@drawbridge/drawbridge-agents 0.1.26 → 0.1.28

package/conventions/cross-repo-contracts.md

@@ -68,12 +68,20 @@ skill) so it stops living only in tribal memory.
   after it produced five distinct defects, ending in a 60-second line-window overlap that billed
   one correctly-delivered event twice. Do not reintroduce meter events, and do not "fix" a billing
   discrepancy by reporting usage to Stripe — corrections are `billing.trueup` ledger rows.
-- **The actions PRODUCT is load-bearing; the meter and metered price are not.** drawbridge-stripe
-  (≥0.1.42) provisions only a product for actions, and drawbridge-sync prices its invoice lines
-  with `price_data.product` read from `items.actions.product`. Deactivating or dropping that
-  product breaks every future invoice — which is why api's `scripts.js removeActionsMeters` strips
-  the item, price and meter but never the product, and does not reuse
-  `stripeSubscription.deactivatableItems` (that includes it).
+- **`items.actions` is the record of what the customer was SOLD** — `{ limit,
+  overageCentsPerAction }`, written by drawbridge-stripe (≥0.1.44) at create/upgrade/downgrade and
+  read by drawbridge-sync at cycle close. plans.js is the default for NEW sales only; editing it
+  does not reprice existing customers (that is `repriceActionsSnapshot`, explicit and dry-runnable).
+  Anything adding custom/enterprise pricing must gate the plan-change paths and the reprice script
+  or negotiated values get silently overwritten. The rate is a NUMBER in cents — the string
+  `'2.5'` shape exists only at the Stripe `unit_amount_decimal` boundary.
+- **No Stripe product backs actions (≥0.1.45).** Invoice items carry
+  currency/quantity/unit_amount_decimal/tax_behavior/description directly; the account keeps exactly
+  one product — the plan product behind `STRIPE_PRICE_*`. Never reintroduce a product-presence guard
+  in sync's billing: the old one skipped billing entirely for a productless subscription, which
+  would have zeroed every invoice once the products were archived.
+- **The v2 pricing-plan layer (`bpp_*`, billing cadences) is never touched by script.** Canceling a
+  billing cadence is terminal and unrecoverable. Dashboard, by hand, only.
 - **A subscription must open with the plan item.** It used to open with the metered actions price
   and attach the plan afterwards with `always_invoice`. With no metered item, Stripe rejects an
   itemless subscription, so the plan goes in at creation — changing the first invoice's shape.
@@ -131,6 +139,14 @@ skill) so it stops living only in tribal memory.
 - The api's `POST /oauth/google/callback` returns `redirectTo` in its 400 body when it read the state
   row before failing, so app-web can keep the resume target across `/auth?error=oauth`. A
   `oauth.state.invalid` failure cannot — that row is what carried the target.
+- Google sign-in NEVER auto-links (`profile/disconnect-google` must stick): the callback signs in
+  only on an exact google account row; an email-only match is refused with `code: google.not.linked`
+  in the error body, which app-web's `/api/auth/google` maps to `/auth?error=google-not-linked`
+  (and `google.already.linked` back to `/account`) — deliberate refusals carry `code` and skip
+  Sentry on both sides. Explicit linking runs GET `/oauth/google/link/start` (authenticated); its
+  state row carries `data.link` (user id) and the callback's **link-mode result has NO token pair**,
+  so the BFF must only (re)write session/refresh/csrf cookies when `result.sessionToken` is present —
+  writing them unconditionally signs the user out mid-link.
 
 ## Reporting (api ↔ app-web)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawbridge/drawbridge-agents",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Shared agent-instruction content (rules, code style, conventions) for the drawbridge-* monorepo.",
   "license": "UNLICENSED",
   "publishConfig": {