@zackbart/connecta 0.34.1 → 0.35.0

package/dist/providers/stripe/{value-safety.js → safety.js}

@@ -1,7 +1,7 @@
 // Stripe's reviewed value-safety table (#801), on the shared mechanism in
 // `../_shared/rest/value-safety.ts`: every operation the detector flags in the
-// pinned spec (`value-safety.candidates.json`) has one verdict here, and
-// `value-safety.node.test.ts` runs the shared harness over it.
+// pinned spec (`evidence/value-safety.json`) has one verdict here, and
+// `provider.safety.node.test.ts` runs the shared harness over it.
 //
 // Stripe repeats one object graph across hundreds of operations (a
 // PaymentIntent is embedded in charges, invoices, and errors), so most flagged
@@ -46,7 +46,7 @@
 //   collects documents from the person being verified and shows no stored
 //   data. Payment link URLs are public by design and bound to no customer.
 // - Issuing card numbers and CVCs come back only as expansions, which the
-//   connector refuses on every Issuing path (`rest.ts`); the card operations
+//   connector refuses on every Issuing path (`api.ts`); the card operations
 //   also redact both fields.
 // Embedded URL verdict (#812): reviewed paths + global signing parameters.
 // Evidence: digest-verified Stripe v2555, components/schemas/charge's
@@ -78,12 +78,12 @@ const METER_SESSION = "It mints an authentication token for the meter event stre
 const EPHEMERAL_REVOKE = "Revokes an ephemeral key; the answer repeats the key's secret, which is redacted.";
 const WEBHOOK = "Webhook endpoints carry a signing secret and a destination URL whose path or query can be a bearer secret.";
 const EVENT_DESTINATION = "Event destinations carry a webhook signing secret and a destination URL whose path or query can be a bearer secret.";
-const APPS_SECRET = "An Apps secret's payload is the stored secret value; names and scopes stay. Expanding payload is also refused (`rest.ts`).";
+const APPS_SECRET = "An Apps secret's payload is the stored secret value; names and scopes stay. Expanding payload is also refused (`api.ts`).";
 const APP_INSTALL = "An app install's auth_code is an OAuth authorization code exchangeable for tokens.";
 const TERMINAL_CONFIG = "Terminal configurations carry Wi-Fi passwords and a private key password; the key file is a File id, and the pre-shared-key network's SSID stays.";
 const FORWARDING = "Forwarded requests carry header values sent to and returned by a third party (API keys, Authorization); header names stay.";
 const PRESIGNED = "Product catalog imports answer pre-signed upload and error-file URLs that grant access without Stripe authentication.";
-const ISSUING_CARD = "Full card numbers and CVCs are refused as expansions (`rest.ts`) and redacted here; the card id, last4, and expiry stay.";
+const ISSUING_CARD = "Full card numbers and CVCs are refused as expansions (`api.ts`) and redacted here; the card id, last4, and expiry stay.";
 const FILE = "A file's own URL needs the account's secret key; its file links are public bearer URLs, reduced to their origin.";
 const FILE_LINK_READ = "A file link's URL lets anyone download the file; only its origin comes back.";
 const CHECKOUT = "Checkout Sessions carry a client secret (redacted). The hosted page URL follows the checkout.session resource rule: verbatim for a guest session, origin only for one bound to a customer.";

package/dist/providers/stripe/skill.generated.js

@@ -1,14 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
-    "instructionsHeading": "Account instructions",
-    "fragments": {
-        "setup": "## Choose OAuth or an API key\n\nImport `stripe` from `@zackbart/connecta/providers/stripe`. Choose one of two setup paths:\n\n```ts\n// OAuth: Stripe's hosted MCP. Authorize the connection with Stripe.\nstripe(\"billing\", { purpose: \"Payments\", auth: { type: \"oauth\" } });\nstripe(\"billing\", { purpose: \"Revenue reports\", auth: { type: \"oauth\" }, readOnly: true });\n\n// API key: Connecta's REST connector. Paste the key into this connection in the operator UI.\nstripe(\"billing\", { purpose: \"Payments\", auth: { type: \"apiKey\" }, mode: \"production\" });\nstripe(\"billing\", { purpose: \"Revenue reports\", auth: { type: \"apiKey\" }, mode: \"production\", readOnly: true });\n```\n\nFor an API key, set `mode` to `\"production\"` or `\"sandbox\"` to match the key.\nUse a secret (`sk_`) or restricted (`rk_`) key. For read-only access, prefer a\nrestricted `rk_` key configured with only read permissions: Stripe enforces\nthose permissions too. Connecta's `readOnly: true` omits non-read tools and\nrefuses their calls on every endpoint. Omit it for the default writable connector;\nendpoint restrictions still apply. OAuth needs no `mode` and can reach both live\nand sandbox accounts through Stripe's account selectors.\n\n",
-        "oauth": "\n\nThis OAuth session may expose both live and sandbox Stripe accounts. Discover the live account-selection tools, select the intended account and mode, then carry exact context fields such as `stripe_context` and `livemode` wherever the schema requires them. A live-mode write moves real money; a sandbox write changes test data. Never infer the account or mode from connector metadata.\n\n- Discover account and mode with the live account-selection tools before every account-scoped read or write. The reviewed hosted catalog exposes `list_available_accounts_or_orgs` to return `stripe_context` and `livemode`, and `manage_stripe_accounts` to return a Dashboard URL for managing session access; discover what this session actually exposes. Select the intended result and carry the exact context fields required by the live schema unchanged. If the account, mode, or supported selector is ambiguous, stop and ask; never guess.\n- Organization accounts are not Stripe Connect connected accounts. A Connect call requires a separate API-key connector whose `connectedAccount` sends Stripe's documented `Stripe-Account` header; OAuth does not support that path.\n- Four generic tools reach any Stripe API method. Find the method with `stripe_api_search`, read its parameters with `stripe_api_details`, then call `stripe_api_read` (GET) or `stripe_api_write` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — `stripe_api_details` is cheaper than a rejected write.\n- Prefer a dedicated tool when one covers the task: `get_balance_summary` for balances and `stripe_analytics` for Sigma or Metrics reporting. Use `stripe_api_search` for everything else instead of assuming a retired dedicated tool still exists.\n- `stripe_implementation_planner` and the query-execution intents of `stripe_analytics` create provider-side planning or query-run state. Connecta therefore classifies both as writes, which a read-only endpoint refuses; their retrieval paths stay behind the same tool boundary.\n- `convert_currency`, `send_money`, and `transfer_money` move funds. Before dispatch, confirm the intended account and its exact `stripe_context`/`livemode` pair, the source and destination or recipient, the currency, and the amount in minor units. `livemode: true` affects real balances; never switch modes to get past a refusal. `setup_recipient` creates a recipient for outbound payments and is also reviewed as destructive, matching Stripe's hint.\n- Money-movement tools can require Stripe human confirmation. Make the host-approved initial call without `human_confirmation.approval_token`. If Stripe returns an approval request and URL, present that URL as a clickable link and wait for the human to confirm approval. Only then call the same tool with the exact original arguments plus the supplied `human_confirmation.approval_token`; never invent a token, change the amount or recipient, or automatically retry an ambiguous money movement. This Stripe confirmation is separate from the host's tool approval.\n- `atlas_company_formation` creates or advances an Atlas formation application. Its `list` and `retrieve` actions share the same destructive tool boundary as `create` and `advance`; obtain host approval and preserve the selected `stripe_context` and `livemode` for every action.\n- `send_stripe_feedback` submits feedback to Stripe and is a write. Discover that name rather than the retired `send_stripe_mcp_feedback`.\n- `stripe_api_write` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; a read-only endpoint refuses it.\n- Any `stripe_api_read` list or `stripe_api_search` that returns full objects belongs inside `execute_code`, projected to the fields the question needs before `return`. Neither `limit` nor `expand` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.\n- Find an object with `stripe_api_search` (or a list endpoint through `stripe_api_read`) and carry the `id` it returned into the write.\n- This connection's tool list is not a fixed set. Stripe gates parts of its MCP catalog by account, integration, and beta enrollment, so search this connector for what it actually exposes rather than assuming a documented tool is here.\n- Send an `Idempotency-Key` on every write you might retry, if the tool accepts it, and reuse the same key for the retry. A retry with a fresh key is a second charge, not a second attempt.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.stripe.com`, holding one operator-managed key. It reaches exactly one account in one mode, so there is no account selection and no `stripe_context` or `livemode` argument.\n- `stripe_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `stripe_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `stripe_api_read` calls GET operations, plus `POST /v1/invoices/create_preview`, which only previews. `stripe_api_write` calls every other POST and every DELETE, from a customer edit to a subscription cancellation, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete: substitute ids into the template search returned (`/v1/payment_intents/pi_123`). Pass `query` and `body` as JSON objects named as `stripe_api_details` lists them. Connecta form-encodes v1 bodies and query lists (`expand: [\"latest_charge\"]`), sends v2 bodies as JSON, and pins `Stripe-Version` to the index's API version. Send `null` or `\"\"` to unset a field.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Stripe, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `starting_after`, or `page` for search and v2 lists. Lists belong inside `execute_code`; pass `select` (dot paths such as `data.id` and `data.status`) to keep only the fields the question needs, which also keeps customer names, emails, and addresses out of the transcript.\n- `get_stripe_account_info` confirms the account, mode, and connected account; `get_balance_summary` returns available and pending balances. Use them when they answer the question.\n- Find records with list and search operations through `stripe_api_read` (`GET /v1/customers/search`, `GET /v1/charges` with `customer`) and carry the returned `id` into the write.\n- `stripe_api_write` sends an `Idempotency-Key` on every POST. Pass `idempotencyKey` for anything you might retry, or reuse the generated one the result returns. An ambiguous failure carries it in its message or as `uncertainCall.recovery.idempotencyKey`. Reuse it only with the exact original arguments and within Stripe's retention (v1 keys may be pruned after 24 hours); after that, look the object up before retrying. A retry with a fresh key is a second charge, not a second attempt.\n- Refused by design: operations that hand out a credential (ephemeral keys, Terminal connection tokens, account links (v1 and v2), Terminal onboarding links, Express login links, account sessions, customer sessions, billing portal sessions, file link creation, Financial Connections session creation, and the meter event session), Stripe Apps secret payloads (`expand` of `payload`), Issuing card `number` and `cvc` expansion on any Issuing path, multipart uploads such as `POST /v1/files` (use the Dashboard), and the meter event stream (send single events with `POST /v2/billing/meter_events`). Each refusal names its reason. Quote PDFs arrive from `files.stripe.com` as base64.\n- Secrets read as `\"[redacted]\"` in every result, expansions included: client secrets (PaymentIntents, SetupIntents, Checkout and Identity sessions, Sources, Financial Connections, invoice confirmation secrets), webhook and event destination signing secrets, Apps secret payloads, app-install authorization codes, Terminal Wi-Fi passwords, forwarded request header values, and Issuing card numbers and CVCs. Webhook and event destination URLs, file link URLs (in an expanded File, a list, or an event too), and pre-signed import URLs keep only their scheme and host. Identity verification `url`s come back whole. A Checkout Session's `url` comes back whole only for a guest payment session (`mode: \"payment\"`, no `customer` or `customer_account`, no customer creation, no saved payment method options); any other session returns only its scheme and host, because its page can show, reuse, or remove a customer's saved payment methods. Create those from your own server code, or send a payment link or the invoice's hosted page instead. These rules follow each object wherever it appears, expansions and events included. A `[redacted]` field is never the real value; do not send it back.\n- Failures of credential-bearing operations (webhook endpoints, Apps secrets, Terminal configurations, forwarding) carry Stripe's type, code, decline code, and param, not its message. Payment, billing, and account failures keep Stripe's message.\n- The hosted OAuth connection's natural-language Sigma, metrics, documentation search, implementation planner, and feedback tools do not exist with a key.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in charge `failure_message` and `outcome.seller_message` wherever charge objects appear, including event partial copies and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Descriptions, metadata, price nicknames, invoice footers and notes keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
-        "shared": "- Lists are cursor-paginated: `limit` defaults to 10 and caps at 100, `starting_after` and `ending_before` take an object id and are mutually exclusive, and `has_more` says whether to continue. Page inside `execute_code`.\n- Search filters on a documented per-resource field set, not on arbitrary attributes. Charges search takes `amount`, `created`, `currency`, `customer`, `status`, `refunded`, `disputed`, `metadata`, `billing_details.address.postal_code`, and `payment_method_details.<source>.*` card fields — there is no `payment_intent` field. When the field you want is not searchable, retrieve the parent object and follow its reference (the PaymentIntent's `latest_charge`) instead of retrying the search with another spelling.\n- The account → `stripe_api_search` → `stripe_api_details` → `stripe_api_read` sequence is one program, not four turns: resolve the method once, then call that method as many times as the investigation needs in the same run.\n- Decline outcomes live on the charge — `outcome`, `failure_code`, `failure_message` — reached from the PaymentIntent's `latest_charge`, so \"why did this payment fail\" is a PaymentIntent read followed by one charge read.\n- Resolve ids before acting; never guess one. Stripe ids are typed prefixes — `cus_` customer, `sub_` subscription, `ch_` charge, `pi_` payment intent, `in_` invoice, `acct_` account — and a plausible-looking id belongs to a different object or to nobody.\n- Amounts are integers in the currency's minor unit: `1099` is 10.99 USD, and zero-decimal currencies like JPY take `10` for 10 JPY. Never send a decimal.\n- Treat every create, update, delete, refund, and report run as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
-        "oauth_limits": "- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of 100 requests per second in live mode and 25 in sandbox mode, and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint.\n- Use `search_stripe_documentation` when the shape of an object or a flow is unclear; it is a read and costs nothing but a call.\n- An `auth_required` failure means this connector's Stripe authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged. A rejected argument or a plan restriction comes back in Stripe's own words instead — read it rather than re-authorizing.\n",
-        "key_limits": "- Stripe answers a rate limit with `429` and a `Stripe-Rate-Limited-Reason` header; back off on that rather than retrying immediately. Stripe documents an account ceiling of ",
-        "key_tail": ", and any single endpoint is capped at 25 per second regardless of mode, so paging one list is the real constraint. A `429` with code `lock_timeout` is a lock conflict on one object, not a rate limit: Stripe did not process the request, so it fails as `conflict` and may be retried after the other request finishes.\n- An `auth_required` failure means the key is missing, revoked, or for the other mode: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A restricted key without a permission fails as `provider_permission_denied` naming it; ask for the permission rather than retrying. A rejected argument comes back in Stripe's own words — read it rather than replacing the key.\n"
-    }
+    "content": "## Account and money\n\nBefore investigating a payment or moving money, confirm the account and mode\nwith `get_stripe_account_info`. A Connect account's objects belong to that\naccount, rather than the platform's account. Sandbox objects do not establish anything about live\ncustomers, revenue or payouts.\n\nResolve ids before acting. Stripe ids identify types: `cus_` customer, `sub_`\nsubscription, `ch_` charge, `pi_` PaymentIntent, `in_` invoice and `acct_`\naccount. A plausible-looking id can refer to a different object or to nobody.\n\nAmounts are integers in the currency's minor unit: 1099 is 10.99 USD, while\n10 is 10 JPY. Keep currencies separate when totaling balances or payments.\n\n## Payment investigations\n\nA PaymentIntent's `latest_charge` joins it to the charge holding the payment's\n`outcome`, `failure_code` and `failure_message`. Follow that reference to\nexplain a decline. Search supports a documented field set for each resource;\ncharge search has no `payment_intent` field. Resolve the parent and follow its\nreference when the needed relationship is not searchable.\n\nSearch is eventually consistent; use a direct object read to reconcile a\nrecent write. A POST's idempotency key identifies the exact operation and\nparameters. Stripe v1 may prune keys after 24 hours, so reconcile the object\nbefore attempting the operation outside that window. A new key can create a\nsecond payment or refund.\n\nIn v1 requests, an empty string (`\"\"`) or `null` unsets a field.\n\n## Data reduction and boundaries\n\nKeep only the customer and payment facts the question needs. Reduce lists to\ncounts, totals or matching records before returning them to the conversation.\nUse the account and balance summaries when their projections answer the task;\nother account fields and balance transactions are available through the API.\n\nCredential creation, customer/account sign-in links, secret payload expansions,\nfull Issuing card details, file uploads and the meter-event stream are outside\nthis connection's surface. Use the Dashboard or application server for those\nflows. Single meter events remain available. A guest Checkout payment page is\navailable only when it is unbound to a Customer or Account and cannot manage\nsaved payment methods; use a payment link or hosted invoice for other cases.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `stripe_api_details`, `stripe_api_read`, `stripe_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `stripe_api_search` finds this API's operations and reads no account data, `stripe_api_details` shows one operation's contract, and `stripe_api_read` calls a reviewed read. `stripe_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 15 operations are refused by design; use `stripe_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. A write that takes `idempotencyKey` may be repeated with the same key and arguments while the vendor retains it.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. `conflict` means: HTTP 409 when the request conflicts with another request, including a concurrent use of the same idempotency key; HTTP 429 with code lock_timeout when another request holds the object's lock.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Account instructions"
 };

package/dist/providers/stripe/tools.js

@@ -0,0 +1,77 @@
+// Stripe's two curated reads; the definition supplies the standard coverage hatch.
+import { Effect, Schema } from "effect";
+import { read } from "../../http/tools.js";
+import { connectedAccount, record, text, sendStripe, stripeIndex } from "./api.js";
+const NullableText = Schema.Union([Schema.String, Schema.Null]);
+const NullableFlag = Schema.Union([Schema.Boolean, Schema.Null]);
+export function stripeTools({ connection, options, }) {
+    // Both named reads use the API origin; only the coverage binding needs files.
+    const send = (call) => sendStripe(connection, options, call, connection);
+    const call = (path) => {
+        const { op, params } = stripeIndex.resolve("GET", path);
+        return send({ method: "GET", path, op, params, query: {}, body: undefined });
+    };
+    return [
+        read(connection, {
+            fields: true,
+            name: "get_stripe_account_info",
+            description: "Read the Stripe account this key reaches: id, name, country, default currency, mode, and connected account. Use it to confirm scope first.",
+            input: Schema.Struct({}),
+            output: Schema.Struct({
+                accountId: Schema.String,
+                name: Schema.optionalKey(NullableText),
+                country: Schema.optionalKey(NullableText),
+                defaultCurrency: Schema.optionalKey(NullableText),
+                mode: Schema.Literals(["production", "sandbox"]),
+                livemode: Schema.Boolean,
+                connectedAccount: NullableText.annotate({ description: "Set when every call acts as this account." }),
+                chargesEnabled: Schema.optionalKey(NullableFlag),
+                payoutsEnabled: Schema.optionalKey(NullableFlag),
+            }),
+            run: () => call("/v1/account").pipe(Effect.map(({ data }) => {
+                const account = record(data), profile = record(account["business_profile"]), dashboard = record(record(account["settings"])["dashboard"]);
+                return {
+                    accountId: String(account["id"] ?? ""),
+                    name: text(profile["name"]) ?? text(dashboard["display_name"]) ?? null,
+                    country: text(account["country"]) ?? null,
+                    defaultCurrency: text(account["default_currency"]) ?? null,
+                    mode: options.mode,
+                    livemode: options.mode === "production",
+                    connectedAccount: connectedAccount(options) ?? null,
+                    chargesEnabled: typeof account["charges_enabled"] === "boolean" ? account["charges_enabled"] : null,
+                    payoutsEnabled: typeof account["payouts_enabled"] === "boolean" ? account["payouts_enabled"] : null,
+                };
+            })),
+        }),
+        read(connection, {
+            fields: true,
+            name: "get_balance_summary",
+            description: "Read the account's available and pending Stripe balance per currency, in minor units. Excludes balance transactions; list those with stripe_api_read.",
+            input: Schema.Struct({}),
+            output: Schema.Struct({
+                livemode: Schema.Boolean,
+                available: Schema.Array(Schema.Unknown).annotate({ description: "Funds available to pay out, per currency." }),
+                pending: Schema.Array(Schema.Unknown).annotate({ description: "Funds not yet available, per currency." }),
+                instantAvailable: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+                connectReserved: Schema.optionalKey(Schema.Array(Schema.Unknown)),
+            }),
+            run: () => call("/v1/balance").pipe(Effect.map(({ data }) => {
+                const balance = record(data);
+                const amounts = (value) => Array.isArray(value)
+                    ? value.map((entry) => ({ amount: record(entry)["amount"], currency: record(entry)["currency"] }))
+                    : [];
+                return {
+                    livemode: balance["livemode"] === true,
+                    available: amounts(balance["available"]),
+                    pending: amounts(balance["pending"]),
+                    ...(Array.isArray(balance["instant_available"])
+                        ? { instantAvailable: amounts(balance["instant_available"]) }
+                        : {}),
+                    ...(Array.isArray(balance["connect_reserved"])
+                        ? { connectReserved: amounts(balance["connect_reserved"]) }
+                        : {}),
+                };
+            })),
+        }),
+    ];
+}