feat(stripe-projects): integrate plugin 0.30.0 → 0.31.0

[cursor]

Daily Stripe Projects upgrade. Pin moves from 0.30.0 to 0.31.0.

Version delta

• Installed latest stripe projects (0.31.0) against main pin 0.30.0.
• Re-blessed plugin-version.txt, catalog.json, and command-surface.txt via mise run stripe-refresh.
• Synced STRIPE_PROJECTS_PINNED and the surface TRAVERSAL verification note.
• No intermediate versions between 0.30.0 and 0.31.0 on this track.
• No open upgrade PR existed; opened this one on bot/stripe-projects-0.31.0. Left stale remote bot/stripe-projects-update alone (fixtures-only tip, no PR).

Fixture changelog

Catalog (198 services, unchanged set)

• Still 89 deployables and 109 plans. No added or removed refs. No configuration_schema edits.
• Description-only noise: posthog/analytics (wording), chatbase/hobby plan (500 → 700 message credits).
• drift_report stayed empty without catalog.rs changes.

Command surface

• TRAVERSAL unchanged (no new top-level commands).
• spend gained optional --duration, --since, and --until date-range flags. Default remains last 6 months.

Landed integrations

• None. Catalog service set and schemas are unchanged; no new CatalogResource adapters.

Explicit skips

• Spend date-range flags. spend_summary still calls bare spend / spend <provider> for up/down reporting. Stackless has no CLI that needs duration windows.
• Plan-tier credit text (chatbase/hobby) stays out of scope with other plan tiers.
• Pre-existing gaps such as createos/project, domains, containers stay out of scope.
• No new --on substrates (needs human stripe projects link + live smoke).
• Live discover skipped (no linked project / OAuth here).

Predicate evidence

• mise run check green (fmt, clippy, taplo, catalog-orphans, provisional-check).
• Targeted nextest -p stackless-stripe-projects -p stackless --all-features: 117/117, including fixture coherence and spend_summary_*.
• Do not merge. Leave for morning review.

  

---

Note

Low Risk
Fixture and version-pin updates only; no runtime logic changes beyond aligning snapshots with plugin 0.31.0.

Overview
Bumps the Stripe Projects plugin pin from 0.30.0 to 0.31.0 in STRIPE_PROJECTS_PINNED, the surface TRAVERSAL verification note, and plugin-version.txt, and re-blesses catalog.json and command-surface.txt via the usual refresh path.

The catalog snapshot keeps the same service set; changes are mostly reordered allowed_updates / updateable_to lists plus minor copy (e.g. PostHog analytics description, Chatbase hobby 500 → 700 message credits). No new commands in TRAVERSAL.

The notable CLI delta in the command surface is stripe projects spend: new optional --duration, --since, and --until for charge date ranges (default still last 6 months). Stackless spend_summary is unchanged and still invokes bare spend / spend <provider>.

^{Reviewed by Cursor Bugbot for commit 89a2b80. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
stackless	Ready	Preview	Aug 14, 2026 7:39pm

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1e82dd1d-aa7c-4249-b086-6d6d624f6925)

[cursor]

Stale comment

Thermos review (security + code quality)

NO MEDIUM+ FINDINGS

Both thermo-nuclear passes agree: this is a pin/fixture-only bump of Stripe Projects 0.30.0 → 0.31.0. No runtime logic, adapters, authz, secret handling, or TRAVERSAL structural changes.

Validated

• Pins synced: STRIPE_PROJECTS_PINNED, plugin-version.txt, surface header, and banner all report 0.31.0
• Catalog: 198 services, 0 add/remove; 2 description-only edits; no configuration_schema content changes
• New spend --duration/--since/--until flags are optional; help default remains last 6 months; spend_summary still correctly uses bare spend (explicit skip)
• Hermetic CI green (fmt/clippy/test/supply-chain). Live render/vercel smoke failures are unrelated Render API 201 handling, not this pin

No prior automation review threads. Bugbot hit a usage limit (no Bugbot findings to incorporate).

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Thermos review (security + code quality)

1 MEDIUM (code quality). Security/correctness pass: no medium+ findings.

Medium

1. catalog.rs crosses 1k lines (999 → 1036) — merge-base was under the threshold; this PR’s ConfigSchema.optional field + in-file unit test push it over. Prod body is still ~759 lines; extract the new regression (or the #[cfg(test)] module) to tests/catalog_drift.rs / a sibling test module before growing the typed model further.

Validated (clean)

• Pins synced at 0.31.0 (STRIPE_PROJECTS_PINNED, plugin-version.txt, surface header/banner)
• Catalog: 198 services, 0 add/remove; description-only + reorder noise; no configuration_schema content changes; blessed fixture has 0 optional keys (field is forward-compat for claimed 0.32.0 wire)
• optional drift modeling matches the existing pattern (modeled, not enforced) pattern; validate_config correctly keys off required
• New spend --duration/--since/--until flags optional; spend_summary still uses bare spend (explicit skip); help default remains last 6 months
• Targeted nextest for the new unit test + fixture drift: green. No prior unresolved automation threads. Bugbot usage-limit (no Bugbot findings).

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Thermos review (security + code quality)

1 MEDIUM (code quality). Security/correctness pass: no medium+ findings.

Tip @d678114 vs merge-base 1dffab4: pin/fixture bless to 0.32.0 + ConfigSchema.optional + new provisional shopify/store CatalogResource.

Medium

1. catalog.rs crosses 1k lines (999 → 1036) — still unresolved from the prior pass. The wire field is fine; the file was already at the ceiling (merge-base 999). Extracting only the new unit test leaves the file ≈1001. Prefer extracting the existing #[cfg(test)] mod tests (prod body ~760) and asserting Shopify optional via tests/catalog_drift.rs before further typed-model growth.

Validated (clean)

• Pins synced at 0.32.0 (STRIPE_PROJECTS_PINNED, plugin-version.txt, surface header/banner); TRAVERSAL structurally unchanged
• Catalog: 198 → 199 (+Shopify/store only); 0 schema content changes on existing services; optional present only on shopify/store
• optional is drift-only (same class as pattern); validate_config still keys off required; bless path writes raw JSON Value
• shopify/store follows canonical CatalogResource pattern; OUTPUT_FIELDS match Shopify llm_context (SHOPIFY_SHOP_DOMAIN / SHOPIFY_SHOP_LOGIN_URL / SHOPIFY_SIGNUP_TOKEN); provisional allowlist + fail-closed required flags; registry/mod/SHORT_PROVIDER one-row registration
• Default trial tier is free (no paid confirm); paid plan tiers still require confirmation; spend_summary still uses bare spend
• Targeted nextest (optional drift + shopify catalog/provision + outputs_match + fixture drift): green. Prior automation thread on this finding: not_addressed.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Stale comment

Could not approve: GitHub rejects self-approval on this cursor[bot]-authored PR, even though Bugbot was absent after the first poll and remaining signals do not require human review. Left a non-blocking comment. Reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Stale comment

Thermos review (security + code quality)

1 MEDIUM (code quality). Security/correctness pass: no medium+ findings.

Tip @a353a32 vs merge-base 1dffab4: pin/fixture bless through 0.33.0 + ConfigSchema.optional + provisional shopify/store CatalogResource.

Medium

1. catalog.rs crosses 1k lines (999 → 1036) — still unresolved. Merge-base was already at the ceiling; this PR’s optional field (+2) plus the in-file regression tip it over. Extracting only the new test still leaves ≈1001. Prefer extracting the existing #[cfg(test)] mod tests (prod body ~760) and asserting Shopify optional via tests/catalog_drift.rs before further typed-model growth.

Validated (clean)

• Pins synced at 0.33.0 (STRIPE_PROJECTS_PINNED, plugin-version.txt, surface header/banner); TRAVERSAL structurally unchanged
• Catalog: 198 → 199 (+Shopify/store only); 0 schema content changes on existing services; optional present only on shopify/store
• 0.32→0.33 delta is version + parent_services/constraint reorders + OpenRouter copy; no new refs or schema edits
• optional is drift-only (same class as pattern); validate_config still keys off required
• shopify/store follows the canonical CatalogResource pattern; OUTPUT_FIELDS match live llm_context (SHOPIFY_SHOP_DOMAIN / SHOPIFY_SHOP_LOGIN_URL / SHOPIFY_SIGNUP_TOKEN); provisional allowlist + fail-closed required; default trial is free, paid plan tiers still require confirmation
• spend_summary still uses bare spend; new --duration/--since/--until flags are optional
• Targeted nextest (optional drift + shopify catalog/provision + outputs_match + fixture drift + spend_summary): 9/9 green. Prior automation thread on this finding: not_addressed.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[cursor]

Extracted the in-file #[cfg(test)] module to src/catalog/tests.rs so catalog.rs is 761 lines (typed model only). Also pinned shopify/store optional (store_name, plan) on the committed fixture in tests/catalog_drift.rs. (Reply to the catalog.rs 1k-line thread; GitHub review-thread APIs are read-only from this token.)

[cursor]

Could not approve: GitHub rejects self-approval on this cursor[bot]-authored PR. Cursor Bugbot was not present after the first poll, so that signal was skipped; remaining signals and approval policies do not require human review. No new reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Thermos review (security + code quality)

NO MEDIUM+ FINDINGS

Both thermo-nuclear passes agree. Tip @dfc0226 vs merge-base 1dffab4: pin/fixture bless through 0.33.0 + ConfigSchema.optional + provisional shopify/store CatalogResource. Prior CQ medium (catalog.rs 999 → 1036) is fixed — tests extracted to catalog/tests.rs; production model is 761 lines.

Prior threads

• catalog.rs under→over 1k — fully addressed (dfc0226)

Validated

• Pins synced: STRIPE_PROJECTS_PINNED, plugin-version.txt, surface header, and banner all report 0.33.0. TRAVERSAL unchanged.
• Catalog: 198 → 199 (+shopify/store). No schema-content changes on existing registered services. optional is drift-only (same class as pattern); validate_config still uses required.
• shopify/store: omitted/trial → no paid confirm; explicit basic|grow|advanced → confirm via match_tier. OUTPUT_FIELDS match live llm_context; required fields fail-closed; allowlist until discover is intentional.
• heygen/privy provider_configuration_schema drift only; those refs stay EXCL/HELD.
• spend_summary still invokes bare spend (new date flags unused; display-only).

Targeted nextest (shopify catalog/provision, optional + fixture drift, outputs/registry hygiene): all green. catalog-orphans ok (90 deployables owned).

  

_{Sent by Cursor Automation: Find vulnerabilities}