@stacksjs/defaults 0.75.140 → 0.75.141

package/ai/skills/stacks-native/CATALOG.md

@@ -807,7 +807,7 @@ Guidance: [`stacks-sms`](../stacks-sms/SKILL.md). Source: [storage/framework/cor
 
 Declared runtime exports: `SMS`, `TwilioDriver`, `VonageDriver`, `createTwilioDriver`, `createVonageDriver`.
 
-Local source modules: [src/compliance.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/compliance.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/index.ts), [src/drivers/twilio.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/twilio.ts), [src/drivers/vonage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/vonage.ts), [src/opt-out.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/opt-out.ts), [src/sms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/sms.ts).
+Local source modules: [src/compliance.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/compliance.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/index.ts), [src/drivers/twilio.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/twilio.ts), [src/drivers/vonage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/drivers/vonage.ts), [src/inbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/inbound.ts), [src/opt-out.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/opt-out.ts), [src/sms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/sms.ts).
 
 Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 

package/ai/skills/stacks-payments/SKILL.md

@@ -117,7 +117,7 @@ const changed = await Payment.changeSubscription(user, 'enterprise-monthly')
 
 `isValid()` returns `true` if the subscription status is `'active'` or `'trialing'`. `isIncomplete()` checks for `'incomplete'` status.
 
-`cancelSubscription(id, immediately)` is gone: its `false` also cancelled at once, only with a proration. For Stripe's `prorate` / `invoice_now`, call `manageSubscription.cancel(id, params)`.
+`cancelSubscription(id, immediately)` is gone: its `false` also cancelled at once, only with a proration. For Stripe's `prorate` / `invoice_now`, call `manageSubscription.cancel(id, params)`. To undo a cancel at period end before the period ends, call `manageSubscription.resume(id)`: Stripe renews again and the stored `ends_at` is cleared. Both use a fresh idempotency key per attempt, so cancel → resume → cancel within Stripe's 24-hour key window still reaches Stripe each time.
 
 ### Customers
 

package/ai/skills/stacks-sms/SKILL.md

@@ -403,6 +403,21 @@ normalizes its payload. `classifySmsIntent/smsComplianceReply` are pure helpers;
 they do not themselves persist consent. Use the persistent handleInboundSms
 workflow when consent state must affect future sends.
 
+For a Twilio incoming-message webhook, `handleTwilioInbound(request, options)`
+does the whole job and returns the TwiML `Response`: it reads the form body,
+verifies `X-Twilio-Signature` with `TWILIO_AUTH_TOKEN` against `APP_URL` plus
+the request path (`publicUrl` overrides it; behind a proxy the request's own
+URL is not what Twilio signed), records STOP/START in `sms_opt_outs`, then
+calls `onConsentChange({ phone, kind })` so the app can switch its own
+preferences, and `onMessage(message)` for every verified text. Without a token
+it answers 503, and a bad signature 403, changing nothing. It does not reply to
+keywords unless `reply: true`, because Twilio's own opt-out handling already
+answers STOP/START/HELP and a second reply arrives twice. Twilio Advanced
+Opt-Out's `OptOutType` field wins over the keyword list (`inboundSmsKind`), so
+custom keywords configured there count. `inboundSmsReply(kind)` is the reply
+copy `handleInboundSms` uses. Route it with `skipCsrf()` and point the number's
+incoming-message webhook (HTTP POST) at it.
+
 `estimateSmsSegments(body)` reports GSM-7/UCS-2 estimates; provider billing is
 authoritative. `isWithinSmsQuietHours(date, { startHour, endHour, timezone? })`
 is a policy helper, not an automatic send gate. Config keys such as spend caps

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.140",
+  "version": "0.75.141",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.140",
+  "version": "0.75.141",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.140",
+    "@stacksjs/mobile": "0.75.141",
     "@stacksjs/sanitizer": "^0.2.422",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",