From 8a2843a2726fa58c8f6ea1a9a83b867c995691a2 Mon Sep 17 00:00:00 2001 From: AINative Admin Date: Tue, 6 Oct 2026 22:59:38 -0700 Subject: [PATCH 1/2] feat(auth): add SMS opt-in disclosure under the phone-first form's phone field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supports the Twilio A2P 10DLC campaign resubmission (core#8533) as a 2FA/ verification use case — carriers require the opt-in language shown to the user at the point of consent to match what's documented in the campaign registration. This is that language, placed directly under the phone input it describes. --- app/modernist.css | 2 +- components/build/screens/Auth.tsx | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/modernist.css b/app/modernist.css index 6de57668..65fbaf35 100644 --- a/app/modernist.css +++ b/app/modernist.css @@ -1300,7 +1300,7 @@ /* Editable profile settings + Danger Zone (#57). */ .m-settings-form { display: flex; flex-direction: column; gap: 16px; max-width: 440px; } .m-select { padding: 10px 12px; border: 1.5px solid var(--neutral-line); font-family: var(--font-body); font-size: 14px; background: var(--color-surface); } -.m-field-hint { font-size: 11px; } +.m-field-hint { font-size: 11px; color: var(--text-muted); margin-top: 4px; } .m-field-err { font-size: 11px; color: #b42318; } /* #479: advisory (never blocking) name-collision notice — amber, distinct from the red m-field-err. */ .m-field-warn { font-size: 11px; color: #93650a; display: flex; flex-wrap: wrap; align-items: center; gap: 6px; } diff --git a/components/build/screens/Auth.tsx b/components/build/screens/Auth.tsx index 31c89476..792f84f7 100644 --- a/components/build/screens/Auth.tsx +++ b/components/build/screens/Auth.tsx @@ -741,6 +741,7 @@ export function Auth({ mode }: { mode: Extract setPrimaryPhone(e.target.value)} placeholder="(512) 555-1234" /> +

We'll text you a one-time code to verify this number.

{phoneFormError &&

{phoneFormError}

} {mode === 'signup' && ( From b2f519f46e416d0e1db69e6883b57f9733c4097f Mon Sep 17 00:00:00 2001 From: AINative Admin Date: Tue, 6 Oct 2026 23:04:22 -0700 Subject: [PATCH 2/2] =?UTF-8?q?docs(auth):=20correct=20otp.ts's=20doc=20co?= =?UTF-8?q?mment=20=E2=80=94=20937=20is=20Builder's=20own=20number,=20not?= =?UTF-8?q?=20ZeroVoice's?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mislabeled during #938's implementation. Both Builder-owned OTP numbers (937, 831) are currently carrier-blocked because their live A2P 10DLC campaigns were registered under ZeroVoice's branding/use case (CUSTOMER_CARE) instead of Builder's — tracked in core#8533. --- lib/build/otp.ts | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/lib/build/otp.ts b/lib/build/otp.ts index c50f2fab..c6c1b52d 100644 --- a/lib/build/otp.ts +++ b/lib/build/otp.ts @@ -262,11 +262,20 @@ export interface SharedSmsResult { * credential ever existed). Builder's own Railway service now holds a * direct Twilio credential (TWILIO_ACCOUNT_SID/TWILIO_AUTH_TOKEN), copied * from core's real, working Twilio account on 2026-10-05, and - * TWILIO_OTP_FROM_NUMBER is the real, confirmed-live ZeroVoice number - * (+19377642838) already wired for two-way SMS. Explicit From/To (never - * routed through a Messaging Service's number-selection) — using a - * MessagingServiceSid here produced a confusing same-number From/To - * collision during live testing earlier this session. + * TWILIO_OTP_FROM_NUMBER is a Builder-owned number (+19377642838) already + * wired for two-way SMS. Explicit From/To (never routed through a + * Messaging Service's number-selection) — using a MessagingServiceSid here + * produced a confusing same-number From/To collision during live testing + * earlier this session. + * + * #944 follow-up (2026-10-07): this number's live A2P 10DLC campaign was + * registered under ZeroVoice's branding/use-case (CUSTOMER_CARE, message + * samples referencing ZeroVoice by name), not Builder's — which is why + * carriers are currently blocking sends (core#8533, error 30034/30896). + * A second Builder-owned number (+18313183353) has the same problem. Both + * need their own 2FA-use-case campaigns resubmitted under Builder's own + * branding/URL, with no ZeroVoice references — tracked in core#8533, a + * Twilio-console task, not a code change. */ export async function sendSharedSms(toE164Number: string, body: string): Promise { const accountSid = process.env.TWILIO_ACCOUNT_SID || ''