@checkbox-site/cli 0.4.0 → 0.4.1

package/dist/checkbox.js

@@ -2612,7 +2612,7 @@ var init_operations = __esm({
       /**
        * Get the compliance plan for a site.
        *
-       * Ordered tasks that make the site's checks pass, recomputed from its latest evaluation: each with the requirement and citation, where to change (file / URL / selector / Stripe object), the exact change (unified-diff template with machine-applicable edits, copy, or Stripe params) and how to verify it. Do plan.next_action: apply the first open task, call verifyTask, repeat until status is compliant. Tasks with status manual hold a question for the human (answerTask); they never block the others.
+       * Ordered tasks that make the site's checks pass, recomputed from its latest evaluation: each with the requirement and citation, where to change (file / URL / selector / Stripe object), the exact change (unified-diff template with machine-applicable edits, copy, or Stripe params) and how to verify it. Do plan.next_action: apply the first open task, call verifyTask, and repeat until the checks pass (status value compliant; status_label "Checks pass"). Tasks with status manual hold a question for the human (answerTask); they never block the others.
        *
        * @param site Unique identifier of the site (site_…).
        * @see GET /v1/sites/{site}/plan (operation `retrieveCompliancePlan`, scope `compliance_plans:read`)
@@ -2831,7 +2831,7 @@ var init_operations = __esm({
       /**
        * Update notice settings.
        *
-       * Chooses who sends the required emails (mode: merchant = you send them and Checkbox tracks them, the default; checkbox = Checkbox sends them), and sets branding, cancel_url and the confirmed cancellation policy. In checkbox mode, turning a notice on (enabled_kinds) requires cancel_url, a confirmed policy, a connected Stripe, Recharge, Chargebee, Recurly or Paddle account and a sending address; otherwise resource_conflict explains what is missing.
+       * Chooses who sends the required emails (mode: merchant = you send them and Checkbox tracks them, the default; checkbox = Checkbox sends them), and sets branding, cancel_url and the confirmed cancellation policy. add_kinds / remove_kinds turn single notices on or off and leave the others as they are; enabled_kinds replaces the whole list. In checkbox mode, turning a notice on requires cancel_url, a confirmed policy, a connected Stripe, Recharge, Chargebee, Recurly or Paddle account and a sending address; otherwise resource_conflict explains what is missing.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/notice_settings (operation `updateNoticeSettings`, scope `notices:write`, live mode needs an activated account)
@@ -4632,6 +4632,13 @@ var init_stripe_ids = __esm({
   }
 });
 
+// ../core/src/go-live.ts
+var init_go_live = __esm({
+  "../core/src/go-live.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/index.ts
 var init_src2 = __esm({
   "../core/src/index.ts"() {
@@ -4640,6 +4647,7 @@ var init_src2 = __esm({
     init_jurisdictions();
     init_todo();
     init_stripe_ids();
+    init_go_live();
   }
 });
 
@@ -4829,7 +4837,7 @@ var init_california = __esm({
         notes: notes(
           AB2863_APPLICABILITY,
           "Misrepresentation is only partly machine-detectable; the auto-renewal language check catches the most common case (offers that hide or deny the renewal).",
-          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock, $35M), a hidden early-termination fee (Adobe, $150M).',
+          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock, $35M), a hidden early-termination fee (Adobe: Justice Department complaint filed June 2024).',
           'CHECK GAP: no check yet flags "cancel anytime" / "no commitment" copy contradicted by the refund or term policy, or a one-time purchase that enrolls the buyer in a subscription (product opportunity: a rollover and misrepresentation check). terms.refund_policy_consistent covers advertised refund promises.'
         )
       }),
@@ -5064,7 +5072,7 @@ var init_federal = __esm({
     ROSCA_EFFECTIVE = "2010-12-29";
     REG_E_URL = "https://www.ecfr.gov/current/title-12/chapter-X/part-1005/subpart-A/section-1005.10";
     EFTA_EFFECTIVE = "1980-05-10";
-    ROSCA_SCOPE = `Applies to goods or services sold in a transaction effected on the Internet through a "negative option feature" (16 C.F.R. \xA7 310.2(w): a provision under which the customer's silence or failure to take affirmative action to reject goods or services or to cancel the agreement is interpreted as acceptance) \u2014 i.e. free-to-pay conversions, automatic renewals and continuity plans sold online. Enforced by the FTC (violations are treated as rule violations under FTC Act \xA7 18, enabling civil penalties and consumer redress) and by state attorneys general.`;
+    ROSCA_SCOPE = `Applies to goods or services sold in a transaction effected on the Internet through a "negative option feature" (16 C.F.R. \xA7 310.2(w): a provision under which the customer's silence or failure to take affirmative action to reject goods or services or to cancel the agreement is interpreted as acceptance) \u2014 i.e. free-to-pay conversions, automatic renewals and continuity plans sold online. The definition was \xA7 310.2(u) when ROSCA was enacted; the FTC redesignated it \xA7 310.2(w) effective Feb. 12, 2016 (80 Fed. Reg. 77520, 77558), so older sources cite (u). Enforced by the FTC (violations are treated as rule violations under FTC Act \xA7 18, enabling civil penalties and consumer redress) and by state attorneys general.`;
     FEDERAL_REQUIREMENTS = [
       draft({
         id: "US-FED.8403.1",
@@ -5497,7 +5505,7 @@ var init_exposure = __esm({
     BASE_JURISDICTION_EXPOSURE = {
       "US-FED": {
         privateRightOfAction: "ag_only",
-        remedies: "ROSCA: enforced by the FTC and state attorneys general; no private right of action. A violation is treated as a violation of an FTC trade regulation rule (15 U.S.C. \xA7 8404(a)), so the FTC Act's penalties apply (\xA7 8404(b)): civil penalties up to $53,088 per violation (15 U.S.C. \xA7 45(m)(1)(A), as adjusted by 16 C.F.R. \xA7 1.98(d), 2025 adjustment, for penalties assessed after January 17, 2025; still the current figure as of 2026-11-08) and consumer redress. Examples: Amazon, a $1B civil penalty + $1.5B refunds ([FTC press release](https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-25-billion-settlement-against-amazon)); Adobe, a $150M settlement ([Justice Department press release](https://www.justice.gov/usao-ndca/pr/adobe-agrees-150-million-settlement-and-injunction-resolve-alleged-violations-restore)).",
+        remedies: "ROSCA: enforced by the FTC and state attorneys general; no private right of action. A violation is treated as a violation of an FTC trade regulation rule (15 U.S.C. \xA7 8404(a)), so the FTC Act's penalties apply (\xA7 8404(b)): civil penalties up to $53,088 per violation (15 U.S.C. \xA7 45(m)(1)(A), as adjusted by 16 C.F.R. \xA7 1.98(d), 2025 adjustment, for penalties assessed after January 17, 2025; still the current figure as of 2026-11-08) and consumer redress. Examples: Amazon, a $1B civil penalty + $1.5B refunds ([FTC press release](https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-secures-historic-25-billion-settlement-against-amazon)); Adobe (Justice Department complaint filed June 2024 in the Northern District of California).",
         civilPenalties: true,
         restitution: true
       },
@@ -6113,7 +6121,11 @@ var init_new_york = __esm({
         scope: 'Consumers (personal, family or household purposes; definitions in \xA7 527). Exempt (\xA7 527-a(4)): services under a municipal franchise, DFS-regulated entities, security alarm operators, banks/credit unions/financial institutions, and service contract sellers and administrators (Ins. Law \xA7 7902). Related but not cataloged: GBL \xA7 5-903 (renewal notice for service, maintenance or repair contracts for real or personal property). New York City consumers are also covered by the stricter DCWP "Click to Cancel" rule (US-NY.NYC.*, effective Oct. 1, 2026).',
         amendments: [
           { citation: "L. 2023, ch. 728 (S5941-B)", effectiveDate: CH728_2023, summary: "15-45 day renewal notice for initial paid terms of one year or longer." },
-          { citation: "L. 2025, ch. 58, Part W (S.3008-C/A.3008-C)", effectiveDate: PART_W, summary: "Comprehensive rewrite of \xA7 527-a (see file header)." }
+          {
+            citation: "L. 2025, ch. 58, Part W (S.3008-C/A.3008-C)",
+            effectiveDate: PART_W,
+            summary: "Rewrote \xA7 527-a: material terms disclosed before consent or billing information is requested; price increases need consent, or a right to cancel for at least 14 days after the charge with a pro-rata refund; a notice after consent; cancellation as easy as sign-up, in the same medium and in every medium used to consent, with no obstruction; material-change notice at least 5 business days and no more than 30 days ahead; notice 3-21 days before the cancellation deadline when a free gift or trial of more than a month converts to paid."
+          }
         ]
       },
       {
@@ -9727,7 +9739,7 @@ var init_catalog = __esm({
     init_states();
     init_terms();
     init_types3();
-    CATALOG_VERSION = "2026.11.08.5";
+    CATALOG_VERSION = "2026.11.09.1";
     CATALOG = [
       ...FEDERAL_REQUIREMENTS,
       ...CALIFORNIA_REQUIREMENTS,
@@ -10363,7 +10375,9 @@ var init_text = __esm({
       /\breply\s+(?:to\s+this\s+email\s+)?(?:with\s+)?["']?(?:cancel|stop)["']?/gi
     ];
     TRIAL_MENTION_PATTERNS = [
-      /\b(?:free\s+)?trial(?:s|\s+period)?\b/gi,
+      // Round 21 (pilot 20, change-guard): "trial-ending" / "trial reminder" names a kind of notice (a dropdown of notice
+      // channels), not a free trial on offer.
+      /\b(?:free\s+)?trial(?:s|\s+period)?\b(?!-end(?:ing|s)?\b)(?!\s+(?:ending\s+)?(?:reminders?|notices?|emails?|alerts?)\b)/gi,
       // "Try for $0.00", "Try 1 month for $0" (calibration corpus: Audible, Spotify)
       /\btry\s+(?:[\w-]+\s+){0,3}?for\s+(?:US)?\$\s?0(?:\.00)?(?![\d.,])/gi,
       /\btry\s+(?:it\s+)?(?:for\s+)?free\b/gi,
@@ -10469,6 +10483,12 @@ function policyKindOf(c) {
   const m = new RegExp(`#${POLICY_FRAGMENT}=([a-z]+)$`).exec(c.url ?? "");
   return m && isPolicyKind(m[1]) ? m[1] : null;
 }
+function isUnreadStaticFetch(c) {
+  return c.userAgent === POLICY_FETCHER_USER_AGENT && !!c.pageProblem && /almost no text/i.test(c.pageProblem) && !/even rendered/i.test(c.pageProblem);
+}
+function renderedRead(c) {
+  return c.userAgent !== POLICY_FETCHER_USER_AGENT && !c.pageProblem;
+}
 function policyDocuments(captures) {
   const best = /* @__PURE__ */ new Map();
   for (const c of captures) {
@@ -10476,7 +10496,13 @@ function policyDocuments(captures) {
     if (!kind) continue;
     const key = `${kind}|${policySourceUrl(c.url)}`;
     const prev = best.get(key);
-    if (!prev || Date.parse(c.capturedAt) > Date.parse(prev.capture.capturedAt)) best.set(key, { kind, capture: c });
+    const newer = !prev || Date.parse(c.capturedAt) > Date.parse(prev.capture.capturedAt);
+    if (prev && newer && isUnreadStaticFetch(c) && renderedRead(prev.capture)) continue;
+    if (prev && !newer && isUnreadStaticFetch(prev.capture) && renderedRead(c)) {
+      best.set(key, { kind, capture: c });
+      continue;
+    }
+    if (newer) best.set(key, { kind, capture: c });
   }
   return [...best.values()].sort((a, b) => POLICY_KINDS.indexOf(a.kind) - POLICY_KINDS.indexOf(b.kind) || a.capture.url.localeCompare(b.capture.url));
 }
@@ -10534,13 +10560,14 @@ function analyzePolicyText(input) {
 function clausesOf(clauses, code2) {
   return clauses.filter((c) => c.code === code2);
 }
-var POLICY_KINDS, POLICY_FRAGMENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
+var POLICY_KINDS, POLICY_FRAGMENT, POLICY_FETCHER_USER_AGENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
 var init_policy_docs = __esm({
   "../rules/src/policy-docs.ts"() {
     "use strict";
     init_text();
     POLICY_KINDS = ["terms", "refund", "cancellation", "privacy"];
     POLICY_FRAGMENT = "checkbox-policy";
+    POLICY_FETCHER_USER_AGENT = "CheckboxPolicyFetcher/1.0 (+https://checkbox.site/docs/policy-fetcher)";
     SUBSCRIPTION_WORDS = /\b(subscriptions?|memberships?|plans?|renew\w*|recurring|billing|agreement|services?|account)\b/i;
     NO_CANCEL = [
       /\bno cancell?ations?\b(?!\s+(?:fees?|charges?|penalt))/i,
@@ -11211,6 +11238,30 @@ function declaredPlansFrom(plans) {
   });
   return out;
 }
+function withIntroOffers(declared, billing, offers) {
+  if (!offers?.length) return [...declared];
+  const introFields = (o) => ({
+    ...o.introAmount !== void 0 ? { intro_amount: o.introAmount } : {},
+    ...o.introPercentOff !== void 0 ? { intro_percent_off: o.introPercentOff } : {},
+    ...o.introAmountOff !== void 0 ? { intro_amount_off: o.introAmountOff } : {},
+    ...o.introPeriods !== void 0 ? { intro_periods: o.introPeriods } : {}
+  });
+  const hasIntro2 = (x) => ["intro_amount", "intro_price", "intro_percent_off", "intro_amount_off"].some((k) => x[k] !== void 0 && x[k] !== null);
+  const base = declared.length ? [...declared] : billing.filter((p) => p && p.amount > 0 && p.interval).map((p) => ({ name: p.name, price_id: p.id, amount: p.amount, currency: (p.currency || "usd").toLowerCase(), interval: p.interval, interval_count: p.intervalCount || 1, ...p.trialDays && p.trialDays > 0 ? { trial_days: p.trialDays } : {} }));
+  const mapped = reconcileDeclaredPlans(base, billing).plans;
+  const key = (p) => `${p.amount}|${(p.currency || "usd").toLowerCase()}|${p.interval}|${p.intervalCount || 1}`;
+  return base.map((raw, i) => {
+    if (!raw || typeof raw !== "object") return raw;
+    const x = raw;
+    const ids = [...declaredPriceIds(x), ...declaredPriceIds(mapped[i] ?? {})];
+    const d = declaredPlansFrom([x])[0];
+    if (d) {
+      for (const p of billing) if (p && key(p) === key(d)) ids.push(p.id);
+    }
+    const o = offers.find((e) => ids.includes(e.priceId));
+    return o && !hasIntro2(x) ? { ...x, ...introFields(o) } : raw;
+  });
+}
 function shortPlanTerms(p) {
   const digits = currencyDigitsOf(p.currency);
   const major = p.amount / 10 ** digits;
@@ -11268,13 +11319,18 @@ function reconcileDeclaredPlans(raw, billing, platform = "Stripe") {
     const wa = nameWords(a);
     return nameWords(b).some((w) => wa.includes(w));
   };
+  const anchorPrices = prices.filter((p) => claimed.has(p.id));
   parsed.forEach((d, i) => {
     if (!d || match[i]) return;
     if (prices.some((p) => key(p) === key(d))) return;
     const same = prices.filter((p) => !claimed.has(p.id) && p.interval === d.interval && (p.intervalCount || 1) === (d.intervalCount || 1) && (p.currency || "usd").toLowerCase() === (d.currency || "usd").toLowerCase());
-    if (same.length !== 1 || !(namesMatch(d, same[0]) || anchored && norm2(same[0].name).length < 3)) return;
-    match[i] = { price: same[0], by: "interval" };
-    claimed.add(same[0].id);
+    if (same.length !== 1) return;
+    const cand = same[0];
+    const sameTrial = (cand.trialDays ?? 0) > 0 && cand.trialDays === d.trialDays;
+    const sameProduct = anchorPrices.some((a) => sameProductName(a.name, cand.name));
+    if (!(namesMatch(d, cand) || anchored && norm2(cand.name).length < 3 || sameTrial || sameProduct)) return;
+    match[i] = { price: cand, by: "interval" };
+    claimed.add(cand.id);
   });
   parsed.forEach((d, i) => {
     const m = match[i];
@@ -11312,7 +11368,8 @@ function reconcileDeclaredPlans(raw, billing, platform = "Stripe") {
       fields,
       declared,
       billing: billed,
-      message: `${d.label ? `${d.label}: ` : ""}Your setup says ${declared}; ${platform} price ${p.id} charges ${billed}. Your page must show what ${platform} charges: Checkbox checks every page, email and fix against the ${platform} Price. Update the price on your page and in your setup plans (update_setup), or change the Price in ${platform}.`
+      // Round 21 (item 9): name the plan the merchant knows ("your Annual plan says $79/year, Stripe charges $72/year").
+      message: `${d.label ? `Your ${d.label}${/\bplan$/i.test(d.label.trim()) ? "" : " plan"} says ${declared}; ${platform} charges ${billed} (price ${p.id}).` : `Your setup says ${declared}; ${platform} price ${p.id} charges ${billed}.`} Your page must show what ${platform} charges: Checkbox checks every page, email and fix against the ${platform} Price. Update the price on your page and in your setup plans (updateSetupSession plans[]), or change the Price in ${platform}.`
     });
   });
   return { plans: out, conflicts };
@@ -12623,6 +12680,14 @@ function oldPaymentLinksWithoutConsent(links, captures) {
   if (!linked.length || !linked.some((l) => l.consentTermsOfService === "required")) return [];
   return active.filter((l) => !linked.includes(l) && l.consentTermsOfService !== "required").slice(0, MAX_PAYMENT_LINKS);
 }
+function unjudgedPaymentLinksWithoutTerms(links, captures, checkoutType) {
+  const judged = new Set([...paymentLinksForSite(links, captures, checkoutType), ...oldPaymentLinksWithoutConsent(links, captures)].map((l) => l.id));
+  const active = links.filter((l) => l.active !== false && (l.lineItems ?? []).some((li) => !!li.interval) && !judged.has(l.id));
+  return active.filter((l) => {
+    const a = analyzeTerms(l.customText?.submit ?? "");
+    return !(a.autoRenew.length || a.untilCanceled.length);
+  }).slice(0, MAX_PAYMENT_LINKS);
+}
 function paymentLinkName(l) {
   const product = l.lineItems?.find((li) => li.productName)?.productName?.trim();
   return `${product ? `\u201C${product}\u201D ` : ""}(${l.id}${l.url ? `, ${l.url}` : ""})`;
@@ -12791,12 +12856,13 @@ function isLoginPage(c) {
 }
 function selectSignupCaptures(captures, opts = {}) {
   const declared = new Set((opts.nonSignupUrls ?? []).filter((u) => typeof u === "string" && u.trim()).map((u) => pageKey(u.trim())));
+  const selling = new Set((opts.signupUrls ?? []).filter((u) => typeof u === "string" && u.trim()).map((u) => pageKey(u.trim())));
   const latest = latestCaptures(captures).filter((c) => !isLoginPage(c) && !declared.has(pageKey(c.url ?? "")));
   const checkout = latest.filter((c) => c.pageKind === "checkout");
   const knownKind = /* @__PURE__ */ new Map();
   for (const c of latest) if (c.pageKind !== "other") knownKind.set(pageKey(c.url ?? ""), c.pageKind);
   const other = latest.filter(
-    (c) => c.pageKind !== "checkout" && !NON_SIGNUP_KINDS.has(c.pageKind) && !(c.pageKind === "other" && knownKind.has(pageKey(c.url ?? "")) && knownKind.get(pageKey(c.url ?? "")) !== "checkout") && (c.ctas?.length ?? 0) > 0 && (c.disclosures?.length ?? 0) > 0 && (checkout.length === 0 || c.pageKind !== "pricing") && // Pilot round 11: a page nobody labelled the checkout is a sign-up page only with a purchase button in its main
+    (c) => c.pageKind !== "checkout" && !NON_SIGNUP_KINDS.has(c.pageKind) && !(c.pageKind === "other" && knownKind.has(pageKey(c.url ?? "")) && knownKind.get(pageKey(c.url ?? "")) !== "checkout") && (c.ctas?.length ?? 0) > 0 && ((c.disclosures?.length ?? 0) > 0 || selling.has(pageKey(c.url ?? ""))) && (checkout.length === 0 || c.pageKind !== "pricing") && // Pilot round 11: a page nobody labelled the checkout is a sign-up page only with a purchase button in its main
     // content; header / nav / footer links and "Cancel subscription" are not purchase buttons, and an account-area
     // path (/account, /billing, /settings…) is not a sign-up page.
     !(c.pageKind !== "pricing" && ACCOUNT_AREA_PATH_RE.test(pathOf(c.url ?? ""))) && hasMainPurchaseCta(c)
@@ -12970,12 +13036,15 @@ function emailLabel(e) {
   const when = toDate(e.receivedAt)?.toISOString().slice(0, 10) ?? "unknown date";
   return `${quoted} (${when})`;
 }
+function emailTemplateKey(e) {
+  const from = (e.from ?? "").toLowerCase().replace(/^.*</, "").replace(/>.*$/, "").trim();
+  const subject = (e.subject ?? "").toLowerCase().replace(/^(?:\s*(?:re|fwd?|fw)\s*:\s*)+/i, "").replace(/#?\w*\d[\w-]*/g, "#").replace(/\s+/g, " ").trim();
+  return `${from}|${subject}`;
+}
 function latestPerTemplate(emails) {
   const map = /* @__PURE__ */ new Map();
   for (const e of emails) {
-    const from = (e.from ?? "").toLowerCase().replace(/^.*</, "").replace(/>.*$/, "").trim();
-    const subject = (e.subject ?? "").toLowerCase().replace(/^(?:\s*(?:re|fwd?|fw)\s*:\s*)+/i, "").replace(/#?\w*\d[\w-]*/g, "#").replace(/\s+/g, " ").trim();
-    const key = `${from}|${subject}`;
+    const key = emailTemplateKey(e);
     const prev = map.get(key);
     if (!prev || time(e.receivedAt) > time(prev.receivedAt)) map.set(key, e);
   }
@@ -13057,14 +13126,23 @@ function annotateSignupViews(views, ctx) {
   }
   return views;
 }
+function staleAccountCaptures(captures, flowSteps = []) {
+  const scannerAccount = (c) => c.pageKind === "account" && c.source !== "snippet";
+  const times = [...captures.filter(scannerAccount), ...flowSteps.filter((s2) => s2.pageKind === "account" && s2.source !== "snippet")].map((c) => time(c.capturedAt)).filter((t) => t > 0);
+  if (!times.length) return [];
+  const newest = Math.max(...times);
+  return captures.filter((c) => scannerAccount(c) && time(c.capturedAt) > 0 && time(c.capturedAt) < newest - ACCOUNT_REFRESH_WINDOW_MS);
+}
 function buildEvaluationData(ctx) {
   const captures = ctx.captures ?? [];
   const latest = latestCaptures(captures);
   const flowSteps = ctx.cancellation?.steps ?? [];
+  const stale = new Set(staleAccountCaptures(latest, flowSteps));
   const emails = (ctx.emails ?? []).filter((e) => toDate(e.receivedAt)).sort((a, b) => time(a.receivedAt) - time(b.receivedAt));
   return {
-    signupViews: annotateSignupViews([...dropNotCheckoutViews(selectSignupCaptures(captures, { nonSignupUrls: ctx.nonSignupUrls ?? [] }).flatMap(buildSignupViews)), ...checkoutConfigViews(ctx)], ctx),
-    accountPages: [...latest.filter((c) => c.pageKind === "account"), ...flowSteps.filter((s2) => s2.pageKind === "account")],
+    signupViews: annotateSignupViews([...dropNotCheckoutViews(selectSignupCaptures(captures, { nonSignupUrls: ctx.nonSignupUrls ?? [], signupUrls: ctx.signupUrls ?? [] }).flatMap(buildSignupViews)), ...checkoutConfigViews(ctx)], ctx),
+    accountPages: [...latest.filter((c) => c.pageKind === "account" && !stale.has(c)), ...flowSteps.filter((s2) => s2.pageKind === "account")],
+    staleAccountPages: [...stale],
     cancelPages: [...latest.filter((c) => c.pageKind === "cancel"), ...flowSteps.filter((s2) => s2.pageKind === "cancel")],
     emails,
     emailCaptureStart: emails.length ? toDate(emails[0].receivedAt) ?? void 0 : void 0,
@@ -13153,7 +13231,7 @@ ${v.pageText}`));
     sources
   };
 }
-var DAY_MS, HOUR_MS, NON_SIGNUP_KINDS, LOGIN_PATH_RE, LOGIN_TEXT_RE, ACCOUNT_AREA_PATH_RE, FOOTER_LINK_RE, CTA_STRONG, CTA_PURCHASE, CTA_WEAK, CTA_EXPRESS, CTA_NOT_PURCHASE, STRIPE_PAY_HREF_RE, OFFER_TEXT_RE, DEFAULT_VIEWPORT, POST_PURCHASE_PATH_RE, POST_PURCHASE_TEXT_RE;
+var DAY_MS, HOUR_MS, NON_SIGNUP_KINDS, LOGIN_PATH_RE, LOGIN_TEXT_RE, ACCOUNT_AREA_PATH_RE, FOOTER_LINK_RE, CTA_STRONG, CTA_PURCHASE, CTA_WEAK, CTA_EXPRESS, CTA_NOT_PURCHASE, STRIPE_PAY_HREF_RE, OFFER_TEXT_RE, DEFAULT_VIEWPORT, POST_PURCHASE_PATH_RE, POST_PURCHASE_TEXT_RE, ACCOUNT_REFRESH_WINDOW_MS;
 var init_context = __esm({
   "../rules/src/checks/context.ts"() {
     "use strict";
@@ -13182,6 +13260,7 @@ var init_context = __esm({
     };
     POST_PURCHASE_PATH_RE = /\/(?:welcome|thank[-_]?you|thanks|success|order[-_]?(?:complete|confirmation|received)|confirmation)(?:[/?#.]|$)/i;
     POST_PURCHASE_TEXT_RE = /\b(?:you(?:['’]re| are)\s+(?:now\s+)?(?:subscribed|all\s+set|in)|thanks?\s+(?:you\s+)?for\s+(?:subscribing|signing\s+up|your\s+(?:order|purchase|subscription))|subscription\s+(?:is\s+)?(?:confirmed|active)|order\s+(?:confirmed|complete)|welcome\s+aboard|payment\s+(?:successful|received))\b/i;
+    ACCOUNT_REFRESH_WINDOW_MS = 30 * 6e4;
   }
 });
 
@@ -13474,7 +13553,8 @@ function inAppPath(input) {
   }
   const hosted = input.ctx.hostedCancel;
   const captures = input.ctx.captures ?? [];
-  for (const p of [...input.data.cancelPages, ...captures.filter((c) => c.pageKind === "account")]) {
+  const stale = new Set(input.data?.staleAccountPages ?? []);
+  for (const p of [...input.data.cancelPages, ...captures.filter((c) => c.pageKind === "account" && !stale.has(c))]) {
     if (p.source !== "scanner" || isFetchedDocument(p) || p.pageProblem || isLiveHostedCancelPage(p, hosted)) continue;
     const controls = ownOnlineCancelControls(p, hosted).filter((el) => !/order/i.test(el.text ?? ""));
     const leadsOnline = controls.filter((el) => {
@@ -13533,7 +13613,8 @@ var init_cancel_paths = __esm({
 
 // ../rules/src/checks/cancellation.ts
 function offlineOnlyCancellation(input) {
-  const captures = input.ctx.captures ?? [];
+  const stale = new Set(input.data?.staleAccountPages ?? []);
+  const captures = (input.ctx.captures ?? []).filter((c) => !stale.has(c));
   const hosted = input.ctx.hostedCancel;
   const helpHits = [];
   for (const c of captures) {
@@ -13908,6 +13989,31 @@ function pageFindability(page, flow, hosted) {
   }
   return { status: "fail", detail: `no cancel or manage-subscription option on ${page.url}`, confidence: 0.7, refs: refs2 };
 }
+function newestCapturedAt(pages) {
+  let best;
+  for (const p of pages) if (p.capturedAt && (!best || Date.parse(p.capturedAt) > Date.parse(best))) best = p.capturedAt;
+  return best;
+}
+function utcMinute(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? iso : `${d.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function notRefreshedUnits(stale, fresh) {
+  const freshDevices = new Set(fresh.map((p) => p.device));
+  const byDevice = /* @__PURE__ */ new Map();
+  for (const p of stale) if (!freshDevices.has(p.device)) byDevice.set(p.device, [...byDevice.get(p.device) ?? [], p]);
+  return [...byDevice].map(([device, pages]) => {
+    const at = newestCapturedAt(pages) ?? pages[0].capturedAt;
+    return {
+      label: `${device} account area`,
+      status: "needs_review",
+      detail: `not refreshed \u2014 last captured ${utcMinute(at)}; the newest scan did not capture it again, so that old capture is not judged. To refresh it, call verifyTask again (each scan logs in with the test account on every device); if it stays like this, check test_account (login_url, email, password) and that the account page loads on that device`,
+      confidence: 0.3,
+      refs: [],
+      meta: { device, capturedAt: at, notRefreshed: true }
+    };
+  });
+}
 var CANCEL_MAX_STEPS, CANCEL_MAX_RETENTION_OFFERS, CANCEL_LINK_MIN_FONT_PX, CANCEL_LINK_MIN_CONTRAST, CANCEL_FLOW_MAX_AGE_DAYS, CLICK_TO_CANCEL_JURISDICTIONS, OFFER_PERMISSION_JURISDICTIONS, RETENTION_PAGE_RE, OFFER_PERMISSION_RE, ONLINE_ALTERNATIVE_RE, NO_CANCEL_ATTEMPT_MESSAGE, OBSTACLE_BLOCKER_RE, CONTACT_BLOCKER_RE, NOT_FOUND_BLOCKER_RE, RETENTION_BLOCKER_RE, TECHNICAL_BLOCKER_RE, CONTACT_TO_CANCEL_RE, CANCEL_CONTROL_RE, ORDER_ONLY_RE, MANAGE_RE, HOSTED_FLOW_NOTE, onlineAvailable, NO_ACTIVE_SUBSCRIPTION_RE, FIND_RANK, mechanismFindable, flowFriction, CANCEL_CONFIRM_EMAIL_RE, confirmation, CANCELLATION_CHECKS;
 var init_cancellation = __esm({
   "../rules/src/checks/cancellation.ts"() {
@@ -14159,6 +14265,10 @@ var init_cancellation = __esm({
         const id = "cancel.mechanism_findable";
         const flow = input.ctx.cancellation;
         const pages = flow ? input.data.accountPages : input.data.accountPages.filter((p) => !isLiveHostedCancelPage(p, input.ctx.hostedCancel));
+        const staleUnits = notRefreshedUnits(input.data.staleAccountPages ?? [], pages);
+        if (!pages.length && staleUnits.length) {
+          return missingData(id, `Not checked yet \u2014 ${staleUnits.map((u) => `${u.label}: ${u.detail}`).join("; ")}`, { notRefreshed: staleUnits.map((u) => u.meta) });
+        }
         if (!pages.length) {
           if (flow) {
             const b = blockerSummary(flow);
@@ -14192,17 +14302,20 @@ var init_cancellation = __esm({
           const scannerCoverage = pages.some((p) => p.source !== "snippet");
           const results = devicePages.map((p) => p.source === "snippet" ? untrustedSnippetUnit(pageFindability(p, flow, input.ctx.hostedCancel), scannerCoverage) : pageFindability(p, flow, input.ctx.hostedCancel));
           results.sort((a, b) => FIND_RANK[b.status] - FIND_RANK[a.status]);
-          units.push({ ...results[0], label: `${device} account area`, refs: results.flatMap((r) => r.refs) });
+          const capturedAt = newestCapturedAt(devicePages);
+          units.push({ ...results[0], label: `${device} account area`, refs: results.flatMap((r) => r.refs), meta: { ...results[0].meta, device, ...capturedAt ? { capturedAt } : {} } });
         }
+        units.push(...staleUnits);
+        const onlyNotRefreshed = staleUnits.length > 0 && !units.some((u) => u.status === "fail") && units.every((u) => u.status === "pass" || u.status === "not_applicable" || staleUnits.includes(u));
         return aggregate(
           id,
           units,
           {
             pass: "The cancel option is easy to find in the account area",
             fail: "The cancel option is not easy to find in the account area",
-            needs_review: "Findability of the cancel option needs review"
+            needs_review: onlyNotRefreshed ? "Not checked yet on every device" : "Findability of the cancel option needs review"
           },
-          { noun: "device" }
+          { noun: "device", ...staleUnits.length ? { data: { notRefreshed: staleUnits.map((u) => u.meta), ...onlyNotRefreshed ? { missingData: true } : {} } } : {} }
         );
       }
     };
@@ -14696,7 +14809,7 @@ function introEmailFinding(rawText, plans, opts) {
       quote: said,
       reason: "intro_unconfirmed",
       detail: `states an introductory price (\u201C${said}\u201D), but no intro terms are known for ${usable.slice(0, 3).map(nameOf).join(", ")}, so Checkbox cannot confirm it`,
-      fix: "Declare the promo on the plan (update_setup plans[]: intro_amount, intro_percent_off or intro_amount_off, with intro_periods), or remove the introductory price from the email if there is none."
+      fix: "Declare the promo on the plan (updateSetupSession plans[]: intro_amount, intro_percent_off or intro_amount_off, with intro_periods), or remove the introductory price from the email if there is none."
     };
   }
   const fits = (p2) => {
@@ -15040,18 +15153,90 @@ function missingSignupAck(input, set) {
     { ...data, missingData: true }
   );
 }
-async function ackDocs(input) {
+async function ackDocs(input, opts = {}) {
   const set = findAcknowledgments(input.data.emails);
   const source = set.acks.length ? set.acks : set.receipts;
   const docs = [];
-  for (const email of latestPerTemplate(source)) {
+  for (const email of opts.perPlan && set.acks.length ? latestPerTemplateAndPlan(source, input) : latestPerTemplate(source)) {
     docs.push({ email, analysis: await input.reader.analyze(emailBody(email), "email") });
   }
   return { docs, receiptsOnly: set.acks.length === 0 && set.receipts.length > 0, set };
 }
+function ackPlan(e, input, offers) {
+  const p = emailPlan(e, input.ctx, offers);
+  if (p.offer || p.how !== "subscription") return p;
+  const { subscriptionRef: _ref, ...rest } = e;
+  const stated = emailPlan(rest, input.ctx, offers);
+  return stated.offer ? { ...stated, ...p.trial !== void 0 ? { trial: p.trial } : {} } : p;
+}
+function latestPerTemplateAndPlan(emails, input) {
+  const offers = contextOffers(input.ctx);
+  if (offers.length < 2) return latestPerTemplate(emails);
+  const at = (e) => toDate(e.receivedAt)?.getTime() ?? 0;
+  const plan2 = new Map(emails.map((e) => [e, ackPlan(e, input, offers).offer?.id ?? ""]));
+  const keep = emails.filter((e) => {
+    const key = emailTemplateKey(e);
+    const p = plan2.get(e);
+    return !emails.some((o) => o !== e && emailTemplateKey(o) === key && at(o) > at(e) && (plan2.get(o) === p || plan2.get(o) === ""));
+  });
+  return keep.sort((a, b) => at(b) - at(a));
+}
 function docUnit(doc, u) {
   return { ...u, label: emailLabel(doc.email), refs: emailRefs(doc.email), meta: { emailId: doc.email.id, kind: doc.email.kind, ...u.meta } };
 }
+function missingIntro(a, body, plans) {
+  const restated = plans.filter(
+    (p) => p.amount > 0 && a.recurringPrices.some((r) => r.money.amount !== null && Math.abs(r.money.amount - planAmount(p)) < 5e-3 && !!r.frequency.unit && frequencyMatchesPlan(r.frequency.unit, r.frequency.count, p))
+  );
+  if (!restated.length || !restated.every(hasIntro)) return void 0;
+  if (new RegExp(PERCENT_OFF_RE.source, "i").test(body)) return void 0;
+  const intros = restated.map((p) => p.introAmount / 10 ** currencyDigitsOf(p.currency));
+  if (positiveAmounts(a).some((m) => m.amount !== null && intros.some((x) => Math.abs(x - m.amount) < 5e-3))) return void 0;
+  const phrase = restated.map((p) => introTermsPhrase(p)).join("; ");
+  return { label: phrase, phrase };
+}
+function plansWithoutAck(input, docs, units) {
+  const offers = contextOffers(input.ctx);
+  if (offers.length < 2) return null;
+  const covered = /* @__PURE__ */ new Set();
+  let unknownPlan = 0;
+  docs.forEach((doc, i) => {
+    const unit2 = units[i];
+    if (unit2.status !== "pass") return;
+    const p = ackPlan(doc.email, input, offers);
+    if (!p.offer) {
+      unknownPlan += 1;
+      return;
+    }
+    if (p.how === "subscription") {
+      const { subscriptionRef: _ref, ...rest } = doc.email;
+      const stated = emailPlan(rest, input.ctx, offers).offer;
+      if (stated && stated !== p.offer) {
+        units[i] = docUnit(doc, {
+          status: "fail",
+          detail: `went to a subscriber of ${offerLabel(p.offer)} but restates the terms of ${offerLabel(stated)} \u2014 restate the terms of the plan this subscriber has`,
+          confidence: 0.7,
+          meta: { planMismatch: true, perPlan: true }
+        });
+        return;
+      }
+    }
+    covered.add(p.offer);
+  });
+  if (units.some((u) => u.status === "fail")) return null;
+  const missing = offers.filter((o) => !covered.has(o));
+  if (!missing.length) return null;
+  const seen = covered.size ? ` Checkbox has an acknowledgment that restates the terms of ${[...covered].map(offerLabel).join(", ")}.` : "";
+  const unknown = unknownPlan ? ` ${unknownPlan} acknowledgment${unknownPlan > 1 ? "s" : ""} could not be matched to a plan (no subscriber billing data and no single plan price stated).` : "";
+  return makeResult(
+    "confirmation.email.terms",
+    "needs_review",
+    `No acknowledgment that restates the terms of ${missing.map(offerLabel).join(", ")} was captured yet: each plan's subscribers must get an acknowledgment with that plan's own price and billing frequency.${seen}${unknown} ${NO_ACK_EMAIL_MESSAGE}`,
+    docs.flatMap((d) => emailRefs(d.email)),
+    0.5,
+    { missingData: true, perPlan: true, plansWithoutAck: missing.map((o) => o.id) }
+  );
+}
 function mentionsCancelling(sentence) {
   return CANCELLING_RE.test(sentence);
 }
@@ -15076,6 +15261,7 @@ var init_confirmation = __esm({
     init_result();
     init_notice_content();
     init_plan_terms();
+    init_intro_terms();
     init_offer();
     init_email_plan();
     ACK_MAX_DELAY_HOURS = 24;
@@ -15167,7 +15353,7 @@ var init_confirmation = __esm({
       id: "confirmation.email.terms",
       usesText: true,
       async run(input) {
-        const { docs, receiptsOnly, set } = await ackDocs(input);
+        const { docs, receiptsOnly, set } = await ackDocs(input, { perPlan: true });
         if (!docs.length) return noAckResult("confirmation.email.terms", input, set);
         const headlines = {
           pass: "The acknowledgment restates the automatic-renewal terms",
@@ -15200,6 +15386,15 @@ var init_confirmation = __esm({
               meta: { introMisstated: content.intro.reason, introFix: content.intro.fix }
             });
           }
+          const noIntro = !missing.length ? missingIntro(a, emailBody(doc.email), noticePlanOptions(input.ctx).plans) : void 0;
+          if (noIntro) {
+            return docUnit(doc, {
+              status: "fail",
+              detail: `does not state the introductory price: ${noIntro.label} \u2014 restate the terms subscribers signed up to`,
+              confidence: 0.75,
+              meta: { introMissing: true, introFix: `State the introductory offer in the acknowledgment: ${noIntro.phrase}.` }
+            });
+          }
           if (!missing.length) {
             const span = a.recurringPrices[0] ?? a.untilCanceled[0] ?? a.autoRenew[0];
             const llm = [a.autoRenew[0], a.untilCanceled[0], positiveAmounts(a)[0], a.frequencies[0]].some((s2) => s2?.source === "llm");
@@ -15207,6 +15402,8 @@ var init_confirmation = __esm({
           }
           return docUnit(doc, { status: "fail", detail: `does not state ${missing.join(", ")}`, confidence: receiptsOnly ? 0.75 : 0.85 });
         });
+        const uncovered = receiptsOnly ? null : plansWithoutAck(input, docs, units);
+        if (uncovered && !units.some((u) => u.status === "fail" || u.status === "needs_review")) return uncovered;
         return aggregate("confirmation.email.terms", units, headlines, { noun: "email" });
       }
     };
@@ -16916,6 +17113,15 @@ function untilCancelIsAboutRenewal(text, span) {
   const sentence = text.slice(start, endRel === -1 ? void 0 : span.index + span.text.length + endRel);
   return RENEWAL_CONTEXT_RE.test(sentence.replace(span.text, " "));
 }
+function withUnjudgedPaymentLinks(input, r) {
+  const links = unjudgedPaymentLinksWithoutTerms(paymentLinksOf(input.ctx.config), input.ctx.captures ?? [], input.ctx.facts?.checkoutType);
+  if (!links.length) return r;
+  const one = links.length === 1;
+  const note = `An active Payment Link in your Stripe account has no renewal terms: ${links.slice(0, 3).map(paymentLinkName).join(", ")}${one ? "" : ` (${links.length} links)`}. No page of your site links to ${one ? "it" : "them"}, but anyone with the URL can still subscribe without seeing the terms. Add the renewal terms to ${one ? "its" : "their"} custom text (and a consent checkbox), or deactivate ${one ? "it" : "them"} in Stripe (Payment Links \u2192 the link \u2192 Deactivate) if ${one ? "it is" : "they are"} no longer used.`;
+  const data = { ...r.data ?? {}, unjudgedPaymentLinks: links.map((l) => ({ id: l.id, ...l.url ? { url: l.url } : {} })) };
+  if (r.status === "fail") return { ...r, message: `${r.message} ${note}`, data };
+  return { ...r, status: "needs_review", message: `Needs review: an active Payment Link with no renewal terms. ${note}${r.status === "pass" ? ` (The checkout itself: ${r.message})` : ` ${r.message}`}`, confidence: Math.min(r.confidence, 0.6), data };
+}
 function currencyDigits(currency) {
   try {
     return new Intl.NumberFormat("en-US", { style: "currency", currency: (currency || "usd").toUpperCase() }).resolvedOptions().maximumFractionDigits ?? 2;
@@ -17098,7 +17304,7 @@ function introPriceUnit(u, view, plans, promosDeclared = false) {
     }
     return unit(
       "needs_review",
-      `the terms state an introductory price (\u201C${said2}\u201D), but no intro terms were given for ${plans.slice(0, 4).map((p2) => p2.label).join(", ")}, so Checkbox cannot confirm it \u2014 declare the intro terms on the plan (update_setup plans[]: intro_amount, intro_percent_off or intro_amount_off, with intro_periods; in a preflight check, the same fields), or apply the coupon in the Stripe params`,
+      `the terms state an introductory price (\u201C${said2}\u201D), but no intro terms were given for ${plans.slice(0, 4).map((p2) => p2.label).join(", ")}, so Checkbox cannot confirm it \u2014 declare the intro terms on the plan (Site settings \u2192 Your offer \u2192 Introductory price or coupon; or updateSetupSession plans[]: intro_amount, intro_percent_off or intro_amount_off, with intro_periods; in a preflight check, the same fields), or apply the coupon in the Stripe params`,
       0.5,
       { ...u.quote ? { quote: u.quote } : {}, meta: { ...u.meta ?? {}, introTermsMissing: true } }
     );
@@ -17256,7 +17462,7 @@ function boxNearCta(box, cta) {
   const gap = box.y >= cta.y + cta.height ? box.y - (cta.y + cta.height) : cta.y >= box.y + box.height ? cta.y - (box.y + box.height) : 0;
   return gap <= 200;
 }
-var NO_CHECKOUT_CAPTURE_MESSAGE, NO_PURCHASE_BUTTON, OTHER_PLAN_CARD_NOTE, heuristicCache, PROCESSOR_LINE_NOTE, RENEWAL_CONTEXT_RE, autorenewLanguage, FOOTNOTE_RE, NON_CHARGE_AMOUNT_RE, INTRO_PRICE_RE, RENEWAL_PRICE_RE, PRODUCT_TITLE_RE, price, frequency, CANCEL_LINK_RE, cancellationPolicy, TRIAL_DAYS_SLACK, trialTerms2, termLength, PLACEMENT_RANK, proximity, conspicuous, RENEWAL_CONSENT_RE, CONSENT_CHECKBOX_RE, TOS_RE, SUBSCRIPTION_CTA_RE, MARKETING_RE, RENEWAL_TERMS_RE, NOTIFICATION_OPT_IN_RE, AGREEMENT_RE, SEPARATE_CONSENT_JURISDICTIONS, EXPRESS_CONSENT_COUNSEL_QUESTION, CA_SEPARATE_CONSENT, consentAffirmative, consentOverViews, notPrechecked, SIGNUP_CHECKS;
+var NO_CHECKOUT_CAPTURE_MESSAGE, NO_PURCHASE_BUTTON, OTHER_PLAN_CARD_NOTE, heuristicCache, PROCESSOR_LINE_NOTE, RENEWAL_CONTEXT_RE, autorenewLanguage, autorenewOverViews, FOOTNOTE_RE, NON_CHARGE_AMOUNT_RE, INTRO_PRICE_RE, RENEWAL_PRICE_RE, PRODUCT_TITLE_RE, price, frequency, CANCEL_LINK_RE, cancellationPolicy, TRIAL_DAYS_SLACK, trialTerms2, termLength, PLACEMENT_RANK, proximity, conspicuous, RENEWAL_CONSENT_RE, CONSENT_CHECKBOX_RE, TOS_RE, SUBSCRIPTION_CTA_RE, MARKETING_RE, RENEWAL_TERMS_RE, NOTIFICATION_OPT_IN_RE, AGREEMENT_RE, SEPARATE_CONSENT_JURISDICTIONS, EXPRESS_CONSENT_COUNSEL_QUESTION, CA_SEPARATE_CONSENT, consentAffirmative, consentOverViews, notPrechecked, SIGNUP_CHECKS;
 var init_signup = __esm({
   "../rules/src/checks/signup.ts"() {
     "use strict";
@@ -17281,73 +17487,74 @@ var init_signup = __esm({
     autorenewLanguage = {
       id: "signup.disclosure.autorenew_language",
       usesText: true,
-      run: (input) => overViews(
-        "signup.disclosure.autorenew_language",
-        input,
-        {
-          pass: "Checkout states that the subscription renews automatically until canceled",
-          fail: "Checkout does not say that the subscription renews automatically until the customer cancels",
-          needs_review: "Automatic-renewal language needs review"
-        },
-        async (view) => {
-          const raw = await input.reader.analyze(view.ownTermsText, "checkout_disclosure");
-          const a = { ...raw, untilCanceled: raw.untilCanceled.filter((sp) => untilCancelIsAboutRenewal(raw.text, sp)) };
-          const span = a.untilCanceled[0] ?? a.autoRenew[0];
-          const far = span ? onlyInFarFootnotes(view, (t) => hasRenewalLanguage(analyzeTerms(t))) : void 0;
-          if (span && far) {
-            return unit(
-              "needs_review",
-              `renewal language (\u201C${quote(span)}\u201D) appears only in ${far} \u2014 confirm it describes this offer, and state it with the offer`,
-              0.5,
-              { quote: quote(span), meta: { ...hostedMeta(view), farFromCta: true } }
-            );
-          }
-          if (span && a.untilCanceled.length === 0) {
-            return unit(
-              "needs_review",
-              `says \u201C${quote(span)}\u201D but not that it continues until the customer cancels \u2014 add \u201Cuntil you cancel\u201D`,
-              0.55,
-              { quote: quote(span), meta: { ...hostedMeta(view), missingUntilCanceled: true } }
-            );
-          }
-          if (span) {
-            const both = a.untilCanceled.length > 0 && a.autoRenew.length > 0;
-            const detail = both ? `states \u201C${quote(a.autoRenew[0])}\u201D and \u201C${quote(a.untilCanceled[0])}\u201D` : `states \u201C${quote(span)}\u201D`;
-            return unit("pass", detail, span.source === "llm" ? 0.75 : both ? 0.92 : 0.85, { quote: quote(span), meta: hostedMeta(view) });
-          }
-          const p = ownPageAnalysis(view);
-          const ps = p.untilCanceled.find((sp) => untilCancelIsAboutRenewal(p.text, sp));
-          if (!ps && p.autoRenew[0]) {
-            return unit("needs_review", `renewal language (\u201C${quote(p.autoRenew[0])}\u201D) appears on the page, outside the detected terms block, and does not say it continues until the customer cancels`, 0.5, {
-              quote: quote(p.autoRenew[0]),
-              meta: { ...hostedMeta(view), missingUntilCanceled: true }
-            });
-          }
-          if (ps) {
-            return unit("pass", `renewal language (\u201C${quote(ps)}\u201D) appears on the page, outside the detected terms block`, 0.6, {
-              quote: quote(ps),
-              meta: hostedMeta(view)
-            });
-          }
-          if (view.processorAuthorization.length) {
-            return unit(
-              "needs_review",
-              `the only renewal wording is ${PROCESSOR_LINE_NOTE} \u2014 state that the subscription renews automatically, at what price and how often, until the customer cancels`,
-              0.5,
-              { quote: quote(view.processorAuthorization[0]), meta: { ...hostedMeta(view), weakEvidence: "processor_authorization" } }
-            );
-          }
-          if (a.negatedAutoRenew.length) {
-            return unit(
-              "needs_review",
-              `the checkout says the plan does not renew automatically (\u201C${quote(a.negatedAutoRenew[0])}\u201D); if that is accurate, automatic-renewal rules may not apply to this offer`,
-              0.5
-            );
-          }
-          return unit("fail", "no statement that the subscription renews automatically and continues until canceled", 0.85);
-        }
-      )
+      run: async (input) => withUnjudgedPaymentLinks(input, await autorenewOverViews(input))
     };
+    autorenewOverViews = (input) => overViews(
+      "signup.disclosure.autorenew_language",
+      input,
+      {
+        pass: "Checkout states that the subscription renews automatically until canceled",
+        fail: "Checkout does not say that the subscription renews automatically until the customer cancels",
+        needs_review: "Automatic-renewal language needs review"
+      },
+      async (view) => {
+        const raw = await input.reader.analyze(view.ownTermsText, "checkout_disclosure");
+        const a = { ...raw, untilCanceled: raw.untilCanceled.filter((sp) => untilCancelIsAboutRenewal(raw.text, sp)) };
+        const span = a.untilCanceled[0] ?? a.autoRenew[0];
+        const far = span ? onlyInFarFootnotes(view, (t) => hasRenewalLanguage(analyzeTerms(t))) : void 0;
+        if (span && far) {
+          return unit(
+            "needs_review",
+            `renewal language (\u201C${quote(span)}\u201D) appears only in ${far} \u2014 confirm it describes this offer, and state it with the offer`,
+            0.5,
+            { quote: quote(span), meta: { ...hostedMeta(view), farFromCta: true } }
+          );
+        }
+        if (span && a.untilCanceled.length === 0) {
+          return unit(
+            "needs_review",
+            `says \u201C${quote(span)}\u201D but not that it continues until the customer cancels \u2014 add \u201Cuntil you cancel\u201D`,
+            0.55,
+            { quote: quote(span), meta: { ...hostedMeta(view), missingUntilCanceled: true } }
+          );
+        }
+        if (span) {
+          const both = a.untilCanceled.length > 0 && a.autoRenew.length > 0;
+          const detail = both ? `states \u201C${quote(a.autoRenew[0])}\u201D and \u201C${quote(a.untilCanceled[0])}\u201D` : `states \u201C${quote(span)}\u201D`;
+          return unit("pass", detail, span.source === "llm" ? 0.75 : both ? 0.92 : 0.85, { quote: quote(span), meta: hostedMeta(view) });
+        }
+        const p = ownPageAnalysis(view);
+        const ps = p.untilCanceled.find((sp) => untilCancelIsAboutRenewal(p.text, sp));
+        if (!ps && p.autoRenew[0]) {
+          return unit("needs_review", `renewal language (\u201C${quote(p.autoRenew[0])}\u201D) appears on the page, outside the detected terms block, and does not say it continues until the customer cancels`, 0.5, {
+            quote: quote(p.autoRenew[0]),
+            meta: { ...hostedMeta(view), missingUntilCanceled: true }
+          });
+        }
+        if (ps) {
+          return unit("pass", `renewal language (\u201C${quote(ps)}\u201D) appears on the page, outside the detected terms block`, 0.6, {
+            quote: quote(ps),
+            meta: hostedMeta(view)
+          });
+        }
+        if (view.processorAuthorization.length) {
+          return unit(
+            "needs_review",
+            `the only renewal wording is ${PROCESSOR_LINE_NOTE} \u2014 state that the subscription renews automatically, at what price and how often, until the customer cancels`,
+            0.5,
+            { quote: quote(view.processorAuthorization[0]), meta: { ...hostedMeta(view), weakEvidence: "processor_authorization" } }
+          );
+        }
+        if (a.negatedAutoRenew.length) {
+          return unit(
+            "needs_review",
+            `the checkout says the plan does not renew automatically (\u201C${quote(a.negatedAutoRenew[0])}\u201D); if that is accurate, automatic-renewal rules may not apply to this offer`,
+            0.5
+          );
+        }
+        return unit("fail", "no statement that the subscription renews automatically and continues until canceled", 0.85);
+      }
+    );
     FOOTNOTE_RE = /^\s*(?:\d{1,2}(?=[A-Z])|[*†‡§¹²³⁴⁵⁶⁷⁸⁹]+\s*(?=[A-Z]))/;
     NON_CHARGE_AMOUNT_RE = /\b(?:off|discount|save[sd]?|saving|savings|value|worth|credit|reward|bonus|max)\b/i;
     INTRO_PRICE_RE = /\bfor\s+(?:the\s+|your\s+)?first\s+(?:\d{1,3}\s+|one\s+|two\s+|three\s+|six\s+|twelve\s+)?(?:months?|years?|weeks?|boxes|box|orders?|deliveries|delivery|shipments?|issues?)\b|\bintro(?:ductory)?\s+(?:price|offer|rate|period)\b|\b(?:your\s+)?first\s+(?:box|order|delivery|shipment|kit|issue|month|week)\b[^.\n]{0,8}?[$€£]\s?\d|[$€£]\s?\d[\d.,]*\s+(?:for\s+)?(?:your\s+|the\s+)?first\s+(?:box|order|delivery|shipment|kit|issue)\b/i;
@@ -17852,6 +18059,12 @@ var init_signup = __esm({
           const meta = { statedTermMonths: [...new Set(stated)], knownTermMonths: [...known], ...minimum ? { minimumObligation: quote(minimum) } : {} };
           const chosen = viewPlans(input, view);
           if (chosen.length && !minimum && !stated.some((m) => chosen.some((p) => termMatchesPlan(m, p)))) {
+            if (stated.length && otherPlanCard(view, input)) {
+              return unit("needs_review", `the card states \u201C${quote(signals[0])}\u201D, not ${chosen.map(planEvery).join(" / ")}: ${OTHER_PLAN_CARD_NOTE}`, 0.5, {
+                quote: quote(signals[0]),
+                meta: { ...meta, termMismatch: true, otherPlanCard: true }
+              });
+            }
             return unit(
               "needs_review",
               stated.length ? `the checkout states \u201C${quote(signals[0])}\u201D, but the plan renews ${chosen.map(planEvery).join(" / ")} \u2014 state the renewal term subscribers actually get` : `the checkout says the subscription continues until cancelled (\u201C${quote(signals[0])}\u201D) but not how long each renewal term is \u2014 the plan renews ${chosen.map(planEvery).join(" / ")}`,
@@ -20042,6 +20255,12 @@ function hostedCheckoutKind(declared, consentData) {
   const [only] = [...kinds];
   return kinds.size === 1 && (only === "payment_link" || only === "stripe_checkout") ? only : void 0;
 }
+function guidePlatformFor(checkId, platform, facts) {
+  if (platform !== "stripe") return platform;
+  if (facts?.checkoutType === "own_page" && checkId.startsWith("signup.")) return "custom";
+  if (facts?.cancelsInApp === true && checkId.startsWith("cancel.")) return "custom";
+  return platform;
+}
 function remediationFor(checkId, platform) {
   const spec = SPECS2[checkId];
   if (!spec) {
@@ -21239,7 +21458,8 @@ function classify(input) {
       return finish({ status: "not_applicable" }, "verdict_not_applicable", checkId);
     case "fail":
       if (checkId === "config.portal_cancel_enabled" && input.origin !== "preflight" && portalCancelRequired(input.siblings)) {
-        const fix = input.data?.cancelPath === "in_app_broken" ? PORTAL_IN_APP_BROKEN_FIX : input.data?.cancelPath === "offline" ? PORTAL_OFFLINE_FIX : PORTAL_REQUIRED_FIX;
+        const noCode = input.data?.paymentLinkSite === true && input.data?.cancelPath !== "in_app_broken";
+        const fix = noCode ? input.data?.cancelPath === "offline" ? PAYMENT_LINK_OFFLINE_FIX : PAYMENT_LINK_PORTAL_FIX : input.data?.cancelPath === "in_app_broken" ? PORTAL_IN_APP_BROKEN_FIX : input.data?.cancelPath === "offline" ? PORTAL_OFFLINE_FIX : PORTAL_REQUIRED_FIX;
         return finish({ status: "needs_fix", fix }, "portal_only_cancel_path", checkId, "required");
       }
       if (checkId.startsWith("cancel.") && input.data?.billingContradicts === true) return finish({ status: "needs_fix", fix: BILLING_CONTRADICTS_FIX }, "cancel_not_in_stripe", checkId);
@@ -21399,7 +21619,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, STRIPE_HOSTED_UNITS, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, FAIL_FIX, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, STRIPE_HOSTED_UNITS, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -21468,13 +21688,13 @@ var init_status = __esm({
     family = (c) => String(c.checkId).split(".")[0];
     isEmailCheck = (id) => id.startsWith("confirmation.") || id.startsWith("reminder.");
     ask = (text, recommended, why) => ({ text, recommended, why });
-    PLAN_FACTS_FIX = "Tell Checkbox your plans (price, how often, any free trial) in Site settings \u2192 Your offer, or update_setup: it only lists the reminders your plans need.";
+    PLAN_FACTS_FIX = "Tell Checkbox your plans (price, how often, any free trial) in Site settings \u2192 Your offer, or with updateSetupSession plans[]: it only lists the reminders your plans need.";
     STRIPE_CANCEL_UNREAD_FIX = "Not checked yet: Checkbox could not read the test subscription in Stripe after cancelling. Connect Stripe (or Re-sync Stripe) with a key that can read Customers and Subscriptions, and use the same email for the test account in Stripe.";
     BILLING_CONTRADICTS_FIX = 'Your cancel button says "cancelled", but Stripe still bills the subscription. In the cancel handler, call stripe.subscriptions.update(id, { cancel_at_period_end: true }) (Python: stripe.Subscription.modify(id, cancel_at_period_end=True)), not a pause or a flag in your own database.';
     VERIFIED_FROM_STRIPE_NOTE = "Verified from Stripe settings: cancellation is on in your Stripe customer portal and your site links to its login page. A test cancellation (a proof run) would confirm it live.";
     VERIFIED_FROM_HOSTED_NOTE = "Verified from Checkbox settings: your Checkbox cancellation page is on and working, and your site links to it. Checkbox runs each cancellation there itself and confirms it on screen and by email.";
     HOSTED_UNLINKED_FIX = (url, hiddenOn) => `${hiddenOn ? `The link to your Checkbox cancellation page on ${hiddenOn} is hidden from visitors, so it does not count. ` : ""}Add a visible "Cancel subscription" link to your Checkbox cancellation page${url ? ` (${url})` : ""} on your site (the footer is fine), or turn on Checkbox Notices so every acknowledgment email carries it. Then re-check; no test account is needed.`;
-    NOT_CHECKED_CANCEL_FIX = "Let Checkbox try your cancel flow: add a test subscriber account in Site settings \u2192 Test account (agents: updateSite / update_site field test_account { login_url, email, password }; the shopper signs in and cancels), or start a test run in Stripe test mode (it signs up and cancels a test subscription). If subscribers cancel in the Stripe customer portal, no test account is needed: turn on cancellation there and link its login page from your site.";
+    NOT_CHECKED_CANCEL_FIX = "Let Checkbox try your cancel flow: add a test subscriber account in Site settings \u2192 Test account (agents: updateSite field test_account { login_url, email, password }; the shopper signs in and cancels), or start a test run in Stripe test mode (it signs up and cancels a test subscription). If subscribers cancel in the Stripe customer portal, no test account is needed: turn on cancellation there and link its login page from your site.";
     EMAIL_EXISTS = /not seen sent yet|only a template or sample|shows the template, not that|turned on in your billing platform|only been received for|captured, but its timing|from another system|not linked to a subscriber|sign-ups have no acknowledgment on record|window has not closed yet|upcoming .* observed|no price change observed yet|confirm they reach every/;
     RULES = [
       // Round 20 (pilot 19 item 1): an acknowledgment that does not mention a trial, on a site where only some plans have
@@ -21488,6 +21708,18 @@ var init_status = __esm({
           fix: "Send each plan its own acknowledgment (the one for a plan with a free trial says when the trial ends and how to cancel before it converts), and BCC the copy your app sends for a Stripe test-mode subscription of each plan so Checkbox can match it to its plan."
         })
       },
+      // Round 21 (pilot 20, codex-newcomer): an active Payment Link with no renewal terms that no page links to still sells.
+      // A decision for the merchant (add the terms, or deactivate it), never a pass.
+      {
+        code: "unjudged_payment_link",
+        category: "legal_choice",
+        when: (c) => c.status === "needs_review" && Array.isArray(c.data?.unjudgedPaymentLinks) && c.data.unjudgedPaymentLinks.length > 0,
+        build: () => ({
+          status: "your_call",
+          fix: "Add the renewal terms (and a consent checkbox) to the Payment Link, or deactivate it in Stripe (Payment Links \u2192 the link \u2192 Deactivate) if it is no longer used.",
+          question: ask("An active Payment Link in your Stripe account states no renewal terms. Is it still used to sell?", "If not, deactivate it in Stripe; if it is, add the renewal terms and a consent checkbox to it.", "Anyone with its URL can still subscribe through it, whether or not your site links to it.")
+        })
+      },
       {
         code: "internal_error",
         category: "legal_choice",
@@ -21568,7 +21800,7 @@ var init_status = __esm({
       // Pilot round 11 (change-guard): an intro / discounted price the Stripe session does not apply.
       // Pilot round 12: an intro price with no intro terms to compare it with (never a pass), a stated intro price that is
       // not the real one, and terms that sit on another page than the payment page.
-      { code: "intro_terms_missing", category: "missing_evidence", when: has(/no intro terms were given/), build: () => ({ status: "not_checked", fix: "Pass the intro terms (intro_price, or intro_percent_off / intro_amount_off with intro_periods) so Checkbox can compare the promo, or apply the coupon in the Stripe params." }) },
+      { code: "intro_terms_missing", category: "missing_evidence", when: has(/no intro terms were given/), build: () => ({ status: "not_checked", fix: "Declare the intro price or coupon in Site settings \u2192 Your offer \u2192 Introductory price or coupon (an agent passes it in updateSetupSession plans[]: intro_amount, intro_percent_off or intro_amount_off, with intro_periods), so Checkbox can compare the promo. On Stripe Checkout, applying the coupon in the Checkout Session params works too." }) },
       { code: "intro_price_mismatch", category: "content", when: has(/intro price is .{1,40} — state the intro price subscribers will actually pay/), build: () => ({ status: "needs_fix", fix: 'State the real intro price, then the regular price ("$8.00 for your first month, then $10.00 every month until you cancel").' }) },
       { code: "terms_on_other_page", category: "content", when: has(/shown on another page than the payment page/), build: () => ({ status: "needs_fix", fix: "Show the disclosure on the payment page, directly above the purchase button." }) },
       { code: "intro_price_not_applied", category: "content", when: has(/promises an introductory or discounted price/), build: () => ({ status: "needs_fix", fix: "Apply the promised discount in the session (discounts: [{ coupon }] or a promotion_code), or remove the promise from the text." }) },
@@ -21942,9 +22174,20 @@ var init_status = __esm({
         code: "portal_off_untested",
         category: "missing_evidence",
         when: (c) => String(c.checkId) === "cancel.online_available" && c.data?.portalOff === true,
-        build: () => ({
+        build: (c) => ({
           status: "not_checked",
-          fix: 'Nothing has been tested yet: cancellation is off in your Stripe customer portal and Checkbox has not tried your own cancel flow. Either turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, or, if you have your own cancel flow, add a test account (Site settings \u2192 Test account) so Checkbox can try it.'
+          fix: c.data?.paymentLinkSite === true ? `Nothing has been tested yet: cancellation is off in your Stripe customer portal. ${PAYMENT_LINK_PORTAL_FIX} If you have your own cancel flow instead, add a test account (Site settings \u2192 Test account) so Checkbox can try it.` : 'Nothing has been tested yet: cancellation is off in your Stripe customer portal and Checkbox has not tried your own cancel flow. Either turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, or, if you have your own cancel flow, add a test account (Site settings \u2192 Test account) so Checkbox can try it.'
+        })
+      },
+      // Round 21 (pilot 20, agent-api-only): an account-area capture the newest scan did not refresh is not judged. Say which
+      // device, since when, and how to refresh it (not "add a test account": there is one).
+      {
+        code: "cancel_device_not_refreshed",
+        category: "missing_evidence",
+        when: (c) => c.checkId === "cancel.mechanism_findable" && c.data?.missingData === true && Array.isArray(c.data?.notRefreshed) && c.data.notRefreshed.length > 0,
+        build: (c) => ({
+          status: "not_checked",
+          fix: `${c.detail.replace(/^Not checked yet[^—]*—\s*/, "").replace(/^./, (m) => m.toUpperCase())}.`
         })
       },
       {
@@ -21989,6 +22232,8 @@ var init_status = __esm({
     PORTAL_REQUIRED_FIX = 'Checkbox has not seen another way for your subscribers to cancel online yet. Choose one: turn on "Cancel subscriptions" in the Stripe customer portal (Stripe Dashboard \u2192 Settings \u2192 Billing \u2192 Customer portal, or POST /v1/billing_portal/configurations/{id} with features[subscription_cancel][enabled]=true) and link the portal from your account page; or, if subscribers cancel on your own page, add a test login for it (site test_account) so Checkbox can try that cancellation.';
     PORTAL_IN_APP_BROKEN_FIX = 'Fix your cancel handler so it cancels in Stripe (Node: stripe.subscriptions.update(id, { cancel_at_period_end: true }); Python: stripe.Subscription.modify(id, cancel_at_period_end=True)). Second option: turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page.';
     PORTAL_OFFLINE_FIX = 'Turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, then replace the "email / call us to cancel" line with "Cancel anytime online in your account".';
+    PAYMENT_LINK_PORTAL_FIX = `Turn on "Cancel subscriptions" in the Stripe customer portal (Stripe Dashboard \u2192 Settings \u2192 Billing \u2192 Customer portal), copy its billing.stripe.com login link and add it to your site's footer as a "Cancel subscription" link.`;
+    PAYMENT_LINK_OFFLINE_FIX = `${PAYMENT_LINK_PORTAL_FIX} Then replace the "email / call us to cancel" line with "Cancel anytime online" and that link.`;
     FAIL_FIX = {
       "signup.disclosure.autorenew_language": 'Add one line above the pay button: "Renews automatically every <interval> at <price> until you cancel."',
       "signup.disclosure.price": "State the recurring price in the renewal line (the amount actually charged each time).",
@@ -22258,6 +22503,12 @@ function withDeliveredSignups(ctx) {
   });
   return changed ? { ...ctx, emails } : ctx;
 }
+function siteRemediation(id, platform, facts) {
+  const guide = guidePlatformFor(id, platform, facts);
+  if (guide === platform) return remediationFor(id, platform);
+  const { platform: _p, ...rest } = remediationFor(id, guide);
+  return platform ? { ...rest, platform } : rest;
+}
 async function runEvaluation(input, opts) {
   return withBrandNames(brandNamesOf(input), () => runEvaluationInScope(input, opts));
 }
@@ -22336,6 +22587,8 @@ async function runEvaluationInScope(input, opts) {
     const result = results.get(id);
     if (!result) continue;
     const reqs = byCheck.get(id);
+    const paymentLinkCancel = platform === "stripe" && (ctx.facts?.checkoutType === "payment_link" || hostedKind === "payment_link") && (result.status === "fail" || result.status === "needs_review") && PAYMENT_LINK_CANCEL_CHECKS.has(id) && result.data?.billingContradicts !== true && // The broken in-app cancel handler gets its own steps (CANCEL_HANDLER_REMEDIATION, below).
+    !(result.status === "fail" && id === "config.portal_cancel_enabled" && result.data?.cancelPath === "in_app_broken");
     const finding = {
       id: findingId(ctx.siteId, id),
       siteId: ctx.siteId,
@@ -22350,12 +22603,13 @@ async function runEvaluationInScope(input, opts) {
       title: CHECKS[id].title,
       detail: result.message,
       evidenceRefs: result.evidenceRefs,
-      remediation: id === "cancel.flow_friction" && result.data?.offerPermissionMissing === true ? { ...OFFER_PERMISSION_REMEDIATION, ...platform ? { platform } : {} } : platform === "stripe" && result.status === "fail" && (id === "cancel.online_available" && result.data?.billingContradicts === true || id === "config.portal_cancel_enabled" && result.data?.cancelPath === "in_app_broken") ? CANCEL_HANDLER_REMEDIATION : platform === "stripe" && (ctx.facts?.checkoutType === "payment_link" || hostedKind === "payment_link") && (result.status === "fail" || result.status === "needs_review") && PAYMENT_LINK_CANCEL_CHECKS.has(id) && result.data?.billingContradicts !== true ? paymentLinkCancelRemediation(ctx.config?.cancellation?.portalUrl, ctx.config?.raw?.portal?.loginPageEnabled) : withContentFix(personalizeRemediation(hostedKind && hostedCheckoutRemediation(id, hostedKind, platform, { consentOn: results.get("signup.consent.affirmative")?.status === "pass" }) || remediationFor(id, platform), values), contentFixLine(id, result.data)),
+      remediation: id === "cancel.flow_friction" && result.data?.offerPermissionMissing === true ? { ...OFFER_PERMISSION_REMEDIATION, ...platform ? { platform } : {} } : platform === "stripe" && result.status === "fail" && (id === "cancel.online_available" && result.data?.billingContradicts === true || id === "config.portal_cancel_enabled" && result.data?.cancelPath === "in_app_broken") ? CANCEL_HANDLER_REMEDIATION : paymentLinkCancel ? paymentLinkCancelRemediation(ctx.config?.cancellation?.portalUrl, ctx.config?.raw?.portal?.loginPageEnabled) : withContentFix(personalizeRemediation(hostedKind && hostedCheckoutRemediation(id, hostedKind, platform, { consentOn: results.get("signup.consent.affirmative")?.status === "pass" }) || siteRemediation(id, platform, ctx.facts), values), contentFixLine(id, result.data)),
       confidence: result.confidence,
       firstSeenAt: evaluatedAt,
       lastSeenAt: evaluatedAt
     };
     if (result.data) finding.data = result.data;
+    if (paymentLinkCancel) finding.data = { ...finding.data ?? {}, paymentLinkSite: true };
     if (id === "config.portal_cancel_enabled" && platform === "stripe" && result.status === "needs_review") finding.data = { ...finding.data ?? {}, stripeSite: true };
     finding.evidence = result.evidence ?? buildEvidence(result, ctx);
     findings.push(finding);
@@ -22645,11 +22899,15 @@ function scrub(v, depth = 0) {
 function withoutSyntheticArtifacts(c) {
   return scrub(c);
 }
+function withCancelUrl(fix, cancelUrl) {
+  if (!cancelUrl) return fix;
+  return fix.replace("Cancel anytime with your cancel link.", `Cancel anytime online at ${cancelUrl}.`).replace('Add "Cancel anytime online" to the renewal line, with your cancel link.', `Add "Cancel anytime online at ${cancelUrl}" to the renewal line.`);
+}
 function withCompliance(c, kind, all, plan2) {
   const siblings = new Map(all.map((x) => [x.check_id, x.status]));
   const classified = classify({ checkId: c.check_id, status: c.status, detail: c.explanation, missing: c.evidence?.missing ?? void 0, origin: "preflight", kind, siblings });
-  const terms2 = plan2 ? { units: [{ status: "fail", planAmount: plan2.amount, planCurrency: plan2.currency, planInterval: plan2.interval, planIntervalCount: plan2.intervalCount }] } : void 0;
-  const info = terms2 && classified.fix ? { ...classified, fix: withPlanTerms(classified.fix, terms2) } : classified;
+  const terms2 = plan2 && "amount" in plan2 ? { units: [{ status: "fail", planAmount: plan2.amount, planCurrency: plan2.currency, planInterval: plan2.interval, planIntervalCount: plan2.intervalCount }] } : void 0;
+  const info = classified.fix ? { ...classified, fix: withCancelUrl(terms2 ? withPlanTerms(classified.fix, terms2) : classified.fix, plan2?.cancelUrl) } : classified;
   return { ...c, ...hostedWording(c, info), compliance_status: info.status, compliance: statusWire(info) };
 }
 function hostedWording(c, info) {
@@ -23677,6 +23935,18 @@ function readParams(params, merchant, kind, asOf) {
   for (const [k, v] of [["custom_text.submit.message", submit], ["custom_text.terms_of_service_acceptance.message", tosAcceptance]]) {
     if (v && v.length > STRIPE_CUSTOM_TEXT_MAX) warnings.push({ code: "stripe_custom_text_too_long", message: `${k} is ${v.length} characters; Stripe rejects more than ${STRIPE_CUSTOM_TEXT_MAX}.`, param: `params.${k}` });
   }
+  for (const k of CUSTOM_TEXT_FIELDS) {
+    if (k === "submit" || k === "terms_of_service_acceptance" && !consentRequired) continue;
+    const other = otherPlanTerms(msg(ct[k]), plan2, { unreadDiscount: hasDiscount });
+    if (other) {
+      caveats.push({
+        checks: other.amount ? ["signup.disclosure.price"] : ["signup.disclosure.frequency"],
+        status: other.alsoOwn ? "needs_review" : "fail",
+        reason: `custom_text.${k}.message states \u201C${other.quote}\u201D, but this checkout charges ${planPhrase(plan2)}: every message on the checkout must state this plan's own terms`,
+        param: `params.custom_text.${k}.message`
+      });
+    }
+  }
   if (tosAcceptance && !consentRequired) {
     warnings.push({
       code: "stripe_tos_acceptance_without_consent",
@@ -23698,6 +23968,33 @@ function readParams(params, merchant, kind, asOf) {
     caveats
   };
 }
+function planPhrase(plan2) {
+  return `${formatMoney(plan2.amount, plan2.currency)} every ${intervalPhrase(plan2.interval, plan2.intervalCount)}`;
+}
+function otherPlanTerms(text, plan2, opts = {}) {
+  const found = otherPlanTerms0(text, plan2, opts);
+  if (!found) return void 0;
+  const a = analyzeTerms(text);
+  const own = a.recurringPrices.some((r) => r.money.amount !== null && Math.abs(Math.round(r.money.amount * 10 ** currencyDigitsOf(plan2.currency)) - plan2.amount) < 1 && !!r.frequency.unit && frequencyMatchesPlan(r.frequency.unit, r.frequency.count, plan2));
+  return { ...found, alsoOwn: own };
+}
+function otherPlanTerms0(text, plan2, opts) {
+  if (!text) return void 0;
+  const a = analyzeTerms(text);
+  const digits = currencyDigitsOf(plan2.currency);
+  const allowed = [plan2.amount, plan2.introAmount, plan2.introAmount !== void 0 ? plan2.amount - plan2.introAmount : void 0, 0].filter((n) => typeof n === "number");
+  for (const m of a.amounts) {
+    if (m.amount === null || m.currency && m.currency.toLowerCase() !== plan2.currency.toLowerCase()) continue;
+    const minor = Math.round(m.amount * 10 ** digits);
+    if (opts.unreadDiscount && plan2.introAmount === void 0 && minor < plan2.amount) continue;
+    if (!allowed.some((x) => Math.abs(x - minor) < 1)) return { quote: a.recurringPrices.find((r) => r.money.index === m.index)?.text ?? m.text, amount: true };
+  }
+  for (const r of a.recurringPrices) {
+    const f = r.frequency;
+    if (f.unit && !frequencyMatchesPlan(f.unit, f.count, plan2)) return { quote: r.text, amount: false };
+  }
+  return void 0;
+}
 function applyCaveats(checks, caveats) {
   if (!caveats.length) return checks;
   return checks.map((c) => {
@@ -23778,8 +24075,10 @@ async function judge2(shape, url, jurisdictions, asOf, now, id) {
 }
 function planAsMerchant(shape, merchant) {
   const p = shape.plan;
+  const { intro_price: _ip, intro_amount: _ia, intro_percent_off: _ipo, intro_amount_off: _iao, intro_periods: _ipr, ...rest } = merchant ?? {};
   return {
-    ...merchant,
+    ...rest,
+    ...p.introAmount !== void 0 ? { intro_amount: p.introAmount, ...p.introPeriods ? { intro_periods: p.introPeriods } : {} } : {},
     price: void 0,
     amount: p.amount,
     currency: p.currency,
@@ -23811,7 +24110,7 @@ function correct(params, shape, checks, forLink, style2 = "full") {
     const ct = isObj(out.custom_text) ? out.custom_text : void 0;
     const set = {};
     if (needText) set.submit = { message: texts.disclosure };
-    if (needConsent) set.terms_of_service_acceptance = { message: texts.consentLabel };
+    if (needConsent || shape.consentRequired) set.terms_of_service_acceptance = { message: texts.consentLabel };
     if (!ct) {
       patch.push({ op: "add", path: "/custom_text", value: set });
       out.custom_text = set;
@@ -23822,6 +24121,13 @@ function correct(params, shape, checks, forLink, style2 = "full") {
       }
     }
   }
+  if (patch.length && Array.isArray(out.discounts)) {
+    out.discounts = out.discounts.map((d, i) => {
+      if (!isObj(d) || !isObj(d.coupon) || typeof d.coupon.id !== "string") return d;
+      patch.push({ op: "replace", path: `/discounts/${i}/coupon`, value: d.coupon.id });
+      return { ...d, coupon: d.coupon.id };
+    });
+  }
   if (forLink && "id" in out) {
     for (const k of ["id", "object", "url", "livemode", "active"]) delete out[k];
     if (isObj(out.line_items) && Array.isArray(out.line_items.data)) {
@@ -23952,7 +24258,7 @@ async function checkStripeCheckoutSession(input0, opts = {}) {
   const channel2 = noticeChannelField(params);
   if (channel2) warnings.push(channel2);
   return {
-    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, nextAction("session", checks, correction)),
+    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, nextAction("session", checks, correction), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_checkout_session",
     correction
   };
@@ -24013,7 +24319,7 @@ async function checkStripePaymentLink(input0, opts = {}) {
   if (fix.needConsent) warnings.push({ code: "stripe_tos_url_required", message: 'consent_collection.terms_of_service = "required" needs a Terms of Service URL in Stripe Dashboard \u2192 Settings \u2192 Public details.' });
   const extra = needsNew && !id ? " Stripe cannot add the consent checkbox to an existing link (stripe.paymentLinks.update refuses consent_collection): create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link." : needsNew ? ` Stripe cannot add the consent checkbox to an existing link: send correction.update_params with stripe.paymentLinks.update("${id}", \u2026) for the text now, then create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link.` : id && update_params ? ` For the existing link use stripe.paymentLinks.update("${id}", correction.update_params) (same URL).` : "";
   return {
-    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, nextAction("link", checks, correction, extra)),
+    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, nextAction("link", checks, correction, extra), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_payment_link",
     correction
   };
@@ -24081,13 +24387,14 @@ function noticeChannelField(params) {
     param: `params.custom_fields[${i}]`
   };
 }
-var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, STRIPE_GREY, DAY_MS3, open, STRIPE_HOSTED_STYLING_NOTE;
+var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, CUSTOM_TEXT_FIELDS, STRIPE_GREY, DAY_MS3, open, STRIPE_HOSTED_STYLING_NOTE;
 var init_stripe2 = __esm({
   "../rules/src/preflight/stripe.ts"() {
     "use strict";
     init_terms2();
     init_compact();
     init_plan_terms();
+    init_text();
     init_verify();
     init_stripe();
     init_common();
@@ -24107,6 +24414,7 @@ var init_stripe2 = __esm({
     INTRO_PROMISE_RE = /\b\d{1,3}(?:\.\d+)?\s?%\s*off\b|\b(?:introductory|intro)\s+(?:price|rate|offer|discount)\b|\b(?:discounted|promotional|promo)\s+(?:price|rate)\b|(?:US\$|\$|€|£)\s?\d[\d,]*(?:\.\d{1,2})?\s+(?:for\s+(?:your|the)\s+)?first\s+(?:\d+\s+)?(?:months?|years?|weeks?|box(?:es)?|orders?|deliver(?:y|ies)|shipments?)\b|\bfirst\s+(?:\d+\s+)?(?:months?|years?|weeks?|box(?:es)?|orders?)\s+(?:for|at|just|only)\s+(?:US\$|\$|€|£)\s?\d/i;
     isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
     msg = (v) => isObj(v) && typeof v.message === "string" && v.message.trim() ? v.message : void 0;
+    CUSTOM_TEXT_FIELDS = ["submit", "terms_of_service_acceptance", "after_submit", "shipping_address"];
     STRIPE_GREY = { fontSizePx: 13, fontWeight: 400, color: "rgba(26, 26, 26, 0.7)", backgroundColor: "rgb(255, 255, 255)" };
     DAY_MS3 = 864e5;
     open = (c) => !!c && (c.status === "fail" || c.status === "needs_review");
@@ -24421,7 +24729,7 @@ function nextAction2(kind, checks, requiredBy, tpl, unresolved = []) {
     if (kind === "renewal_reminder") {
       return {
         type: "provide_input",
-        message: `No applicable requirement governs a renewal reminder for this plan (renewal reminders apply to longer terms). Plans billed more often need the yearly terms reminder instead: check that email with kind "annual_terms" (check_email / POST /v1/checks/email).${fill2}`
+        message: `No applicable requirement governs a renewal reminder for this plan (renewal reminders apply to longer terms). Plans billed more often need the yearly terms reminder instead: check that email with kind "annual_terms" (checkEmail, POST /v1/checks/email).${fill2}`
       };
     }
     return {
@@ -24474,7 +24782,10 @@ ${text}
 ${html ?? ""}`, kind);
   if (unresolved.length) {
     warnings.push({ code: "unresolved_placeholders", message: `The email still contains placeholders a subscriber would see: ${unresolved.join(", ")}. Checkbox cannot confirm a term it cannot read: to confirm, check the email again with sample values in their place (keep the merge tags in your code).`, param: "text" });
-    checks = checks.map((c) => c.status === "pass" ? { ...c, status: "needs_review", explanation: `${c.explanation} (Not confirmed: the email contains unresolved placeholders ${unresolved.join(", ")}.)` } : c);
+    const tags = `The email has unfilled merge tags (${unresolved.join(", ")}): Checkbox cannot read what they hold. Check the email again with sample values in their place`;
+    checks = checks.map(
+      (c) => c.status === "pass" ? { ...c, status: "needs_review", explanation: `${c.explanation} (Not confirmed: the email contains unresolved placeholders ${unresolved.join(", ")}.)` } : c.status === "fail" && c.fix ? { ...c, fix: `${tags}; if it still fails: ${c.fix.charAt(0).toLowerCase()}${c.fix.slice(1)}` } : c
+    );
   }
   const requiredBy = checks.every((c) => c.status === "not_applicable") ? [] : run2.applicable.filter((r) => r.checkIds.some((c) => checkIds.includes(c))).map((r) => r.id);
   const prevMinor = minorAmount({ price: input.terms.previous_price, amount: input.terms.previous_amount, currency: plan2.currency }, "terms.previous_price");
@@ -24623,6 +24934,16 @@ function staticUncertainty(v, u) {
   }
   return v;
 }
+function pagePriceDiffers(findings) {
+  const f = findings.find((x) => x.checkId === "signup.disclosure.price");
+  const units = f?.data?.units ?? [];
+  const quotes = units.filter((u) => u.priceMismatch === true && u.otherPlanCard !== true && u.equivalentPrice !== true && u.status !== "pass" && u.status !== "not_applicable").map((u) => typeof u.quote === "string" && u.quote ? u.quote : "a different price");
+  return [...new Set(quotes)];
+}
+function withPriceDiffers(next, differs) {
+  if (!differs.length) return next;
+  return { ...next, message: `The price on the page differs from the plan terms you passed (warning page_price_differs): confirm which price subscribers are charged first. ${next.message}` };
+}
 function nextAction3(checks, replacement, buttons, perPlan = false, onStripe) {
   if (!buttons) {
     return { type: "provide_input", message: "No purchase button was found. Pass the rendered checkout HTML (after JavaScript runs), or the page that contains the subscribe button." };
@@ -24691,7 +25012,7 @@ async function checkPageHtml(input, opts = {}) {
   const facts = input.checkout_type ? { ...facts0, checkoutType: input.checkout_type } : facts0;
   let onStripe;
   const merchantNames = [...new Set([plan2?.merchantName, ...plans.map((p) => p.merchantName)].filter((n) => !!n))];
-  const ctx = modelContext(jurisdictions, asOf, facts, { captures: [capture], ...multi ? multi.extra : plan2 ? { config: planConfig(plan2, asOf) } : {}, ...merchantNames.length ? { merchantNames } : {} });
+  const ctx = modelContext(jurisdictions, asOf, facts, { captures: [capture], signupUrls: [capture.url], ...multi ? multi.extra : plan2 ? { config: planConfig(plan2, asOf) } : {}, ...merchantNames.length ? { merchantNames } : {} });
   const run2 = await runChecks(ctx, SIGNUP_FIX_CHECKS, now);
   const checks = shapeChecks(run2.findings, {
     adjust: (v0, f) => {
@@ -24748,10 +25069,24 @@ async function checkPageHtml(input, opts = {}) {
   }
   const consentOnStripe = onStripe ?? (input.checkout_type === "payment_link" || input.checkout_type === "stripe_checkout" ? input.checkout_type : input.checkout_type ? void 0 : stripeButtonsKind(capture));
   const repOpts = consentOnStripe ? { onStripe: consentOnStripe } : {};
-  const replacement = plan2 ? await buildReplacement(plan2, jurisdictions, asOf, now, { ...repOpts, page: capture }) : void 0;
+  const built = plan2 ? await buildReplacement(plan2, jurisdictions, asOf, now, { ...repOpts, page: capture }) : void 0;
+  const differs = plan2 && !multi ? pagePriceDiffers(run2.findings) : [];
+  if (plan2 && differs.length) {
+    warnings.push({
+      code: "page_price_differs",
+      message: `The price on the page (${differs.map((q2) => `\u201C${q2}\u201D`).join(", ")}) differs from the plan terms you passed (${planDisplay(plan2, 0)}). The replacement states the plan's price and is not verified for this page: confirm which price subscribers are charged. If the plan terms are out of date, pass the real price and check again; if the page is wrong, use the replacement and remove the other price from the page.`,
+      param: t && hasPrice(t) ? "terms" : "plans"
+    });
+  }
+  const replacement = built && differs.length ? {
+    ...built,
+    verified: false,
+    remaining_checks: [.../* @__PURE__ */ new Set([...built.remaining_checks, "signup.disclosure.price"])],
+    note: `${built.note ? `${built.note} ` : ""}The price on the page differs from the plan terms you passed, so this replacement is not verified for this page (warning page_price_differs).`
+  } : built;
   const planReplacements = multi ? await Promise.all(plans.map(async (p, i) => ({ plan: planDisplay(p, i), ...await buildReplacement(p, jurisdictions, asOf, now, repOpts) }))) : void 0;
   return {
-    ...baseReport("page", checks, jurisdictions, asOf, warnings, nextAction3(checks, replacement ?? planReplacements?.[0], capture.ctas.length, !!planReplacements, onStripe), capture.text, multi ? void 0 : plan2),
+    ...baseReport("page", checks, jurisdictions, asOf, warnings, withPriceDiffers(nextAction3(checks, replacement ?? planReplacements?.[0], capture.ctas.length, !!planReplacements, onStripe), differs), capture.text, multi ? void 0 : plan2),
     kind: "page",
     source: opts.source ?? "html",
     extraction: {
@@ -24901,7 +25236,8 @@ __export(preflight_exports, {
   resolvePriceIds: () => resolvePriceIds,
   runChecks: () => runChecks,
   shapeChecks: () => shapeChecks,
-  signupStripeObjects: () => signupStripeObjects
+  signupStripeObjects: () => signupStripeObjects,
+  withIntroOffers: () => withIntroOffers
 });
 var init_preflight = __esm({
   "../rules/src/preflight/index.ts"() {
@@ -24914,6 +25250,7 @@ var init_preflight = __esm({
     init_page();
     init_checkout_plans();
     init_stripe_objects();
+    init_plan_terms();
   }
 });
 
@@ -25221,6 +25558,11 @@ var init_check = __esm({
 // src/ci/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+function planList(config, ref) {
+  if (Array.isArray(ref)) return ref;
+  if (ref === "all" && !(config.plans ?? []).some((p) => p.name === "all")) return (config.plans ?? []).map((p) => p.name);
+  return void 0;
+}
 function findConfig(cwd, explicit) {
   if (explicit) {
     const p = isAbsolute(explicit) ? explicit : resolve2(cwd, explicit);
@@ -25249,7 +25591,7 @@ function loadConfig(path) {
 function validateConfig(value) {
   const is = new Issues();
   if (!isObj2(value)) return ["must be a JSON object (see https://checkbox.site/docs/guides/ci#config)"];
-  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "checks", "coverage"]);
+  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "notices", "checks", "coverage"]);
   const cov = value.coverage;
   if (cov !== void 0 && cov !== false) {
     if (!isObj2(cov)) is.add("coverage", `must be false or an object like { "ignore": ["scripts/**"] } (got ${show(cov)})`);
@@ -25303,6 +25645,17 @@ function validateConfig(value) {
       });
   }
   const planCount = Array.isArray(plans) ? plans.length : 0;
+  const notices = value.notices;
+  if (notices !== void 0) {
+    if (!isObj2(notices)) is.add("notices", `must be an object like { "sent_by_checkbox": true } (got ${show(notices)})`);
+    else {
+      is.keys("notices", notices, ["sent_by_checkbox"]);
+      const sb = notices.sent_by_checkbox;
+      if (sb !== true && !(Array.isArray(sb) && sb.length && sb.every((k) => typeof k === "string" && EMAIL_KINDS2.includes(k)))) {
+        is.add("notices.sent_by_checkbox", `must be true (every email Checkbox Notices sends) or a list of kinds (${EMAIL_KINDS2.join(", ")}) (got ${show(sb)})`);
+      }
+    }
+  }
   const checks = value.checks;
   if (!isObj2(checks)) {
     is.add("checks", checks === void 0 ? "is required (an object with stripe_checkout, disclosures, pages, emails and/or notice_schedule)" : `must be an object (got ${show(checks)})`);
@@ -25310,7 +25663,7 @@ function validateConfig(value) {
   }
   is.keys("checks", checks, ["stripe_checkout", "disclosures", "pages", "emails", "notice_schedule"]);
   const names = /* @__PURE__ */ new Set();
-  const entries = (key, each, needsPlan) => {
+  const entries = (key, each, needsPlan, severalPlans = false) => {
     const list2 = checks[key];
     if (list2 === void 0) return;
     if (!Array.isArray(list2)) return is.add(`checks.${key}`, `must be an array (got ${show(list2)})`);
@@ -25321,7 +25674,12 @@ function validateConfig(value) {
         if (names.has(e.name)) is.add(`${at}.name`, `duplicates another check's name (${show(e.name)}); names must be unique`);
         names.add(e.name);
       }
-      if (e.plan !== void 0) {
+      if (severalPlans && Array.isArray(e.plan)) {
+        if (!e.plan.length || !e.plan.every((n) => typeof n === "string")) is.add(`${at}.plan`, `must be a plan name, a list of plan names or "all" (got ${show(e.plan)})`);
+        else for (const n of e.plan) if (!planNames.has(n)) is.add(`${at}.plan`, `names no plan in "plans" (${show(n)}; plans: ${[...planNames].map((x) => JSON.stringify(x)).join(", ")})`);
+      } else if (severalPlans && e.plan === "all" && !planNames.has("all")) {
+        if (!planCount) is.add(`${at}.plan`, 'is "all", but "plans" is empty: add the plans to "plans"');
+      } else if (e.plan !== void 0) {
         if (is.str(`${at}.plan`, e.plan) && !planNames.has(e.plan)) {
           is.add(`${at}.plan`, planCount ? `names no plan in "plans" (${show(e.plan)}; plans: ${[...planNames].map((n) => JSON.stringify(n)).join(", ")})` : `names a plan, but "plans" is empty: add the plan to "plans"`);
         }
@@ -25373,7 +25731,9 @@ function validateConfig(value) {
       if (e.url !== void 0) is.str(`${at}.url`, e.url, { pattern: /^https?:\/\/\S+$/, patternHint: "an http(s) URL" });
       is.oneOf(`${at}.kind`, e.kind, PAGE_KINDS2);
     },
-    "several"
+    // Round 21 (pilot 20, ci-pr-agent): a page with no "plan" is checked against every plan (a multi-plan pricing page).
+    false,
+    true
   );
   entries(
     "emails",
@@ -25395,7 +25755,8 @@ function validateConfig(value) {
       if ((e.text !== void 0 || e.html !== void 0) && e.subject === void 0) is.add(`${at}.subject`, 'is required with inline "text" / "html"');
       is.money(`${at}.previous_price`, e.previous_price);
     },
-    "always"
+    "always",
+    true
   );
   const ns = checks.notice_schedule;
   if (ns !== void 0 && typeof ns !== "boolean") is.add("checks.notice_schedule", `must be true or false (got ${show(ns)})`);
@@ -26470,11 +26831,14 @@ async function stripeJob(loaded, e, o, root) {
       params = r.params;
       if (r.unresolved.length) {
         job.partial = true;
+        job.unresolved = r.unresolved;
         job.warnings.push(`Read statically; ${r.unresolved.length} value(s) are expressions Checkbox cannot evaluate (${r.unresolved.slice(0, 4).join(", ")}${r.unresolved.length > 4 ? ", \u2026" : ""}). Give the price in "plans" (and "plan" here), or use "module" to return the exact params.`);
       }
     }
     if (!params || typeof params !== "object" || Array.isArray(params)) throw new InputError("the Checkout Session params must be a JSON object");
     const merchant = planTerms(config, pickPlan(config, e.plan));
+    const drift = planDrift(params, pickPlan(config, e.plan));
+    if (drift) job.warnings.push(drift);
     const items = Array.isArray(params.line_items) ? params.line_items : [];
     if (items.length && items.every((li) => li && typeof li === "object" && li.price_data)) for (const k of ["price", "amount", "currency", "interval", "interval_count"]) delete merchant[k];
     job.body = { params, ...Object.keys(merchant).length ? { merchant } : {}, ...jurisdictionsOf(config) };
@@ -26483,6 +26847,23 @@ async function stripeJob(loaded, e, o, root) {
   }
   return job;
 }
+function planDrift(params, plan2) {
+  if (!plan2) return void 0;
+  const sd = params.subscription_data ?? {};
+  const trial = typeof sd.trial_period_days === "number" ? sd.trial_period_days : void 0;
+  const out = [];
+  if (trial !== void 0 && trial !== (plan2.trial_days ?? 0)) out.push(`the params give a ${trial}-day free trial, plan "${plan2.name}" has ${plan2.trial_days ? `a ${plan2.trial_days}-day trial` : "none"}`);
+  if (trial === void 0 && plan2.trial_days && plan2.trial_days > 0 && sd.trial_end === void 0) out.push(`plan "${plan2.name}" has a ${plan2.trial_days}-day free trial, the params give none`);
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const pd = items.map((li) => li && typeof li === "object" ? li.price_data : void 0).find((x) => x && typeof x === "object");
+  const rec = pd && typeof pd.recurring === "object" ? pd.recurring : void 0;
+  if (rec && typeof rec.interval === "string" && rec.interval !== plan2.interval) out.push(`the params bill every ${rec.interval}, plan "${plan2.name}" every ${plan2.interval}`);
+  const price3 = typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
+    out.push(`the params charge ${(pd.unit_amount / 100).toFixed(2)}, plan "${plan2.name}" ${price3.toFixed(2)}`);
+  }
+  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The checks use the params; update "plans" in checkbox.json so the required emails and pages are checked for the plan you really sell.` : void 0;
+}
 function disclosureJob(loaded, e, root) {
   const { config, dir } = loaded;
   const job = { name: e.name, type: "disclosure", ...e.plan ? { plan: e.plan } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
@@ -26509,9 +26890,17 @@ function disclosureJob(loaded, e, root) {
 }
 function pageJob(loaded, e, o, root) {
   const { config, dir } = loaded;
-  const job = { name: e.name, type: "page", ...e.plan ? { plan: e.plan } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
-  const terms2 = planTerms(config, pickPlan(config, e.plan));
-  const common3 = { ...e.kind ? { page_kind: e.kind } : {}, ...Object.keys(terms2).length ? { terms: terms2 } : {}, ...jurisdictionsOf(config) };
+  const several = planList(config, e.plan);
+  const one = several?.length === 1 ? several[0] : several ? void 0 : e.plan;
+  const job = { name: e.name, type: "page", ...one ? { plan: one } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
+  const plan2 = several && several.length > 1 ? void 0 : pickPlan(config, one);
+  const terms2 = planTerms(config, plan2);
+  const names = several && several.length > 1 ? several : !plan2 && !e.plan && (config.plans?.length ?? 0) > 1 ? (config.plans ?? []).map((p) => p.name) : void 0;
+  const every = names?.map((n) => {
+    const { merchant_name: _m, cancel_url: _c, ...own } = planTerms(config, pickPlan(config, n));
+    return own;
+  });
+  const common3 = { ...e.kind ? { page_kind: e.kind } : {}, ...Object.keys(terms2).length ? { terms: terms2 } : {}, ...every ? { plans: every } : {}, ...jurisdictionsOf(config) };
   if (e.url) {
     if (!o.online) job.skip = "URL pages are fetched by the API: run with --online (and CHECKBOX_SECRET_KEY)";
     else job.body = { url: e.url, ...common3 };
@@ -26526,9 +26915,9 @@ function pageJob(loaded, e, o, root) {
   }
   return job;
 }
-async function emailJob(loaded, e, o, root) {
+async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
   const { config, dir } = loaded;
-  const job = { name: e.name, type: "email", ...e.plan ? { plan: e.plan } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
+  const job = { name, type: "email", ...planName ? { plan: planName } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
   try {
     let msg2;
     if (e.file) {
@@ -26548,7 +26937,7 @@ async function emailJob(loaded, e, o, root) {
     } else msg2 = { subject: e.subject, ...e.text ? { text: e.text } : {}, ...e.html ? { html: e.html } : {} };
     if (!msg2.subject) throw new InputError(`no subject: add "subject" to the entry, a first line "Subject: \u2026" to the file, or an HTML <title>`);
     if (!msg2.text && !msg2.html) throw new InputError("the email body is empty");
-    const terms2 = { ...planTerms(config, pickPlan(config, e.plan)) };
+    const terms2 = { ...planTerms(config, pickPlan(config, planName)) };
     if (config.merchant?.support_contact) terms2.support_contact = config.merchant.support_contact;
     if (e.previous_price !== void 0) terms2.previous_price = typeof e.previous_price === "string" && /^[\d.]+$/.test(e.previous_price) ? Number(e.previous_price) : e.previous_price;
     job.body = { kind: e.kind, subject: msg2.subject, ...msg2.text ? { text: msg2.text } : {}, ...msg2.html ? { html: msg2.html } : {}, terms: terms2, ...jurisdictionsOf(config) };
@@ -26564,7 +26953,11 @@ async function resolveJobs(loaded, o) {
   for (const e of c.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
   for (const e of c.disclosures ?? []) jobs.push(disclosureJob(loaded, e, root));
   for (const e of c.pages ?? []) jobs.push(pageJob(loaded, e, o, root));
-  for (const e of c.emails ?? []) jobs.push(await emailJob(loaded, e, o, root));
+  for (const e of c.emails ?? []) {
+    const several = planList(loaded.config, e.plan);
+    if (several && several.length > 1) for (const n of several) jobs.push(await emailJob(loaded, e, o, root, n, `${e.name} (${n})`));
+    else jobs.push(await emailJob(loaded, e, o, root, several?.[0] ?? e.plan));
+  }
   if (c.notice_schedule) {
     const plans = loaded.config.plans ?? [];
     for (const p of plans) {
@@ -26598,6 +26991,8 @@ var init_inputs = __esm({
 const [url, name, argsJson] = process.argv.slice(1);
 const mod = await import(url);
 let v = mod[name];
+// A CommonJS-compiled module (a .ts file without "type": "module") puts its named exports on default.
+if (v === undefined && name !== 'default' && mod.default && typeof mod.default === 'object' && name in mod.default) v = mod.default[name];
 if (v === undefined) {
   process.stderr.write('__CHECKBOX_ERR__ ' + (name === 'default' ? 'no default export' : 'no export named "' + name + '"') + ' (exports: ' + (Object.keys(mod).join(', ') || 'none') + ')\\n');
   process.exit(2);
@@ -26642,7 +27037,7 @@ function renderHuman(run2, c, opts = {}) {
     for (const w of x.warnings.slice(0, opts.verbose ? 10 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
     if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
   }
-  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && !run2.strict ? c.yellow : c.red;
+  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
   lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
   if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
   lines.push(c.dim(run2.disclaimer));
@@ -26651,7 +27046,7 @@ function renderHuman(run2, c, opts = {}) {
 function annotations(run2) {
   const out = [];
   for (const x of run2.checks) {
-    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict ? "error" : "warning" : void 0;
+    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : void 0;
     if (!level) continue;
     const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
     const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
@@ -26781,6 +27176,7 @@ var init_src3 = __esm({
     init_engine();
     init_checks2();
     init_terms_of_service();
+    init_context();
     init_plan_terms();
     init_offer();
     init_offer_view();
@@ -27196,7 +27592,10 @@ function fixesOf(r) {
   const out = [];
   const failing = (r.checks ?? []).filter((c) => (c.status === "fail" || c.status === "needs_review") && !(c.compliance_status && OK_STATUSES.has(c.compliance_status)));
   failing.sort((a, b) => (a.compliance_status === "needs_fix" ? 0 : 1) - (b.compliance_status === "needs_fix" ? 0 : 1) || (RANK2[a.status] ?? 2) - (RANK2[b.status] ?? 2));
-  for (const c of failing) if (c.fix && !out.includes(c.fix)) out.push(c.fix);
+  for (const c of failing) {
+    const text = c.compliance?.fix || c.fix || c.compliance?.question?.text || c.explanation || c.title || c.check_id;
+    if (text && !out.includes(text)) out.push(text);
+  }
   return out;
 }
 function correctedOf(type, r, partial = false) {
@@ -27220,7 +27619,10 @@ ${r.template.text}` };
 }
 function noticeCoverage(config, planName, schedule) {
   const plan2 = (config.plans ?? []).find((p) => p.name === planName);
-  const have = new Set((config.checks.emails ?? []).filter((e) => !e.plan || e.plan === planName).map((e) => e.kind));
+  const have = new Set((config.checks.emails ?? []).filter((e) => !e.plan || e.plan === planName || planList(config, e.plan)?.includes(planName)).map((e) => e.kind));
+  const sb = config.notices?.sent_by_checkbox;
+  const byCheckbox = new Set(sb === true ? Object.values(NOTICE_TO_EMAIL) : Array.isArray(sb) ? sb : []);
+  for (const k of byCheckbox) have.add(k);
   const yearly = plan2 ? (plan2.interval === "year" ? 12 * (plan2.interval_count ?? 1) : plan2.interval === "month" ? plan2.interval_count ?? 1 : 0) >= 12 : false;
   if (yearly && have.has("renewal_reminder")) have.add("annual_terms");
   const required = /* @__PURE__ */ new Map();
@@ -27230,7 +27632,8 @@ function noticeCoverage(config, planName, schedule) {
   }
   const missing = [...required].filter(([k]) => !have.has(k));
   if (!required.size) return { status: "not_applicable", label: "No reminder emails required", fixes: [] };
-  if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered`, fixes: [] };
+  const sent2 = [...required.keys()].filter((k) => byCheckbox.has(k)).length;
+  if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered${sent2 ? ` (${sent2} sent by Checkbox Notices, as checkbox.json declares)` : ""}`, fixes: [] };
   const fixes = missing.map(([k, w]) => `Add a ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it.`);
   return { status: "needs_review", label: `${missing.length} required email${missing.length === 1 ? "" : "s"} not in checkbox.json`, fix: fixes[0], fixes };
 }
@@ -27243,17 +27646,26 @@ async function runJob(job, engine, config) {
     report = await engine.run(ENGINE_KIND[job.type], job.body);
   } catch (err) {
     const e = err;
-    return { ...base, status: "error", label: "Could not run", message: `${e.message}${e.param ? ` (${e.param})` : ""}`, fixes: [] };
+    const failure = isAuthError(err) ? "auth" : err instanceof CheckboxError && (!e.statusCode || e.statusCode >= 500 || e.statusCode === 429) ? "api" : void 0;
+    return { ...base, status: "error", label: "Could not run", message: `${e.message}${e.param ? ` (${e.param})` : ""}`, fixes: [], ...failure ? { failure } : {} };
   }
   if (job.type === "notice_schedule") return { ...base, ...noticeCoverage(config, job.plan, report), report };
   for (const w of report.warnings ?? []) base.warnings.push(w.message);
   const status = ciStatusOf(report);
   const fixes = status === "pass" || status === "not_applicable" ? [] : fixesOf(report);
+  const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection)\b/.test(p));
+  const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review");
+  if (unread) {
+    fixes.unshift(`${unreadText.slice(0, 3).join(", ")} ${unreadText.length === 1 ? "is an expression" : "are expressions"} Checkbox cannot read statically (e.g. a ternary), so ${unreadText.length === 1 ? "its" : "their"} text was not checked. Use "module" (a function returning the exact params for each plan) or "file" instead of "source"; the findings below are what the params read without ${unreadText.length === 1 ? "it" : "them"}.`);
+  }
+  const finalStatus = unread ? "needs_review" : status;
   const corrected = correctedOf(job.type, report, job.partial);
+  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked");
   return {
     ...base,
-    status,
-    label: report.compliance?.label || DEFAULT_LABEL[status],
+    status: finalStatus,
+    ...blocking ? { blocking: true } : {},
+    label: unread ? `Not checked: ${unreadText[0]} is an expression` : report.compliance?.label || DEFAULT_LABEL[status],
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
@@ -27261,14 +27673,36 @@ async function runJob(job, engine, config) {
   };
 }
 function exitCodeOf(checks, strict) {
+  if (checks.some((c) => c.failure === "auth")) return { status: "error", exit: EXIT.auth };
+  if (checks.some((c) => c.failure === "api")) return { status: "error", exit: EXIT.error };
   if (checks.some((c) => c.status === "error")) return { status: "error", exit: EXIT.usage };
   if (checks.some((c) => c.status === "fail")) return { status: "fail", exit: EXIT.fail };
-  if (checks.some((c) => c.status === "needs_review")) return { status: "needs_review", exit: strict ? EXIT.needs_review : EXIT.ok };
+  if (checks.some((c) => c.status === "needs_review")) return { status: "needs_review", exit: strict || checks.some((c) => c.blocking) ? EXIT.needs_review : EXIT.ok };
   return { status: "pass", exit: EXIT.ok };
 }
+function mergeSourcePatches(checks) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const c of checks) {
+    if (c.type !== "stripe_checkout" || c.corrected?.format !== "json" || !c.target.line) continue;
+    const key = `${c.target.file}:${c.target.line}`;
+    groups.set(key, [...groups.get(key) ?? [], c]);
+  }
+  for (const list2 of groups.values()) {
+    if (list2.length < 2) continue;
+    const body = {};
+    for (const c of list2) body[c.plan ?? c.name] = JSON.parse(c.corrected.body);
+    const first2 = list2[0];
+    first2.corrected = { format: "json", title: `Changes for this one call, per plan (${list2.length} plans share it: choose each value by plan, e.g. build the params in a function of the plan)`, body: JSON.stringify(body, null, 2) };
+    for (const c of list2.slice(1)) {
+      delete c.corrected;
+      c.warnings.push(`The changes for this call (shared with "${first2.name}") are shown once, per plan, under "${first2.name}".`);
+    }
+  }
+}
 async function runCi(jobs, engine, opts) {
   const checks = [...opts.extra ?? []];
   for (const j of jobs) checks.push(await runJob(j, engine, opts.config));
+  mergeSourcePatches(checks);
   const summary = { pass: 0, fail: 0, needs_review: 0, not_applicable: 0, skipped: 0, error: 0 };
   for (const c of checks) summary[c.status]++;
   const { status, exit } = exitCodeOf(checks, opts.strict);
@@ -27292,7 +27726,10 @@ var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
     init_src();
+    init_http();
+    init_src();
     init_types2();
+    init_config3();
     ENGINE_KIND = {
       stripe_checkout: "stripe_checkout_session",
       disclosure: "disclosure",
@@ -27487,7 +27924,8 @@ var init_ci = __esm({
       "In GitHub Actions (GITHUB_ACTIONS=true): ::error / ::warning annotations on the file each check reads, a Markdown",
       "table in $GITHUB_STEP_SUMMARY, and status=<pass|fail|needs_review|error|skipped> in $GITHUB_OUTPUT.",
       "",
-      "Exit: 0 pass (or needs review without --strict) \xB7 1 a check needs a fix \xB7 2 needs review with --strict \xB7",
+      "Exit: 0 pass (or needs review without --strict) \xB7 1 a check needs a fix \xB7 2 needs review with --strict, or a",
+      "      page / disclosure with no renewal terms to judge \xB7",
       "      3 config / usage error \xB7 4 auth (--online) \xB7 5 API or network error",
       "",
       "checkbox ci init [--yes] [--force] [--dry-run] [--no-workflow]",
@@ -28952,7 +29390,7 @@ var init_plan = __esm({
         "  --json         The plan object exactly as the API returns it (for agents)",
         "",
         "The loop: apply plan.next_action \u2192 `checkbox fix <task>` (prints the change, or an exact diff of your file) \u2192",
-        "`checkbox verify <task> --wait` \u2192 `checkbox plan` again, until status is compliant. Tasks marked [!] need a human",
+        "`checkbox verify <task> --wait` \u2192 `checkbox plan` again, until the checks pass (status compliant). Tasks marked [!] need a human",
         "answer (answerTask); they never block the others."
       ].join("\n"),
       async run(ctx) {