@stacksjs/defaults 0.72.63 → 0.72.66

package/ai/skills/stacks-payments/SKILL.md

@@ -276,14 +276,31 @@ Supported webhook event types: `payment_intent.succeeded`, `payment_intent.payme
 
 ### Setup Products from SaaS Config
 
+Prefer the command; it is what an app author can discover:
+
+```bash
+buddy stripe:setup --dry-run   # report the plan of record, write nothing
+buddy stripe:setup             # apply it
+```
+
 ```typescript
-import { createStripeProduct } from '@stacksjs/payments'
+import { createStripeProduct, formatSetupReport } from '@stacksjs/payments'
 
-const result = await createStripeProduct()
-// Creates Stripe products and prices from config/saas.ts plans
+const result = await createStripeProduct({ dryRun: true })
+if (!result.isErr)
+  console.log(formatSetupReport(result.value).join('\n'))
 ```
 
-This iterates `saas.plans`, creates a Stripe product per plan, then creates prices for each pricing option using `lookup_key` from the `key` field.
+This iterates `saas.plans` and reconciles each one against the live account: a
+product is matched by name and reused, and each pricing option is matched by its
+`lookup_key` (from the `key` field). Prices are immutable in Stripe, so a changed
+amount is applied by creating a new price with `transfer_lookup_key: true`, which
+moves the key atomically and leaves the superseded price active so existing
+subscriptions keep billing.
+
+Re-running is safe and converges. It does not use `products.search` on purpose:
+that index is eventually consistent, so a second run inside the lag window would
+find nothing and create a duplicate.
 
 ### Utility Functions
 

package/bootstrap.ts

@@ -134,7 +134,27 @@ if (mounts('dashboard', feature('dashboard'))) {
   await route.register(frameworkPath('defaults/routes/dashboard-api.ts'))
   // The dev dashboard boots through this file rather than the application
   // router's importRoutes() path, so load model-declared useApi routes here too.
-  await import(frameworkPath('orm/routes.ts'))
+  //
+  // Package first, vendored second, matching importRoutes() and start.ts. This
+  // line used to import the vendored copy only, and nothing re-vendors that
+  // file: `@stacksjs/orm` publishes `dist/routes.js` and no `routes.ts`, so an
+  // app kept whatever generator its copy froze at however often it upgraded.
+  // An old enough copy compares route paths literally, so a generated
+  // `PATCH /api/sites/{id}` does not recognise a hand-written
+  // `/api/sites/{siteId}` as the same endpoint and registers alongside it,
+  // and the hand-written handler's authorization check stops running
+  // (stacksjs/stacks#2364).
+  //
+  // Held in a variable so the specifier resolves at runtime rather than while
+  // transpiling, where an unresolvable literal would fail this module instead
+  // of throwing where it can be caught.
+  const ormRoutesPackage = '@stacksjs/orm/routes'
+  try {
+    await import(ormRoutesPackage)
+  }
+  catch {
+    await import(frameworkPath('orm/routes.ts'))
+  }
 }
 
 // Email webhook + unsubscribe routes (stacksjs/stacks#1881, #1880).

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.72.63",
+  "version": "0.72.66",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.63",
+  "version": "0.72.66",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -51,7 +51,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.72.63",
+    "@stacksjs/mobile": "^0.72.66",
     "@stacksjs/sanitizer": "^0.2.113"
   },
   "scripts": {

package/vcs/github/workflows/deploy.yml

@@ -0,0 +1,77 @@
+name: Deploy
+
+# Push to deploy.
+#
+# Gated on CI rather than firing on the push itself: `buddy deploy` activates a
+# release atomically, so the failure mode of deploying an untested commit is a
+# live site running it, not a red check somebody notices later.
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+  # Ship a specific commit without pushing, and reach environments that no
+  # branch maps to.
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Which environment to deploy
+        type: choice
+        options: [production, staging, development]
+        default: production
+
+concurrency:
+  group: deploy-${{ github.event.inputs.environment || 'production' }}
+  # Never cancel a deploy in flight. Half of one is a release uploaded but not
+  # activated, or services restarted against the previous release's env.
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    # `workflow_run` fires for failed runs too — that is the point of the
+    # gate, so check the conclusion.
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    # Attach a GitHub Environment to get required reviewers and to scope these
+    # secrets to it.
+    environment: ${{ github.event.inputs.environment || 'production' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # The exact commit CI approved, not whatever main points at now.
+          ref: ${{ github.event.workflow_run.head_sha || github.ref }}
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Setup Pantry
+        uses: home-lang/pantry/packages/action@main
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      # The deploy talks to the server as root over SSH with BatchMode on, so
+      # the key has to be in an agent before it runs — there is no prompt to
+      # fall back to.
+      - name: Load the deploy key
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
+
+      - name: Deploy
+        run: ./buddy deploy --${{ github.event.inputs.environment == 'staging' && 'staging' || github.event.inputs.environment == 'development' && 'dev' || 'prod' }} --yes
+        env:
+          # Decrypts .env.production. Without it the encrypted values silently
+          # fall back to defaults, which is how an app deploys with the wrong
+          # APP_KEY and invalidates every session it had.
+          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+          # DNS records are written through the registrar that administers the
+          # zone, declared in config/cloud.ts. Keep these in the environment
+          # even when they are also in .env.production — a missing one now
+          # fails loudly instead of reaching for another provider's keys.
+          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
+          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}