stripe-experiment-sync 1.0.16 → 1.0.18

package/dist/{chunk-QHM3A4VW.js → chunk-HV64EIZU.js}

@@ -2,11 +2,11 @@ import {
   StripeSync,
   createStripeWebSocketClient,
   runMigrations
-} from "./chunk-NI6UMBIL.js";
+} from "./chunk-K4JQHI7Y.js";
 import {
   install,
   uninstall
-} from "./chunk-2Q3SNSKG.js";
+} from "./chunk-M5TTM27L.js";
 
 // src/cli/config.ts
 import dotenv from "dotenv";

package/dist/{chunk-NI6UMBIL.js → chunk-K4JQHI7Y.js}

@@ -1,6 +1,6 @@
 import {
   package_default
-} from "./chunk-VOYYTAJF.js";
+} from "./chunk-XO57OJUE.js";
 
 // src/stripeSync.ts
 import Stripe3 from "stripe";
@@ -505,15 +505,17 @@ var PostgresClient = class {
   /**
    * Create object run entries for a sync run.
    * All objects start as 'pending'.
+   *
+   * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
    */
-  async createObjectRuns(accountId, runStartedAt, objects) {
-    if (objects.length === 0) return;
-    const values = objects.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
+  async createObjectRuns(accountId, runStartedAt, resourceNames) {
+    if (resourceNames.length === 0) return;
+    const values = resourceNames.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
     await this.query(
       `INSERT INTO "${this.config.schema}"."_sync_obj_runs" ("_account_id", run_started_at, object)
        VALUES ${values}
        ON CONFLICT ("_account_id", run_started_at, object) DO NOTHING`,
-      [accountId, runStartedAt, ...objects]
+      [accountId, runStartedAt, ...resourceNames]
     );
   }
   /**
@@ -2238,31 +2240,43 @@ var StripeSync = class {
    * This is used by workers and background processes that should cooperate.
    *
    * @param triggeredBy - What triggered this sync (for observability)
+   * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
    * @returns Run key and list of objects to sync
    */
-  async joinOrCreateSyncRun(triggeredBy = "worker") {
+  async joinOrCreateSyncRun(triggeredBy = "worker", objectFilter) {
     await this.getCurrentAccount();
     const accountId = await this.getAccountId();
     const result = await this.postgresClient.getOrCreateSyncRun(accountId, triggeredBy);
+    const objects = objectFilter === "all" || objectFilter === void 0 ? this.getSupportedSyncObjects() : [objectFilter];
     if (!result) {
       const activeRun = await this.postgresClient.getActiveSyncRun(accountId);
       if (!activeRun) {
         throw new Error("Failed to get or create sync run");
       }
+      await this.postgresClient.createObjectRuns(
+        activeRun.accountId,
+        activeRun.runStartedAt,
+        objects.map((obj) => this.getResourceName(obj))
+      );
       return {
         runKey: { accountId: activeRun.accountId, runStartedAt: activeRun.runStartedAt },
-        objects: this.getSupportedSyncObjects()
+        objects
       };
     }
     const { accountId: runAccountId, runStartedAt } = result;
+    await this.postgresClient.createObjectRuns(
+      runAccountId,
+      runStartedAt,
+      objects.map((obj) => this.getResourceName(obj))
+    );
     return {
       runKey: { accountId: runAccountId, runStartedAt },
-      objects: this.getSupportedSyncObjects()
+      objects
     };
   }
   async processUntilDone(params) {
     const { object } = params ?? { object: "all" };
-    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone");
+    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone", object);
     return this.processUntilDoneWithRun(runKey.runStartedAt, object, params);
   }
   /**

package/dist/{chunk-2Q3SNSKG.js → chunk-M5TTM27L.js}

@@ -1,12 +1,12 @@
 import {
   package_default
-} from "./chunk-VOYYTAJF.js";
+} from "./chunk-XO57OJUE.js";
 
 // src/supabase/supabase.ts
 import { SupabaseManagementAPI } from "supabase-management-js";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-setup.ts
-var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('SUPABASE_MANAGEMENT_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
+var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('MANAGEMENT_API_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-webhook.ts
 var stripe_webhook_default = "import { StripeSync } from 'npm:stripe-experiment-sync'\n\nDeno.serve(async (req) => {\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  const sig = req.headers.get('stripe-signature')\n  if (!sig) {\n    return new Response('Missing stripe-signature header', { status: 400 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  const stripeSync = new StripeSync({\n    poolConfig: { connectionString: dbUrl, max: 1 },\n    stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n  })\n\n  try {\n    const rawBody = new Uint8Array(await req.arrayBuffer())\n    await stripeSync.processWebhook(rawBody, sig)\n    return new Response(JSON.stringify({ received: true }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Webhook processing error:', error)\n    const isSignatureError =\n      error.message?.includes('signature') || error.type === 'StripeSignatureVerificationError'\n    const status = isSignatureError ? 400 : 500\n    return new Response(JSON.stringify({ error: error.message }), {\n      status,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    await stripeSync.postgresClient.pool.end()\n  }\n})\n";
@@ -346,7 +346,7 @@ var SupabaseSetupClient = class {
       await this.deployFunction("stripe-worker", versionedWorker, false);
       const secrets = [{ name: "STRIPE_SECRET_KEY", value: trimmedStripeKey }];
       if (this.supabaseManagementUrl) {
-        secrets.push({ name: "SUPABASE_MANAGEMENT_URL", value: this.supabaseManagementUrl });
+        secrets.push({ name: "MANAGEMENT_API_URL", value: this.supabaseManagementUrl });
       }
       await this.setSecrets(secrets);
       const setupResult = await this.invokeFunction("stripe-setup", this.accessToken);

package/dist/{chunk-VOYYTAJF.js → chunk-XO57OJUE.js}

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.16",
+  version: "1.0.18",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",

package/dist/cli/index.cjs

@@ -33,7 +33,7 @@ var import_commander = require("commander");
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.16",
+  version: "1.0.18",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",
@@ -687,15 +687,17 @@ var PostgresClient = class {
   /**
    * Create object run entries for a sync run.
    * All objects start as 'pending'.
+   *
+   * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
    */
-  async createObjectRuns(accountId, runStartedAt, objects) {
-    if (objects.length === 0) return;
-    const values = objects.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
+  async createObjectRuns(accountId, runStartedAt, resourceNames) {
+    if (resourceNames.length === 0) return;
+    const values = resourceNames.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
     await this.query(
       `INSERT INTO "${this.config.schema}"."_sync_obj_runs" ("_account_id", run_started_at, object)
        VALUES ${values}
        ON CONFLICT ("_account_id", run_started_at, object) DO NOTHING`,
-      [accountId, runStartedAt, ...objects]
+      [accountId, runStartedAt, ...resourceNames]
     );
   }
   /**
@@ -2420,31 +2422,43 @@ var StripeSync = class {
    * This is used by workers and background processes that should cooperate.
    *
    * @param triggeredBy - What triggered this sync (for observability)
+   * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
    * @returns Run key and list of objects to sync
    */
-  async joinOrCreateSyncRun(triggeredBy = "worker") {
+  async joinOrCreateSyncRun(triggeredBy = "worker", objectFilter) {
     await this.getCurrentAccount();
     const accountId = await this.getAccountId();
     const result = await this.postgresClient.getOrCreateSyncRun(accountId, triggeredBy);
+    const objects = objectFilter === "all" || objectFilter === void 0 ? this.getSupportedSyncObjects() : [objectFilter];
     if (!result) {
       const activeRun = await this.postgresClient.getActiveSyncRun(accountId);
       if (!activeRun) {
         throw new Error("Failed to get or create sync run");
       }
+      await this.postgresClient.createObjectRuns(
+        activeRun.accountId,
+        activeRun.runStartedAt,
+        objects.map((obj) => this.getResourceName(obj))
+      );
       return {
         runKey: { accountId: activeRun.accountId, runStartedAt: activeRun.runStartedAt },
-        objects: this.getSupportedSyncObjects()
+        objects
       };
     }
     const { accountId: runAccountId, runStartedAt } = result;
+    await this.postgresClient.createObjectRuns(
+      runAccountId,
+      runStartedAt,
+      objects.map((obj) => this.getResourceName(obj))
+    );
     return {
       runKey: { accountId: runAccountId, runStartedAt },
-      objects: this.getSupportedSyncObjects()
+      objects
     };
   }
   async processUntilDone(params) {
     const { object } = params ?? { object: "all" };
-    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone");
+    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone", object);
     return this.processUntilDoneWithRun(runKey.runStartedAt, object, params);
   }
   /**
@@ -4250,7 +4264,7 @@ Creating ngrok tunnel for port ${port}...`));
 var import_supabase_management_js = require("supabase-management-js");
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-setup.ts
-var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('SUPABASE_MANAGEMENT_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
+var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('MANAGEMENT_API_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-webhook.ts
 var stripe_webhook_default = "import { StripeSync } from 'npm:stripe-experiment-sync'\n\nDeno.serve(async (req) => {\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  const sig = req.headers.get('stripe-signature')\n  if (!sig) {\n    return new Response('Missing stripe-signature header', { status: 400 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  const stripeSync = new StripeSync({\n    poolConfig: { connectionString: dbUrl, max: 1 },\n    stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n  })\n\n  try {\n    const rawBody = new Uint8Array(await req.arrayBuffer())\n    await stripeSync.processWebhook(rawBody, sig)\n    return new Response(JSON.stringify({ received: true }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Webhook processing error:', error)\n    const isSignatureError =\n      error.message?.includes('signature') || error.type === 'StripeSignatureVerificationError'\n    const status = isSignatureError ? 400 : 500\n    return new Response(JSON.stringify({ error: error.message }), {\n      status,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    await stripeSync.postgresClient.pool.end()\n  }\n})\n";
@@ -4590,7 +4604,7 @@ var SupabaseSetupClient = class {
       await this.deployFunction("stripe-worker", versionedWorker, false);
       const secrets = [{ name: "STRIPE_SECRET_KEY", value: trimmedStripeKey }];
       if (this.supabaseManagementUrl) {
-        secrets.push({ name: "SUPABASE_MANAGEMENT_URL", value: this.supabaseManagementUrl });
+        secrets.push({ name: "MANAGEMENT_API_URL", value: this.supabaseManagementUrl });
       }
       await this.setSecrets(secrets);
       const setupResult = await this.invokeFunction("stripe-setup", this.accessToken);

package/dist/cli/index.js

@@ -5,12 +5,12 @@ import {
   migrateCommand,
   syncCommand,
   uninstallCommand
-} from "../chunk-QHM3A4VW.js";
-import "../chunk-NI6UMBIL.js";
-import "../chunk-2Q3SNSKG.js";
+} from "../chunk-HV64EIZU.js";
+import "../chunk-K4JQHI7Y.js";
+import "../chunk-M5TTM27L.js";
 import {
   package_default
-} from "../chunk-VOYYTAJF.js";
+} from "../chunk-XO57OJUE.js";
 
 // src/cli/index.ts
 import { Command } from "commander";

package/dist/cli/lib.cjs

@@ -117,7 +117,7 @@ async function loadConfig(options) {
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.16",
+  version: "1.0.18",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",
@@ -701,15 +701,17 @@ var PostgresClient = class {
   /**
    * Create object run entries for a sync run.
    * All objects start as 'pending'.
+   *
+   * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
    */
-  async createObjectRuns(accountId, runStartedAt, objects) {
-    if (objects.length === 0) return;
-    const values = objects.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
+  async createObjectRuns(accountId, runStartedAt, resourceNames) {
+    if (resourceNames.length === 0) return;
+    const values = resourceNames.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
     await this.query(
       `INSERT INTO "${this.config.schema}"."_sync_obj_runs" ("_account_id", run_started_at, object)
        VALUES ${values}
        ON CONFLICT ("_account_id", run_started_at, object) DO NOTHING`,
-      [accountId, runStartedAt, ...objects]
+      [accountId, runStartedAt, ...resourceNames]
     );
   }
   /**
@@ -2434,31 +2436,43 @@ var StripeSync = class {
    * This is used by workers and background processes that should cooperate.
    *
    * @param triggeredBy - What triggered this sync (for observability)
+   * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
    * @returns Run key and list of objects to sync
    */
-  async joinOrCreateSyncRun(triggeredBy = "worker") {
+  async joinOrCreateSyncRun(triggeredBy = "worker", objectFilter) {
     await this.getCurrentAccount();
     const accountId = await this.getAccountId();
     const result = await this.postgresClient.getOrCreateSyncRun(accountId, triggeredBy);
+    const objects = objectFilter === "all" || objectFilter === void 0 ? this.getSupportedSyncObjects() : [objectFilter];
     if (!result) {
       const activeRun = await this.postgresClient.getActiveSyncRun(accountId);
       if (!activeRun) {
         throw new Error("Failed to get or create sync run");
       }
+      await this.postgresClient.createObjectRuns(
+        activeRun.accountId,
+        activeRun.runStartedAt,
+        objects.map((obj) => this.getResourceName(obj))
+      );
       return {
         runKey: { accountId: activeRun.accountId, runStartedAt: activeRun.runStartedAt },
-        objects: this.getSupportedSyncObjects()
+        objects
       };
     }
     const { accountId: runAccountId, runStartedAt } = result;
+    await this.postgresClient.createObjectRuns(
+      runAccountId,
+      runStartedAt,
+      objects.map((obj) => this.getResourceName(obj))
+    );
     return {
       runKey: { accountId: runAccountId, runStartedAt },
-      objects: this.getSupportedSyncObjects()
+      objects
     };
   }
   async processUntilDone(params) {
     const { object } = params ?? { object: "all" };
-    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone");
+    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone", object);
     return this.processUntilDoneWithRun(runKey.runStartedAt, object, params);
   }
   /**
@@ -4264,7 +4278,7 @@ Creating ngrok tunnel for port ${port}...`));
 var import_supabase_management_js = require("supabase-management-js");
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-setup.ts
-var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('SUPABASE_MANAGEMENT_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
+var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('MANAGEMENT_API_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-webhook.ts
 var stripe_webhook_default = "import { StripeSync } from 'npm:stripe-experiment-sync'\n\nDeno.serve(async (req) => {\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  const sig = req.headers.get('stripe-signature')\n  if (!sig) {\n    return new Response('Missing stripe-signature header', { status: 400 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  const stripeSync = new StripeSync({\n    poolConfig: { connectionString: dbUrl, max: 1 },\n    stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n  })\n\n  try {\n    const rawBody = new Uint8Array(await req.arrayBuffer())\n    await stripeSync.processWebhook(rawBody, sig)\n    return new Response(JSON.stringify({ received: true }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Webhook processing error:', error)\n    const isSignatureError =\n      error.message?.includes('signature') || error.type === 'StripeSignatureVerificationError'\n    const status = isSignatureError ? 400 : 500\n    return new Response(JSON.stringify({ error: error.message }), {\n      status,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    await stripeSync.postgresClient.pool.end()\n  }\n})\n";
@@ -4604,7 +4618,7 @@ var SupabaseSetupClient = class {
       await this.deployFunction("stripe-worker", versionedWorker, false);
       const secrets = [{ name: "STRIPE_SECRET_KEY", value: trimmedStripeKey }];
       if (this.supabaseManagementUrl) {
-        secrets.push({ name: "SUPABASE_MANAGEMENT_URL", value: this.supabaseManagementUrl });
+        secrets.push({ name: "MANAGEMENT_API_URL", value: this.supabaseManagementUrl });
       }
       await this.setSecrets(secrets);
       const setupResult = await this.invokeFunction("stripe-setup", this.accessToken);

package/dist/cli/lib.js

@@ -6,10 +6,10 @@ import {
   migrateCommand,
   syncCommand,
   uninstallCommand
-} from "../chunk-QHM3A4VW.js";
-import "../chunk-NI6UMBIL.js";
-import "../chunk-2Q3SNSKG.js";
-import "../chunk-VOYYTAJF.js";
+} from "../chunk-HV64EIZU.js";
+import "../chunk-K4JQHI7Y.js";
+import "../chunk-M5TTM27L.js";
+import "../chunk-XO57OJUE.js";
 export {
   backfillCommand,
   createTunnel,

package/dist/index.cjs

@@ -46,7 +46,7 @@ var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.16",
+  version: "1.0.18",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",
@@ -630,15 +630,17 @@ var PostgresClient = class {
   /**
    * Create object run entries for a sync run.
    * All objects start as 'pending'.
+   *
+   * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
    */
-  async createObjectRuns(accountId, runStartedAt, objects) {
-    if (objects.length === 0) return;
-    const values = objects.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
+  async createObjectRuns(accountId, runStartedAt, resourceNames) {
+    if (resourceNames.length === 0) return;
+    const values = resourceNames.map((_, i) => `($1, $2, $${i + 3})`).join(", ");
     await this.query(
       `INSERT INTO "${this.config.schema}"."_sync_obj_runs" ("_account_id", run_started_at, object)
        VALUES ${values}
        ON CONFLICT ("_account_id", run_started_at, object) DO NOTHING`,
-      [accountId, runStartedAt, ...objects]
+      [accountId, runStartedAt, ...resourceNames]
     );
   }
   /**
@@ -2363,31 +2365,43 @@ var StripeSync = class {
    * This is used by workers and background processes that should cooperate.
    *
    * @param triggeredBy - What triggered this sync (for observability)
+   * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
    * @returns Run key and list of objects to sync
    */
-  async joinOrCreateSyncRun(triggeredBy = "worker") {
+  async joinOrCreateSyncRun(triggeredBy = "worker", objectFilter) {
     await this.getCurrentAccount();
     const accountId = await this.getAccountId();
     const result = await this.postgresClient.getOrCreateSyncRun(accountId, triggeredBy);
+    const objects = objectFilter === "all" || objectFilter === void 0 ? this.getSupportedSyncObjects() : [objectFilter];
     if (!result) {
       const activeRun = await this.postgresClient.getActiveSyncRun(accountId);
       if (!activeRun) {
         throw new Error("Failed to get or create sync run");
       }
+      await this.postgresClient.createObjectRuns(
+        activeRun.accountId,
+        activeRun.runStartedAt,
+        objects.map((obj) => this.getResourceName(obj))
+      );
       return {
         runKey: { accountId: activeRun.accountId, runStartedAt: activeRun.runStartedAt },
-        objects: this.getSupportedSyncObjects()
+        objects
       };
     }
     const { accountId: runAccountId, runStartedAt } = result;
+    await this.postgresClient.createObjectRuns(
+      runAccountId,
+      runStartedAt,
+      objects.map((obj) => this.getResourceName(obj))
+    );
     return {
       runKey: { accountId: runAccountId, runStartedAt },
-      objects: this.getSupportedSyncObjects()
+      objects
     };
   }
   async processUntilDone(params) {
     const { object } = params ?? { object: "all" };
-    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone");
+    const { runKey } = await this.joinOrCreateSyncRun("processUntilDone", object);
     return this.processUntilDoneWithRun(runKey.runStartedAt, object, params);
   }
   /**

package/dist/index.d.cts

@@ -137,8 +137,10 @@ declare class PostgresClient {
     /**
      * Create object run entries for a sync run.
      * All objects start as 'pending'.
+     *
+     * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
      */
-    createObjectRuns(accountId: string, runStartedAt: Date, objects: string[]): Promise<void>;
+    createObjectRuns(accountId: string, runStartedAt: Date, resourceNames: string[]): Promise<void>;
     /**
      * Try to start an object sync (respects max_concurrent).
      * Returns true if claimed, false if already running or at concurrency limit.
@@ -621,9 +623,10 @@ declare class StripeSync {
      * This is used by workers and background processes that should cooperate.
      *
      * @param triggeredBy - What triggered this sync (for observability)
+     * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
      * @returns Run key and list of objects to sync
      */
-    joinOrCreateSyncRun(triggeredBy?: string): Promise<{
+    joinOrCreateSyncRun(triggeredBy?: string, objectFilter?: SyncObject): Promise<{
         runKey: RunKey;
         objects: Exclude<SyncObject, 'all' | 'customer_with_entitlements'>[];
     }>;

package/dist/index.d.ts

@@ -137,8 +137,10 @@ declare class PostgresClient {
     /**
      * Create object run entries for a sync run.
      * All objects start as 'pending'.
+     *
+     * @param resourceNames - Database resource names (e.g. 'products', 'customers', NOT 'product', 'customer')
      */
-    createObjectRuns(accountId: string, runStartedAt: Date, objects: string[]): Promise<void>;
+    createObjectRuns(accountId: string, runStartedAt: Date, resourceNames: string[]): Promise<void>;
     /**
      * Try to start an object sync (respects max_concurrent).
      * Returns true if claimed, false if already running or at concurrency limit.
@@ -621,9 +623,10 @@ declare class StripeSync {
      * This is used by workers and background processes that should cooperate.
      *
      * @param triggeredBy - What triggered this sync (for observability)
+     * @param objectFilter - Optional specific object to sync (e.g. 'payment_intent'). If 'all' or undefined, syncs all objects.
      * @returns Run key and list of objects to sync
      */
-    joinOrCreateSyncRun(triggeredBy?: string): Promise<{
+    joinOrCreateSyncRun(triggeredBy?: string, objectFilter?: SyncObject): Promise<{
         runKey: RunKey;
         objects: Exclude<SyncObject, 'all' | 'customer_with_entitlements'>[];
     }>;

package/dist/index.js

@@ -5,8 +5,8 @@ import {
   createStripeWebSocketClient,
   hashApiKey,
   runMigrations
-} from "./chunk-NI6UMBIL.js";
-import "./chunk-VOYYTAJF.js";
+} from "./chunk-K4JQHI7Y.js";
+import "./chunk-XO57OJUE.js";
 export {
   PostgresClient,
   StripeSync,

package/dist/supabase/index.cjs

@@ -38,7 +38,7 @@ module.exports = __toCommonJS(supabase_exports);
 var import_supabase_management_js = require("supabase-management-js");
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-setup.ts
-var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('SUPABASE_MANAGEMENT_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
+var stripe_setup_default = "import { StripeSync, runMigrations, VERSION } from 'npm:stripe-experiment-sync'\nimport postgres from 'npm:postgres'\n\n// Get management API base URL from environment variable (for testing against localhost/staging)\n// Caller should provide full URL with protocol (e.g., http://localhost:54323 or https://api.supabase.com)\nconst MGMT_API_BASE_RAW = Deno.env.get('MANAGEMENT_API_URL') || 'https://api.supabase.com'\nconst MGMT_API_BASE = MGMT_API_BASE_RAW.match(/^https?:\\/\\//)\n  ? MGMT_API_BASE_RAW\n  : `https://${MGMT_API_BASE_RAW}`\n\n// Helper to validate accessToken against Management API\nasync function validateAccessToken(projectRef: string, accessToken: string): Promise<boolean> {\n  // Try to fetch project details using the access token\n  // This validates that the token is valid for the management API\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}`\n  const response = await fetch(url, {\n    method: 'GET',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  // If we can successfully get the project, the token is valid\n  return response.ok\n}\n\n// Helper to delete edge function via Management API\nasync function deleteEdgeFunction(\n  projectRef: string,\n  functionSlug: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/functions/${functionSlug}`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    throw new Error(`Failed to delete function ${functionSlug}: ${response.status} ${text}`)\n  }\n}\n\n// Helper to delete secrets via Management API\nasync function deleteSecret(\n  projectRef: string,\n  secretName: string,\n  accessToken: string\n): Promise<void> {\n  const url = `${MGMT_API_BASE}/v1/projects/${projectRef}/secrets`\n  const response = await fetch(url, {\n    method: 'DELETE',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/json',\n    },\n    body: JSON.stringify([secretName]),\n  })\n\n  if (!response.ok && response.status !== 404) {\n    const text = await response.text()\n    console.warn(`Failed to delete secret ${secretName}: ${response.status} ${text}`)\n  }\n}\n\nDeno.serve(async (req) => {\n  // Extract project ref from SUPABASE_URL (format: https://{projectRef}.{base})\n  const supabaseUrl = Deno.env.get('SUPABASE_URL')\n  if (!supabaseUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_URL not set' }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n  const projectRef = new URL(supabaseUrl).hostname.split('.')[0]\n\n  // Validate access token for all requests\n  const authHeader = req.headers.get('Authorization')\n  if (!authHeader?.startsWith('Bearer ')) {\n    return new Response('Unauthorized', { status: 401 })\n  }\n\n  const accessToken = authHeader.substring(7) // Remove 'Bearer '\n  const isValid = await validateAccessToken(projectRef, accessToken)\n  if (!isValid) {\n    return new Response('Forbidden: Invalid access token for this project', { status: 403 })\n  }\n\n  // Handle GET requests for status\n  if (req.method === 'GET') {\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n    let sql\n\n    try {\n      sql = postgres(dbUrl, { max: 1, prepare: false })\n\n      // Query installation status from schema comment\n      const commentResult = await sql`\n        SELECT obj_description(oid, 'pg_namespace') as comment\n        FROM pg_namespace\n        WHERE nspname = 'stripe'\n      `\n\n      const comment = commentResult[0]?.comment || null\n      let installationStatus = 'not_installed'\n\n      if (comment && comment.includes('stripe-sync')) {\n        // Parse installation status from comment\n        if (comment.includes('installation:started')) {\n          installationStatus = 'installing'\n        } else if (comment.includes('installation:error')) {\n          installationStatus = 'error'\n        } else if (comment.includes('installed')) {\n          installationStatus = 'installed'\n        }\n      }\n\n      // Query sync runs (only if schema exists)\n      let syncStatus = []\n      if (comment) {\n        try {\n          syncStatus = await sql`\n            SELECT DISTINCT ON (account_id)\n              account_id, started_at, closed_at, status, error_message,\n              total_processed, total_objects, complete_count, error_count,\n              running_count, pending_count, triggered_by, max_concurrent\n            FROM stripe.sync_runs\n            ORDER BY account_id, started_at DESC\n          `\n        } catch (err) {\n          // Ignore errors if sync_runs view doesn't exist yet\n          console.warn('sync_runs query failed (may not exist yet):', err)\n        }\n      }\n\n      return new Response(\n        JSON.stringify({\n          package_version: VERSION,\n          installation_status: installationStatus,\n          sync_status: syncStatus,\n        }),\n        {\n          status: 200,\n          headers: {\n            'Content-Type': 'application/json',\n            'Cache-Control': 'no-cache, no-store, must-revalidate',\n          },\n        }\n      )\n    } catch (error) {\n      console.error('Status query error:', error)\n      return new Response(\n        JSON.stringify({\n          error: error.message,\n          package_version: VERSION,\n          installation_status: 'not_installed',\n        }),\n        {\n          status: 500,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } finally {\n      if (sql) await sql.end()\n    }\n  }\n\n  // Handle DELETE requests for uninstall\n  if (req.method === 'DELETE') {\n    let stripeSync = null\n    try {\n      // Get and validate database URL\n      const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n      if (!rawDbUrl) {\n        throw new Error('SUPABASE_DB_URL environment variable is not set')\n      }\n      // Remove sslmode from connection string (not supported by pg in Deno)\n      const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n      // Stripe key is required for uninstall to delete webhooks\n      const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')\n      if (!stripeKey) {\n        throw new Error('STRIPE_SECRET_KEY environment variable is required for uninstall')\n      }\n\n      // Step 1: Delete Stripe webhooks and clean up database\n      stripeSync = new StripeSync({\n        poolConfig: { connectionString: dbUrl, max: 2 },\n        stripeSecretKey: stripeKey,\n      })\n\n      // Delete all managed webhooks\n      const webhooks = await stripeSync.listManagedWebhooks()\n      for (const webhook of webhooks) {\n        try {\n          await stripeSync.deleteManagedWebhook(webhook.id)\n          console.log(`Deleted webhook: ${webhook.id}`)\n        } catch (err) {\n          console.warn(`Could not delete webhook ${webhook.id}:`, err)\n        }\n      }\n\n      // Unschedule pg_cron job\n      try {\n        await stripeSync.postgresClient.query(`\n          DO $$\n          BEGIN\n            IF EXISTS (SELECT 1 FROM cron.job WHERE jobname = 'stripe-sync-worker') THEN\n              PERFORM cron.unschedule('stripe-sync-worker');\n            END IF;\n          END $$;\n        `)\n      } catch (err) {\n        console.warn('Could not unschedule pg_cron job:', err)\n      }\n\n      // Delete vault secret\n      try {\n        await stripeSync.postgresClient.query(`\n          DELETE FROM vault.secrets\n          WHERE name = 'stripe_sync_worker_secret'\n        `)\n      } catch (err) {\n        console.warn('Could not delete vault secret:', err)\n      }\n\n      // Terminate connections holding locks on stripe schema\n      try {\n        await stripeSync.postgresClient.query(`\n          SELECT pg_terminate_backend(pid)\n          FROM pg_locks l\n          JOIN pg_class c ON l.relation = c.oid\n          JOIN pg_namespace n ON c.relnamespace = n.oid\n          WHERE n.nspname = 'stripe'\n            AND l.pid != pg_backend_pid()\n        `)\n      } catch (err) {\n        console.warn('Could not terminate connections:', err)\n      }\n\n      // Drop schema with retry\n      let dropAttempts = 0\n      const maxAttempts = 3\n      while (dropAttempts < maxAttempts) {\n        try {\n          await stripeSync.postgresClient.query('DROP SCHEMA IF EXISTS stripe CASCADE')\n          break // Success, exit loop\n        } catch (err) {\n          dropAttempts++\n          if (dropAttempts >= maxAttempts) {\n            throw new Error(\n              `Failed to drop schema after ${maxAttempts} attempts. ` +\n                `There may be active connections or locks on the stripe schema. ` +\n                `Error: ${err.message}`\n            )\n          }\n          // Wait 1 second before retrying\n          await new Promise((resolve) => setTimeout(resolve, 1000))\n        }\n      }\n\n      await stripeSync.postgresClient.pool.end()\n\n      // Step 2: Delete Supabase secrets\n      try {\n        await deleteSecret(projectRef, 'STRIPE_SECRET_KEY', accessToken)\n      } catch (err) {\n        console.warn('Could not delete STRIPE_SECRET_KEY secret:', err)\n      }\n\n      // Step 3: Delete Edge Functions\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-setup', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-setup function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-webhook', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-webhook function:', err)\n      }\n\n      try {\n        await deleteEdgeFunction(projectRef, 'stripe-worker', accessToken)\n      } catch (err) {\n        console.warn('Could not delete stripe-worker function:', err)\n      }\n\n      return new Response(\n        JSON.stringify({\n          success: true,\n          message: 'Uninstall complete',\n        }),\n        {\n          status: 200,\n          headers: { 'Content-Type': 'application/json' },\n        }\n      )\n    } catch (error) {\n      console.error('Uninstall error:', error)\n      // Cleanup on error\n      if (stripeSync) {\n        try {\n          await stripeSync.postgresClient.pool.end()\n        } catch (cleanupErr) {\n          console.warn('Cleanup failed:', cleanupErr)\n        }\n      }\n      return new Response(JSON.stringify({ success: false, error: error.message }), {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n      })\n    }\n  }\n\n  // Handle POST requests for install\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  let stripeSync = null\n  try {\n    // Get and validate database URL\n    const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n    if (!rawDbUrl) {\n      throw new Error('SUPABASE_DB_URL environment variable is not set')\n    }\n    // Remove sslmode from connection string (not supported by pg in Deno)\n    const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n    await runMigrations({ databaseUrl: dbUrl })\n\n    stripeSync = new StripeSync({\n      poolConfig: { connectionString: dbUrl, max: 2 }, // Need 2 for advisory lock + queries\n      stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY'),\n    })\n\n    // Release any stale advisory locks from previous timeouts\n    await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n\n    // Construct webhook URL from SUPABASE_URL (available in all Edge Functions)\n    const supabaseUrl = Deno.env.get('SUPABASE_URL')\n    if (!supabaseUrl) {\n      throw new Error('SUPABASE_URL environment variable is not set')\n    }\n    const webhookUrl = supabaseUrl + '/functions/v1/stripe-webhook'\n\n    const webhook = await stripeSync.findOrCreateManagedWebhook(webhookUrl)\n\n    await stripeSync.postgresClient.pool.end()\n\n    return new Response(\n      JSON.stringify({\n        success: true,\n        message: 'Setup complete',\n        webhookId: webhook.id,\n      }),\n      {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n      }\n    )\n  } catch (error) {\n    console.error('Setup error:', error)\n    // Cleanup on error\n    if (stripeSync) {\n      try {\n        await stripeSync.postgresClient.query('SELECT pg_advisory_unlock_all()')\n        await stripeSync.postgresClient.pool.end()\n      } catch (cleanupErr) {\n        console.warn('Cleanup failed:', cleanupErr)\n      }\n    }\n    return new Response(JSON.stringify({ success: false, error: error.message }), {\n      status: 500,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  }\n})\n";
 
 // raw-ts:/home/runner/work/sync-engine/sync-engine/packages/sync-engine/src/supabase/edge-functions/stripe-webhook.ts
 var stripe_webhook_default = "import { StripeSync } from 'npm:stripe-experiment-sync'\n\nDeno.serve(async (req) => {\n  if (req.method !== 'POST') {\n    return new Response('Method not allowed', { status: 405 })\n  }\n\n  const sig = req.headers.get('stripe-signature')\n  if (!sig) {\n    return new Response('Missing stripe-signature header', { status: 400 })\n  }\n\n  const rawDbUrl = Deno.env.get('SUPABASE_DB_URL')\n  if (!rawDbUrl) {\n    return new Response(JSON.stringify({ error: 'SUPABASE_DB_URL not set' }), { status: 500 })\n  }\n  const dbUrl = rawDbUrl.replace(/[?&]sslmode=[^&]*/g, '').replace(/[?&]$/, '')\n\n  const stripeSync = new StripeSync({\n    poolConfig: { connectionString: dbUrl, max: 1 },\n    stripeSecretKey: Deno.env.get('STRIPE_SECRET_KEY')!,\n  })\n\n  try {\n    const rawBody = new Uint8Array(await req.arrayBuffer())\n    await stripeSync.processWebhook(rawBody, sig)\n    return new Response(JSON.stringify({ received: true }), {\n      status: 200,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } catch (error) {\n    console.error('Webhook processing error:', error)\n    const isSignatureError =\n      error.message?.includes('signature') || error.type === 'StripeSignatureVerificationError'\n    const status = isSignatureError ? 400 : 500\n    return new Response(JSON.stringify({ error: error.message }), {\n      status,\n      headers: { 'Content-Type': 'application/json' },\n    })\n  } finally {\n    await stripeSync.postgresClient.pool.end()\n  }\n})\n";
@@ -54,7 +54,7 @@ var workerFunctionCode = stripe_worker_default;
 // package.json
 var package_default = {
   name: "stripe-experiment-sync",
-  version: "1.0.16",
+  version: "1.0.18",
   private: false,
   description: "Stripe Sync Engine to sync Stripe data to Postgres",
   type: "module",
@@ -462,7 +462,7 @@ var SupabaseSetupClient = class {
       await this.deployFunction("stripe-worker", versionedWorker, false);
       const secrets = [{ name: "STRIPE_SECRET_KEY", value: trimmedStripeKey }];
       if (this.supabaseManagementUrl) {
-        secrets.push({ name: "SUPABASE_MANAGEMENT_URL", value: this.supabaseManagementUrl });
+        secrets.push({ name: "MANAGEMENT_API_URL", value: this.supabaseManagementUrl });
       }
       await this.setSecrets(secrets);
       const setupResult = await this.invokeFunction("stripe-setup", this.accessToken);

package/dist/supabase/index.js

@@ -9,8 +9,8 @@ import {
   uninstall,
   webhookFunctionCode,
   workerFunctionCode
-} from "../chunk-2Q3SNSKG.js";
-import "../chunk-VOYYTAJF.js";
+} from "../chunk-M5TTM27L.js";
+import "../chunk-XO57OJUE.js";
 export {
   INSTALLATION_ERROR_SUFFIX,
   INSTALLATION_INSTALLED_SUFFIX,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stripe-experiment-sync",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "private": false,
   "description": "Stripe Sync Engine to sync Stripe data to Postgres",
   "type": "module",