter is a `du_…`, and the call answers 404 with `No dispute for charge: du_…`, a message that points at the wrong mistake.\n\nA CHARGE WITH NO DISPUTE IS AN ERROR AND NOT AN EMPTY ANSWER. Stripe answers 404 with `No dispute for charge: ch_…`, verified against a test account on 2026-09-17. So this is not the way to ask whether a charge was disputed: reach for it on a run started by a `charge.dispute.*` event, or handle the failure.\n\n`evidence_details.due_by` is the deadline, and it is the field the whole operation exists for: miss it and the dispute is lost by default. `is_charge_refundable` says whether refunding is still an option, which usually stops being one once a dispute opens.",
+						parameters: [{
+							name: "charge",
+							in: "path",
+							required: true,
+							description: "The disputed charge id, e.g. `ch_3PqR2sC0mNqLxYzA0kL1mN2o`.",
+							schema: { type: "string" }
+						}],
+						responses: { "200": {
+							description: "The dispute on that charge.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									charge: { type: "string" },
+									payment_intent: { type: ["string", "null"] },
+									amount: {
+										type: "integer",
+										description: "What is being disputed, in the smallest unit of `currency`. It can be less than the charge."
+									},
+									currency: { type: "string" },
+									reason: {
+										type: "string",
+										description: "What the cardholder claimed, such as `fraudulent`, `product_not_received`, `duplicate` or `credit_not_processed`."
+									},
+									status: {
+										type: "string",
+										description: "One of `warning_needs_response`, `warning_under_review`, `warning_closed`, `needs_response`, `under_review`, `won`, `lost` or `prevented`."
+									},
+									is_charge_refundable: { type: "boolean" },
+									created: { type: "integer" },
+									livemode: { type: "boolean" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									},
+									evidence_details: {
+										type: "object",
+										properties: {
+											due_by: {
+												type: ["integer", "null"],
+												description: "When evidence has to be submitted. Null while no response is owed."
+											},
+											has_evidence: { type: "boolean" },
+											past_due: { type: "boolean" },
+											submission_count: { type: "integer" }
+										},
+										required: [
+											"has_evidence",
+											"past_due",
+											"submission_count"
+										]
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"charge",
+									"amount",
+									"currency",
+									"reason",
+									"status",
+									"is_charge_refundable",
+									"created",
+									"livemode",
+									"evidence_details"
+								]
+							} } }
+						} }
+					} },
+					"/v1/payment_intents": { post: {
+						operationId: "createPaymentIntent",
+						summary: "Create a payment intent",
+						description: "Creates a payment intent — Stripe’s record of an intent to collect money, which a browser then confirms. `amount` is in the currency’s smallest unit, so 4900 with `eur` is 49.00 euros and a zero-decimal currency like `jpy` has no such factor at all. The intent comes back `requires_payment_method`: creating one moves no money and charges nobody, which is why this operation needs no confirmation step here.\n\n`client_secret` is left out of the response schema, and it is worth knowing exactly how little that does. The schema documents an operation; it never filters a response. `connect-action-executor.ts` parses the provider body and returns it whole, and nothing in the broker reads `responseSchema` at all — so Stripe sends the secret and the workflow receives it, declared or not. Logs are a different story: `@stackbone/redaction` masks any key ending in `secret`, so a logged body loses it. A run’s output is not scrubbed, so a workflow that returns this response persists a bearer credential for one payment. Take the fields you need.\n\nIf a workflow of yours also watches this account’s event feed, declare `echoPath: 'id'` on the call and open that workflow with `isOwnEcho('stripe', event.data.object.id)`: creating an intent raises `payment_intent.created` on the feed, and the `pi_…` id is the value both sides can compare. Without it a link scoped to a payment-intent family, pointed at a workflow that creates intents, starts itself again on every lap.",
+						"x-stackbone-body-encoding": "form",
+						parameters: [IDEMPOTENCY_KEY_PARAM],
+						requestBody: {
+							required: true,
+							content: { "application/x-www-form-urlencoded": { schema: {
+								type: "object",
+								properties: {
+									amount: {
+										type: "integer",
+										description: "How much to collect, in the smallest unit of `currency`. 4900 is 49.00 in a two-decimal currency."
+									},
+									currency: {
+										type: "string",
+										description: "Three-letter ISO code, lowercase, e.g. `eur`."
+									},
+									customer: {
+										type: "string",
+										description: "Optional customer id (`cus_…`) to attach the intent to."
+									},
+									description: {
+										type: "string",
+										description: "Free text shown on the payment in the Stripe dashboard."
+									},
+									metadata: {
+										type: "object",
+										additionalProperties: { type: "string" },
+										description: "Arbitrary key/value pairs stored on the intent, sent as `metadata[key]=value`."
+									}
+								},
+								required: ["amount", "currency"]
+							} } }
+						},
+						responses: { "200": {
+							description: "The payment intent, newly created.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									amount: { type: "integer" },
+									amount_received: { type: "integer" },
+									currency: { type: "string" },
+									customer: { type: ["string", "null"] },
+									description: { type: ["string", "null"] },
+									status: {
+										type: "string",
+										description: "A freshly created intent is `requires_payment_method` until something confirms it."
+									},
+									created: { type: "integer" },
+									livemode: { type: "boolean" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"created",
+									"livemode",
+									"status"
+								]
+							} } }
+						} }
+					} },
+					"/v1/refunds": { post: {
+						operationId: "createRefund",
+						summary: "Refund a charge or a payment intent",
+						description: "Gives money back. Name one of `charge` or `payment_intent`, never both — Stripe refuses the pair rather than picking one. Omit `amount` to refund the whole thing; supply it, in the smallest unit, for a partial refund. Two calls are two refunds: nothing about the arguments makes a repeat a no-op, and the second fails only once the charge has nothing left to give back. Send `Idempotency-Key` to make a retry safe — see the parameter. If a workflow of yours also watches this account's event feed, declare `echoPath: 'charge'` on the call and open that workflow with `isOwnEcho('stripe', event.data.object.id)`: a refund raises `charge.refunded` on the feed, and the charge id is the value both sides can compare.\n\n`reason` takes exactly `duplicate`, `fraudulent` or `requested_by_customer`. Any other string is refused, so it is an enum rather than free text.",
+						"x-stackbone-body-encoding": "form",
+						parameters: [IDEMPOTENCY_KEY_PARAM],
+						requestBody: {
+							required: true,
+							content: { "application/x-www-form-urlencoded": { schema: {
+								type: "object",
+								properties: {
+									charge: {
+										type: "string",
+										description: "The charge to refund (`ch_…`). Mutually exclusive with `payment_intent`."
+									},
+									payment_intent: {
+										type: "string",
+										description: "The payment intent to refund (`pi_…`). Mutually exclusive with `charge`."
+									},
+									amount: {
+										type: "integer",
+										description: "How much to give back, in the smallest unit. Omitted refunds the full amount."
+									},
+									reason: {
+										type: "string",
+										enum: [
+											"duplicate",
+											"fraudulent",
+											"requested_by_customer"
+										],
+										description: "Why. Stripe accepts these three strings and no others."
+									},
+									metadata: {
+										type: "object",
+										additionalProperties: { type: "string" },
+										description: "Key/value pairs stored on the refund, as `metadata[key]=value`."
+									}
+								},
+								required: []
+							} } }
+						},
+						responses: { "200": {
+							description: "The refund.",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: {
+									id: { type: "string" },
+									object: { type: "string" },
+									amount: { type: "integer" },
+									currency: { type: "string" },
+									charge: { type: ["string", "null"] },
+									payment_intent: { type: ["string", "null"] },
+									reason: { type: ["string", "null"] },
+									status: {
+										type: "string",
+										description: "One of `pending`, `succeeded`, `failed` or `canceled`. A card refund in test mode comes back `succeeded` at once."
+									},
+									created: { type: "integer" },
+									metadata: {
+										type: "object",
+										additionalProperties: true
+									}
+								},
+								required: [
+									"id",
+									"object",
+									"created",
+									"status"
+								]
+							} } }
+						} }
+					} }
+				}
+			}
+		},
+		triggers: [{
+			id: "event-received",
+			displayName: "Stripe event",
+			description: "A Stripe event is the account’s own record of something that happened: a charge succeeded, an invoice was created. This link reads that feed and starts one run per event recorded after you turn it on. The event arrives whole — `type` names what happened, and `data.object` carries the thing it happened to.",
+			docs: "Starts a run for each event Stripe records on the account, from the moment you turn the link on. The event arrives whole: `type` names what happened, and the object it happened to rides along with it. That object is a charge on a charge.succeeded event and an invoice on an invoice.created one, so a mapping that reads a charge field belongs on a link scoped to charge events.\n\nEvent type takes one name, or a family with a wildcard such as `charge.*`. Left blank, every type the account emits starts a run.\n\nTest mode and live mode are separate feeds. A test key sees only test events, and every event carries a `livemode` flag saying which feed it came from.\n\nCAUTION: a poll walks page after page until Stripe says there are no more, and stops at 10,000 events. Reaching that ceiling marks the tick cut off, so the loss is on the record rather than silent, but those events do not arrive on a later poll. Only a very busy account gets near it.\n\nCAUTION: Stripe keeps events for 30 days. A link switched off for longer resumes from a bookmark older than anything the feed still holds, and whatever expired in the meantime never arrives.\n\nCAUTION: this connector writes, and a workflow that creates a payment intent or issues a refund through this connection raises events on the very feed this link reads. A refund raises a charge.refunded event, so a link scoped to `charge.*` that also refunds starts itself again, and deduplication cannot stop it because every lap carries a new event id. There are two guards. The cheap one is the scope: keep the writing workflow off the types its own writes raise. That is why the event type field offers no charge or payment intent wildcard, though it still accepts one you type yourself. The other guard is `isOwnEcho` inside the workflow body, which compares a value the delivery carried against one your own write recorded. Declare an echo path on the write so it records the charge id, or the payment intent id, and compare it against the id the event object carries. Compare the resource id and never the event id, which is new on every lap and would match nothing. The `createRefund` and `createPaymentIntent` pages name the exact paths. A mapping cannot skip an event: every delivery starts a run.",
+			sampleData: {
+				id: "evt_1PqR2sC0mNqLxYzA3bK4dEf5",
+				object: "event",
+				api_version: "2026-08-26.dahlia",
+				created: 1757836921,
+				livemode: false,
+				pending_webhooks: 0,
+				request: {
+					id: "req_9fT2kQwZ1aBcDe",
+					idempotency_key: null
+				},
+				type: "charge.succeeded",
+				data: { object: {
+					id: "ch_3PqR2sC0mNqLxYzA0kL1mN2o",
+					object: "charge",
+					amount: 4900,
+					amount_captured: 4900,
+					amount_refunded: 0,
+					currency: "eur",
+					customer: "cus_QhT8kLmNoPqRs",
+					description: "Stackbone Pro, monthly",
+					paid: true,
+					refunded: false,
+					receipt_url: "https://pay.stripe.com/receipts/payment/example",
+					payment_intent: "pi_3PqR2sC0mNqLxYzA1cD2eF3g",
+					status: "succeeded",
+					created: 1757836920,
+					livemode: false,
+					metadata: { workspace: "stackbone-demo" }
+				} }
+			},
+			outputSchema: {
+				type: "object",
+				properties: {
+					id: { type: "string" },
+					object: { type: "string" },
+					api_version: { type: ["string", "null"] },
+					created: {
+						type: "integer",
+						description: "When Stripe recorded the event, in seconds from the epoch."
+					},
+					livemode: {
+						type: "boolean",
+						description: "False for an event from test mode, true for one from live mode."
+					},
+					pending_webhooks: { type: "integer" },
+					type: { type: "string" },
+					request: {
+						type: ["object", "null"],
+						properties: {
+							id: { type: ["string", "null"] },
+							idempotency_key: { type: ["string", "null"] }
+						}
+					},
+					data: {
+						type: "object",
+						properties: {
+							object: {
+								type: "object",
+								additionalProperties: true
+							},
+							previous_attributes: {
+								type: "object",
+								additionalProperties: true
+							}
+						},
+						required: ["object"]
+					}
+				},
+				required: [
+					"id",
+					"object",
+					"created",
+					"livemode",
+					"pending_webhooks",
+					"type",
+					"data"
+				]
+			},
+			poll: {
+				kind: "declarative",
+				list: {
+					operationId: "listEvents",
+					args: { limit: 100 },
+					itemsPath: "data",
+					order: "newest-first",
+					pageLastId: {
+						param: "starting_after",
+						itemPath: "id",
+						hasMorePath: "has_more"
+					},
+					scopeParams: [{
+						param: "type",
+						displayName: "Event type",
+						description: "One event name, or a family with a wildcard: `charge.*`. Blank delivers every type the account emits.",
+						example: "charge.succeeded",
+						required: false,
+						pattern: "^[a-z0-9_.*]+$",
+						suggestions: [
+							"charge.succeeded",
+							"charge.failed",
+							"charge.refunded",
+							"charge.dispute.created",
+							"payment_intent.succeeded",
+							"payment_intent.payment_failed",
+							"payment_intent.canceled",
+							"invoice.paid",
+							"invoice.payment_failed",
+							"invoice.*",
+							"customer.subscription.created",
+							"customer.subscription.updated",
+							"customer.subscription.deleted",
+							"customer.subscription.*",
+							"checkout.session.completed",
+							"payout.paid",
+							"payout.failed"
+						]
+					}]
+				},
+				cursor: {
+					kind: "timestamp",
+					field: "created",
+					param: "created[gte]",
+					unit: "unix-seconds"
+				},
+				dedup: { idPath: "id" }
+			}
+		}]
+	};
+}));
+//#endregion
 //#region ../../libs/shared/connect-registry/src/lib/catalog/supabase/supabase.connector.ts
 var SUPABASE_CONNECTOR;
 var init_supabase_connector = __esmMin((() => {
@@ -33985,8 +35229,8 @@ var init_supabase_connector = __esmMin((() => {
 		triggers: [{
 			id: "row-inserted",
 			displayName: "Row inserted or changed",
-			description: "Starts a run for each row that appears past the cursor column, delivered as { table, row }. THE CURSOR COLUMN DECIDES WHAT \"APPEARS\" MEANS. Left at the default `id`, or set to any column written once and never touched again such as `created_at`, this is insert-only: one run per new row, and an edit to an existing row is never delivered. Set to a column your database bumps on every write, such as `updated_at`, this is change detection: EVERY UPDATE TO A ROW STARTS A NEW RUN. CAUTION: on a moving column a workflow that writes back to the row it received bumps that column and re-triggers itself, and the delivery journal cannot stop it — guard INSIDE THE WORKFLOW BODY. The table must expose a unique, non-null `id` column for delivery identity. Rows whose cursor value is NULL are ignored. Rows are read in ascending cursor order: a row that becomes visible after the cursor advances, with a value EQUAL TO OR LOWER THAN the highest seen, is not delivered. Choose values that increase as changes become visible; this also applies to timestamp and date columns. A trigger mapping cannot skip an item; every delivered row starts a run.",
-			docs: "Starts a run for each row that appears past the cursor column, delivered as `{ table, row }`.\n\nThe cursor column decides what \"appears\" means, and it is the only choice that matters here. Left at the default `id`, or set to a column written once and never touched again such as `created_at`, this is insert-only: one run per new row, and an edit to an existing row is never delivered. Set to a column your database bumps on every write, such as `updated_at`, it becomes change detection, and every update to a row starts a new run.\n\nThe table must expose a unique, non-null `id` column for delivery identity. Rows whose cursor value is NULL are ignored.\n\nRows are read in ascending cursor order. A row that becomes visible after the cursor advances, with a value equal to or lower than the highest already seen, is not delivered. Choose values that increase as changes become visible; this also applies to timestamp and date columns.\n\nCAUTION: on a moving column, a workflow that writes back to the row it received bumps that column and starts itself again. Nothing on the platform stops that loop, so guard inside the workflow body. A mapping cannot skip an event: every delivered row starts a run.",
+			description: "Starts a run for each row that appears past the cursor column, delivered as { table, row }. THE CURSOR COLUMN DECIDES WHAT \"APPEARS\" MEANS. Left at the default `id`, or set to any column written once and never touched again such as `created_at`, this is insert-only: one run per new row, and an edit to an existing row is never delivered. Set to a column your database bumps on every write, such as `updated_at`, this is change detection: EVERY UPDATE TO A ROW STARTS A NEW RUN. CAUTION: a workflow that writes to this table can re-trigger itself, and the delivery journal cannot stop it: on a moving column a write-back bumps that column, and on the default column a workflow that answers each row by inserting another mints a new id. Guard INSIDE THE WORKFLOW BODY with `isOwnEcho`, and MATCH THE VALUE TO THE CURSOR COLUMN. Insert-only, compare the new row's id: `echoPath: '0.id'` on the write against `event.row.id`. Change detection, compare the cursor column itself: `echoPath: '0.updated_at'` against `event.row.updated_at`, with your own column name in place of `updated_at`. COMPARING THE ID ON A MOVING COLUMN IS WRONG — a row's id never changes, so the guard would read every later delivery of that row as your own echo for the whole window and swallow a human's edit with it. The write must also ask for `Prefer: return=representation`: without it PostgREST answers no body, the echo path resolves to nothing, and the guard throws instead of guarding. The table must expose a unique, non-null `id` column for delivery identity. Rows whose cursor value is NULL are ignored. Rows are read in ascending cursor order: a row that becomes visible after the cursor advances, with a value EQUAL TO OR LOWER THAN the highest seen, is not delivered. Choose values that increase as changes become visible; this also applies to timestamp and date columns. A trigger mapping cannot skip an item; every delivered row starts a run.",
+			docs: "Starts a run for each row that appears past the cursor column, delivered as `{ table, row }`.\n\nThe cursor column decides what \"appears\" means, and it is the only choice that matters here. Left at the default `id`, or set to a column written once and never touched again such as `created_at`, this is insert-only: one run per new row, and an edit to an existing row is never delivered. Set to a column your database bumps on every write, such as `updated_at`, it becomes change detection, and every update to a row starts a new run.\n\nThe table must expose a unique, non-null `id` column for delivery identity. Rows whose cursor value is NULL are ignored.\n\nRows are read in ascending cursor order. A row that becomes visible after the cursor advances, with a value equal to or lower than the highest already seen, is not delivered. Choose values that increase as changes become visible; this also applies to timestamp and date columns.\n\nCAUTION: a workflow that writes to this table starts itself again, and nothing on the platform stops that loop: on a moving column a write-back bumps that column, and on the default column a workflow that answers each row by inserting another row mints a new id. Guard inside the workflow body with `isOwnEcho`, and match the value you compare to the cursor column. Insert-only: compare the `id` the delivery carried, with `echoPath: '0.id'` on the write. Change detection: compare the cursor column the delivery carried, with `echoPath: '0.updated_at'` on the write, putting your own column name in place of `updated_at`. Comparing the id on a moving column is wrong, because a row's id never changes, so the guard would read every later delivery of that row as your own echo for the whole window and swallow a human's edit with it. The write also has to ask for `Prefer: return=representation`: without it PostgREST answers no body, the echo path resolves to nothing, and the guard throws instead of guarding. A mapping cannot skip an event: every delivered row starts a run.",
 			sampleData: {
 				table: "todos",
 				row: {
@@ -34007,6 +35251,7 @@ var init_supabase_connector = __esmMin((() => {
 				kind: "declarative",
 				list: {
 					operationId: "GET /{table}",
+					order: "oldest-first",
 					args: {
 						order: "{cursorColumn}.asc",
 						and: "({cursorColumn}.not.is.null)"
@@ -34120,6 +35365,7 @@ var init_built_in_catalog = __esmMin((() => {
 	init_linear_connector();
 	init_outlook_connector();
 	init_outlook_app_only_connector();
+	init_stripe_connector();
 	init_supabase_connector();
 	init_telegram_connector();
 	init_whatsapp_connector();
@@ -34130,6 +35376,7 @@ var init_built_in_catalog = __esmMin((() => {
 		LINEAR_CONNECTOR,
 		OUTLOOK_CONNECTOR,
 		OUTLOOK_APP_ONLY_CONNECTOR,
+		STRIPE_CONNECTOR,
 		SUPABASE_CONNECTOR,
 		TELEGRAM_CONNECTOR,
 		WHATSAPP_CONNECTOR
@@ -34536,6 +35783,7 @@ function buildOperation(rawPath, resolvedPath, method, operation, pathLevelParam
 	const rawResponse = declaredRawResponse === true || declaredRawResponse === "when-requested" ? declaredRawResponse : void 0;
 	const declaredVersionPath = operation["x-stackbone-version-path"];
 	const versionPath = typeof declaredVersionPath === "string" && declaredVersionPath !== "" ? declaredVersionPath : void 0;
+	const bodyEncoding = operation["x-stackbone-body-encoding"] === "form" ? "form" : void 0;
 	const continuation = readContinuation(operation);
 	return {
 		operationId,
@@ -34547,6 +35795,7 @@ function buildOperation(rawPath, resolvedPath, method, operation, pathLevelParam
 		...parameters.length > 0 ? { parameters } : {},
 		...requestBodySchema !== void 0 ? { requestBodySchema } : {},
 		...bodyArgName !== void 0 ? { bodyArgName } : {},
+		...bodyEncoding !== void 0 ? { bodyEncoding } : {},
 		...responseSchema !== void 0 ? { responseSchema } : {},
 		...rawBody ? { rawBody } : {},
 		...rawResponse !== void 0 ? { rawResponse } : {},
@@ -34780,8 +36029,15 @@ async function mapWithConcurrency(items, limit, fn) {
 var init_concurrency = __esmMin((() => {}));
 //#endregion
 //#region ../../libs/shared/connect-registry/src/lib/triggers/stamps.ts
-/** The instant a stamp names, or `null` for anything that is not a stamp. */
-function parseStamp(value) {
+/**
+* The instant a stamp names, or `null` for anything that is not a stamp.
+*
+* `unit` is the cursor's declared unit, passed by every caller that has one.
+* Omitted — the case for every trigger written before units existed — the two
+* ISO shapes above are the only ones read, exactly as before.
+*/
+function parseStamp(value, unit) {
+	if (unit === "unix-seconds") return parseUnixSeconds(value);
 	if (typeof value !== "string") return null;
 	const zoned = EXPLICIT_OFFSET.test(value);
 	const zoneless = !zoned && ZONELESS_STAMP.test(value);
@@ -34797,17 +36053,36 @@ function parseStamp(value) {
 		}
 	};
 }
+/** A stamp counted in seconds from the epoch, as a number or as its digits. */
+function parseUnixSeconds(value) {
+	const numeric = typeof value === "number";
+	if (!numeric && !(typeof value === "string" && UNIX_SECONDS.test(value))) return null;
+	const seconds = numeric ? value : Number(value);
+	if (!Number.isSafeInteger(seconds) || Math.abs(seconds) >= 0xe8d4a51000) return null;
+	return {
+		epochMs: seconds * 1e3,
+		shape: {
+			unit: "unix-seconds",
+			numeric
+		}
+	};
+}
 /** Write an instant in the shape {@link parseStamp} read. */
 function formatStamp(epochMs, shape) {
+	if (shape.unit === "unix-seconds") {
+		const seconds = Math.floor(epochMs / 1e3);
+		return shape.numeric ? seconds : String(seconds);
+	}
 	const iso = new Date(epochMs).toISOString();
 	const withFraction = shape.fractional ? iso : iso.replace(/\.\d{3}Z$/, "Z");
 	if (shape.zoned) return withFraction;
 	return withFraction.slice(0, -1).replace("T", shape.separator);
 }
-var EXPLICIT_OFFSET, ZONELESS_STAMP;
+var EXPLICIT_OFFSET, ZONELESS_STAMP, UNIX_SECONDS;
 var init_stamps = __esmMin((() => {
 	EXPLICIT_OFFSET = /(?:Z|[+-]\d{2}:?\d{2})$/i;
 	ZONELESS_STAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?$/;
+	UNIX_SECONDS = /^\d{1,12}$/;
 }));
 //#endregion
 //#region ../../libs/shared/connect-registry/src/lib/triggers/list-args.ts
@@ -34845,17 +36120,30 @@ function scopeValue(param, scope) {
 * same filter the stored one did and has to parse the way that one parsed. An
 * offset other than `Z` comes back as `Z`; it names the same instant.
 *
-* @throws on a stored cursor that is not a date stamp — a number, or a string
-* in no shape `parseStamp` reads. The margin is the definition's promise; a
-* cursor it cannot be applied to is that promise unkept, and the failed tick
-* puts the reason on the row where an operator sees it. Sending the cursor
-* unmoved would keep the row green and the margin fictional.
-*/
-function withLookback(cursor, stored) {
+* @throws on a stored cursor the reader cannot take, whenever the definition
+* claimed it could be read: a declared `unit`, a declared `lookbackMs`, or both
+* (PLA-1506). Refusing to PARSE a value is not the same as refusing to SEND it,
+* and sending it is the worse of the two. A `unix-seconds` cursor holding a
+* 13-digit millisecond value goes out verbatim, matches nothing, never advances,
+* and every tick after it reports `polled` on a green row — the definition's
+* promise unkept with nothing anywhere to say so. The failed tick puts the value
+* on the row where an operator sees it.
+*
+* A cursor that declares NEITHER is passed through unread, and has to be: an
+* opaque provider token, a Supabase integer id, the `'12345'` that
+* `declarative-poll.spec.ts` pins as passing through untouched. Reading is owed
+* only where the definition said the value is readable.
+*/
+function cursorForRequest(cursor, stored) {
 	if (stored === null || stored === void 0) return stored;
-	if (cursor.kind !== "timestamp" || cursor.lookbackMs === void 0) return stored;
-	const stamp = parseStamp(stored);
-	if (stamp === null) throw new Error(`trigger declares a cursor lookback of ${cursor.lookbackMs}ms but the stored cursor ${JSON.stringify(stored)} is not a date stamp, so there is nothing to move back — a lookback belongs on a date-stamped cursor only`);
+	if (cursor.kind !== "timestamp") return stored;
+	if (cursor.unit === void 0 && cursor.lookbackMs === void 0) return stored;
+	const stamp = parseStamp(stored, cursor.unit);
+	if (stamp === null) {
+		const value = JSON.stringify(stored);
+		throw new Error(cursor.lookbackMs !== void 0 ? `trigger declares a cursor lookback of ${cursor.lookbackMs}ms but the stored cursor ${value} cannot be read as an instant` + (cursor.unit === void 0 ? ", and this cursor declares no unit, so only an ISO date stamp can be moved back" : ` in the declared unit ${cursor.unit}`) + " — there is nothing to subtract the margin from" : `trigger declares a cursor unit of ${cursor.unit} but the stored cursor ${value} cannot be read in it — sending it on would filter for a moment that is not the one it names, match nothing, and leave the marker where it is on a green row`);
+	}
+	if (cursor.lookbackMs === void 0) return stored;
 	return formatStamp(stamp.epochMs - cursor.lookbackMs, stamp.shape);
 }
 /**
@@ -34866,11 +36154,13 @@ function withLookback(cursor, stored) {
 * failed tick.
 * @throws when a scope clause and the cursor clause target one key and the
 * cursor declares no `composeWith` to join them with.
+* @throws when the stored cursor cannot be read in the unit or shape the
+* definition declared — see {@link cursorForRequest}.
 */
 function buildListArgs(spec, input) {
 	const args = { ...spec.list.args ?? {} };
 	const cursorParam = spec.cursor.kind === "timestamp" ? spec.cursor.param : spec.cursor.requestParam;
-	const cursor = withLookback(spec.cursor, input.cursor);
+	const cursor = cursorForRequest(spec.cursor, input.cursor);
 	const cursorValue = cursor === null || cursor === void 0 ? void 0 : spec.cursor.kind === "timestamp" && spec.cursor.cursorTemplate ? fill(spec.cursor.cursorTemplate, "{cursor}", String(cursor)) : cursor;
 	let collidingClause = void 0;
 	for (const param of spec.list.scopeParams ?? []) {
@@ -34895,7 +36185,8 @@ function buildListArgs(spec, input) {
 	} else if (spec.list.pageNumber) {
 		setPath(args, spec.list.pageNumber.pageSizeParam, spec.list.pageNumber.size);
 		setPath(args, spec.list.pageNumber.param, page.index + 1);
-	} else if (spec.list.pageToken && page.token !== null && page.token !== void 0) setPath(args, spec.list.pageToken.requestParam, page.token);
+	} else if (spec.list.pageLastId && page.lastId !== null && page.lastId !== void 0) setPath(args, spec.list.pageLastId.param, page.lastId);
+	else if (spec.list.pageToken && page.token !== null && page.token !== void 0) setPath(args, spec.list.pageToken.requestParam, page.token);
 	return args;
 }
 var init_list_args = __esmMin((() => {
@@ -35001,10 +36292,22 @@ function firstErrorMessage(errors) {
 		return String(first);
 	}
 }
-function laterOf(a, b) {
+/**
+* The later of two markers. With a `unit` declared both sides are read as
+* INSTANTS, because the lexical fallback below gets a declared unit wrong every
+* time: `'1757000000'` sorts under `'2026-…'`, so a unix marker would lose to
+* the ISO value the seed used to mint and the cursor would never move — the
+* link green, the poll asking for the same window forever.
+*/
+function laterOf(a, b, unit) {
 	const other = typeof b === "string" || typeof b === "number" ? b : void 0;
 	if (a === void 0) return other;
 	if (other === void 0) return a;
+	if (unit !== void 0) {
+		const left = parseStamp(a, unit);
+		const right = parseStamp(other, unit);
+		if (left !== null && right !== null) return left.epochMs > right.epochMs ? a : other;
+	}
 	if (typeof a === "number" && typeof other === "number") return a > other ? a : other;
 	return String(a) > String(other) ? a : other;
 }
@@ -35031,14 +36334,15 @@ function laterOf(a, b) {
 * A provider clock running ahead therefore makes the marker trail by the skew
 * and re-list once — which dedup absorbs — rather than stall.
 *
-* Only date STRINGS are judged, and only the two shapes `parseStamp` reads: a
-* numeric cursor is ambiguous (seconds or milliseconds, or a provider's own
-* sequence) and is left alone, and so is anything that is not a date shape —
-* which is what keeps `Date.parse('12345')`, the year 12345, from barring a
-* numeric-looking id. A zoneless stamp is read as UTC; `stamps.ts` says why.
+* Only values `parseStamp` reads are judged: the two date shapes, plus a number
+* when the cursor DECLARES its unit. An undeclared numeric cursor is ambiguous
+* (seconds or milliseconds, or a provider's own sequence) and is left alone, and
+* so is anything that is not a date shape — which is what keeps
+* `Date.parse('12345')`, the year 12345, from barring a numeric-looking id. A
+* zoneless stamp is read as UTC; `stamps.ts` says why.
 */
-function isFuture(value) {
-	const stamp = parseStamp(value);
+function isFuture(value, unit) {
+	const stamp = parseStamp(value, unit);
 	return stamp !== null && stamp.epochMs > Date.now();
 }
 /** The greatest value across items AND across every declared field (ISO strings
@@ -35046,14 +36350,15 @@ function isFuture(value) {
 *  yet. `undefined` when no item carries a usable value — an item barred from
 *  moving the marker is still delivered; it is re-listed until its date arrives,
 *  and dedup absorbs that. */
-function latestTimestamp(items, field) {
+function latestTimestamp(items, field, unit) {
 	const fields = typeof field === "string" ? [field] : field;
 	let latest;
 	for (const item of items) for (const path of fields) {
 		const value = getPath(item, path);
 		if (typeof value !== "string" && typeof value !== "number") continue;
-		if (isFuture(value)) continue;
-		latest = laterOf(value, latest);
+		if (unit !== void 0 && parseStamp(value, unit) === null) continue;
+		if (isFuture(value, unit)) continue;
+		latest = laterOf(value, latest, unit);
 	}
 	return latest;
 }
@@ -35067,6 +36372,7 @@ function createDeclarativePoll(spec) {
 		const rawItems = [];
 		let opaqueNext;
 		let pageToken;
+		let pageLastId;
 		let drained = false;
 		let pagesWalked = 0;
 		for (let page = 0; page < 100; page += 1) {
@@ -35076,7 +36382,8 @@ function createDeclarativePoll(spec) {
 				cursor,
 				page: {
 					index: page,
-					token: pageToken
+					token: pageToken,
+					lastId: pageLastId
 				}
 			});
 			const response = await ctx.runOperation(spec.list.operationId, args);
@@ -35098,9 +36405,20 @@ function createDeclarativePoll(spec) {
 					drained = true;
 					break;
 				}
+			} else if (spec.list.pageLastId) {
+				const hasMore = getPath(response, spec.list.pageLastId.hasMorePath);
+				if (hasMore === false) {
+					drained = true;
+					break;
+				}
+				if (hasMore !== true) break;
+				const last = Array.isArray(items) && items.length > 0 ? items[items.length - 1] : void 0;
+				const next = last === void 0 ? void 0 : getPath(last, spec.list.pageLastId.itemPath);
+				if (next === null || next === void 0) break;
+				pageLastId = next;
 			} else {
 				pageToken = spec.list.pageToken ? getPath(response, spec.list.pageToken.responsePath) : void 0;
-				const hasMorePath = spec.list.pageToken?.hasMorePath;
+				const hasMorePath = spec.list.pageToken?.hasMorePath ?? spec.list.hasMorePath;
 				const hasMore = hasMorePath === void 0 ? void 0 : getPath(response, hasMorePath);
 				if (hasMore === false) {
 					drained = true;
@@ -35108,6 +36426,7 @@ function createDeclarativePoll(spec) {
 				}
 				if (hasMorePath !== void 0 && hasMore !== true) break;
 				if (pageToken === null || pageToken === void 0) {
+					if (spec.list.pageToken === void 0 && hasMorePath !== void 0) break;
 					drained = true;
 					break;
 				}
@@ -35126,7 +36445,7 @@ function createDeclarativePoll(spec) {
 			id: dedupId(item, spec.dedup),
 			payload: withScopeFields(spec.map ? mapFields(spec.map, item) : item, spec.list.scopeParams, ctx.scope)
 		}));
-		const nextCursor = spec.cursor.kind === "opaque" ? opaqueNext ?? cursor ?? null : laterOf(latestTimestamp(items, spec.cursor.field), cursor) ?? null;
+		const nextCursor = spec.cursor.kind === "opaque" ? opaqueNext ?? cursor ?? null : laterOf(latestTimestamp(items, spec.cursor.field, spec.cursor.unit), cursor, spec.cursor.unit) ?? null;
 		if (!drained) return {
 			items: events,
 			nextCursor,
@@ -35294,6 +36613,7 @@ var init_src$4 = __esmMin((() => {
 	init_trigger_descriptor();
 	init_declarative_poll();
 	init_list_args();
+	init_stamps();
 	init_paths();
 	init_concurrency();
 	init_built_in_strategies();
@@ -36286,6 +37606,70 @@ var init_body_error = __esmMin((() => {
 	init_src$20();
 }));
 //#endregion
+//#region ../../libs/runtime/connect-broker/src/lib/executor/form-encoding.ts
+/**
+* Encode an object as a form body. Returns the `&`-joined pairs, with no leading
+* `?` and no trailing separator; an object with nothing to send returns the
+* empty string.
+*
+* The value rules, each of which a provider can tell apart:
+*
+*   - `null` and `undefined` are OMITTED, key and all. A form body has no null:
+*     the wire can only carry text, so `x=null` would set the field to the
+*     four-letter string. Omitting is the one encoding that means "not sent".
+*   - the empty string is NOT omitted — `x=` is how a form body clears a field,
+*     and a caller that wrote `''` asked for exactly that.
+*   - an empty object or an empty array contributes NO pairs, because it has no
+*     leaf to hang a key off. Same reading as `qs` and as Stripe's own client.
+*   - booleans go out as `true` / `false`, numbers as their digits.
+*
+* @param body the arguments to send, already stripped of anything the broker
+*   consumes (see `buildRequestBody`).
+*/
+function encodeFormBody(body) {
+	const pairs = [];
+	for (const [key, value] of Object.entries(body)) appendPairs(encodeURIComponent(key), value, pairs);
+	return pairs.join("&");
+}
+/**
+* Walk one value into `pairs`, carrying the key prefix built so far. The prefix
+* arrives ALREADY ENCODED, which is why the brackets this function adds survive
+* literally: `encodeURIComponent` would turn `[` into `%5B`, and while every
+* provider decodes that back, a percent-escaped key is unreadable in a log and
+* in a spec assertion for no gain.
+*/
+function appendPairs(key, value, pairs) {
+	if (value === null || value === void 0) return;
+	if (Array.isArray(value)) {
+		value.forEach((item, index) => appendPairs(`${key}[${index}]`, item, pairs));
+		return;
+	}
+	if (isNestable(value)) {
+		for (const [childKey, childValue] of Object.entries(value)) appendPairs(`${key}[${encodeURIComponent(childKey)}]`, childValue, pairs);
+		return;
+	}
+	pairs.push(`${key}=${encodeURIComponent(String(value))}`);
+}
+/**
+* Is this value a structure to walk into, or a leaf to stringify?
+*
+* Only a PLAIN object counts. A `Date`, a `Map`, a class instance — anything
+* with its own prototype — has no enumerable own entries worth speaking of, so
+* walking it would emit NOTHING and the field would vanish from the request with
+* no error anywhere. Stringifying it instead sends `[object Map]`, which the
+* provider rejects with a 400 naming the field. A loud rejection beats a field
+* that silently never arrived.
+*
+* In practice every body reaching here was parsed from JSON and is plain, so
+* this branch is a guard against the day something else does.
+*/
+function isNestable(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+var init_form_encoding = __esmMin((() => {}));
+//#endregion
 //#region ../../libs/runtime/connect-broker/src/lib/executor/provider-error-classes.ts
 /**
 * Classify one failed provider response, or answer `null` for anything the
@@ -36711,25 +38095,50 @@ function brokerCodeForProviderStatus(status) {
 	}
 }
 /**
-* Build the JSON request body for an OpenAPI operation. When the operation
-* names a Swagger body argument containing an object, send that object directly.
+* Build the request body for an OpenAPI operation. When the operation names a
+* Swagger body argument containing an object, send that object directly.
 * Otherwise, every payload key that is NOT a declared path/query/
 * header param becomes the body. Sets `content-type` when a body is produced.
 * Returns `undefined` for body-less operations (e.g. GET).
+*
+* JSON unless the operation declares `bodyEncoding: 'form'` — see
+* {@link serialiseRequestBody}. Both exits go through it, because a provider
+* that only speaks form-encoding speaks it on every endpoint and a Swagger
+* named body is not the exception.
+*
+* Exported for the specs: the encoding is a property of THIS function — which
+* bytes go out with which `content-type` — and asserting it here is a direct
+* reading rather than an inference from what a `fetch` stub was handed.
 */
 function buildRequestBody(operation, args, headers) {
 	if (operation.requestBodySchema === void 0) return void 0;
 	const namedBody = operation.bodyArgName === void 0 ? void 0 : args[operation.bodyArgName];
-	if (namedBody !== null && typeof namedBody === "object") {
-		headers["content-type"] = "application/json";
-		return JSON.stringify(namedBody);
-	}
+	if (namedBody !== null && typeof namedBody === "object") return serialiseRequestBody(operation, namedBody, headers);
 	const consumed = /* @__PURE__ */ new Set();
 	for (const param of operation.parameters ?? []) if (param.in === "path" || param.in === "query" || param.in === "header") consumed.add(param.name);
 	for (const arg of brokerConsumedArgs(operation)) consumed.add(arg.name);
 	const body = {};
 	for (const [key, value] of Object.entries(args)) if (!consumed.has(key)) body[key] = value;
 	if (Object.keys(body).length === 0) return void 0;
+	return serialiseRequestBody(operation, body, headers);
+}
+/**
+* Serialise one already-assembled body, and set the `content-type` it goes out
+* with. The two travel together on purpose: a form body sent under
+* `application/json` is a provider parsing `amount=2000` as malformed JSON, and
+* a JSON body under the form header is a provider reading `{"amount":2000}` as
+* ONE field whose name is that whole string — it answers 200 and stores
+* nonsense. Neither failure is readable from the operator's side, so the header
+* is never set anywhere but here.
+*
+* `bodyEncoding` is the operation's own declaration (`x-stackbone-body-encoding`
+* in the document); absent, this is the JSON path exactly as it has always been.
+*/
+function serialiseRequestBody(operation, body, headers) {
+	if (operation.bodyEncoding === "form") {
+		headers["content-type"] = "application/x-www-form-urlencoded";
+		return encodeFormBody(body);
+	}
 	headers["content-type"] = "application/json";
 	return JSON.stringify(body);
 }
@@ -36955,6 +38364,7 @@ var init_connect_action_executor = __esmMin((() => {
 	init_connection_fence();
 	init_delete_guard();
 	init_body_error();
+	init_form_encoding();
 	init_provider_error_classes();
 	init_spec_request();
 	init_operation_continuation();
@@ -51808,8 +53218,27 @@ var CONNECT_DDL = `
 * Ensure the connect tables exist in the emulator Postgres. Idempotent. Exported
 * so the workspace-server can run it once at boot (and the spec can run it before
 * exercising the routes) instead of paying the DDL on every request.
-*/
-var ensureConnectTables = async (connectionString) => {
+*
+* A NO-OP WHEN THE CONTROL PLANE OWNS THE SCHEMA (PLA-1286). In the self-host
+* topology the box and the control plane share ONE Postgres, and both declare
+* `connection_grant`: db-core's `0008_connect.sql` with a bare `CREATE TABLE`,
+* this module with `CREATE TABLE IF NOT EXISTS`. Only one of the two survives
+* arriving second — the migration dies on `relation already exists`, the control
+* plane restarts, and the self-host smoke reports it as a health-check timeout.
+*
+* The DDL here runs LAZILY, on the first request that builds the broker context,
+* so which of the two lands first is a coin flip decided by traffic. Probing the
+* database for a control plane cannot settle it: the box answers healthy seconds
+* before the control plane has written anything at all, so the probe would come
+* back empty and create the table anyway. So the topology DECLARES the owner
+* instead of the box guessing it, and a declared owner is the same answer on
+* every boot.
+*
+* `stackbone dev` and BYOC set nothing, have no control plane on their database,
+* and keep creating their own tables exactly as before.
+*/
+var ensureConnectTables = async (connectionString, opts = {}) => {
+	if ((opts.schemaOwner ?? process.env["STACKBONE_PLATFORM_SCHEMA_OWNER"]) === "control-plane") return;
 	const client = new Client({ connectionString });
 	await client.connect();
 	try {
@@ -51879,47 +53308,53 @@ var deriveBase64Key = (raw) => createHash("sha256").update(raw).digest().toStrin
 var makeContextFactory = (opts) => {
 	let cached;
 	const get = () => {
-		if (!cached) cached = (async () => {
-			await ensureConnectTables(opts.connectionString);
-			const cipher = await createSecretCipher(deriveBase64Key(opts.encryptionKey ?? DEV_CONNECT_ENCRYPTION_KEY));
-			const sql = postgres(opts.connectionString, {
-				max: 4,
-				onnotice: () => void 0
-			});
-			const db = drizzle(sql);
-			const store = new DrizzleBrokerStore(db, cipher);
-			const cache = createInMemoryTokenCache();
-			const specCache = createBoxSpecCache(opts.redisUrl);
-			const bindings = createInMemoryBindingStore();
-			const exchanger = new DefaultOAuthExchanger();
-			const brokerCallbackBaseUrl = opts.brokerCallbackBaseUrl ?? "http://127.0.0.1:4242/api/connect/callback";
-			const service = new ConnectService({
-				store,
-				exchanger,
-				cache,
-				bindings,
-				oauth: {
-					brokerCallbackUrl: brokerCallbackBaseUrl,
-					stateSecret: deriveBase64Key(opts.encryptionKey ?? DEV_CONNECT_ENCRYPTION_KEY)
-				}
+		if (!cached) {
+			const building = (async () => {
+				await ensureConnectTables(opts.connectionString);
+				const cipher = await createSecretCipher(deriveBase64Key(opts.encryptionKey ?? DEV_CONNECT_ENCRYPTION_KEY));
+				const sql = postgres(opts.connectionString, {
+					max: 4,
+					onnotice: () => void 0
+				});
+				const db = drizzle(sql);
+				const store = new DrizzleBrokerStore(db, cipher);
+				const cache = createInMemoryTokenCache();
+				const specCache = createBoxSpecCache(opts.redisUrl);
+				const bindings = createInMemoryBindingStore();
+				const exchanger = new DefaultOAuthExchanger();
+				const brokerCallbackBaseUrl = opts.brokerCallbackBaseUrl ?? "http://127.0.0.1:4242/api/connect/callback";
+				const service = new ConnectService({
+					store,
+					exchanger,
+					cache,
+					bindings,
+					oauth: {
+						brokerCallbackUrl: brokerCallbackBaseUrl,
+						stateSecret: deriveBase64Key(opts.encryptionKey ?? DEV_CONNECT_ENCRYPTION_KEY)
+					}
+				});
+				return {
+					db,
+					audit: opts.audit,
+					sql,
+					cipher,
+					store,
+					service,
+					bindings,
+					exchanger,
+					specCache: specCache.cache,
+					brokerCallbackBaseUrl,
+					async close() {
+						await sql.end({ timeout: 5 }).catch(() => void 0);
+						await specCache.close();
+					}
+				};
+			})();
+			cached = building;
+			building.catch(() => {
+				if (cached === building) cached = void 0;
 			});
-			return {
-				db,
-				audit: opts.audit,
-				sql,
-				cipher,
-				store,
-				service,
-				bindings,
-				exchanger,
-				specCache: specCache.cache,
-				brokerCallbackBaseUrl,
-				async close() {
-					await sql.end({ timeout: 5 }).catch(() => void 0);
-					await specCache.close();
-				}
-			};
-		})();
+		}
 		return cached;
 	};
 	const close = async () => {
@@ -52144,14 +53579,13 @@ var init_trigger_strategies = __esmMin((() => {
 }));
 //#endregion
 //#region ../../libs/runtime/workspace-runtime/src/lib/connect-inbound/timestamp-poll-cursor.ts
-var epoch, createTimestampPoll;
+var readStamp, createTimestampPoll;
 var init_timestamp_poll_cursor = __esmMin((() => {
 	init_src$4();
-	epoch = (value) => {
-		if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})$/i.test(value)) throw new Error("Invalid timestamp cursor: expected an ISO date stamp");
-		const parsed = Date.parse(value);
-		if (!Number.isFinite(parsed)) throw new Error("Invalid timestamp cursor: unreadable date stamp");
-		return parsed;
+	readStamp = (value, unit) => {
+		const stamp = parseStamp(value, unit);
+		if (stamp === null) throw new Error(unit === void 0 ? "Invalid timestamp cursor: expected an ISO date stamp" : `Invalid timestamp cursor: expected a stamp in ${unit}`);
+		return stamp;
 	};
 	createTimestampPoll = (spec) => {
 		const rawPoll = createDeclarativePoll(spec);
@@ -52161,8 +53595,10 @@ var init_timestamp_poll_cursor = __esmMin((() => {
 			if (cursor === null || typeof cursor !== "object" || !("kind" in cursor)) return rawPoll(ctx, cursor);
 			if (cursor.kind !== "timestamp-v1") throw new Error("Invalid timestamp cursor: unknown version");
 			const stored = cursor;
-			const valueEpoch = epoch(stored.value);
-			const floorEpoch = epoch(stored.floor);
+			const unit = cursorSpec.unit;
+			const value = readStamp(stored.value, unit);
+			const valueEpoch = value.epochMs;
+			const floorEpoch = readStamp(stored.floor, unit).epochMs;
 			if (valueEpoch < floorEpoch) throw new Error("Invalid timestamp cursor: value precedes arming floor");
 			const lookbackMs = Math.min(cursorSpec.lookbackMs ?? 0, valueEpoch - floorEpoch);
 			const result = await createDeclarativePoll({
@@ -52171,8 +53607,8 @@ var init_timestamp_poll_cursor = __esmMin((() => {
 					...cursorSpec,
 					lookbackMs
 				}
-			})(ctx, new Date(valueEpoch).toISOString());
-			const next = epoch(result.nextCursor) > valueEpoch ? result.nextCursor : stored.value;
+			})(ctx, unit === void 0 ? new Date(valueEpoch).toISOString() : formatStamp(valueEpoch, value.shape));
+			const next = readStamp(result.nextCursor, unit).epochMs > valueEpoch ? result.nextCursor : stored.value;
 			return {
 				...result,
 				nextCursor: {
@@ -52335,7 +53771,11 @@ var init_trigger_capability = __esmMin((() => {
 		if (!descriptor || descriptor.poll.kind !== "declarative") return null;
 		if (descriptor.poll.cursor.kind !== "timestamp") return null;
 		if (SCOPE_TEMPLATE.test(descriptor.poll.list.operationId)) return null;
-		const value = armedAt.toISOString();
+		const unit = descriptor.poll.cursor.unit;
+		const value = unit === void 0 ? armedAt.toISOString() : formatStamp(armedAt.getTime(), {
+			unit,
+			numeric: true
+		});
 		return descriptor.poll.cursor.lookbackMs === void 0 ? value : {
 			kind: "timestamp-v1",
 			value,
@@ -65943,6 +67383,7 @@ var init_load_project_runtime = __esmMin((() => {
 		let setActiveStepReader;
 		let approvalRequest;
 		let setConnectorInvoker;
+		let setEchoGuardReader;
 		let connectorInvoker;
 		let setActionInvoker;
 		let actionInvoker;
@@ -65958,6 +67399,7 @@ var init_load_project_runtime = __esmMin((() => {
 			setApprovalRecorder = sdk.setApprovalRecorder;
 			setActiveStepReader = sdk.setActiveStepReader;
 			setConnectorInvoker = sdk.setConnectorInvoker;
+			setEchoGuardReader = sdk.setEchoGuardReader;
 			connectorInvoker = sdk.createConnectInvoker?.();
 			setActionInvoker = sdk.setActionInvoker;
 			actionInvoker = sdk.createActionInvoker?.();
@@ -66015,6 +67457,7 @@ var init_load_project_runtime = __esmMin((() => {
 			setActiveStepReader,
 			approvalRequest,
 			setConnectorInvoker,
+			setEchoGuardReader,
 			connectorInvoker,
 			setActionInvoker,
 			actionInvoker,
@@ -66679,11 +68122,49 @@ var init_runtime_approval_plants = __esmMin((() => {
 }));
 //#endregion
 //#region ../../libs/runtime/workspace-runtime/src/lib/workflow/runtime-connector-plants.ts
-var plantConnectorInvoker, plantActionInvoker;
+var owningWorkflow, echoOwner, unresolvedEcho, resolveEcho, echoRecordError, plantConnectorInvoker, plantActionInvoker, ECHO_WINDOW_MS, renderEcho, echoGuardUnavailable, plantEchoGuard;
 var init_runtime_connector_plants = __esmMin((() => {
+	init_src$4();
+	init_src$13();
 	init_call_ordinal();
 	init_monotonic_span();
 	init_project_runtime();
+	owningWorkflow = () => {
+		const owner = getExecutionOwner();
+		return owner?.kind === "workflow" ? owner.name : void 0;
+	};
+	echoOwner = () => {
+		const workflowName = owningWorkflow();
+		return workflowName !== void 0 ? { workflowName } : {};
+	};
+	unresolvedEcho = (echoPath) => ({
+		echoPath,
+		echo: null,
+		echoUnresolved: true,
+		...echoOwner()
+	});
+	resolveEcho = (echoPath, output, label) => {
+		const owner = echoOwner();
+		const echo = getPath(output, echoPath);
+		if (echo !== void 0 && echo !== null && echo !== "") return {
+			echoPath,
+			echo,
+			...owner
+		};
+		console.warn(`[connector] ${label}: echoPath "${echoPath}" resolved to nothing (missing, null or empty) in the response, so the run step records no echo value and the self-write guard cannot answer for this call`);
+		return {
+			echoPath,
+			echo: null,
+			echoUnresolved: true,
+			...owner
+		};
+	};
+	echoRecordError = (label, cause) => {
+		const error = /* @__PURE__ */ new Error(`[connector] ${label}: the provider call succeeded but its echo record could not be written (${cause instanceof Error ? cause.message : String(cause)}), so nothing can recognise this write when the trigger delivers it back. The step stops here.`);
+		error.code = "echo_record_failed";
+		error.fatal = true;
+		return error;
+	};
 	plantConnectorInvoker = (rt, ctx) => {
 		if (!rt.setConnectorInvoker || !rt.connectorInvoker) return;
 		const baseInvoker = rt.connectorInvoker;
@@ -66697,14 +68178,15 @@ var init_runtime_connector_plants = __esmMin((() => {
 				const span = startSpan();
 				const ordinal = stepInfo ? nextConnOrdinal(runId ?? "", stepInfo.stepId, stepInfo.attempt) : 0;
 				const externalStepId = stepInfo ? `${stepInfo.stepId}::conn::${ordinal}` : randomUUID();
-				const record = (status, extra) => {
-					if (!runId) return;
+				const label = `${args.connector}/${args.operation}`;
+				const writeRow = (status, extra, echo) => {
+					if (!runId) return void 0;
 					const { completedAt, durationMs } = closeSpan(span);
-					recordActivityStep({
+					return recordActivityStep({
 						runId,
 						externalStepId,
 						type: "connection",
-						name: `${args.connector}/${args.operation}`,
+						name: label,
 						status,
 						startedAt: span.startedAt.toISOString(),
 						completedAt: completedAt.toISOString(),
@@ -66712,26 +68194,52 @@ var init_runtime_connector_plants = __esmMin((() => {
 						input: {
 							connector: args.connector,
 							operation: args.operation,
-							args: args.args
+							args: args.args,
+							...echo ?? {}
 						},
 						...extra,
 						enclosingExternalStepId: stepInfo?.stepId ?? null
-					}).catch((err) => {
+					});
+				};
+				const forget = (write) => {
+					write?.catch((err) => {
 						console.warn(`[connector] run-step write failed for run ${runId}: ${err instanceof Error ? err.message : String(err)}`);
 					});
 				};
+				let result;
 				try {
-					const result = await baseInvoker.invoke(args);
-					record("completed", { output: result.output });
-					return result;
+					result = await baseInvoker.invoke(args);
 				} catch (err) {
 					const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
-					record("failed", { error: {
+					const echo = typeof args.echoPath === "string" ? unresolvedEcho(args.echoPath) : void 0;
+					if (echo) console.warn(`[connector] ${label}: the call failed after naming an echoPath, so it may have landed with nothing recorded — the run step keeps an unresolved marker and the self-write guard will refuse rather than answer for this connector`);
+					const write = writeRow("failed", { error: {
 						message: err instanceof Error ? err.message : String(err),
 						...typeof code === "string" ? { code } : {}
-					} });
+					} }, echo);
+					if (echo) await write?.catch((cause) => {
+						console.warn(`[connector] ${label}: could not record the unresolved echo marker: ${cause instanceof Error ? cause.message : String(cause)}`);
+					});
+					else forget(write);
 					throw err;
 				}
+				if (typeof args.echoPath !== "string") {
+					forget(writeRow("completed", { output: result.output }));
+					return result;
+				}
+				const echo = resolveEcho(args.echoPath, result.output, label);
+				const write = writeRow("completed", { output: result.output }, echo);
+				if (write === void 0) console.warn(`[connector] ${label}: this call named an echoPath but runs with no invocation context, so no run step records its echo and the self-write guard cannot recognise the delivery this write causes`);
+				if (write !== void 0) {
+					let rowId;
+					try {
+						rowId = await write;
+					} catch (cause) {
+						throw echoRecordError(label, cause);
+					}
+					if (rowId === null) throw echoRecordError(label, /* @__PURE__ */ new Error(`the store wrote no row for run ${runId}`));
+				}
+				return result;
 			} });
 		} else rt.setConnectorInvoker(baseInvoker);
 	};
@@ -66795,6 +68303,34 @@ var init_runtime_connector_plants = __esmMin((() => {
 			}
 		} });
 	};
+	ECHO_WINDOW_MS = 3600 * 1e3;
+	renderEcho = (value) => String(value);
+	echoGuardUnavailable = (connector, workflowName) => {
+		const scope = workflowName ? `this workflow ("${workflowName}"), or a caller with no workflow owner,` : "some caller on this connector";
+		const error = /* @__PURE__ */ new Error(`isOwnEcho("${connector}"): a write by ${scope} inside the last hour named an echoPath that resolved to nothing, so the value it produced was never recorded. The guard cannot tell your own write from somebody else's change. Find the echoPath that resolved to nothing — the runtime warned which one when it wrote the row.`);
+		error.code = "echo_guard_unavailable";
+		return error;
+	};
+	plantEchoGuard = (rt, ctx) => {
+		if (!rt.setEchoGuardReader) return;
+		const findEchoRecord = ctx.invocations?.findEchoRecord?.bind(ctx.invocations);
+		if (!findEchoRecord) {
+			rt.setEchoGuardReader(void 0);
+			return;
+		}
+		rt.setEchoGuardReader({ isOwnEcho: async ({ connector, value }) => {
+			const workflowName = owningWorkflow();
+			const { matched, unresolved } = await findEchoRecord({
+				connector,
+				value: renderEcho(value),
+				workflowName: workflowName ?? null,
+				windowMs: ECHO_WINDOW_MS
+			});
+			if (matched) return true;
+			if (unresolved) throw echoGuardUnavailable(connector, workflowName);
+			return false;
+		} });
+	};
 }));
 //#endregion
 //#region ../../libs/runtime/workspace-runtime/src/lib/workflow/runtime-sdk-plants.ts
@@ -66858,6 +68394,7 @@ var init_runtime_sdk_plants = __esmMin((() => {
 		plantPromptUseReporter(rt, ctx);
 		plantApprovalRecorder(rt, ctx);
 		plantConnectorInvoker(rt, ctx);
+		plantEchoGuard(rt, ctx);
 		plantActionInvoker(rt, ctx);
 		return rt;
 	};
@@ -66884,6 +68421,7 @@ var init_runtime_loader = __esmMin((() => {
 			rt.setPromptUseReporter?.(void 0);
 			rt.setApprovalRecorder?.(void 0);
 			rt.setConnectorInvoker?.(void 0);
+			rt.setEchoGuardReader?.(void 0);
 			rt.setActionInvoker?.(void 0);
 			rt.setActiveStepReader?.(void 0);
 			planted = void 0;
@@ -67265,7 +68803,8 @@ var init_workflow_http_schemas = __esmMin((() => {
 			displayName: z.string().optional(),
 			description: z.string().optional(),
 			example: z.string().optional(),
-			required: z.boolean()
+			required: z.boolean(),
+			suggestions: z.array(z.string()).optional().openapi({ example: ["charge.succeeded", "charge.*"] })
 		})).openapi({ description: "The per-subscription values this trigger needs, declared by the connector. The register dialog renders a field each and the register call must carry every required one. Empty when the credential is the trigger's whole scope." }),
 		cursorColumn: z.object({ default: z.string() }).nullable().openapi({
 			description: "Present when the poll cursor advances on a column the subscription chooses; `default` pre-fills the field.",
@@ -71117,7 +72656,7 @@ var toWorkflowExport = (name) => `${toCamelCase(name)}Workflow`;
 var index_ts_default = "import { tool } from \"@langchain/core/tools\";\nimport { z } from \"zod\";\nimport { defineDeepAgent } from \"@stackbone/sdk/deep\";\n\n// A deep agent is a single file: a name, a model, and optional tools /\n// sub-agents. `stackbone dev` discovers it by its folder\n// (`deep-agents/{{name}}/`), builds the LangGraph graph in-process (no server,\n// no port), and serves it over the standard OpenAI + Anthropic chat wire — point\n// any client at the emulator and select this agent with `\"model\": \"{{name}}\"`.\n\n// ITS INSTRUCTION IS NOT IN THIS FILE. Write it in Studio, under the prompt\n// named `{{name}}` (the agent's name is its default prompt key). Until you do,\n// the agent runs with an empty instruction — it answers, it just has no persona\n// yet. To put values into the text, declare them here and reference them in the\n// prompt with the double-brace syntax:\n//\n//   instructions: { key: \"{{name}}\", variables: { tone: \"friendly\" } },\n\n// A tiny example tool. Delete it (and the `tools` field below) if your agent\n// needs none, or add more — each is a plain LangChain `tool(...)`.\nconst addNumbers = tool(\n  async ({ a, b }: { a: number; b: number }) => String(a + b),\n  {\n    name: \"add_numbers\",\n    description: \"Add two integers and return the sum.\",\n    schema: z.object({ a: z.number().int(), b: z.number().int() }),\n  },\n);\n\nexport default defineDeepAgent({\n  // Must match the folder name: it is who this agent's prompts belong to.\n  name: \"{{name}}\",\n  model: \"openai/gpt-4o-mini\",\n  tools: [addNumbers],\n});\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/AGENTS.md.tmpl?raw
-var AGENTS_md_default = "# Agent instructions\n\nThis project is the **{{name}}** Stackbone workspace — a multi-agent project. It\nholds one or more in-process deep agents plus the durable workflows that\norchestrate them:\n\n- `deep-agents/<name>/` — one deep agent per folder (discovered by its `index.ts`).\n  Its code is `deep-agents/<name>/index.ts`, which `export default defineDeepAgent({\n  name, model, tools })`. Its INSTRUCTION is not in the code: it is written in\n  Studio, under the prompt keyed by the agent's name, so changing the wording is an\n  edit rather than a deploy. A deep agent is a plain JS module: no server, no port,\n  no HTTP code — the emulator builds its LangGraph graph in-process and serves it\n  over the standard OpenAI + Anthropic chat wire.\n- `workflows/<name>.workflow.ts` — one durable Workflow SDK workflow per file:\n  a plain async function tagged `\"use workflow\"`, with each `\"use step\"` a\n  durable checkpoint, and its contract declared as sibling `inputSchema` /\n  `outputSchema` exports.\n\n`stackbone dev` discovers every deep agent and workflow by convention — there is no\nregistry file to hand-edit.\n\n## Always use the Stackbone skills\n\n`stackbone init` / `stackbone link` install four skills into this workspace for\nevery coding agent you picked (Claude Code, Cursor, Windsurf, Codex, Cline, …), and\nadd the `stackbone-docs` MCP server to that agent's configuration.\n**Use them — do not improvise from memory.** The skills tell you how to work here:\nthe shapes, the order of operations, the rules. The SDK surface, the CLI flags and\nthe error catalog are read from the docs MCP server (`search_docs`, `get_doc`); each\nskill names the page to read before you touch a surface.\n\n| Skill             | Use it when…                                                                                                                                                                        |\n| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `stackbone`       | **Editing agent or workflow code.** Writing a `defineDeepAgent`, a `*.workflow.ts`, DB CRUD, storage uploads, LLM calls, RAG, queues, HITL, secrets, or prompts.                     |\n| `stackbone-cli`   | **Running or shipping the workspace.** Scaffolding (`init` / `add` / `link`), the local emulator (`dev`), compiling the deployable bundle (`build`), DB migrations (`db migrate`), reading metadata. |\n| `stackbone-debug` | **Triaging a failure.** An error, a 4xx/5xx, a stuck or timed-out run, a HITL run waiting on approval, a failed deploy, or a quota/billing response. Locate the cause, then fix it.  |\n| `stackbone-coder` | **Starting a new piece, feature…** — interviews, then scaffolds it by description.                                                                                                  |\n\n## Grow the workspace\n\n```sh\nstackbone add agent <name>            # add a deep agent (alias of add deep-agent)\nstackbone add workflow <name>         # add a durable workflow\nstackbone add workflow-agent <name>   # add a deep agent + a workflow wired to call it\n```\n\n## Edit a deep agent\n\n- The agent lives in `deep-agents/<name>/index.ts` as `defineDeepAgent({ name,\n  model, tools })` from `@stackbone/sdk/deep`. Its tools are plain LangChain\n  `tool(...)` values.\n- Its behaviour and tone are its PROMPT, written in Studio and keyed by the agent's\n  name. Write text there, never in the code. Pass values into it with\n  `instructions: { variables: { ... } }`, and point it at another key with\n  `instructions: { key: \"...\" }`. An agent whose prompt is still empty runs and\n  answers — it just has no persona yet.\n- Pick the model with a bare id string (resolved through the deployment's **model\n  provider**, i.e. whatever OpenAI-compatible endpoint it is pointed at) — e.g.\n  `model: \"openai/gpt-4o-mini\"` — or pass a built LangChain model instance.\n- Follow the `stackbone` skill for every `client.*` / `stackbone.*` surface.\n\n## Edit a workflow\n\nA workflow is a bare async function — no class, no decorators:\n\n```ts\nexport const inputSchema = z.object({ message: z.string() });\nexport const outputSchema = z.object({ reply: z.string() });\n\nexport async function myWorkflow(input) {\n  \"use workflow\";\n  const reply = await askAgent(input.message); // a durable step\n  return { reply };\n}\n```\n\nThe `inputSchema` / `outputSchema` exports next to the function ARE the contract.\nTag each durable checkpoint with `\"use step\"`.\n\n## Reaching a deep agent or a connector\n\n- To call a deep agent from a workflow step, use `callDeepAgent` from\n  `@stackbone/sdk/workflow` inside a `\"use step\"` — it runs the agent IN-PROCESS\n  (no HTTP, no HMAC):\n\n  ```ts\n  import { callDeepAgent } from '@stackbone/sdk/workflow';\n\n  async function askAgent(message: string) {\n    \"use step\";\n    const { text } = await callDeepAgent('support', message);\n    return text;\n  }\n  ```\n\n- To call a connector directly (typed when its types are generated), use the\n  ambient handle:\n\n  ```ts\n  import { stackbone } from '@stackbone/sdk';\n  await stackbone.connection('stub-mail').sendMail({ to, subject, body });\n  ```\n\n## Run it locally\n\n```sh\npnpm install\nstackbone dev          # runs the workspace against a local World + Studio\n```\n\n**The first run stops for setup.** With no model provider configured, `stackbone\ndev` brings up the local stack and then holds the workflows and agents back,\nprinting a Studio link to finish setup in the browser. Saving there starts the\nworkspace in place, with no restart. To skip that step entirely, export the\nendpoint before booting:\n\n```sh\nexport MODEL_PROVIDER_BASE_URL=https://openrouter.ai/api/v1\nexport MODEL_PROVIDER_API_KEY=sk-...   # omit for a keyless local gateway\n```\n\nUse the `stackbone-cli` skill for the emulator, migrations, and building the\nbundle you deploy, and the `stackbone-debug` skill the moment something fails.\n\nThe full SDK and CLI reference lives at https://docs.stackbone.ai, and is\nserved over MCP at https://docs.stackbone.ai/mcp so you can search it from\nhere. Run `stackbone docs` for the connection details.\n";
+var AGENTS_md_default = "# Agent instructions\n\nThis project is the **{{name}}** Stackbone workspace — a multi-agent project. It\nholds one or more in-process deep agents plus the durable workflows that\norchestrate them:\n\n- `deep-agents/<name>/` — one deep agent per folder (discovered by its `index.ts`).\n  Its code is `deep-agents/<name>/index.ts`, which `export default defineDeepAgent({\n  name, model, tools })`. Its INSTRUCTION is not in the code: it is written in\n  Studio, under the prompt keyed by the agent's name, so changing the wording is an\n  edit rather than a deploy. A deep agent is a plain JS module: no server, no port,\n  no HTTP code — the emulator builds its LangGraph graph in-process and serves it\n  over the standard OpenAI + Anthropic chat wire.\n- `workflows/<name>.workflow.ts` — one durable Workflow SDK workflow per file:\n  a plain async function tagged `\"use workflow\"`, with each `\"use step\"` a\n  durable checkpoint, and its contract declared as sibling `inputSchema` /\n  `outputSchema` exports.\n\n`stackbone dev` discovers every deep agent and workflow by convention — there is no\nregistry file to hand-edit.\n\n## Always use the Stackbone skills\n\n`stackbone init` / `stackbone link` install seven skills into this workspace for\nevery coding agent you picked (Claude Code, Cursor, Windsurf, Codex, Cline, …), and\nadd the `stackbone-docs` MCP server to that agent's configuration.\n**Use them — do not improvise from memory.** The skills tell you how to work here:\nthe shapes, the order of operations, the rules. The SDK surface, the CLI flags and\nthe error catalog are read from the docs MCP server (`search_docs`, `get_doc`); each\nskill names the page to read before you touch a surface.\n\n| Skill             | Use it when…                                                                                                                                                                        |\n| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `stackbone`       | **Editing agent or workflow code.** Writing a `defineDeepAgent`, a `*.workflow.ts`, DB CRUD, storage uploads, LLM calls, RAG, queues, HITL, secrets, or prompts.                     |\n| `stackbone-cli`   | **Running or shipping the workspace.** Scaffolding (`init` / `add` / `link`), the local emulator (`dev`), compiling the deployable bundle (`build`), DB migrations (`db migrate`), reading metadata. |\n| `stackbone-debug` | **Triaging a failure.** An error, a 4xx/5xx, a stuck or timed-out run, a HITL run waiting on approval, a failed deploy, or a quota/billing response. Locate the cause, then fix it.  |\n| `stackbone-coder` | **Starting a new piece, feature…** — interviews, then scaffolds it by description.                                                                                                  |\n| `stackbone-evals` | **Measuring whether it works.** Turning a Playground exchange into an eval case, a case into a suite, a suite into a run, and comparing two variants of the same suite. |\n| `stackbone-guardrails` | **Putting limits on a running agent.** Blocking a turn, masking data on its way out, or holding it for a person. The rule is state on the box, so it needs no rebuild. |\n| `stackbone-integrations` | **Wiring the workspace to the outside.** Registering a connection, arming a trigger so a workflow starts on its own, and binding what a run outputs to a destination. |\n\n## Grow the workspace\n\n```sh\nstackbone add agent <name>            # add a deep agent (alias of add deep-agent)\nstackbone add workflow <name>         # add a durable workflow\nstackbone add workflow-agent <name>   # add a deep agent + a workflow wired to call it\n```\n\n## Edit a deep agent\n\n- The agent lives in `deep-agents/<name>/index.ts` as `defineDeepAgent({ name,\n  model, tools })` from `@stackbone/sdk/deep`. Its tools are plain LangChain\n  `tool(...)` values.\n- Its behaviour and tone are its PROMPT, written in Studio and keyed by the agent's\n  name. Write text there, never in the code. Pass values into it with\n  `instructions: { variables: { ... } }`, and point it at another key with\n  `instructions: { key: \"...\" }`. An agent whose prompt is still empty runs and\n  answers — it just has no persona yet.\n- Pick the model with a bare id string (resolved through the deployment's **model\n  provider**, i.e. whatever OpenAI-compatible endpoint it is pointed at) — e.g.\n  `model: \"openai/gpt-4o-mini\"` — or pass a built LangChain model instance.\n- Follow the `stackbone` skill for every `client.*` / `stackbone.*` surface.\n\n## Edit a workflow\n\nA workflow is a bare async function — no class, no decorators:\n\n```ts\nexport const inputSchema = z.object({ message: z.string() });\nexport const outputSchema = z.object({ reply: z.string() });\n\nexport async function myWorkflow(input) {\n  \"use workflow\";\n  const reply = await askAgent(input.message); // a durable step\n  return { reply };\n}\n```\n\nThe `inputSchema` / `outputSchema` exports next to the function ARE the contract.\nTag each durable checkpoint with `\"use step\"`.\n\n## Reaching a deep agent or a connector\n\n- To call a deep agent from a workflow step, use `callDeepAgent` from\n  `@stackbone/sdk/workflow` inside a `\"use step\"` — it runs the agent IN-PROCESS\n  (no HTTP, no HMAC):\n\n  ```ts\n  import { callDeepAgent } from '@stackbone/sdk/workflow';\n\n  async function askAgent(message: string) {\n    \"use step\";\n    const { text } = await callDeepAgent('support', message);\n    return text;\n  }\n  ```\n\n- To call a connector directly (typed when its types are generated), use the\n  ambient handle:\n\n  ```ts\n  import { stackbone } from '@stackbone/sdk';\n  await stackbone.connection('stub-mail').sendMail({ to, subject, body });\n  ```\n\n## Run it locally\n\n```sh\npnpm install\nstackbone dev          # runs the workspace against a local World + Studio\n```\n\n**The first run stops for setup.** With no model provider configured, `stackbone\ndev` brings up the local stack and then holds the workflows and agents back,\nprinting a Studio link to finish setup in the browser. Saving there starts the\nworkspace in place, with no restart. To skip that step entirely, export the\nendpoint before booting:\n\n```sh\nexport MODEL_PROVIDER_BASE_URL=https://openrouter.ai/api/v1\nexport MODEL_PROVIDER_API_KEY=sk-...   # omit for a keyless local gateway\n```\n\nUse the `stackbone-cli` skill for the emulator, migrations, and building the\nbundle you deploy, and the `stackbone-debug` skill the moment something fails.\n\nThe full SDK and CLI reference lives at https://docs.stackbone.ai, and is\nserved over MCP at https://docs.stackbone.ai/mcp so you can search it from\nhere. Run `stackbone docs` for the connection details.\n";
 //#endregion
 //#region src/services/scaffold/templates/shell/CLAUDE.md.tmpl?raw
 var CLAUDE_md_default = "# CLAUDE.md\n\nThis is the **{{name}}** Stackbone workspace. The full agent-development guidance\nlives in `AGENTS.md` — read it.\n\n@AGENTS.md\n\n## Claude Code note\n\nThe Stackbone skills (`stackbone`, `stackbone-cli`, `stackbone-debug`,\n`stackbone-coder`) are installed for Claude Code under `.claude/`, and the\n`stackbone-docs` MCP server is registered in `.mcp.json`. Invoke the skills\nthrough the Skill tool:\n\n- `stackbone` — write/edit deep agents (`deep-agents/<name>/index.ts`) and\n  workflows (`workflows/<name>.workflow.ts`).\n- `stackbone-cli` — run the emulator (`stackbone dev`), migrate the DB, compile\n  the deployable bundle (`stackbone build`).\n- `stackbone-debug` — triage any error or stuck run, then return to the skill\n  above to apply the fix.\n- `stackbone-coder` — start a new agent or workflow from a one-line idea.\n\nEach skill says how to find the docs page to read before you touch a surface\n(`list_docs`, then `get_doc`); read it instead of guessing a flag or a signature.\n";
@@ -71153,7 +72692,7 @@ var calls_workflow_ts_default = "import { z } from \"zod\";\nimport { streamDeep
 var plain_workflow_ts_default = "import { z } from \"zod\";\n\n/**\n * Workflow \"{{name}}\" — a durable pipeline.\n *\n * Each `\"use step\"` is a durable checkpoint: kill the runtime mid-run and it\n * resumes from the last completed step instead of replaying everything.\n */\n\n// THE contract — sibling exports next to the bare workflow function. The build\n// harvests these (by convention) into the manifest + a live validator. The\n// parameter type is DERIVED from `inputSchema` and the RETURN type from\n// `outputSchema` (both `z.infer`), so neither side can drift from the contract\n// the build harvests. Without the return annotation the schema is published to\n// Studio and the generated types and never compared to what the body returns\n// (PLA-1272).\nexport const inputSchema = z.object({\n  message: z.string().describe(\"The input to process\"),\n});\n\nexport const outputSchema = z.object({\n  message: z.string(),\n  processed: z.boolean(),\n});\n\ntype {{Name}}Input = z.infer<typeof inputSchema>;\n\nexport async function {{export}}(input: {{Name}}Input): Promise<z.infer<typeof outputSchema>> {\n  \"use workflow\";\n\n  const result = await processMessage(input); // step 1 — durable checkpoint\n  return result;\n}\n\nasync function processMessage(input: {{Name}}Input) {\n  \"use step\";\n  // Replace this with the deterministic work of your step (DB write, HTTP call,\n  // an LLM call, …). Returning a value records it as the step's checkpoint.\n  return { message: input.message, processed: true };\n}\n";
 //#endregion
 //#region src/services/scaffold/template-loader.ts
-var SDK_TEMPLATE_VERSION = "0.4.1";
+var SDK_TEMPLATE_VERSION = "0.6.0";
 var PREFIX = "./templates/";
 var templates = new Map(Object.entries(/* @__PURE__ */ Object.assign({
 	"./templates/deep-agents/index.ts.tmpl": index_ts_default,
@@ -75125,7 +76664,7 @@ var REDIS_IMAGE$1 = "redis:7-alpine";
 * Same image and pin as `stackbone dev`'s compose, so the emulator and the
 * deliverable run the identical backend.
 */
-var MINIO_IMAGE$1 = "minio/minio:RELEASE.2025-03-12T18-04-18Z";
+var MINIO_IMAGE$1 = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
 /** Access key the bundled MinIO is created with. The secret is generated per package. */
 var MINIO_ACCESS_KEY = "stackbone";
 /** Bucket the init container creates, and the agent's `STACKBONE_S3_BUCKET`. */
@@ -76178,6 +77717,15 @@ ${objectStore}
       # MinIO addresses buckets by path. A managed bucket that only answers to the
       # bucket-as-subdomain form (AWS S3, Railway Buckets) needs this set to false.
       STACKBONE_S3_FORCE_PATH_STYLE: \${STACKBONE_S3_FORCE_PATH_STYLE:-true}
+      # PLA-1286 — WHO OWNS THE PLATFORM SCHEMA IN THE DATABASE BELOW. This is the
+      # only topology where the agent and the control plane share one Postgres,
+      # and both of them declare \`connection_grant\`: the control plane through
+      # its db-core migrations, the agent through its own boot DDL. The control
+      # plane's statement is a bare CREATE TABLE and dies if the table is already
+      # there, so the agent stands down here and lets the migrations create them.
+      # Not overridable from .env on purpose: it is a fact about this compose file,
+      # not a preference, and a box that shares no database never sees this line.
+      STACKBONE_PLATFORM_SCHEMA_OWNER: control-plane
 ${sharedIdentity}
       # REPLACES the agent's built-in origin allowlist — it does not add to it. The
       # dashboard is a different ORIGIN from the agent (different port), so its
@@ -78485,7 +80033,7 @@ var readStackboneConfig = async (cwd) => readJsonFile(stackboneConfigPath(cwd),
 //#region src/dev/compose-template.ts
 var POSTGRES_IMAGE = "pgvector/pgvector:pg17";
 var REDIS_IMAGE = "redis:7-alpine";
-var MINIO_IMAGE = "minio/minio:RELEASE.2025-03-12T18-04-18Z";
+var MINIO_IMAGE = "quay.io/minio/minio:RELEASE.2025-03-12T18-04-18Z";
 var PGVECTOR_INIT_SQL = `-- Generated by stackbone dev. Runs once on Postgres first boot via
 -- /docker-entrypoint-initdb.d. The queue extension is gone (BullMQ over Redis
 -- is the only job engine); only pgvector is enabled here.
@@ -79028,7 +80576,9 @@ function renderOperation(op) {
 * time (`call-connector.ts`), and no generated signature declared it — so
 * `idempotent` was reachable only through the untyped `.call(...)`, which is not
 * the path a creator is steered to. Typed as the whole options object rather than
-* one field, because PLA-1351's `echoPath` lands in exactly the same place.
+* one field, which is what carried PLA-1351's `echoPath` in with no change here:
+* the option landed on `CallConnectorOptions` and every generated signature already
+* accepted it.
 *
 * It is ALWAYS second, and `renderParam` is what guarantees that: an operation
 * with nothing to put in `args` still prints `args?: undefined` ahead of this. The
@@ -84151,6 +85701,7 @@ var assertBoxCanBeRegistered = (contract) => {
 };
 //#endregion
 //#region src/commands/link/link.command.ts
+init_src$19();
 var requireLinkField = (value, flag, description) => {
 	const trimmed = (value ?? "").trim();
 	if (trimmed.length === 0) throw new StackboneCliError({
@@ -84161,6 +85712,27 @@ var requireLinkField = (value, flag, description) => {
 	return trimmed;
 };
 /**
+* PLA-1583 — `link` refuses a plain `http://` box before it touches anything.
+*
+* The rule itself comes from `deploymentUrlSchema`, the very schema the control
+* plane validates the request body with, imported rather than restated: a rule
+* written twice is a rule the CLI and the API drift apart on, and the CLI is
+* the caller that used to pass `--url` straight through while only the browser
+* wizard refused one. What this adds is WHERE the refusal lands — here, before
+* the handshake dials the box, instead of as a 400 after the operator has
+* already watched `link` talk to it.
+*/
+var requireEncryptedUrl = (url) => {
+	const checked = deploymentUrlSchema.safeParse(url);
+	if (checked.success) return;
+	const refusedScheme = checked.error.issues.find((issue) => issue.code === "custom");
+	throw new StackboneCliError({
+		code: "generic",
+		message: `\`--url ${url}\` cannot be registered: ${refusedScheme?.message ?? checked.error.issues[0]?.message ?? "it is not an https:// address"}`,
+		suggestion: refusedScheme ? "Terminate TLS at your own proxy and pass its https:// address. Callbacks from the control plane and calls from the browser reach the box over this URL; the HMAC secret signs them, it does not encrypt them." : "Pass the full address, scheme and host, like https://box.example.com — a bare host is not enough to know where to call."
+	});
+};
+/**
 * STA-440 — what `link` tells the operator about the box's browser-identity gate.
 * `null` when the box verifies identity: there is nothing to say. The other two
 * read differently on purpose — a box that reports it is not verifying is a
@@ -84263,6 +85835,7 @@ var runLink = async (ctx, args) => {
 		colors: true
 	}));
 	const url = requireLinkField(args.url, "url", "the public URL of the deployed agent");
+	requireEncryptedUrl(url);
 	const secret = requireLinkField(args.secret, "secret", "the HMAC secret the deployed agent authenticates its callbacks with");
 	const tag = requireLinkField(args.tag, "tag", "the tag of the deep-agents image you deployed");
 	const agentsArg = readAgentsArg(args.agents);