@checkbox-site/cli 0.2.0 → 0.3.0

package/dist/checkbox.js

@@ -3673,9 +3673,9 @@ var init_client = __esm({
       const p = globalThis.process;
       return p?.env?.[name] || void 0;
     };
-    sleep = (ms, signal) => new Promise((resolve8, reject) => {
+    sleep = (ms, signal) => new Promise((resolve9, reject) => {
       if (signal?.aborted) return reject(signal.reason);
-      const t = setTimeout(resolve8, ms);
+      const t = setTimeout(resolve9, ms);
       signal?.addEventListener("abort", () => (clearTimeout(t), reject(signal.reason)), { once: true });
     });
     Checkbox = class {
@@ -4113,11 +4113,11 @@ async function listCommands(dir = COMMANDS_DIR) {
 }
 function readAll(stream) {
   if (!stream || stream.isTTY) return Promise.resolve("");
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     stream.setEncoding?.("utf8");
     stream.on("data", (c) => data += c.toString());
-    stream.on("end", () => resolve8(data));
+    stream.on("end", () => resolve9(data));
     stream.on("error", reject);
   });
 }
@@ -10465,8 +10465,8 @@ function isNear(el, cta, viewport, device) {
   }
   return verticalGap(el, cta) <= maxVerticalGapPx(device, viewport) && horizontalGap(el, cta) <= maxHorizontalGapPx(device);
 }
-function tastefulSmall(relative6, style2, opacity) {
-  if (relative6 < CONSPICUOUS_TASTEFUL_RELATIVE_FONT) return false;
+function tastefulSmall(relative7, style2, opacity) {
+  if (relative7 < CONSPICUOUS_TASTEFUL_RELATIVE_FONT) return false;
   const contrast = textContrast({ color: style2.color, backgroundColor: style2.backgroundColor, opacity });
   if (contrast === null || contrast < CONSPICUOUS_MIN_CONTRAST) return false;
   return (style2.fontWeight ?? 400) >= 600 || contrast >= CONSPICUOUS_STRONG_CONTRAST;
@@ -10486,18 +10486,18 @@ function assessConspicuousness(el, opts = {}) {
     warnings.push("font size could not be measured");
   } else {
     const ref = opts.referenceFontPx && opts.referenceFontPx > 0 ? opts.referenceFontPx : void 0;
-    const relative6 = ref ? fontSizePx / ref : void 0;
+    const relative7 = ref ? fontSizePx / ref : void 0;
     if (fontSizePx < CONSPICUOUS_MIN_FONT_PX) {
-      if (relative6 !== void 0 && relative6 >= CONSPICUOUS_MIN_RELATIVE_FONT) {
+      if (relative7 !== void 0 && relative7 >= CONSPICUOUS_MIN_RELATIVE_FONT) {
         warnings.push(
-          `font is ${round2(fontSizePx)}px (below ${CONSPICUOUS_MIN_FONT_PX}px, but ${Math.round(relative6 * 100)}% of the surrounding ${round2(ref)}px text)`
+          `font is ${round2(fontSizePx)}px (below ${CONSPICUOUS_MIN_FONT_PX}px, but ${Math.round(relative7 * 100)}% of the surrounding ${round2(ref)}px text)`
         );
       } else {
         failures.push(`font is ${round2(fontSizePx)}px (min ${CONSPICUOUS_MIN_FONT_PX}px)`);
       }
-    } else if (relative6 !== void 0 && relative6 < CONSPICUOUS_MIN_RELATIVE_FONT && !tastefulSmall(relative6, style2, opacity)) {
+    } else if (relative7 !== void 0 && relative7 < CONSPICUOUS_MIN_RELATIVE_FONT && !tastefulSmall(relative7, style2, opacity)) {
       warnings.push(
-        `font is ${round2(fontSizePx)}px, ${Math.round(relative6 * 100)}% of the surrounding ${round2(ref)}px text \u2014 smaller than surrounding text must contrast or be set off to be conspicuous`
+        `font is ${round2(fontSizePx)}px, ${Math.round(relative7 * 100)}% of the surrounding ${round2(ref)}px text \u2014 smaller than surrounding text must contrast or be set off to be conspicuous`
       );
     }
   }
@@ -17328,9 +17328,9 @@ function limiter(max) {
       run2();
     }
   };
-  return async (fn) => new Promise((resolve8, reject) => {
+  return async (fn) => new Promise((resolve9, reject) => {
     queue.push(() => {
-      fn().then(resolve8, reject).finally(() => {
+      fn().then(resolve9, reject).finally(() => {
         active--;
         next();
       });
@@ -22747,7 +22747,15 @@ function loadConfig(path) {
 function validateConfig(value) {
   const is = new Issues();
   if (!isObj2(value)) return ["must be a JSON object (see https://checkbox.site/docs/guides/ci#config)"];
-  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "checks"]);
+  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "checks", "coverage"]);
+  const cov = value.coverage;
+  if (cov !== void 0 && cov !== false) {
+    if (!isObj2(cov)) is.add("coverage", `must be false or an object like { "ignore": ["scripts/**"] } (got ${show(cov)})`);
+    else {
+      is.keys("coverage", cov, ["ignore"]);
+      if (cov.ignore !== void 0 && (!Array.isArray(cov.ignore) || !cov.ignore.every((g) => typeof g === "string" && g.trim()))) is.add("coverage.ignore", `must be a list of file globs like ["scripts/**", "admin/*.ts"] (got ${show(cov.ignore)})`);
+    }
+  }
   if (value.$schema !== void 0 && typeof value.$schema !== "string") is.add("$schema", "must be a string");
   const m = value.merchant;
   if (m !== void 0) {
@@ -22820,13 +22828,16 @@ function validateConfig(value) {
       } else if (needsPlan === "always" && !planCount) {
         is.add(at, 'needs the plan it describes: add it to "plans" (name, price, interval, trial_days)');
       }
+      if (e.covers !== void 0 && (!Array.isArray(e.covers) || !e.covers.every((c) => typeof c === "string" && /^[^#]+(?:#[1-9]\d*)?$/.test(c)))) {
+        is.add(`${at}.covers`, `must be a list of files, or "file#n" for the n-th call (got ${show(e.covers)})`);
+      }
       each(at, e);
     });
   };
   entries(
     "stripe_checkout",
     (at, e) => {
-      is.keys(at, e, ["name", "plan", "params", "file", "module", "args", "source", "call"]);
+      is.keys(at, e, ["name", "plan", "params", "file", "module", "args", "source", "call", "covers"]);
       is.exactlyOne(at, e, ["params", "file", "module", "source"]);
       if (e.params !== void 0 && !isObj2(e.params)) is.add(`${at}.params`, `must be the params object (got ${show(e.params)})`);
       if (e.file !== void 0) is.path(`${at}.file`, e.file);
@@ -22842,7 +22853,7 @@ function validateConfig(value) {
   entries(
     "disclosures",
     (at, e) => {
-      is.keys(at, e, ["name", "plan", "text", "file", "button_text", "placement", "consent"]);
+      is.keys(at, e, ["name", "plan", "text", "file", "button_text", "placement", "consent", "covers"]);
       is.exactlyOne(at, e, ["text", "file"]);
       if (e.text !== void 0) is.str(`${at}.text`, e.text, { max: 5e3 });
       if (e.file !== void 0) is.path(`${at}.file`, e.file);
@@ -22854,7 +22865,7 @@ function validateConfig(value) {
   entries(
     "pages",
     (at, e) => {
-      is.keys(at, e, ["name", "plan", "file", "url", "kind"]);
+      is.keys(at, e, ["name", "plan", "file", "url", "kind", "covers"]);
       is.exactlyOne(at, e, ["file", "url"]);
       if (e.file !== void 0) is.path(`${at}.file`, e.file);
       if (e.url !== void 0) is.str(`${at}.url`, e.url, { pattern: /^https?:\/\/\S+$/, patternHint: "an http(s) URL" });
@@ -23524,15 +23535,299 @@ var init_detect = __esm({
   }
 });
 
+// src/ci/scaffold.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { basename, join as join5, relative as relative2 } from "node:path";
+function walk3(root, visit) {
+  let n = 0;
+  const go = (dir, depth) => {
+    if (depth > 8 || n > MAX_FILES2) return;
+    let names = [];
+    try {
+      names = readdirSync3(dir).sort();
+    } catch {
+      return;
+    }
+    for (const name of names) {
+      if (IGNORE.has(name) || name.startsWith(".") && name !== ".well-known") continue;
+      const abs = join5(dir, name);
+      let st;
+      try {
+        st = statSync2(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) go(abs, depth + 1);
+      else if (st.isFile() && st.size < 4e5) {
+        n++;
+        visit(relative2(root, abs).split("\\").join("/"));
+      }
+    }
+  };
+  go(root, 0);
+}
+function emailKindOf(file) {
+  const name = basename(file).replace(/\.[^.]+$/, "");
+  return EMAIL_NAMES.find(([re]) => re.test(name))?.[1];
+}
+function scaffoldConfig(root, env2 = {}) {
+  const det = detectProject(root, env2);
+  const todos = [];
+  const found = [];
+  const names = /* @__PURE__ */ new Set();
+  const merchant = {};
+  merchant.name = det.brand?.name ?? "TODO: the brand subscribers see";
+  if (!det.brand) todos.push("merchant.name: the brand subscribers see");
+  const cancelPath = det.policyPaths.cancellation;
+  if (det.siteUrl && cancelPath) merchant.cancel_url = `${originOf(det.siteUrl)}${cancelPath}`;
+  else {
+    merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
+    todos.push("merchant.cancel_url: the page where subscribers cancel online");
+  }
+  const plans = det.plans.map((p, i) => ({
+    name: p.name ?? `Plan ${i + 1}`,
+    amount: p.amount,
+    currency: p.currency,
+    interval: p.interval,
+    ...p.interval_count ? { interval_count: p.interval_count } : {},
+    ...p.trial_days ? { trial_days: p.trial_days } : {}
+  }));
+  for (const p of det.plans) found.push(`plan ${p.name ?? ""} ${p.amount / 100} ${p.currency}/${p.interval} (${p.source})`.replace(/\s+/g, " "));
+  if (!plans.length) {
+    plans.push({ name: "TODO: plan name", price: "TODO: e.g. 19.99", currency: "usd", interval: "month" });
+    todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
+  }
+  const planNames = plans.map((p) => String(p.name));
+  const planFor = () => plans.length > 1 ? { plan: `TODO: one of ${planNames.map((n) => JSON.stringify(n)).join(", ")}` } : {};
+  if (plans.length > 1) todos.push("plan: pick the plan of each disclosure, page and email entry");
+  const stripe = [];
+  const perFile = /* @__PURE__ */ new Map();
+  for (const s2 of det.checkoutSessions) {
+    const call = (perFile.get(s2.file) ?? 0) + 1;
+    perFile.set(s2.file, call);
+    const entry = { name: unique(names, `Stripe Checkout (${basename(s2.file)}${call > 1 ? ` #${call}` : ""})`), source: s2.file, ...call > 1 ? { call } : {} };
+    if (!s2.params) {
+      todos.push(`${s2.file}:${s2.line}: the params are not an object literal; use "module" (an exported function returning the params) instead of "source"`);
+      delete entry.source;
+      delete entry.call;
+      entry.module = `TODO: ${s2.file.replace(/\.[^.]+$/, "")}.ts#buildCheckoutParams`;
+    } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
+    else found.push(`${s2.file}:${s2.line}: Checkout Session`);
+    stripe.push(entry);
+  }
+  const emails = [];
+  const pages = [];
+  const disclosures = [];
+  walk3(root, (rel2) => {
+    if (IN_EMAIL_DIR.test(rel2)) {
+      const kind = emailKindOf(rel2);
+      if (/\.(?:html?|txt|md)$/i.test(rel2) && kind) {
+        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...planFor() });
+        found.push(`${rel2}: ${kind} email`);
+        return;
+      }
+      if (/\.[jt]sx$|\.mjml$/i.test(rel2) && kind) {
+        todos.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
+        return;
+      }
+    }
+    if (PAGE_FILE.test(rel2)) {
+      const kind = /checkout|subscribe/i.test(rel2) ? "checkout" : "pricing";
+      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor() });
+      found.push(`${rel2}: ${kind} page`);
+      return;
+    }
+    if (/\.(?:txt|md)$/i.test(rel2) && !/(?:^|\/)(?:README|CHANGELOG|LICENSE|CONTRIBUTING|AGENTS|CLAUDE)[^/]*$/i.test(rel2) && !rel2.startsWith("docs/")) {
+      let text = "";
+      try {
+        text = readFileSync6(join5(root, rel2), "utf8");
+      } catch {
+        return;
+      }
+      if (text.length < 1500 && DISCLOSURE_TEXT.test(text)) {
+        disclosures.push({ name: unique(names, `Disclosure: ${basename(rel2)}`), file: rel2, ...planFor() });
+        found.push(`${rel2}: disclosure text`);
+      }
+    }
+  });
+  if (!disclosures.length && det.payButtons.length) {
+    todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
+  }
+  const checks = {};
+  if (stripe.length) checks.stripe_checkout = stripe;
+  if (disclosures.length) checks.disclosures = disclosures;
+  if (pages.length) checks.pages = pages;
+  if (emails.length) checks.emails = emails;
+  checks.notice_schedule = true;
+  if (!stripe.length && !disclosures.length && !pages.length && !emails.length) {
+    todos.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
+  }
+  return {
+    config: { $schema: SCHEMA_URL, merchant, jurisdictions: "all", plans, checks },
+    todos,
+    found
+  };
+}
+var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique;
+var init_scaffold = __esm({
+  "src/ci/scaffold.ts"() {
+    "use strict";
+    init_detect();
+    init_config3();
+    IGNORE = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "coverage", ".astro", "vendor", ".venv", "__pycache__", ".github"]);
+    MAX_FILES2 = 5e3;
+    EMAIL_NAMES = [
+      [/trial/i, "trial_reminder"],
+      [/price[-_ ]?(?:change|increase|update)/i, "price_change"],
+      [/annual|yearly[-_ ]?terms/i, "annual_terms"],
+      [/renew/i, "renewal_reminder"],
+      [/cancel/i, "cancellation_confirmation"],
+      [/receipt|charge|invoice|payment[-_ ]?(?:succeeded|receipt)/i, "charge_notice"],
+      [/welcome|confirm|acknowledg|subscribed|signup|sign[-_]up|order/i, "acknowledgment"]
+    ];
+    IN_EMAIL_DIR = /(?:^|\/)(?:e-?mails?|mail(?:ers?)?|notifications?)(?:\/|$)|(?:^|\/)templates\/(?:e-?mails?|mail)\//i;
+    PAGE_FILE = /(?:^|\/)(?:public|dist|out|build|static|_site|www)\/(?:.*\/)?(pricing|checkout|subscribe|plans)(?:\/index)?\.html?$/i;
+    DISCLOSURE_TEXT = /renews? automatically|automatically renews?|auto-?renew|until (?:you )?cancel/i;
+    unique = (names, base) => {
+      let n = base;
+      for (let i = 2; names.has(n); i++) n = `${base} ${i}`;
+      names.add(n);
+      return n;
+    };
+  }
+});
+
+// src/ci/coverage.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { join as join6, relative as relative3, resolve as resolve3 } from "node:path";
+function callsIn(text, file) {
+  const hits = [];
+  for (const [re, kind] of PATTERNS) {
+    for (const m of text.matchAll(re)) hits.push({ at: m.index, end: m.index + m[0].length, kind });
+  }
+  hits.sort((a, b) => a.at - b.at);
+  const out = [];
+  const count = { checkout_session: 0, payment_link: 0 };
+  let last = -1;
+  for (const h of hits) {
+    if (h.at < last) continue;
+    last = h.end;
+    const lineStart2 = text.lastIndexOf("\n", h.at) + 1;
+    const before = text.slice(lineStart2, h.at).trim();
+    if (/^(?:\/\/|#|\*|\/\*)/.test(before)) continue;
+    out.push({ file, line: text.slice(0, h.at).split("\n").length, kind: h.kind, index: ++count[h.kind], arg: text.slice(h.end, h.end + 200) });
+  }
+  return out;
+}
+function coverageOf(loaded, root, files) {
+  const cfg = loaded.config;
+  const toRoot = (p) => relative3(root, resolve3(loaded.dir, p)).split("\\").join("/");
+  const calls = [];
+  const visit = (rel2) => {
+    if (!CODE.test(rel2) || TESTISH.test(rel2)) return;
+    let text = "";
+    try {
+      text = readFileSync7(join6(root, rel2), "utf8");
+    } catch {
+      return;
+    }
+    if (!/create\s*\(/.test(text)) return;
+    calls.push(...callsIn(text, rel2));
+  };
+  if (files) files.forEach(visit);
+  else walk3(root, visit);
+  const ignore = (cfg.coverage && typeof cfg.coverage === "object" ? cfg.coverage.ignore ?? [] : []).map((g) => glob(toRoot(g)));
+  const wholeFiles = /* @__PURE__ */ new Set();
+  const exactCalls = /* @__PURE__ */ new Set();
+  const exportNames = [];
+  const entries = [...cfg.checks.stripe_checkout ?? [], ...cfg.checks.disclosures ?? [], ...cfg.checks.pages ?? []];
+  for (const e of cfg.checks.stripe_checkout ?? []) {
+    if (e.source) exactCalls.add(`${toRoot(e.source)}#checkout_session#${e.call ?? 1}`);
+    if (e.file) wholeFiles.add(toRoot(e.file));
+    if (e.module) {
+      const [path, name] = e.module.split("#");
+      wholeFiles.add(toRoot(path));
+      if (name && name !== "default") exportNames.push(name);
+    }
+  }
+  for (const e of entries) {
+    for (const c of e.covers ?? []) {
+      const [path, n] = c.split("#");
+      if (n) {
+        exactCalls.add(`${toRoot(path)}#checkout_session#${n}`);
+        exactCalls.add(`${toRoot(path)}#payment_link#${n}`);
+      } else wholeFiles.add(toRoot(path));
+    }
+  }
+  const uncovered = [];
+  const ignored = [];
+  for (const c of calls) {
+    if (ignore.some((re) => re.test(c.file))) ignored.push(c);
+    else if (wholeFiles.has(c.file) || exactCalls.has(`${c.file}#${c.kind}#${c.index}`)) continue;
+    else if (exportNames.some((n) => new RegExp(`\\b${n.replace(/[$]/g, "\\$")}\\b`).test(c.arg))) continue;
+    else uncovered.push(c);
+  }
+  return { calls, uncovered, ignored };
+}
+function coverageResults(cov) {
+  return cov.uncovered.map((c) => {
+    const fix = c.kind === "checkout_session" ? `Add it to checks.stripe_checkout: { "name": "\u2026", "source": "${c.file}"${c.index > 1 ? `, "call": ${c.index}` : ""} } (or "module" if the params come from a function). If it never reaches a subscriber (an admin tool, a script), add the file to "coverage": { "ignore": [...] }.` : `Payment Links are checked live from Stripe (connect Stripe in Checkbox). Say which check covers it with "covers": ["${c.file}${c.index > 1 ? `#${c.index}` : ""}"] on that entry, or add the file to "coverage": { "ignore": [...] } if it never reaches a subscriber.`;
+    return {
+      name: `${KIND_LABEL2[c.kind]} at ${c.file}:${c.line}`,
+      type: "stripe_checkout",
+      target: { file: c.file, line: c.line },
+      status: "error",
+      label: "Not in checkbox.json",
+      message: `This ${KIND_LABEL2[c.kind]} call is not checked by any entry in checkbox.json, so a change to it would pass unnoticed.`,
+      fix,
+      fixes: [fix],
+      warnings: []
+    };
+  });
+}
+var CODE, TESTISH, PATTERNS, glob, KIND_LABEL2;
+var init_coverage = __esm({
+  "src/ci/coverage.ts"() {
+    "use strict";
+    init_scaffold();
+    CODE = /\.(?:[cm]?[jt]sx?|py|rb|php)$/i;
+    TESTISH = /(?:^|\/)(?:__tests__|__mocks__|tests?|spec|specs|fixtures?|mocks?|e2e|cypress|playwright|stories|storybook)(?:\/|$)|\.(?:test|spec|stories|e2e)\.[^/]+$|(?:^|\/)test_[^/]+\.py$|_test\.(?:py|rb)$|_spec\.rb$/i;
+    PATTERNS = [
+      [/\bcheckout\s*\.\s*sessions\s*\.\s*create\s*\(/g, "checkout_session"],
+      // Node, Python StripeClient
+      [/\bcheckout\s*\.\s*Session\s*\.\s*create\s*\(/g, "checkout_session"],
+      // Python stripe.checkout.Session
+      [/Checkout::Session\s*\.\s*create\s*\(/g, "checkout_session"],
+      // Ruby
+      [/checkout\s*->\s*sessions\s*->\s*create\s*\(/g, "checkout_session"],
+      // PHP
+      [/\bpaymentLinks\s*\.\s*create\s*\(/g, "payment_link"],
+      // Node
+      [/\bpayment_links\s*\.\s*create\s*\(/g, "payment_link"],
+      // Python StripeClient
+      [/\bPaymentLink\s*\.\s*create\s*\(/g, "payment_link"],
+      // Python, Ruby (Stripe::PaymentLink.create)
+      [/paymentLinks\s*->\s*create\s*\(/g, "payment_link"]
+      // PHP
+    ];
+    glob = (pattern) => {
+      const p = pattern.replace(/^\.\//, "").replace(/\/$/, "/**");
+      const re = p.split("**").map((part) => part.split("*").map((s2) => s2.replace(/[.+^${}()|[\]\\?]/g, "\\$&")).join("[^/]*")).join(".*");
+      return new RegExp(`^${re}$`);
+    };
+    KIND_LABEL2 = { checkout_session: "Stripe Checkout Session", payment_link: "Stripe Payment Link" };
+  }
+});
+
 // src/ci/inputs.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 function readRel(dir, file) {
-  const abs = isAbsolute2(file) ? file : resolve3(dir, file);
+  const abs = isAbsolute2(file) ? file : resolve4(dir, file);
   try {
-    return readFileSync6(abs, "utf8");
+    return readFileSync8(abs, "utf8");
   } catch (err) {
     const code2 = err.code;
     throw new InputError(code2 === "ENOENT" ? `${file} does not exist (paths are relative to checkbox.json)` : `cannot read ${file} (${code2 ?? err.message})`);
@@ -23540,7 +23835,7 @@ function readRel(dir, file) {
 }
 function hasTsx(dir) {
   for (let d = dir, i = 0; i < 8; i++) {
-    if (existsSync5(join5(d, "node_modules", "tsx", "package.json"))) return true;
+    if (existsSync5(join7(d, "node_modules", "tsx", "package.json"))) return true;
     const up = dirname3(d);
     if (up === d) break;
     d = up;
@@ -23560,7 +23855,7 @@ function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
   const hash = ref.lastIndexOf("#");
   const file = hash > 0 ? ref.slice(0, hash) : ref;
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
-  const abs = resolve3(dir, file);
+  const abs = resolve4(dir, file);
   if (!existsSync5(abs)) return Promise.reject(new InputError(`${file} does not exist (paths are relative to checkbox.json)`));
   const flags = loaderFlags(file, dir);
   if (typeof flags === "string") return Promise.reject(new InputError(flags));
@@ -23602,7 +23897,7 @@ function projectEnv(dir) {
   const out = {};
   for (const f of [".env.example", ".env", ".env.local", ".env.test"]) {
     try {
-      Object.assign(out, parseDotenv(readFileSync6(join5(dir, f), "utf8")));
+      Object.assign(out, parseDotenv(readFileSync8(join7(dir, f), "utf8")));
     } catch {
     }
   }
@@ -23628,7 +23923,7 @@ function planTerms(config, plan2) {
   return t;
 }
 function rel(loaded, root, file) {
-  return relative2(root, resolve3(loaded.dir, file)).split("\\").join("/") || file;
+  return relative4(root, resolve4(loaded.dir, file)).split("\\").join("/") || file;
 }
 function emailFromFile(content, file, subject) {
   let body = content;
@@ -23857,7 +24152,8 @@ function annotations(run2) {
     const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict ? "error" : "warning" : void 0;
     if (!level) continue;
     const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
-    const body = x.status === "error" ? `Could not run: ${x.message ?? ""}` : [x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+    const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
     out.push(`::${level} ${props.join(",")}::${escData(body)}`);
   }
   return out;
@@ -23869,7 +24165,7 @@ function stepSummary(run2) {
   lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
   lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
   for (const x of run2.checks) {
-    const fix = x.status === "error" || x.status === "skipped" ? x.message ?? "" : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : "";
+    const fix = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : "";
     lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
   }
   const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
@@ -24441,7 +24737,7 @@ function exitCodeOf(checks, strict) {
   return { status: "pass", exit: EXIT.ok };
 }
 async function runCi(jobs, engine, opts) {
-  const checks = [];
+  const checks = [...opts.extra ?? []];
   for (const j of jobs) checks.push(await runJob(j, engine, opts.config));
   const summary = { pass: 0, fail: 0, needs_review: 0, not_applicable: 0, skipped: 0, error: 0 };
   for (const c of checks) summary[c.status]++;
@@ -24498,168 +24794,6 @@ var init_runner = __esm({
   }
 });
 
-// src/ci/scaffold.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
-import { basename, join as join6, relative as relative3 } from "node:path";
-function walk3(root, visit) {
-  let n = 0;
-  const go = (dir, depth) => {
-    if (depth > 8 || n > MAX_FILES2) return;
-    let names = [];
-    try {
-      names = readdirSync3(dir).sort();
-    } catch {
-      return;
-    }
-    for (const name of names) {
-      if (IGNORE.has(name) || name.startsWith(".") && name !== ".well-known") continue;
-      const abs = join6(dir, name);
-      let st;
-      try {
-        st = statSync2(abs);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) go(abs, depth + 1);
-      else if (st.isFile() && st.size < 4e5) {
-        n++;
-        visit(relative3(root, abs).split("\\").join("/"));
-      }
-    }
-  };
-  go(root, 0);
-}
-function emailKindOf(file) {
-  const name = basename(file).replace(/\.[^.]+$/, "");
-  return EMAIL_NAMES.find(([re]) => re.test(name))?.[1];
-}
-function scaffoldConfig(root, env2 = {}) {
-  const det = detectProject(root, env2);
-  const todos = [];
-  const found = [];
-  const names = /* @__PURE__ */ new Set();
-  const merchant = {};
-  merchant.name = det.brand?.name ?? "TODO: the brand subscribers see";
-  if (!det.brand) todos.push("merchant.name: the brand subscribers see");
-  const cancelPath = det.policyPaths.cancellation;
-  if (det.siteUrl && cancelPath) merchant.cancel_url = `${originOf(det.siteUrl)}${cancelPath}`;
-  else {
-    merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
-    todos.push("merchant.cancel_url: the page where subscribers cancel online");
-  }
-  const plans = det.plans.map((p, i) => ({
-    name: p.name ?? `Plan ${i + 1}`,
-    amount: p.amount,
-    currency: p.currency,
-    interval: p.interval,
-    ...p.interval_count ? { interval_count: p.interval_count } : {},
-    ...p.trial_days ? { trial_days: p.trial_days } : {}
-  }));
-  for (const p of det.plans) found.push(`plan ${p.name ?? ""} ${p.amount / 100} ${p.currency}/${p.interval} (${p.source})`.replace(/\s+/g, " "));
-  if (!plans.length) {
-    plans.push({ name: "TODO: plan name", price: "TODO: e.g. 19.99", currency: "usd", interval: "month" });
-    todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
-  }
-  const planNames = plans.map((p) => String(p.name));
-  const planFor = () => plans.length > 1 ? { plan: `TODO: one of ${planNames.map((n) => JSON.stringify(n)).join(", ")}` } : {};
-  if (plans.length > 1) todos.push("plan: pick the plan of each disclosure, page and email entry");
-  const stripe = [];
-  const perFile = /* @__PURE__ */ new Map();
-  for (const s2 of det.checkoutSessions) {
-    const call = (perFile.get(s2.file) ?? 0) + 1;
-    perFile.set(s2.file, call);
-    const entry = { name: unique(names, `Stripe Checkout (${basename(s2.file)}${call > 1 ? ` #${call}` : ""})`), source: s2.file, ...call > 1 ? { call } : {} };
-    if (!s2.params) {
-      todos.push(`${s2.file}:${s2.line}: the params are not an object literal; use "module" (an exported function returning the params) instead of "source"`);
-      delete entry.source;
-      delete entry.call;
-      entry.module = `TODO: ${s2.file.replace(/\.[^.]+$/, "")}.ts#buildCheckoutParams`;
-    } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
-    else found.push(`${s2.file}:${s2.line}: Checkout Session`);
-    stripe.push(entry);
-  }
-  const emails = [];
-  const pages = [];
-  const disclosures = [];
-  walk3(root, (rel2) => {
-    if (IN_EMAIL_DIR.test(rel2)) {
-      const kind = emailKindOf(rel2);
-      if (/\.(?:html?|txt|md)$/i.test(rel2) && kind) {
-        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...planFor() });
-        found.push(`${rel2}: ${kind} email`);
-        return;
-      }
-      if (/\.[jt]sx$|\.mjml$/i.test(rel2) && kind) {
-        todos.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
-        return;
-      }
-    }
-    if (PAGE_FILE.test(rel2)) {
-      const kind = /checkout|subscribe/i.test(rel2) ? "checkout" : "pricing";
-      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor() });
-      found.push(`${rel2}: ${kind} page`);
-      return;
-    }
-    if (/\.(?:txt|md)$/i.test(rel2) && !/(?:^|\/)(?:README|CHANGELOG|LICENSE|CONTRIBUTING|AGENTS|CLAUDE)[^/]*$/i.test(rel2) && !rel2.startsWith("docs/")) {
-      let text = "";
-      try {
-        text = readFileSync7(join6(root, rel2), "utf8");
-      } catch {
-        return;
-      }
-      if (text.length < 1500 && DISCLOSURE_TEXT.test(text)) {
-        disclosures.push({ name: unique(names, `Disclosure: ${basename(rel2)}`), file: rel2, ...planFor() });
-        found.push(`${rel2}: disclosure text`);
-      }
-    }
-  });
-  if (!disclosures.length && det.payButtons.length) {
-    todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
-  }
-  const checks = {};
-  if (stripe.length) checks.stripe_checkout = stripe;
-  if (disclosures.length) checks.disclosures = disclosures;
-  if (pages.length) checks.pages = pages;
-  if (emails.length) checks.emails = emails;
-  checks.notice_schedule = true;
-  if (!stripe.length && !disclosures.length && !pages.length && !emails.length) {
-    todos.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
-  }
-  return {
-    config: { $schema: SCHEMA_URL, merchant, jurisdictions: "all", plans, checks },
-    todos,
-    found
-  };
-}
-var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique;
-var init_scaffold = __esm({
-  "src/ci/scaffold.ts"() {
-    "use strict";
-    init_detect();
-    init_config3();
-    IGNORE = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "coverage", ".astro", "vendor", ".venv", "__pycache__", ".github"]);
-    MAX_FILES2 = 5e3;
-    EMAIL_NAMES = [
-      [/trial/i, "trial_reminder"],
-      [/price[-_ ]?(?:change|increase|update)/i, "price_change"],
-      [/annual|yearly[-_ ]?terms/i, "annual_terms"],
-      [/renew/i, "renewal_reminder"],
-      [/cancel/i, "cancellation_confirmation"],
-      [/receipt|charge|invoice|payment[-_ ]?(?:succeeded|receipt)/i, "charge_notice"],
-      [/welcome|confirm|acknowledg|subscribed|signup|sign[-_]up|order/i, "acknowledgment"]
-    ];
-    IN_EMAIL_DIR = /(?:^|\/)(?:e-?mails?|mail(?:ers?)?|notifications?)(?:\/|$)|(?:^|\/)templates\/(?:e-?mails?|mail)\//i;
-    PAGE_FILE = /(?:^|\/)(?:public|dist|out|build|static|_site|www)\/(?:.*\/)?(pricing|checkout|subscribe|plans)(?:\/index)?\.html?$/i;
-    DISCLOSURE_TEXT = /renews? automatically|automatically renews?|auto-?renew|until (?:you )?cancel/i;
-    unique = (names, base) => {
-      let n = base;
-      for (let i = 2; names.has(n); i++) n = `${base} ${i}`;
-      names.add(n);
-      return n;
-    };
-  }
-});
-
 // src/ci/workflow.ts
 var WORKFLOW_PATH, WORKFLOW_YAML;
 var init_workflow = __esm({
@@ -24706,12 +24840,12 @@ __export(ci_exports, {
 import { execFileSync } from "node:child_process";
 import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname4, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, join as join8, relative as relative5, resolve as resolve5 } from "node:path";
 function gitChanged(cwd, base) {
   try {
     const root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
     const out = execFileSync("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve4(root, f)) };
+    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve5(root, f)) };
   } catch (err) {
     const msg2 = String(err.stderr || err.message).trim().split("\n")[0];
     return `git diff ${base}...HEAD failed (${msg2}); fetch the base branch (actions/checkout with fetch-depth: 0)`;
@@ -24722,7 +24856,7 @@ function touchesConfig(loaded, jobs, changed) {
   if (set.has(loaded.path)) return true;
   const codeChanged = changed.some((f) => /\.(?:[cm]?[jt]sx?)$/.test(f));
   for (const j of jobs) {
-    for (const f of j.inputs) if (set.has(resolve4(loaded.dir, f))) return true;
+    for (const f of j.inputs) if (set.has(resolve5(loaded.dir, f))) return true;
   }
   const hasModules = [...loaded.config.checks.stripe_checkout ?? [], ...loaded.config.checks.emails ?? []].some((e) => "module" in e && e.module);
   return hasModules && codeChanged;
@@ -24747,8 +24881,8 @@ async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
   const explicit = str(p.flags, "config");
-  const configPath = explicit ? resolve4(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join7(ctx.cwd, f)).find((f) => existsSync6(f)) ?? join7(ctx.cwd, CONFIG_FILES[0]);
-  const workflowPath = join7(ctx.cwd, WORKFLOW_PATH);
+  const configPath = explicit ? resolve5(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join8(ctx.cwd, f)).find((f) => existsSync6(f)) ?? join8(ctx.cwd, CONFIG_FILES[0]);
+  const workflowPath = join8(ctx.cwd, WORKFLOW_PATH);
   const force = bool(p.flags, "force") === true;
   const withWorkflow = bool(p.flags, "workflow") !== false;
   const s2 = scaffoldConfig(ctx.cwd, ctx.env);
@@ -24761,7 +24895,7 @@ async function runInit(ctx, argv) {
   let write = !dry && toWrite.length > 0;
   if (write && bool(p.flags, "yes") !== true) {
     if (process.stdin.isTTY && !ctx.flags.json) {
-      for (const f of toWrite) ctx.out.info(`${f.action === "create" ? "create" : "overwrite"} ${relative4(ctx.cwd, f.path)}`);
+      for (const f of toWrite) ctx.out.info(`${f.action === "create" ? "create" : "overwrite"} ${relative5(ctx.cwd, f.path)}`);
       write = await confirm("Write these files? [Y/n] ");
     } else write = false;
   }
@@ -24771,7 +24905,7 @@ async function runInit(ctx, argv) {
       writeFileSync2(f.path, f.content);
     }
   }
-  const relName = (f) => relative4(ctx.cwd, f) || f;
+  const relName = (f) => relative5(ctx.cwd, f) || f;
   const result = {
     object: "ci_init",
     written: write ? toWrite.map((f) => relName(f.path)) : [],
@@ -24800,6 +24934,7 @@ var init_ci = __esm({
     "use strict";
     init_args();
     init_config3();
+    init_coverage();
     init_inputs();
     init_report();
     init_runner();
@@ -24858,21 +24993,26 @@ var init_ci = __esm({
           loaded = loadConfig(path);
         } catch (err) {
           if (!(err instanceof ConfigError)) throw err;
-          const file = relative4(ctx.env.GITHUB_WORKSPACE ?? ctx.cwd, path) || path;
+          const file = relative5(ctx.env.GITHUB_WORKSPACE ?? ctx.cwd, path) || path;
           if (gha) for (const i of err.issues) emit(`::error file=${file},title=Checkbox config::${i.replace(/%/g, "%25").replace(/\n/g, "%0A")}`);
-          ctx.out.error({ message: `${relative4(ctx.cwd, path) || path} is not valid:
+          ctx.out.error({ message: `${relative5(ctx.cwd, path) || path} is not valid:
   - ${err.issues.join("\n  - ")}`, code: "config_invalid", type: "usage_error", issues: err.issues, next_action: { type: "edit_config", message: "Fix the keys listed above (reference: https://checkbox.site/docs/guides/ci#config)." } });
           return EXIT.usage;
         }
-        const configName = relative4(ctx.cwd, path) || path;
+        const configName = relative5(ctx.cwd, path) || path;
         const jobs = await resolveJobs(loaded, { online, env: ctx.env, root: ctx.env.GITHUB_WORKSPACE ?? ctx.cwd });
+        const workspace = ctx.env.GITHUB_WORKSPACE ?? ctx.cwd;
+        const extra = (loaded.config.coverage === false ? [] : coverageResults(coverageOf(loaded, loaded.dir))).map((r) => ({
+          ...r,
+          target: { ...r.target, file: relative5(workspace, join8(loaded.dir, r.target.file)).split("\\").join("/") || r.target.file }
+        }));
         if (bool(p.flags, "changed-only")) {
           const base = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
           if (!base) ctx.out.info("--changed-only: no --base and not a pull request (GITHUB_BASE_REF); running every check.");
           else {
             const changed = gitChanged(ctx.cwd, base);
             if (typeof changed === "string") ctx.out.warn(`${changed}; running every check.`);
-            else if (!touchesConfig(loaded, jobs, changed.files)) {
+            else if (!extra.length && !touchesConfig(loaded, jobs, changed.files)) {
               const message = `No file checkbox.json reads changed since ${base}: ${jobs.length} check(s) skipped.`;
               if (gha) {
                 writeGithubFile(ctx.env.GITHUB_STEP_SUMMARY, `## Checkbox compliance checks
@@ -24887,7 +25027,7 @@ ${message}
           }
         }
         const engine = online ? onlineEngine(ctx.client()) : offlineEngine();
-        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict });
+        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra });
         ctx.out.result(run2, () => renderHuman(run2, ctx.out.c, { verbose: bool(p.flags, "verbose") === true }));
         if (gha) {
           for (const a of annotations(run2)) emit(a);
@@ -25119,8 +25259,8 @@ var init_patch = __esm({
 });
 
 // src/commands/plan/fix.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
-import { relative as relative5, resolve as resolve5 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { relative as relative6, resolve as resolve6 } from "node:path";
 function fixForTask(task, cwd, file) {
   const base = {
     object: "task_fix",
@@ -25132,17 +25272,17 @@ function fixForTask(task, cwd, file) {
     verify: task.verify
   };
   const verifyCmd = `checkbox verify ${task.id} --wait`;
-  const candidate = file ?? (task.where.file_hint && existsSync7(resolve5(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
+  const candidate = file ?? (task.where.file_hint && existsSync7(resolve6(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
   if (task.change.type === "patch" && task.change.edits.length && candidate) {
-    const path = resolve5(cwd, candidate);
+    const path = resolve6(cwd, candidate);
     let src;
     try {
-      src = readFileSync8(path, "utf8");
+      src = readFileSync9(path, "utf8");
     } catch (err) {
       throw new UsageError(`Cannot read ${candidate}: ${err.code ?? err.message}`);
     }
     const r = applyEdits(src, task.change.edits, { jsx: isJsxFile(candidate) });
-    const rel2 = relative5(cwd, path).split("\\").join("/");
+    const rel2 = relative6(cwd, path).split("\\").join("/");
     const diff2 = unifiedDiff(src, r.patched, rel2);
     const complete = r.unmatched.length === 0;
     return {
@@ -25197,7 +25337,7 @@ var init_fix = __esm({
         const task = await ctx.client().sdk.tasks.retrieve(id);
         const result = fixForTask(task, ctx.cwd, str(flags, "file"));
         const out = str(flags, "out");
-        if (out && result.diff) writeFileSync3(resolve5(ctx.cwd, out), result.diff);
+        if (out && result.diff) writeFileSync3(resolve6(ctx.cwd, out), result.diff);
         ctx.out.result({ ...result, task_object: task }, () => {
           const c = ctx.out.c;
           const lines = [`${c.bold(task.title)} ${c.dim(`(${task.priority}, ${task.id})`)}`, c.dim(`${task.requirement.citation}`), task.why, ""];
@@ -25299,11 +25439,11 @@ var init_device = __esm({
 });
 
 // src/commands/init/patch.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5, join as join8 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname5, join as join9 } from "node:path";
 function read(root, rel2) {
   try {
-    return readFileSync9(join8(root, rel2), "utf8");
+    return readFileSync10(join9(root, rel2), "utf8");
   } catch {
     return null;
   }
@@ -25466,7 +25606,7 @@ function planGitignore(d) {
     const covered = lines.some((l) => l === env2 || l === `/${env2}` || l === ".env*" || l === "*.env" || env2 === ".env.local" && (l === ".env*.local" || l === "*.local" || l === ".env.local*") || env2 === ".env" && l === ".env*");
     if (covered) return null;
   }
-  if (existing === null && !existsSync8(join8(d.root, ".git"))) return null;
+  if (existing === null && !existsSync8(join9(d.root, ".git"))) return null;
   const text = `${existing ?? ""}${existing && !existing.endsWith("\n") ? "\n" : ""}# Checkbox keys (checkbox init)
 ${env2}
 `;
@@ -25482,7 +25622,7 @@ function planWellKnown(d, token) {
 }
 function applyChange(root, c) {
   if (c.action === "unchanged" || c.contents === void 0) return;
-  const abs = join8(root, c.file);
+  const abs = join9(root, c.file);
   mkdirSync3(dirname5(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
@@ -25545,7 +25685,7 @@ function saveState(ctx, root, patch) {
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve8) => rl.question(question, resolve8));
+    return await new Promise((resolve9) => rl.question(question, resolve9));
   } finally {
     rl.close();
   }
@@ -26092,7 +26232,7 @@ import { createInterface as createInterface3 } from "node:readline";
 async function prompt(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve8) => rl.question(question, resolve8));
+    return await new Promise((resolve9) => rl.question(question, resolve9));
   } finally {
     rl.close();
   }
@@ -26187,7 +26327,7 @@ var init_logout = __esm({
 });
 
 // src/commands/plan/lib.ts
-import { dirname as dirname6, resolve as resolve6 } from "node:path";
+import { dirname as dirname6, resolve as resolve7 } from "node:path";
 async function resolveSite(ctx, flag, client) {
   const explicit = flag ?? ctx.env.CHECKBOX_SITE;
   if (explicit) {
@@ -26195,7 +26335,7 @@ async function resolveSite(ctx, flag, client) {
     return explicit;
   }
   const projects = ctx.config.load().init?.projects ?? {};
-  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
+  for (let dir = resolve7(ctx.cwd); ; dir = dirname6(dir)) {
     const site = projects[dir]?.site;
     if (site) return site;
     if (dirname6(dir) === dir) break;
@@ -26294,11 +26434,11 @@ var init_plan = __esm({
 });
 
 // src/commands/plan/verify.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { readFileSync as readFileSync11 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
 function readJson2(ctx, file, what) {
   try {
-    const v = JSON.parse(readFileSync10(resolve7(ctx.cwd, file), "utf8"));
+    const v = JSON.parse(readFileSync11(resolve8(ctx.cwd, file), "utf8"));
     if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("not a JSON object");
     return v;
   } catch (err) {
@@ -26344,7 +26484,7 @@ var init_verify2 = __esm({
           const htmlFile = str(flags, "html-file");
           if (htmlFile) {
             try {
-              body.html = readFileSync10(resolve7(ctx.cwd, htmlFile), "utf8");
+              body.html = readFileSync11(resolve8(ctx.cwd, htmlFile), "utf8");
             } catch (err) {
               throw new UsageError(`Cannot read ${htmlFile}: ${err.code ?? err.message}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "The checkbox CLI: automatic-renewal law checks (ROSCA, California ARL, New York and other states) for subscription checkouts, disclosures and emails, from a terminal, CI or an AI coding agent. Runs offline.",
   "keywords": [
     "subscription",