stripe-experiment-sync 1.0.13 → 1.0.15-beta.1766078819

package/dist/cli/index.cjs

@@ -33,7 +33,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.13",
+  version: "1.0.15-beta.1766078819",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",
@@ -73,6 +73,7 @@ var package_default = {
     dotenv: "^16.4.7",
     express: "^4.18.2",
     inquirer: "^12.3.0",
+    papaparse: "5.4.1",
     pg: "^8.16.3",
     "pg-node-migrations": "0.0.8",
     stripe: "^17.7.0",
@@ -84,6 +85,7 @@ var package_default = {
     "@types/express": "^4.17.21",
     "@types/inquirer": "^9.0.7",
     "@types/node": "^24.10.1",
+    "@types/papaparse": "5.3.16",
     "@types/pg": "^8.15.5",
     "@types/ws": "^8.5.13",
     "@types/yesql": "^4.1.4",
@@ -127,6 +129,7 @@ async function loadConfig(options) {
   config.stripeApiKey = options.stripeKey || process.env.STRIPE_API_KEY || "";
   config.ngrokAuthToken = options.ngrokToken || process.env.NGROK_AUTH_TOKEN || "";
   config.databaseUrl = options.databaseUrl || process.env.DATABASE_URL || "";
+  config.enableSigma = options.enableSigma ?? (process.env.ENABLE_SIGMA !== void 0 ? process.env.ENABLE_SIGMA === "true" : void 0);
   const questions = [];
   if (!config.stripeApiKey) {
     questions.push({
@@ -138,8 +141,8 @@ async function loadConfig(options) {
         if (!input || input.trim() === "") {
           return "Stripe API key is required";
         }
-        if (!input.startsWith("sk_")) {
-          return 'Stripe API key should start with "sk_"';
+        if (!input.startsWith("sk_") && !input.startsWith("rk_")) {
+          return 'Stripe API key should start with "sk_" or "rk_"';
         }
         return true;
       }
@@ -162,23 +165,80 @@ async function loadConfig(options) {
       }
     });
   }
+  if (config.enableSigma === void 0) {
+    questions.push({
+      type: "confirm",
+      name: "enableSigma",
+      message: "Enable Sigma sync? (Requires Sigma access in Stripe API key)",
+      default: false
+    });
+  }
   if (questions.length > 0) {
-    console.log(import_chalk.default.yellow("\nMissing required configuration. Please provide:"));
+    console.log(import_chalk.default.yellow("\nMissing configuration. Please provide:"));
     const answers = await import_inquirer.default.prompt(questions);
     Object.assign(config, answers);
   }
+  if (config.enableSigma === void 0) {
+    config.enableSigma = false;
+  }
   return config;
 }
 
 // src/stripeSync.ts
-var import_stripe2 = __toESM(require("stripe"), 1);
+var import_stripe3 = __toESM(require("stripe"), 1);
 var import_yesql2 = require("yesql");
 
 // src/database/postgres.ts
 var import_pg = __toESM(require("pg"), 1);
 var import_yesql = require("yesql");
+
+// src/database/QueryUtils.ts
+var QueryUtils = class _QueryUtils {
+  constructor() {
+  }
+  static quoteIdent(name) {
+    return `"${name}"`;
+  }
+  static quotedList(names) {
+    return names.map(_QueryUtils.quoteIdent).join(", ");
+  }
+  static buildInsertParts(columns) {
+    const columnsSql = columns.map((c) => _QueryUtils.quoteIdent(c.column)).join(", ");
+    const valuesSql = columns.map((c, i) => {
+      const placeholder = `$${i + 1}`;
+      return `${placeholder}::${c.pgType}`;
+    }).join(", ");
+    const params = columns.map((c) => c.value);
+    return { columnsSql, valuesSql, params };
+  }
+  static buildRawJsonUpsertQuery(schema, table, columns, conflictTarget) {
+    const { columnsSql, valuesSql, params } = _QueryUtils.buildInsertParts(columns);
+    const conflictSql = _QueryUtils.quotedList(conflictTarget);
+    const tsParamIdx = columns.findIndex((c) => c.column === "_last_synced_at") + 1;
+    if (tsParamIdx <= 0) {
+      throw new Error("buildRawJsonUpsertQuery requires _last_synced_at column");
+    }
+    const sql3 = `
+    INSERT INTO ${_QueryUtils.quoteIdent(schema)}.${_QueryUtils.quoteIdent(table)} (${columnsSql})
+    VALUES (${valuesSql})
+    ON CONFLICT (${conflictSql})
+    DO UPDATE SET
+      "_raw_data" = EXCLUDED."_raw_data",
+      "_last_synced_at" = $${tsParamIdx},
+      "_account_id" = EXCLUDED."_account_id"
+    WHERE ${_QueryUtils.quoteIdent(table)}."_last_synced_at" IS NULL
+       OR ${_QueryUtils.quoteIdent(table)}."_last_synced_at" < $${tsParamIdx}
+    RETURNING *
+  `;
+    return { sql: sql3, params };
+  }
+};
+
+// src/database/postgres.ts
 var ORDERED_STRIPE_TABLES = [
+  "exchange_rates_from_usd",
   "subscription_items",
+  "subscription_item_change_events_v2_beta",
   "subscriptions",
   "subscription_schedules",
   "checkout_session_line_items",
@@ -248,7 +308,7 @@ var PostgresClient = class {
     }
     return results.flatMap((it) => it.rows);
   }
-  async upsertManyWithTimestampProtection(entries, table, accountId, syncTimestamp) {
+  async upsertManyWithTimestampProtection(entries, table, accountId, syncTimestamp, upsertOptions) {
     const timestamp = syncTimestamp || (/* @__PURE__ */ new Date()).toISOString();
     if (!entries.length) return [];
     const chunkSize = 5;
@@ -283,20 +343,33 @@ var PostgresClient = class {
           const prepared = (0, import_yesql.pg)(upsertSql, { useNullForMissing: true })(cleansed);
           queries.push(this.pool.query(prepared.text, prepared.values));
         } else {
-          const rawData = JSON.stringify(entry);
-          const upsertSql = `
-            INSERT INTO "${this.config.schema}"."${table}" ("_raw_data", "_last_synced_at", "_account_id")
-            VALUES ($1::jsonb, $2, $3)
-            ON CONFLICT (id)
-            DO UPDATE SET
-              "_raw_data" = EXCLUDED."_raw_data",
-              "_last_synced_at" = $2,
-              "_account_id" = EXCLUDED."_account_id"
-            WHERE "${table}"."_last_synced_at" IS NULL
-               OR "${table}"."_last_synced_at" < $2
-            RETURNING *
-          `;
-          queries.push(this.pool.query(upsertSql, [rawData, timestamp, accountId]));
+          const conflictTarget = upsertOptions?.conflictTarget ?? ["id"];
+          const extraColumns = upsertOptions?.extraColumns ?? [];
+          if (!conflictTarget.length) {
+            throw new Error(`Invalid upsert config for ${table}: conflictTarget must be non-empty`);
+          }
+          const columns = [
+            { column: "_raw_data", pgType: "jsonb", value: JSON.stringify(entry) },
+            ...extraColumns.map((c) => ({
+              column: c.column,
+              pgType: c.pgType,
+              value: entry[c.entryKey]
+            })),
+            { column: "_last_synced_at", pgType: "timestamptz", value: timestamp },
+            { column: "_account_id", pgType: "text", value: accountId }
+          ];
+          for (const c of columns) {
+            if (c.value === void 0) {
+              throw new Error(`Missing required value for ${table}.${c.column}`);
+            }
+          }
+          const { sql: upsertSql, params } = QueryUtils.buildRawJsonUpsertQuery(
+            this.config.schema,
+            table,
+            columns,
+            conflictTarget
+          );
+          queries.push(this.pool.query(upsertSql, params));
         }
       });
       results.push(...await Promise.all(queries));
@@ -696,7 +769,12 @@ var PostgresClient = class {
     } else {
       await this.query(
         `UPDATE "${this.config.schema}"."_sync_obj_runs"
-         SET cursor = $4, updated_at = now()
+         SET cursor = CASE
+           WHEN cursor IS NULL THEN $4
+           WHEN (cursor COLLATE "C") < ($4::text COLLATE "C") THEN $4
+           ELSE cursor
+         END,
+         updated_at = now()
          WHERE "_account_id" = $1 AND run_started_at = $2 AND object = $3`,
         [accountId, runStartedAt, object, cursor]
       );
@@ -707,10 +785,17 @@ var PostgresClient = class {
    * This considers completed, error, AND running runs to ensure recovery syncs
    * don't re-process data that was already synced before a crash.
    * A 'running' status with a cursor means the process was killed mid-sync.
+   *
+   * Handles two cursor formats:
+   * - Numeric: compared as bigint for correct ordering
+   * - Composite cursors: compared as strings with COLLATE "C"
    */
   async getLastCompletedCursor(accountId, object) {
     const result = await this.query(
-      `SELECT MAX(o.cursor::bigint)::text as cursor
+      `SELECT CASE
+         WHEN BOOL_OR(o.cursor !~ '^\\d+$') THEN MAX(o.cursor COLLATE "C")
+         ELSE MAX(CASE WHEN o.cursor ~ '^\\d+$' THEN o.cursor::bigint END)::text
+       END as cursor
        FROM "${this.config.schema}"."_sync_obj_runs" o
        WHERE o."_account_id" = $1
          AND o.object = $2
@@ -995,6 +1080,269 @@ function hashApiKey(apiKey) {
   return (0, import_crypto.createHash)("sha256").update(apiKey).digest("hex");
 }
 
+// src/sigma/sigmaApi.ts
+var import_papaparse = __toESM(require("papaparse"), 1);
+var import_stripe2 = __toESM(require("stripe"), 1);
+var STRIPE_FILES_BASE = "https://files.stripe.com/v1";
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseCsvObjects(csv) {
+  const input = csv.replace(/^\uFEFF/, "");
+  const parsed = import_papaparse.default.parse(input, {
+    header: true,
+    skipEmptyLines: "greedy"
+  });
+  if (parsed.errors.length > 0) {
+    throw new Error(`Failed to parse Sigma CSV: ${parsed.errors[0]?.message ?? "unknown error"}`);
+  }
+  return parsed.data.filter((row) => row && Object.keys(row).length > 0).map(
+    (row) => Object.fromEntries(
+      Object.entries(row).map(([k, v]) => [k, v == null || v === "" ? null : String(v)])
+    )
+  );
+}
+function normalizeSigmaTimestampToIso(value) {
+  const v = value.trim();
+  if (!v) return null;
+  const hasExplicitTz = /z$|[+-]\d{2}:?\d{2}$/i.test(v);
+  const isoish = v.includes("T") ? v : v.replace(" ", "T");
+  const candidate = hasExplicitTz ? isoish : `${isoish}Z`;
+  const d = new Date(candidate);
+  if (Number.isNaN(d.getTime())) return null;
+  return d.toISOString();
+}
+async function fetchStripeText(url, apiKey, options) {
+  const res = await fetch(url, {
+    ...options,
+    headers: {
+      ...options.headers ?? {},
+      Authorization: `Bearer ${apiKey}`
+    }
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Sigma file download error (${res.status}) for ${url}: ${text}`);
+  }
+  return text;
+}
+async function runSigmaQueryAndDownloadCsv(params) {
+  const pollTimeoutMs = params.pollTimeoutMs ?? 5 * 60 * 1e3;
+  const pollIntervalMs = params.pollIntervalMs ?? 2e3;
+  const stripe = new import_stripe2.default(params.apiKey);
+  const created = await stripe.rawRequest("POST", "/v1/sigma/query_runs", {
+    sql: params.sql
+  });
+  const queryRunId = created.id;
+  const start = Date.now();
+  let current = created;
+  while (current.status === "running") {
+    if (Date.now() - start > pollTimeoutMs) {
+      throw new Error(`Sigma query run timed out after ${pollTimeoutMs}ms: ${queryRunId}`);
+    }
+    await sleep2(pollIntervalMs);
+    current = await stripe.rawRequest(
+      "GET",
+      `/v1/sigma/query_runs/${queryRunId}`,
+      {}
+    );
+  }
+  if (current.status !== "succeeded") {
+    throw new Error(
+      `Sigma query run did not succeed (status=${current.status}) id=${queryRunId} error=${JSON.stringify(
+        current.error
+      )}`
+    );
+  }
+  const fileId = current.result?.file;
+  if (!fileId) {
+    throw new Error(`Sigma query run succeeded but result.file is missing (id=${queryRunId})`);
+  }
+  const csv = await fetchStripeText(
+    `${STRIPE_FILES_BASE}/files/${fileId}/contents`,
+    params.apiKey,
+    { method: "GET" }
+  );
+  return { queryRunId, fileId, csv };
+}
+
+// src/sigma/sigmaIngestionConfigs.ts
+var SIGMA_INGESTION_CONFIGS = {
+  subscription_item_change_events_v2_beta: {
+    sigmaTable: "subscription_item_change_events_v2_beta",
+    destinationTable: "subscription_item_change_events_v2_beta",
+    pageSize: 1e4,
+    cursor: {
+      version: 1,
+      columns: [
+        { column: "event_timestamp", type: "timestamp" },
+        { column: "event_type", type: "string" },
+        { column: "subscription_item_id", type: "string" }
+      ]
+    },
+    upsert: {
+      conflictTarget: ["_account_id", "event_timestamp", "event_type", "subscription_item_id"],
+      extraColumns: [
+        { column: "event_timestamp", pgType: "timestamptz", entryKey: "event_timestamp" },
+        { column: "event_type", pgType: "text", entryKey: "event_type" },
+        { column: "subscription_item_id", pgType: "text", entryKey: "subscription_item_id" }
+      ]
+    }
+  },
+  exchange_rates_from_usd: {
+    sigmaTable: "exchange_rates_from_usd",
+    destinationTable: "exchange_rates_from_usd",
+    pageSize: 1e4,
+    cursor: {
+      version: 1,
+      columns: [
+        { column: "date", type: "string" },
+        { column: "sell_currency", type: "string" }
+      ]
+    },
+    upsert: {
+      conflictTarget: ["_account_id", "date", "sell_currency"],
+      extraColumns: [
+        { column: "date", pgType: "date", entryKey: "date" },
+        { column: "sell_currency", pgType: "text", entryKey: "sell_currency" }
+      ]
+    }
+  }
+};
+
+// src/sigma/sigmaIngestion.ts
+var SIGMA_CURSOR_DELIM = "";
+function escapeSigmaSqlStringLiteral(value) {
+  return value.replace(/'/g, "''");
+}
+function formatSigmaTimestampForSqlLiteral(date) {
+  return date.toISOString().replace("T", " ").replace("Z", "");
+}
+function decodeSigmaCursorValues(spec, cursor) {
+  const prefix = `v${spec.version}${SIGMA_CURSOR_DELIM}`;
+  if (!cursor.startsWith(prefix)) {
+    throw new Error(
+      `Unrecognized Sigma cursor format (expected prefix ${JSON.stringify(prefix)}): ${cursor}`
+    );
+  }
+  const parts = cursor.split(SIGMA_CURSOR_DELIM);
+  const expected = 1 + spec.columns.length;
+  if (parts.length !== expected) {
+    throw new Error(`Malformed Sigma cursor: expected ${expected} parts, got ${parts.length}`);
+  }
+  return parts.slice(1);
+}
+function encodeSigmaCursor(spec, values) {
+  if (values.length !== spec.columns.length) {
+    throw new Error(
+      `Cannot encode Sigma cursor: expected ${spec.columns.length} values, got ${values.length}`
+    );
+  }
+  for (const v of values) {
+    if (v.includes(SIGMA_CURSOR_DELIM)) {
+      throw new Error("Cannot encode Sigma cursor: value contains delimiter character");
+    }
+  }
+  return [`v${spec.version}`, ...values].join(SIGMA_CURSOR_DELIM);
+}
+function sigmaSqlLiteralForCursorValue(spec, rawValue) {
+  switch (spec.type) {
+    case "timestamp": {
+      const d = new Date(rawValue);
+      if (Number.isNaN(d.getTime())) {
+        throw new Error(`Invalid timestamp cursor value for ${spec.column}: ${rawValue}`);
+      }
+      return `timestamp '${formatSigmaTimestampForSqlLiteral(d)}'`;
+    }
+    case "number": {
+      if (!/^-?\d+(\.\d+)?$/.test(rawValue)) {
+        throw new Error(`Invalid numeric cursor value for ${spec.column}: ${rawValue}`);
+      }
+      return rawValue;
+    }
+    case "string":
+      return `'${escapeSigmaSqlStringLiteral(rawValue)}'`;
+  }
+}
+function buildSigmaCursorWhereClause(spec, cursorValues) {
+  if (cursorValues.length !== spec.columns.length) {
+    throw new Error(
+      `Cannot build Sigma cursor predicate: expected ${spec.columns.length} values, got ${cursorValues.length}`
+    );
+  }
+  const cols = spec.columns.map((c) => c.column);
+  const lits = spec.columns.map((c, i) => sigmaSqlLiteralForCursorValue(c, cursorValues[i] ?? ""));
+  const ors = [];
+  for (let i = 0; i < cols.length; i++) {
+    const ands = [];
+    for (let j = 0; j < i; j++) {
+      ands.push(`${cols[j]} = ${lits[j]}`);
+    }
+    ands.push(`${cols[i]} > ${lits[i]}`);
+    ors.push(`(${ands.join(" AND ")})`);
+  }
+  return ors.join(" OR ");
+}
+function buildSigmaQuery(config, cursor) {
+  const select = config.select === void 0 || config.select === "*" ? "*" : config.select.join(", ");
+  const whereParts = [];
+  if (config.additionalWhere) {
+    whereParts.push(`(${config.additionalWhere})`);
+  }
+  if (cursor) {
+    const values = decodeSigmaCursorValues(config.cursor, cursor);
+    const predicate = buildSigmaCursorWhereClause(config.cursor, values);
+    whereParts.push(`(${predicate})`);
+  }
+  const whereClause = whereParts.length > 0 ? `WHERE ${whereParts.join(" AND ")}` : "";
+  const orderBy = config.cursor.columns.map((c) => c.column).join(", ");
+  return [
+    `SELECT ${select} FROM ${config.sigmaTable}`,
+    whereClause,
+    `ORDER BY ${orderBy} ASC`,
+    `LIMIT ${config.pageSize}`
+  ].filter(Boolean).join(" ");
+}
+function defaultSigmaRowToEntry(config, row) {
+  const out = { ...row };
+  for (const col of config.cursor.columns) {
+    const raw = row[col.column];
+    if (raw == null) {
+      throw new Error(`Sigma row missing required cursor column: ${col.column}`);
+    }
+    if (col.type === "timestamp") {
+      const normalized = normalizeSigmaTimestampToIso(raw);
+      if (!normalized) {
+        throw new Error(`Sigma row has invalid timestamp for ${col.column}: ${raw}`);
+      }
+      out[col.column] = normalized;
+    } else if (col.type === "string") {
+      const v = raw.trim();
+      if (!v) {
+        throw new Error(`Sigma row has empty string for required cursor column: ${col.column}`);
+      }
+      out[col.column] = v;
+    } else {
+      const v = raw.trim();
+      if (!v) {
+        throw new Error(`Sigma row has empty value for required cursor column: ${col.column}`);
+      }
+      out[col.column] = v;
+    }
+  }
+  return out;
+}
+function sigmaCursorFromEntry(config, entry) {
+  const values = config.cursor.columns.map((c) => {
+    const raw = entry[c.column];
+    if (raw == null) {
+      throw new Error(`Cannot build cursor: entry missing ${c.column}`);
+    }
+    return String(raw);
+  });
+  return encodeSigmaCursor(config.cursor, values);
+}
+
 // src/stripeSync.ts
 function getUniqueIds(entries, key) {
   const set = new Set(
@@ -1005,7 +1353,7 @@ function getUniqueIds(entries, key) {
 var StripeSync = class {
   constructor(config) {
     this.config = config;
-    const baseStripe = new import_stripe2.default(config.stripeSecretKey, {
+    const baseStripe = new import_stripe3.default(config.stripeSecretKey, {
       // https://github.com/stripe/stripe-node#configuration
       // @ts-ignore
       apiVersion: config.stripeApiVersion,
@@ -1406,6 +1754,17 @@ var StripeSync = class {
       listFn: (p) => this.stripe.checkout.sessions.list(p),
       upsertFn: (items, id) => this.upsertCheckoutSessions(items, id),
       supportsCreatedFilter: true
+    },
+    // Sigma-backed resources
+    subscription_item_change_events_v2_beta: {
+      order: 18,
+      supportsCreatedFilter: false,
+      sigma: SIGMA_INGESTION_CONFIGS.subscription_item_change_events_v2_beta
+    },
+    exchange_rates_from_usd: {
+      order: 19,
+      supportsCreatedFilter: false,
+      sigma: SIGMA_INGESTION_CONFIGS.exchange_rates_from_usd
     }
   };
   async processEvent(event) {
@@ -1438,7 +1797,13 @@ var StripeSync = class {
    * Order is determined by the `order` field in resourceRegistry.
    */
   getSupportedSyncObjects() {
-    return Object.entries(this.resourceRegistry).sort(([, a], [, b]) => a.order - b.order).map(([key]) => key);
+    const all = Object.entries(this.resourceRegistry).sort(([, a], [, b]) => a.order - b.order).map(([key]) => key);
+    if (!this.config.enableSigma) {
+      return all.filter(
+        (o) => o !== "subscription_item_change_events_v2_beta" && o !== "exchange_rates_from_usd"
+      );
+    }
+    return all;
   }
   // Event handler methods
   async handleChargeEvent(event, accountId) {
@@ -1517,7 +1882,7 @@ var StripeSync = class {
       );
       await this.upsertProducts([product], accountId, this.getSyncTimestamp(event, refetched));
     } catch (err) {
-      if (err instanceof import_stripe2.default.errors.StripeAPIError && err.code === "resource_missing") {
+      if (err instanceof import_stripe3.default.errors.StripeAPIError && err.code === "resource_missing") {
         const product = event.data.object;
         await this.deleteProduct(product.id);
       } else {
@@ -1537,7 +1902,7 @@ var StripeSync = class {
       );
       await this.upsertPrices([price], accountId, false, this.getSyncTimestamp(event, refetched));
     } catch (err) {
-      if (err instanceof import_stripe2.default.errors.StripeAPIError && err.code === "resource_missing") {
+      if (err instanceof import_stripe3.default.errors.StripeAPIError && err.code === "resource_missing") {
         const price = event.data.object;
         await this.deletePrice(price.id);
       } else {
@@ -1557,7 +1922,7 @@ var StripeSync = class {
       );
       await this.upsertPlans([plan], accountId, false, this.getSyncTimestamp(event, refetched));
     } catch (err) {
-      if (err instanceof import_stripe2.default.errors.StripeAPIError && err.code === "resource_missing") {
+      if (err instanceof import_stripe3.default.errors.StripeAPIError && err.code === "resource_missing") {
         const plan = event.data.object;
         await this.deletePlan(plan.id);
       } else {
@@ -1804,10 +2169,10 @@ var StripeSync = class {
     let cursor = null;
     if (!params?.created) {
       if (objRun?.cursor) {
-        cursor = parseInt(objRun.cursor);
+        cursor = objRun.cursor;
       } else {
         const lastCursor = await this.postgresClient.getLastCompletedCursor(accountId, resourceName);
-        cursor = lastCursor ? parseInt(lastCursor) : null;
+        cursor = lastCursor ?? null;
       }
     }
     const result = await this.fetchOnePage(
@@ -1862,9 +2227,18 @@ var StripeSync = class {
       throw new Error(`Unsupported object type for processNext: ${object}`);
     }
     try {
+      if (config.sigma) {
+        return await this.fetchOneSigmaPage(
+          accountId,
+          resourceName,
+          runStartedAt,
+          cursor,
+          config.sigma
+        );
+      }
       const listParams = { limit };
       if (config.supportsCreatedFilter) {
-        const created = params?.created ?? (cursor ? { gte: cursor } : void 0);
+        const created = params?.created ?? (cursor && /^\d+$/.test(cursor) ? { gte: Number.parseInt(cursor, 10) } : void 0);
         if (created) {
           listParams.created = created;
         }
@@ -1909,6 +2283,97 @@ var StripeSync = class {
       throw error;
     }
   }
+  async getSigmaFallbackCursorFromDestination(accountId, sigmaConfig) {
+    const cursorCols = sigmaConfig.cursor.columns;
+    const selectCols = cursorCols.map((c) => `"${c.column}"`).join(", ");
+    const orderBy = cursorCols.map((c) => `"${c.column}" DESC`).join(", ");
+    const result = await this.postgresClient.query(
+      `SELECT ${selectCols}
+       FROM "stripe"."${sigmaConfig.destinationTable}"
+       WHERE "_account_id" = $1
+       ORDER BY ${orderBy}
+       LIMIT 1`,
+      [accountId]
+    );
+    if (result.rows.length === 0) return null;
+    const row = result.rows[0];
+    const entryForCursor = {};
+    for (const c of cursorCols) {
+      const v = row[c.column];
+      if (v == null) {
+        throw new Error(
+          `Sigma fallback cursor query returned null for ${sigmaConfig.destinationTable}.${c.column}`
+        );
+      }
+      if (c.type === "timestamp") {
+        const d = v instanceof Date ? v : new Date(String(v));
+        if (Number.isNaN(d.getTime())) {
+          throw new Error(
+            `Sigma fallback cursor query returned invalid timestamp for ${sigmaConfig.destinationTable}.${c.column}: ${String(
+              v
+            )}`
+          );
+        }
+        entryForCursor[c.column] = d.toISOString();
+      } else {
+        entryForCursor[c.column] = String(v);
+      }
+    }
+    return sigmaCursorFromEntry(sigmaConfig, entryForCursor);
+  }
+  async fetchOneSigmaPage(accountId, resourceName, runStartedAt, cursor, sigmaConfig) {
+    if (!this.config.stripeSecretKey) {
+      throw new Error("Sigma sync requested but stripeSecretKey is not configured.");
+    }
+    if (resourceName !== sigmaConfig.destinationTable) {
+      throw new Error(
+        `Sigma sync config mismatch: resourceName=${resourceName} destinationTable=${sigmaConfig.destinationTable}`
+      );
+    }
+    const effectiveCursor = cursor ?? await this.getSigmaFallbackCursorFromDestination(accountId, sigmaConfig);
+    const sigmaSql = buildSigmaQuery(sigmaConfig, effectiveCursor);
+    this.config.logger?.info(
+      { object: resourceName, pageSize: sigmaConfig.pageSize, hasCursor: Boolean(effectiveCursor) },
+      "Sigma sync: running query"
+    );
+    const { queryRunId, fileId, csv } = await runSigmaQueryAndDownloadCsv({
+      apiKey: this.config.stripeSecretKey,
+      sql: sigmaSql,
+      logger: this.config.logger
+    });
+    const rows = parseCsvObjects(csv);
+    if (rows.length === 0) {
+      await this.postgresClient.completeObjectSync(accountId, runStartedAt, resourceName);
+      return { processed: 0, hasMore: false, runStartedAt };
+    }
+    const entries = rows.map(
+      (row) => defaultSigmaRowToEntry(sigmaConfig, row)
+    );
+    this.config.logger?.info(
+      { object: resourceName, rows: entries.length, queryRunId, fileId },
+      "Sigma sync: upserting rows"
+    );
+    await this.postgresClient.upsertManyWithTimestampProtection(
+      entries,
+      resourceName,
+      accountId,
+      void 0,
+      sigmaConfig.upsert
+    );
+    await this.postgresClient.incrementObjectProgress(
+      accountId,
+      runStartedAt,
+      resourceName,
+      entries.length
+    );
+    const newCursor = sigmaCursorFromEntry(sigmaConfig, entries[entries.length - 1]);
+    await this.postgresClient.updateObjectCursor(accountId, runStartedAt, resourceName, newCursor);
+    const hasMore = rows.length === sigmaConfig.pageSize;
+    if (!hasMore) {
+      await this.postgresClient.completeObjectSync(accountId, runStartedAt, resourceName);
+    }
+    return { processed: entries.length, hasMore, runStartedAt };
+  }
   /**
    * Process all pages for all (or specified) object types until complete.
    *
@@ -2037,6 +2502,12 @@ var StripeSync = class {
             case "checkout_sessions":
               results.checkoutSessions = result;
               break;
+            case "subscription_item_change_events_v2_beta":
+              results.subscriptionItemChangeEventsV2Beta = result;
+              break;
+            case "exchange_rates_from_usd":
+              results.exchangeRatesFromUsd = result;
+              break;
           }
         }
       }
@@ -2062,30 +2533,41 @@ var StripeSync = class {
       const customerIds = await this.postgresClient.query(prepared.text, prepared.values).then(({ rows }) => rows.map((it) => it.id));
       this.config.logger?.info(`Getting payment methods for ${customerIds.length} customers`);
       let synced = 0;
-      for (const customerIdChunk of chunkArray(customerIds, 10)) {
+      const chunkSize = this.config.maxConcurrentCustomers ?? 10;
+      for (const customerIdChunk of chunkArray(customerIds, chunkSize)) {
         await Promise.all(
           customerIdChunk.map(async (customerId) => {
             const CHECKPOINT_SIZE = 100;
             let currentBatch = [];
-            for await (const item of this.stripe.paymentMethods.list({
-              limit: 100,
-              customer: customerId
-            })) {
-              currentBatch.push(item);
-              if (currentBatch.length >= CHECKPOINT_SIZE) {
-                await this.upsertPaymentMethods(
-                  currentBatch,
-                  accountId,
-                  syncParams?.backfillRelatedEntities
-                );
-                synced += currentBatch.length;
-                await this.postgresClient.incrementObjectProgress(
-                  accountId,
-                  runStartedAt,
-                  resourceName,
-                  currentBatch.length
-                );
-                currentBatch = [];
+            let hasMore = true;
+            let startingAfter = void 0;
+            while (hasMore) {
+              const response = await this.stripe.paymentMethods.list({
+                limit: 100,
+                customer: customerId,
+                ...startingAfter ? { starting_after: startingAfter } : {}
+              });
+              for (const item of response.data) {
+                currentBatch.push(item);
+                if (currentBatch.length >= CHECKPOINT_SIZE) {
+                  await this.upsertPaymentMethods(
+                    currentBatch,
+                    accountId,
+                    syncParams?.backfillRelatedEntities
+                  );
+                  synced += currentBatch.length;
+                  await this.postgresClient.incrementObjectProgress(
+                    accountId,
+                    runStartedAt,
+                    resourceName,
+                    currentBatch.length
+                  );
+                  currentBatch = [];
+                }
+              }
+              hasMore = response.has_more;
+              if (response.data.length > 0) {
+                startingAfter = response.data[response.data.length - 1].id;
               }
             }
             if (currentBatch.length > 0) {
@@ -2129,7 +2611,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.products.list(params),
+        (pagination) => this.stripe.products.list({ ...params, ...pagination }),
         (products) => this.upsertProducts(products, accountId),
         accountId,
         "products",
@@ -2149,7 +2631,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.prices.list(params),
+        (pagination) => this.stripe.prices.list({ ...params, ...pagination }),
         (prices) => this.upsertPrices(prices, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "prices",
@@ -2169,7 +2651,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.plans.list(params),
+        (pagination) => this.stripe.plans.list({ ...params, ...pagination }),
         (plans) => this.upsertPlans(plans, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "plans",
@@ -2189,7 +2671,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.customers.list(params),
+        (pagination) => this.stripe.customers.list({ ...params, ...pagination }),
         // @ts-expect-error
         (items) => this.upsertCustomers(items, accountId),
         accountId,
@@ -2210,7 +2692,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.subscriptions.list(params),
+        (pagination) => this.stripe.subscriptions.list({ ...params, ...pagination }),
         (items) => this.upsertSubscriptions(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "subscriptions",
@@ -2233,7 +2715,7 @@ var StripeSync = class {
           this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
         }
         return this.fetchAndUpsert(
-          () => this.stripe.subscriptionSchedules.list(params),
+          (pagination) => this.stripe.subscriptionSchedules.list({ ...params, ...pagination }),
           (items) => this.upsertSubscriptionSchedules(items, accountId, syncParams?.backfillRelatedEntities),
           accountId,
           "subscription_schedules",
@@ -2254,7 +2736,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.invoices.list(params),
+        (pagination) => this.stripe.invoices.list({ ...params, ...pagination }),
         (items) => this.upsertInvoices(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "invoices",
@@ -2274,7 +2756,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.charges.list(params),
+        (pagination) => this.stripe.charges.list({ ...params, ...pagination }),
         (items) => this.upsertCharges(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "charges",
@@ -2294,7 +2776,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.setupIntents.list(params),
+        (pagination) => this.stripe.setupIntents.list({ ...params, ...pagination }),
         (items) => this.upsertSetupIntents(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "setup_intents",
@@ -2317,7 +2799,7 @@ var StripeSync = class {
           this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
         }
         return this.fetchAndUpsert(
-          () => this.stripe.paymentIntents.list(params),
+          (pagination) => this.stripe.paymentIntents.list({ ...params, ...pagination }),
           (items) => this.upsertPaymentIntents(items, accountId, syncParams?.backfillRelatedEntities),
           accountId,
           "payment_intents",
@@ -2332,7 +2814,7 @@ var StripeSync = class {
       const accountId = await this.getAccountId();
       const params = { limit: 100 };
       return this.fetchAndUpsert(
-        () => this.stripe.taxIds.list(params),
+        (pagination) => this.stripe.taxIds.list({ ...params, ...pagination }),
         (items) => this.upsertTaxIds(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "tax_ids",
@@ -2353,30 +2835,41 @@ var StripeSync = class {
         const customerIds = await this.postgresClient.query(prepared.text, prepared.values).then(({ rows }) => rows.map((it) => it.id));
         this.config.logger?.info(`Getting payment methods for ${customerIds.length} customers`);
         let synced = 0;
-        for (const customerIdChunk of chunkArray(customerIds, 10)) {
+        const chunkSize = this.config.maxConcurrentCustomers ?? 10;
+        for (const customerIdChunk of chunkArray(customerIds, chunkSize)) {
           await Promise.all(
             customerIdChunk.map(async (customerId) => {
               const CHECKPOINT_SIZE = 100;
               let currentBatch = [];
-              for await (const item of this.stripe.paymentMethods.list({
-                limit: 100,
-                customer: customerId
-              })) {
-                currentBatch.push(item);
-                if (currentBatch.length >= CHECKPOINT_SIZE) {
-                  await this.upsertPaymentMethods(
-                    currentBatch,
-                    accountId,
-                    syncParams?.backfillRelatedEntities
-                  );
-                  synced += currentBatch.length;
-                  await this.postgresClient.incrementObjectProgress(
-                    accountId,
-                    runStartedAt,
-                    "payment_methods",
-                    currentBatch.length
-                  );
-                  currentBatch = [];
+              let hasMore = true;
+              let startingAfter = void 0;
+              while (hasMore) {
+                const response = await this.stripe.paymentMethods.list({
+                  limit: 100,
+                  customer: customerId,
+                  ...startingAfter ? { starting_after: startingAfter } : {}
+                });
+                for (const item of response.data) {
+                  currentBatch.push(item);
+                  if (currentBatch.length >= CHECKPOINT_SIZE) {
+                    await this.upsertPaymentMethods(
+                      currentBatch,
+                      accountId,
+                      syncParams?.backfillRelatedEntities
+                    );
+                    synced += currentBatch.length;
+                    await this.postgresClient.incrementObjectProgress(
+                      accountId,
+                      runStartedAt,
+                      "payment_methods",
+                      currentBatch.length
+                    );
+                    currentBatch = [];
+                  }
+                }
+                hasMore = response.has_more;
+                if (response.data.length > 0) {
+                  startingAfter = response.data[response.data.length - 1].id;
                 }
               }
               if (currentBatch.length > 0) {
@@ -2413,7 +2906,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.disputes.list(params),
+        (pagination) => this.stripe.disputes.list({ ...params, ...pagination }),
         (items) => this.upsertDisputes(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "disputes",
@@ -2436,7 +2929,7 @@ var StripeSync = class {
           this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
         }
         return this.fetchAndUpsert(
-          () => this.stripe.radar.earlyFraudWarnings.list(params),
+          (pagination) => this.stripe.radar.earlyFraudWarnings.list({ ...params, ...pagination }),
           (items) => this.upsertEarlyFraudWarning(items, accountId, syncParams?.backfillRelatedEntities),
           accountId,
           "early_fraud_warnings",
@@ -2457,7 +2950,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.refunds.list(params),
+        (pagination) => this.stripe.refunds.list({ ...params, ...pagination }),
         (items) => this.upsertRefunds(items, accountId, syncParams?.backfillRelatedEntities),
         accountId,
         "refunds",
@@ -2477,7 +2970,7 @@ var StripeSync = class {
         this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
       }
       return this.fetchAndUpsert(
-        () => this.stripe.creditNotes.list(params),
+        (pagination) => this.stripe.creditNotes.list({ ...params, ...pagination }),
         (creditNotes) => this.upsertCreditNotes(creditNotes, accountId),
         accountId,
         "credit_notes",
@@ -2539,7 +3032,7 @@ var StripeSync = class {
           this.config.logger?.info(`Incremental sync from cursor: ${cursor}`);
         }
         return this.fetchAndUpsert(
-          () => this.stripe.checkout.sessions.list(params),
+          (pagination) => this.stripe.checkout.sessions.list({ ...params, ...pagination }),
           (items) => this.upsertCheckoutSessions(items, accountId, syncParams?.backfillRelatedEntities),
           accountId,
           "checkout_sessions",
@@ -2593,31 +3086,42 @@ var StripeSync = class {
     try {
       this.config.logger?.info("Fetching items to sync from Stripe");
       try {
-        for await (const item of fetch2()) {
-          currentBatch.push(item);
-          if (currentBatch.length >= CHECKPOINT_SIZE) {
-            this.config.logger?.info(`Upserting batch of ${currentBatch.length} items`);
-            await upsert(currentBatch, accountId);
-            totalSynced += currentBatch.length;
-            await this.postgresClient.incrementObjectProgress(
-              accountId,
-              runStartedAt,
-              resourceName,
-              currentBatch.length
-            );
-            const maxCreated = Math.max(
-              ...currentBatch.map((i) => i.created || 0)
-            );
-            if (maxCreated > 0) {
-              await this.postgresClient.updateObjectCursor(
+        let hasMore = true;
+        let startingAfter = void 0;
+        while (hasMore) {
+          const response = await fetch2(
+            startingAfter ? { starting_after: startingAfter } : void 0
+          );
+          for (const item of response.data) {
+            currentBatch.push(item);
+            if (currentBatch.length >= CHECKPOINT_SIZE) {
+              this.config.logger?.info(`Upserting batch of ${currentBatch.length} items`);
+              await upsert(currentBatch, accountId);
+              totalSynced += currentBatch.length;
+              await this.postgresClient.incrementObjectProgress(
                 accountId,
                 runStartedAt,
                 resourceName,
-                String(maxCreated)
+                currentBatch.length
+              );
+              const maxCreated = Math.max(
+                ...currentBatch.map((i) => i.created || 0)
               );
-              this.config.logger?.info(`Checkpoint: cursor updated to ${maxCreated}`);
+              if (maxCreated > 0) {
+                await this.postgresClient.updateObjectCursor(
+                  accountId,
+                  runStartedAt,
+                  resourceName,
+                  String(maxCreated)
+                );
+                this.config.logger?.info(`Checkpoint: cursor updated to ${maxCreated}`);
+              }
+              currentBatch = [];
             }
-            currentBatch = [];
+          }
+          hasMore = response.has_more;
+          if (response.data.length > 0) {
+            startingAfter = response.data[response.data.length - 1].id;
           }
         }
         if (currentBatch.length > 0) {
@@ -2985,10 +3489,18 @@ var StripeSync = class {
   async fillCheckoutSessionsLineItems(checkoutSessionIds, accountId, syncTimestamp) {
     for (const checkoutSessionId of checkoutSessionIds) {
       const lineItemResponses = [];
-      for await (const lineItem of this.stripe.checkout.sessions.listLineItems(checkoutSessionId, {
-        limit: 100
-      })) {
-        lineItemResponses.push(lineItem);
+      let hasMore = true;
+      let startingAfter = void 0;
+      while (hasMore) {
+        const response = await this.stripe.checkout.sessions.listLineItems(checkoutSessionId, {
+          limit: 100,
+          ...startingAfter ? { starting_after: startingAfter } : {}
+        });
+        lineItemResponses.push(...response.data);
+        hasMore = response.has_more;
+        if (response.data.length > 0) {
+          startingAfter = response.data[response.data.length - 1].id;
+        }
       }
       await this.upsertCheckoutSessionLineItems(
         lineItemResponses,
@@ -3302,14 +3814,25 @@ var StripeSync = class {
   };
   /**
    * Stripe only sends the first 10 entries by default, the option will actively fetch all entries.
+   * Uses manual pagination - each fetch() gets automatic retry protection.
    */
   async expandEntity(entities, property, listFn) {
     if (!this.config.autoExpandLists) return;
     for (const entity of entities) {
       if (entity[property]?.has_more) {
         const allData = [];
-        for await (const fetchedEntity of listFn(entity.id)) {
-          allData.push(fetchedEntity);
+        let hasMore = true;
+        let startingAfter = void 0;
+        while (hasMore) {
+          const response = await listFn(
+            entity.id,
+            startingAfter ? { starting_after: startingAfter } : void 0
+          );
+          allData.push(...response.data);
+          hasMore = response.has_more;
+          if (response.data.length > 0) {
+            startingAfter = response.data[response.data.length - 1].id;
+          }
         }
         entity[property] = {
           ...entity[property],
@@ -3434,7 +3957,9 @@ async function runMigrations(config) {
 var import_ws = __toESM(require("ws"), 1);
 var CLI_VERSION = "1.33.0";
 var PONG_WAIT = 10 * 1e3;
-var PING_PERIOD = PONG_WAIT * 2 / 10;
+var PING_PERIOD = PONG_WAIT * 9 / 10;
+var CONNECT_ATTEMPT_WAIT = 10 * 1e3;
+var DEFAULT_RECONNECT_INTERVAL = 60 * 1e3;
 function getClientUserAgent() {
   return JSON.stringify({
     name: "stripe-cli",
@@ -3463,129 +3988,215 @@ async function createCliSession(stripeApiKey) {
   }
   return await response.json();
 }
+function sleep3(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function createStripeWebSocketClient(options) {
   const { stripeApiKey, onEvent, onReady, onError, onClose } = options;
   const session = await createCliSession(stripeApiKey);
+  const reconnectInterval = session.reconnect_delay ? session.reconnect_delay * 1e3 : DEFAULT_RECONNECT_INTERVAL;
   let ws = null;
   let pingInterval = null;
+  let reconnectTimer = null;
   let connected = false;
-  let shouldReconnect = true;
-  function connect() {
-    const wsUrl = `${session.websocket_url}?websocket_feature=${encodeURIComponent(session.websocket_authorized_feature)}`;
-    ws = new import_ws.default(wsUrl, {
-      headers: {
-        "Accept-Encoding": "identity",
-        "User-Agent": `Stripe/v1 stripe-cli/${CLI_VERSION}`,
-        "X-Stripe-Client-User-Agent": getClientUserAgent(),
-        "Websocket-Id": session.websocket_id
+  let shouldRun = true;
+  let lastPongReceived = Date.now();
+  let notifyCloseResolve = null;
+  let stopResolve = null;
+  function cleanupConnection() {
+    if (pingInterval) {
+      clearInterval(pingInterval);
+      pingInterval = null;
+    }
+    if (reconnectTimer) {
+      clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+    }
+    if (ws) {
+      ws.removeAllListeners();
+      if (ws.readyState === import_ws.default.OPEN || ws.readyState === import_ws.default.CONNECTING) {
+        ws.close(1e3, "Resetting connection");
       }
-    });
-    ws.on("pong", () => {
-    });
-    ws.on("open", () => {
-      connected = true;
-      pingInterval = setInterval(() => {
-        if (ws && ws.readyState === import_ws.default.OPEN) {
-          ws.ping();
+      ws = null;
+    }
+    connected = false;
+  }
+  function setupWebSocket() {
+    return new Promise((resolve, reject) => {
+      lastPongReceived = Date.now();
+      const wsUrl = `${session.websocket_url}?websocket_feature=${encodeURIComponent(session.websocket_authorized_feature)}`;
+      ws = new import_ws.default(wsUrl, {
+        headers: {
+          "Accept-Encoding": "identity",
+          "User-Agent": `Stripe/v1 stripe-cli/${CLI_VERSION}`,
+          "X-Stripe-Client-User-Agent": getClientUserAgent(),
+          "Websocket-Id": session.websocket_id
         }
-      }, PING_PERIOD);
-      if (onReady) {
-        onReady(session.secret);
-      }
-    });
-    ws.on("message", async (data) => {
-      try {
-        const message = JSON.parse(data.toString());
-        const ack = {
-          type: "event_ack",
-          event_id: message.webhook_id,
-          webhook_conversation_id: message.webhook_conversation_id,
-          webhook_id: message.webhook_id
-        };
-        if (ws && ws.readyState === import_ws.default.OPEN) {
-          ws.send(JSON.stringify(ack));
+      });
+      const connectionTimeout = setTimeout(() => {
+        if (ws && ws.readyState === import_ws.default.CONNECTING) {
+          ws.terminate();
+          reject(new Error("WebSocket connection timeout"));
+        }
+      }, CONNECT_ATTEMPT_WAIT);
+      ws.on("pong", () => {
+        lastPongReceived = Date.now();
+      });
+      ws.on("open", () => {
+        clearTimeout(connectionTimeout);
+        connected = true;
+        pingInterval = setInterval(() => {
+          if (ws && ws.readyState === import_ws.default.OPEN) {
+            const timeSinceLastPong = Date.now() - lastPongReceived;
+            if (timeSinceLastPong > PONG_WAIT) {
+              if (onError) {
+                onError(new Error(`WebSocket stale: no pong in ${timeSinceLastPong}ms`));
+              }
+              if (notifyCloseResolve) {
+                notifyCloseResolve();
+                notifyCloseResolve = null;
+              }
+              ws.terminate();
+              return;
+            }
+            ws.ping();
+          }
+        }, PING_PERIOD);
+        if (onReady) {
+          onReady(session.secret);
         }
-        let response;
+        resolve();
+      });
+      ws.on("message", async (data) => {
         try {
-          const result = await onEvent(message);
-          response = {
-            type: "webhook_response",
-            webhook_id: message.webhook_id,
+          const message = JSON.parse(data.toString());
+          const ack = {
+            type: "event_ack",
+            event_id: message.webhook_id,
             webhook_conversation_id: message.webhook_conversation_id,
-            forward_url: "stripe-sync-engine",
-            status: result?.status ?? 200,
-            http_headers: {},
-            body: JSON.stringify({
-              event_type: result?.event_type,
-              event_id: result?.event_id,
-              database_url: result?.databaseUrl,
-              error: result?.error
-            }),
-            request_headers: message.http_headers,
-            request_body: message.event_payload,
-            notification_id: message.webhook_id
+            webhook_id: message.webhook_id
           };
+          if (ws && ws.readyState === import_ws.default.OPEN) {
+            ws.send(JSON.stringify(ack));
+          }
+          let response;
+          try {
+            const result = await onEvent(message);
+            response = {
+              type: "webhook_response",
+              webhook_id: message.webhook_id,
+              webhook_conversation_id: message.webhook_conversation_id,
+              forward_url: "stripe-sync-engine",
+              status: result?.status ?? 200,
+              http_headers: {},
+              body: JSON.stringify({
+                event_type: result?.event_type,
+                event_id: result?.event_id,
+                database_url: result?.databaseUrl,
+                error: result?.error
+              }),
+              request_headers: message.http_headers,
+              request_body: message.event_payload,
+              notification_id: message.webhook_id
+            };
+          } catch (err) {
+            const errorMessage = err instanceof Error ? err.message : String(err);
+            response = {
+              type: "webhook_response",
+              webhook_id: message.webhook_id,
+              webhook_conversation_id: message.webhook_conversation_id,
+              forward_url: "stripe-sync-engine",
+              status: 500,
+              http_headers: {},
+              body: JSON.stringify({ error: errorMessage }),
+              request_headers: message.http_headers,
+              request_body: message.event_payload,
+              notification_id: message.webhook_id
+            };
+            if (onError) {
+              onError(err instanceof Error ? err : new Error(errorMessage));
+            }
+          }
+          if (ws && ws.readyState === import_ws.default.OPEN) {
+            ws.send(JSON.stringify(response));
+          }
         } catch (err) {
-          const errorMessage = err instanceof Error ? err.message : String(err);
-          response = {
-            type: "webhook_response",
-            webhook_id: message.webhook_id,
-            webhook_conversation_id: message.webhook_conversation_id,
-            forward_url: "stripe-sync-engine",
-            status: 500,
-            http_headers: {},
-            body: JSON.stringify({ error: errorMessage }),
-            request_headers: message.http_headers,
-            request_body: message.event_payload,
-            notification_id: message.webhook_id
-          };
           if (onError) {
-            onError(err instanceof Error ? err : new Error(errorMessage));
+            onError(err instanceof Error ? err : new Error(String(err)));
           }
         }
-        if (ws && ws.readyState === import_ws.default.OPEN) {
-          ws.send(JSON.stringify(response));
-        }
-      } catch (err) {
+      });
+      ws.on("error", (error) => {
+        clearTimeout(connectionTimeout);
         if (onError) {
-          onError(err instanceof Error ? err : new Error(String(err)));
+          onError(error);
         }
-      }
-    });
-    ws.on("error", (error) => {
-      if (onError) {
-        onError(error);
-      }
+        if (!connected) {
+          reject(error);
+        }
+      });
+      ws.on("close", (code, reason) => {
+        clearTimeout(connectionTimeout);
+        connected = false;
+        if (pingInterval) {
+          clearInterval(pingInterval);
+          pingInterval = null;
+        }
+        if (onClose) {
+          onClose(code, reason.toString());
+        }
+        if (notifyCloseResolve) {
+          notifyCloseResolve();
+          notifyCloseResolve = null;
+        }
+      });
     });
-    ws.on("close", (code, reason) => {
+  }
+  async function runLoop() {
+    while (shouldRun) {
       connected = false;
-      if (pingInterval) {
-        clearInterval(pingInterval);
-        pingInterval = null;
-      }
-      if (onClose) {
-        onClose(code, reason.toString());
-      }
-      if (shouldReconnect) {
-        const delay = (session.reconnect_delay || 5) * 1e3;
-        setTimeout(() => {
-          connect();
-        }, delay);
+      let connectError = null;
+      do {
+        try {
+          await setupWebSocket();
+          connectError = null;
+        } catch (err) {
+          connectError = err instanceof Error ? err : new Error(String(err));
+          if (onError) {
+            onError(connectError);
+          }
+          if (shouldRun) {
+            await sleep3(CONNECT_ATTEMPT_WAIT);
+          }
+        }
+      } while (connectError && shouldRun);
+      if (!shouldRun) break;
+      await new Promise((resolve) => {
+        notifyCloseResolve = resolve;
+        stopResolve = resolve;
+        reconnectTimer = setTimeout(() => {
+          cleanupConnection();
+          resolve();
+        }, reconnectInterval);
+      });
+      if (reconnectTimer) {
+        clearTimeout(reconnectTimer);
+        reconnectTimer = null;
       }
-    });
+      notifyCloseResolve = null;
+      stopResolve = null;
+    }
+    cleanupConnection();
   }
-  connect();
+  runLoop();
   return {
     close: () => {
-      shouldReconnect = false;
-      if (pingInterval) {
-        clearInterval(pingInterval);
-        pingInterval = null;
-      }
-      if (ws) {
-        ws.close(1e3, "Connection Done");
-        ws = null;
+      shouldRun = false;
+      if (stopResolve) {
+        stopResolve();
+        stopResolve = null;
       }
+      cleanupConnection();
     },
     isConnected: () => connected
   };
@@ -3631,13 +4242,13 @@ Creating ngrok tunnel for port ${port}...`));
 var import_supabase_management_js = require("supabase-management-js");
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-setup.ts
-var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `https://api.supabase.com/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `https://api.supabase.com/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Parse request body\n      const body = await req.json()\n      const { supabase_access_token, supabase_project_ref } = body\n\n      if (!supabase_access_token || !supabase_project_ref) {\n        throw new Error(\n          'supabase_access_token and supabase_project_ref are required in request body'\n        )\n      }\n\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_service_role_key'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(supabase_project_ref, 'STRIPE_SECRET_KEY', supabase_access_token)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(supabase_project_ref, 'stripe-setup', supabase_access_token)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(supabase_project_ref, 'stripe-webhook', supabase_access_token)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(supabase_project_ref, 'stripe-worker', supabase_access_token)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
+var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `https://api.supabase.com/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `https://api.supabase.com/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `https://api.supabase.com/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-webhook.ts
 var stripe_webhook_default = "import { StripeSync } from 'npm:stripe-experiment-sync'\n\nDeno.serve(async (req) => {\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  const sig = req.headers.get('stripe-signature')\n  if (!sig) {\n    return new Response('Missing stripe-signature header', { status: 400 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  const stripeSync = new StripeSync({\n    poolConfig: { connectionString: dbUrl, max: 1 },\n    stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n  })\n\n  try {\n    const rawBody = new Uint8Array(await req.arrayBuffer())\n    await stripeSync.processWebhook(rawBody, sig)\n    return new Response(JSON.stringify({ received: true }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Webhook processing error:', error)\n    const isSignatureError =\n      error.message?.includes('signature') || error.type === 'StripeSignatureVerificationError'\n    const status = isSignatureError ? 400 : 500\n    return new Response(JSON.stringify({ error: error.message }), {\n      status,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    await stripeSync.postgresClient.pool.end()\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-worker.ts
-var stripe_worker_default = "/**\n * Stripe Sync Worker\n *\n * Triggered by pg_cron at a configurable interval (default: 60 seconds). Uses pgmq for durable work queue.\n *\n * Flow:\n * 1. Read batch of messages from pgmq (qty=10, vt=60s)\n * 2. If queue empty: enqueue all objects (continuous sync)\n * 3. Process messages in parallel (Promise.all):\n *    - processNext(object)\n *    - Delete message on success\n *    - Re-enqueue if hasMore\n * 4. Return results summary\n *\n * Concurrency:\n * - Multiple workers can run concurrently via overlapping pg_cron triggers.\n * - Each worker processes its batch of messages in parallel (Promise.all).\n * - pgmq visibility timeout prevents duplicate message reads across workers.\n * - processNext() is idempotent (uses internal cursor tracking), so duplicate\n *   processing on timeout/crash is safe.\n */\n\nimport { StripeSync } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\nconst QUEUE_NAME = 'stripe_sync_work'\nconst VISIBILITY_TIMEOUT = 60 // seconds\nconst BATCH_SIZE = 10\n\nDeno.serve(async (req) => {\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  let sql\n  let stripeSync\n\n  try {\n    sql = postgres(dbUrl, { max: 1, prepare: false })\n  } catch (error) {\n    return new Response(\n      JSON.stringify({\n        error: 'Failed to create postgres connection',\n        details: error.message,\n        stack: error.stack,\n      }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } }\n    )\n  }\n\n  try {\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 1 },\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n    })\n  } catch (error) {\n    await sql.end()\n    return new Response(\n      JSON.stringify({\n        error: 'Failed to create StripeSync',\n        details: error.message,\n        stack: error.stack,\n      }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } }\n    )\n  }\n\n  try {\n    // Read batch of messages from queue\n    const messages = await sql`\n      SELECT * FROM pgmq.read(${QUEUE_NAME}::text, ${VISIBILITY_TIMEOUT}::int, ${BATCH_SIZE}::int)\n    `\n\n    // If queue empty, enqueue all objects for continuous sync\n    if (messages.length === 0) {\n      // Create sync run to make enqueued work visible (status='pending')\n      const { objects } = await stripeSync.joinOrCreateSyncRun('worker')\n      const msgs = objects.map((object) => JSON.stringify({ object }))\n\n      await sql`\n        SELECT pgmq.send_batch(\n          ${QUEUE_NAME}::text,\n          ${sql.array(msgs)}::jsonb[]\n        )\n      `\n\n      return new Response(JSON.stringify({ enqueued: objects.length, objects }), {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    // Process messages in parallel\n    const results = await Promise.all(\n      messages.map(async (msg) => {\n        const { object } = msg.message as { object: string }\n\n        try {\n          const result = await stripeSync.processNext(object)\n\n          // Delete message on success (cast to bigint to disambiguate overloaded function)\n          await sql`SELECT pgmq.delete(${QUEUE_NAME}::text, ${msg.msg_id}::bigint)`\n\n          // Re-enqueue if more pages\n          if (result.hasMore) {\n            await sql`SELECT pgmq.send(${QUEUE_NAME}::text, ${sql.json({ object })}::jsonb)`\n          }\n\n          return { object, ...result }\n        } catch (error) {\n          // Log error but continue to next message\n          // Message will become visible again after visibility timeout\n          console.error(`Error processing ${object}:`, error)\n          return {\n            object,\n            processed: 0,\n            hasMore: false,\n            error: error.message,\n            stack: error.stack,\n          }\n        }\n      })\n    )\n\n    return new Response(JSON.stringify({ results }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Worker error:', error)\n    return new Response(JSON.stringify({ error: error.message, stack: error.stack }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    if (sql) await sql.end()\n    if (stripeSync) await stripeSync.postgresClient.pool.end()\n  }\n})\n";
+var stripe_worker_default = "/**\n * Stripe Sync Worker\n *\n * Triggered by pg_cron at a configurable interval (default: 60 seconds). Uses pgmq for durable work queue.\n *\n * Flow:\n * 1. Read batch of messages from pgmq (qty=10, vt=60s)\n * 2. If queue empty: enqueue all objects (continuous sync)\n * 3. Process messages in parallel (Promise.all):\n *    - processNext(object)\n *    - Delete message on success\n *    - Re-enqueue if hasMore\n * 4. Return results summary\n *\n * Concurrency:\n * - Multiple workers can run concurrently via overlapping pg_cron triggers.\n * - Each worker processes its batch of messages in parallel (Promise.all).\n * - pgmq visibility timeout prevents duplicate message reads across workers.\n * - processNext() is idempotent (uses internal cursor tracking), so duplicate\n *   processing on timeout/crash is safe.\n */\n\nimport { StripeSync } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\nconst QUEUE_NAME = 'stripe_sync_work'\nconst VISIBILITY_TIMEOUT = 60 // seconds\nconst BATCH_SIZE = 10\n\nDeno.serve(async (req) => {\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const token = authHeader.substring(7) // Remove 'Bearer '\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  let sql\n  let stripeSync\n\n  try {\n    sql = postgres(dbUrl, { max: 1, prepare: false })\n  } catch (error) {\n    return new Response(\n      JSON.stringify({\n        error: 'Failed to create postgres connection',\n        details: error.message,\n        stack: error.stack,\n      }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } }\n    )\n  }\n\n  try {\n    // Validate that the token matches the unique worker secret stored in vault\n    const vaultResult = await sql`\n      SELECT decrypted_secret\n      FROM vault.decrypted_secrets\n      WHERE name = 'stripe_sync_worker_secret'\n    `\n\n    if (vaultResult.length === 0) {\n      await sql.end()\n      return new Response('Worker secret not configured in vault', { status: 500 })\n    }\n\n    const storedSecret = vaultResult[0].decrypted_secret\n    if (token !== storedSecret) {\n      await sql.end()\n      return new Response('Forbidden: Invalid worker secret', { status: 403 })\n    }\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 1 },\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n      enableSigma: (Deno.env.get('ENABLE_SIGMA') ?? 'false') === 'true',\n    })\n  } catch (error) {\n    await sql.end()\n    return new Response(\n      JSON.stringify({\n        error: 'Failed to create StripeSync',\n        details: error.message,\n        stack: error.stack,\n      }),\n      { status: 500, headers: { 'Content-Type': 'application/json' } }\n    )\n  }\n\n  try {\n    // Read batch of messages from queue\n    const messages = await sql`\n      SELECT * FROM pgmq.read(${QUEUE_NAME}::text, ${VISIBILITY_TIMEOUT}::int, ${BATCH_SIZE}::int)\n    `\n\n    // If queue empty, enqueue all objects for continuous sync\n    if (messages.length === 0) {\n      // Create sync run to make enqueued work visible (status='pending')\n      const { objects } = await stripeSync.joinOrCreateSyncRun('worker')\n      const msgs = objects.map((object) => JSON.stringify({ object }))\n\n      await sql`\n        SELECT pgmq.send_batch(\n          ${QUEUE_NAME}::text,\n          ${sql.array(msgs)}::jsonb[]\n        )\n      `\n\n      return new Response(JSON.stringify({ enqueued: objects.length, objects }), {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    // Process messages in parallel\n    const results = await Promise.all(\n      messages.map(async (msg) => {\n        const { object } = msg.message as { object: string }\n\n        try {\n          const result = await stripeSync.processNext(object)\n\n          // Delete message on success (cast to bigint to disambiguate overloaded function)\n          await sql`SELECT pgmq.delete(${QUEUE_NAME}::text, ${msg.msg_id}::bigint)`\n\n          // Re-enqueue if more pages\n          if (result.hasMore) {\n            await sql`SELECT pgmq.send(${QUEUE_NAME}::text, ${sql.json({ object })}::jsonb)`\n          }\n\n          return { object, ...result }\n        } catch (error) {\n          // Log error but continue to next message\n          // Message will become visible again after visibility timeout\n          console.error(`Error processing ${object}:`, error)\n          return {\n            object,\n            processed: 0,\n            hasMore: false,\n            error: error.message,\n            stack: error.stack,\n          }\n        }\n      })\n    )\n\n    return new Response(JSON.stringify({ results }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Worker error:', error)\n    return new Response(JSON.stringify({ error: error.message, stack: error.stack }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    if (sql) await sql.end()\n    if (stripeSync) await stripeSync.postgresClient.pool.end()\n  }\n})\n";
 
 // src/supabase/edge-function-code.ts
 var setupFunctionCode = stripe_setup_default;
@@ -3735,8 +4346,8 @@ var SupabaseSetupClient = class {
         `Invalid interval: ${intervalSeconds}. Must be either 1-59 seconds or a multiple of 60 (e.g., 60, 120, 180).`
       );
     }
-    const serviceRoleKey = await this.getServiceRoleKey();
-    const escapedServiceRoleKey = serviceRoleKey.replace(/'/g, "''");
+    const workerSecret = crypto.randomUUID();
+    const escapedWorkerSecret = workerSecret.replace(/'/g, "''");
     const sql3 = `
       -- Enable extensions
       CREATE EXTENSION IF NOT EXISTS pg_cron;
@@ -3749,10 +4360,10 @@ var SupabaseSetupClient = class {
         SELECT 1 FROM pgmq.list_queues() WHERE queue_name = 'stripe_sync_work'
       );
 
-      -- Store service role key in vault for pg_cron to use
+      -- Store unique worker secret in vault for pg_cron to use
       -- Delete existing secret if it exists, then create new one
-      DELETE FROM vault.secrets WHERE name = 'stripe_sync_service_role_key';
-      SELECT vault.create_secret('${escapedServiceRoleKey}', 'stripe_sync_service_role_key');
+      DELETE FROM vault.secrets WHERE name = 'stripe_sync_worker_secret';
+      SELECT vault.create_secret('${escapedWorkerSecret}', 'stripe_sync_worker_secret');
 
       -- Delete existing jobs if they exist
       SELECT cron.unschedule('stripe-sync-worker') WHERE EXISTS (
@@ -3771,7 +4382,7 @@ var SupabaseSetupClient = class {
         SELECT net.http_post(
           url := 'https://${this.projectRef}.${this.projectBaseUrl}/functions/v1/stripe-worker',
           headers := jsonb_build_object(
-            'Authorization', 'Bearer ' || (SELECT decrypted_secret FROM vault.decrypted_secrets WHERE name = 'stripe_sync_service_role_key')
+            'Authorization', 'Bearer ' || (SELECT decrypted_secret FROM vault.decrypted_secrets WHERE name = 'stripe_sync_worker_secret')
           )
         )
         $$
@@ -3785,17 +4396,6 @@ var SupabaseSetupClient = class {
   getWebhookUrl() {
     return `https://${this.projectRef}.${this.projectBaseUrl}/functions/v1/stripe-webhook`;
   }
-  /**
-   * Get the service role key for this project (needed to invoke Edge Functions)
-   */
-  async getServiceRoleKey() {
-    const apiKeys = await this.api.getProjectApiKeys(this.projectRef);
-    const serviceRoleKey = apiKeys?.find((k) => k.name === "service_role");
-    if (!serviceRoleKey) {
-      throw new Error("Could not find service_role API key");
-    }
-    return serviceRoleKey.api_key;
-  }
   /**
    * Get the anon key for this project (needed for Realtime subscriptions)
    */
@@ -3816,12 +4416,12 @@ var SupabaseSetupClient = class {
   /**
    * Invoke an Edge Function
    */
-  async invokeFunction(name, serviceRoleKey) {
+  async invokeFunction(name, bearerToken) {
     const url = `https://${this.projectRef}.${this.projectBaseUrl}/functions/v1/${name}`;
     const response = await fetch(url, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${serviceRoleKey}`,
+        Authorization: `Bearer ${bearerToken}`,
         "Content-Type": "application/json"
       }
     });
@@ -3928,18 +4528,13 @@ var SupabaseSetupClient = class {
    */
   async uninstall() {
     try {
-      const serviceRoleKey = await this.getServiceRoleKey();
       const url = `https://${this.projectRef}.${this.projectBaseUrl}/functions/v1/stripe-setup`;
       const response = await fetch(url, {
         method: "DELETE",
         headers: {
-          Authorization: `Bearer ${serviceRoleKey}`,
+          Authorization: `Bearer ${this.accessToken}`,
           "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          supabase_access_token: this.accessToken,
-          supabase_project_ref: this.projectRef
-        })
+        }
       });
       if (!response.ok) {
         const text = await response.text();
@@ -3980,12 +4575,11 @@ var SupabaseSetupClient = class {
       const versionedSetup = this.injectPackageVersion(setupFunctionCode, version);
       const versionedWebhook = this.injectPackageVersion(webhookFunctionCode, version);
       const versionedWorker = this.injectPackageVersion(workerFunctionCode, version);
-      await this.deployFunction("stripe-setup", versionedSetup, true);
+      await this.deployFunction("stripe-setup", versionedSetup, false);
       await this.deployFunction("stripe-webhook", versionedWebhook, false);
-      await this.deployFunction("stripe-worker", versionedWorker, true);
+      await this.deployFunction("stripe-worker", versionedWorker, false);
       await this.setSecrets([{ name: "STRIPE_SECRET_KEY", value: trimmedStripeKey }]);
-      const serviceRoleKey = await this.getServiceRoleKey();
-      const setupResult = await this.invokeFunction("stripe-setup", serviceRoleKey);
+      const setupResult = await this.invokeFunction("stripe-setup", this.accessToken);
       if (!setupResult.success) {
         throw new Error(`Setup failed: ${setupResult.error}`);
       }
@@ -4048,7 +4642,9 @@ var VALID_SYNC_OBJECTS = [
   "credit_note",
   "early_fraud_warning",
   "refund",
-  "checkout_sessions"
+  "checkout_sessions",
+  "subscription_item_change_events_v2_beta",
+  "exchange_rates_from_usd"
 ];
 async function backfillCommand(options, entityName) {
   let stripeSync = null;
@@ -4077,8 +4673,8 @@ async function backfillCommand(options, entityName) {
             if (!input || input.trim() === "") {
               return "Stripe API key is required";
             }
-            if (!input.startsWith("sk_")) {
-              return 'Stripe API key should start with "sk_"';
+            if (!input.startsWith("sk_") && !input.startsWith("rk_")) {
+              return 'Stripe API key should start with "sk_" or "rk_"';
             }
             return true;
           }
@@ -4135,6 +4731,7 @@ async function backfillCommand(options, entityName) {
     stripeSync = new StripeSync({
       databaseUrl: config.databaseUrl,
       stripeSecretKey: config.stripeApiKey,
+      enableSigma: process.env.ENABLE_SIGMA === "true",
       stripeApiVersion: process.env.STRIPE_API_VERSION || "2020-08-27",
       autoExpandLists: process.env.AUTO_EXPAND_LISTS === "true",
       backfillRelatedEntities: process.env.BACKFILL_RELATED_ENTITIES !== "false",
@@ -4273,7 +4870,7 @@ Cleaning up... (signal: ${signal || "manual"})`));
   process.on("SIGTERM", () => cleanup("SIGTERM"));
   try {
     const config = await loadConfig(options);
-    const useWebSocketMode = !config.ngrokAuthToken;
+    const useWebSocketMode = process.env.USE_WEBSOCKET === "true" || !config.ngrokAuthToken;
     const modeLabel = useWebSocketMode ? "WebSocket" : "Webhook (ngrok)";
     console.log(import_chalk3.default.blue(`
 Mode: ${modeLabel}`));
@@ -4298,6 +4895,7 @@ Mode: ${modeLabel}`));
     stripeSync = new StripeSync({
       databaseUrl: config.databaseUrl,
       stripeSecretKey: config.stripeApiKey,
+      enableSigma: config.enableSigma,
       stripeApiVersion: process.env.STRIPE_API_VERSION || "2020-08-27",
       autoExpandLists: process.env.AUTO_EXPAND_LISTS === "true",
       backfillRelatedEntities: process.env.BACKFILL_RELATED_ENTITIES !== "false",
@@ -4445,7 +5043,8 @@ async function installCommand(options) {
           mask: "*",
           validate: (input) => {
             if (!input.trim()) return "Stripe key is required";
-            if (!input.startsWith("sk_")) return 'Stripe key should start with "sk_"';
+            if (!input.startsWith("sk_") && !input.startsWith("rk_"))
+              return 'Stripe key should start with "sk_" or "rk_"';
             return true;
           }
         });
@@ -4547,11 +5146,12 @@ program.command("migrate").description("Run database migrations only").option("-
     databaseUrl: options.databaseUrl
   });
 });
-program.command("start").description("Start Stripe sync").option("--stripe-key <key>", "Stripe API key (or STRIPE_API_KEY env)").option("--ngrok-token <token>", "ngrok auth token (or NGROK_AUTH_TOKEN env)").option("--database-url <url>", "Postgres DATABASE_URL (or DATABASE_URL env)").action(async (options) => {
+program.command("start").description("Start Stripe sync").option("--stripe-key <key>", "Stripe API key (or STRIPE_API_KEY env)").option("--ngrok-token <token>", "ngrok auth token (or NGROK_AUTH_TOKEN env)").option("--database-url <url>", "Postgres DATABASE_URL (or DATABASE_URL env)").option("--sigma", "Sync Sigma data (requires Sigma access in Stripe API key)").action(async (options) => {
   await syncCommand({
     stripeKey: options.stripeKey,
     ngrokToken: options.ngrokToken,
-    databaseUrl: options.databaseUrl
+    databaseUrl: options.databaseUrl,
+    enableSigma: options.sigma
   });
 });
 program.command("backfill <entityName>").description("Backfill a specific entity type from Stripe (e.g., customer, invoice, product)").option("--stripe-key <key>", "Stripe API key (or STRIPE_API_KEY env)").option("--database-url <url>", "Postgres DATABASE_URL (or DATABASE_URL env)").action(async (entityName, options) => {