@drawbridge/drawbridge-agents 0.1.47 → 0.1.50

package/claude/CLAUDE.md

@@ -14,6 +14,7 @@
 @../conventions/app-web-forms.md
 @../conventions/app-web-gates.md
 @../conventions/docs-linkage.md
+@../conventions/humanized-copy.md
 @../conventions/superpowers-docs.md
 @../conventions/git-branching.md
 @../conventions/graphify.md

package/conventions/cross-repo-contracts.md

@@ -136,6 +136,16 @@ skill) so it stops living only in tribal memory.
   admin-negotiated actions values, so read the dry run). The legacy keys are copy-only until the
   overrides cleanup release, and sync (reader) deploys before stripe (writer) on any shape change.
   Detail: drawbridge-docs `reference/billing.md`.
+- **Stripe response shapes follow drawbridge-stripe's `apiVersion` pin, not the Stripe docs
+  default** (stripe ↔ api ↔ sync ↔ webhooks). The shared client pins a preview version
+  (`drawbridge-stripe/index.js`, currently `2026-01-28.preview`), and pinned versions change
+  embedded-object shapes — e.g. a promotion code carries its coupon as a bare id under
+  `promotion.coupon`; there is no embedded `coupon` object. Reading the docs-default shape fails
+  SILENTLY (optional chaining just skips the branch): the promo entry validation shipped with its
+  currency and product-restriction refusals dead this way (Asana 1211453698575738). Before reading
+  a Stripe field a consumer hasn't read before, verify it against a real response at the pin
+  (`curl` with the `Stripe-Version` header); treat any pin bump as a shape-change release across
+  every consumer.
 - **No Stripe product backs actions (≥0.1.45).** Invoice items carry
   currency/quantity/unit_amount_decimal/tax_behavior/description directly; the account keeps exactly
   one product — the plan product behind `STRIPE_PRICE_*`. Never reintroduce a product-presence guard
@@ -314,6 +324,15 @@ skill) so it stops living only in tribal memory.
   in the tree. Keep the pins aligned.
 - Shared packages that wrap a stateful SDK (Sentry, redis, mongodb) must direct-dep it at an
   exact pin, never a loose peer range (see `sentry-sdk.md`).
+- **A publish must rebuild `dist/` in the same command** — every published package needs a
+  `prepublishOnly` script (tsup + tests), because a bare `npm publish` ships whatever stale
+  `dist/` sits on disk with the current `package.json` version stamped on it: the version says
+  one thing, the code says another, and nothing errors anywhere. utils `0.0.100/0.0.101`
+  silently dropped the multipart upload exports this way, and utils `0.0.139` shipped the old
+  2GB `maximumUploadBytes` under a version everyone believed carried 50MB (2026-09-04; `0.0.139`
+  is poisoned — never pin it). utils ≥0.0.140 has the guard; add it to any `@drawbridge/*`
+  package before its next publish (`shopify` flagged 2026-09-04). After ANY publish, verify the
+  tarball, not the git tree: `npm pack`/curl the tarball and grep `dist/` for the change.
 - `@drawbridge/components` `Video` (≥0.0.62) owns the whole pre-playback story; consumers must NOT
   re-add their own poster layer or mount gate. `poster` renders as an SSR placeholder (opt into
   `priority` for fetchpriority=high when it's the LCP element), `defer` gates only the player —

package/conventions/humanized-copy.md

@@ -0,0 +1,25 @@
+# Humanize every word a person will read
+
+Any prose you write that a human will read as *product or communication* goes through the
+`humanizer` skill before it ships or posts. No exceptions for length — a two-line Asana
+comment counts.
+
+Covers, at minimum:
+
+- App/UI copy: labels, buttons, empty states, error and notice messages, tooltips, onboarding.
+- Asana comments and task descriptions, ship handoffs, retest instructions.
+- Docs and user stories, README prose, release notes.
+- Emails, SMS bodies, notification text, outreach drafts (growth), article/content drafts.
+- Anything else a customer, teammate, or prospect reads as writing.
+
+Does NOT cover: code, commit messages, code comments, test names, log lines, schema
+descriptions — engineer-facing text follows the code conventions instead.
+
+Rules when running it:
+
+- Run humanizer BEFORE posting/committing the copy, not after someone flags it.
+- It must not change facts, numbers, steps, or expected results — if a pass makes concrete
+  instructions vaguer, keep the original wording for those parts.
+- Leave markup intact (Asana mention tags, links, placeholders like `{name}`).
+- If the humanizer skill is not available in your session, say so and flag the copy as
+  un-humanized — do not silently skip the pass.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawbridge/drawbridge-agents",
-  "version": "0.1.47",
+  "version": "0.1.50",
   "description": "Shared agent-instruction content (rules, code style, conventions) for the drawbridge-* monorepo.",
   "license": "UNLICENSED",
   "publishConfig": {