@checkbox-site/cli 0.4.3 → 0.4.4

package/dist/checkbox.js

@@ -2444,7 +2444,7 @@ var init_operations = __esm({
       /**
        * Connect a billing platform.
        *
-       * Connects the site's billing platform with the one restricted key (a Stripe restricted key, a Recharge token, a Shopify Admin API token, a Chargebee read-only API key, a Recurly private API key or a Paddle API key with read permissions), so Checkbox reads the customer-portal and reminder settings. Stripe: One Stripe restricted key per site: Read permissions for the checks, and Write permissions that Checkbox uses only after you click Approve on a fix, or in test mode (the one exception: Webhook Endpoints, used once to add Checkbox's webhook endpoint when you connect the key) (checklist: https://checkbox.site/docs/guides/stripe-key). A full secret key (sk_test_ / sk_live_) is refused on every path with test_key_not_restricted: use a restricted key. API keys and AI agents may connect TEST-mode keys (rk_test_…) only; a live key (rk_live_ / sk_live_) is refused with live_key_requires_dashboard, because only a person signed in to the Checkbox dashboard can connect one. The credentials are validated by reading the settings once and stored encrypted. When the key's Stripe account looks like another site's (the site's prices or Payment Links are not in it, or it is already connected in another workspace), nothing is connected and the error billing_account_mismatch asks the human to confirm; retry with confirm_account_mismatch: true only after they said yes. The account owner is emailed about every key connected.
+       * Connects the site's billing platform with the one restricted key (a Stripe restricted key, a Recharge token, a Shopify Admin API token, a Chargebee read-only API key, a Recurly private API key or a Paddle API key with read permissions), so Checkbox reads the customer-portal and reminder settings. Stripe: One Stripe restricted key per site: Read permissions for the checks, and Write permissions that Checkbox uses only after you click Approve on a fix, or in test mode (the one exception: Webhook Endpoints, used once to add Checkbox's webhook endpoint when you connect the key) (checklist: https://checkbox.site/docs/guides/stripe-key). A full secret key (sk_test_ / sk_live_) is refused on every path with test_key_not_restricted: use a restricted key. API keys and AI agents may connect TEST-mode keys (rk_test_…) only; a live key (rk_live_ / sk_live_) is refused with live_key_requires_dashboard, because only a person signed in to the Checkbox dashboard can connect one. The credentials are validated by reading the settings once and stored encrypted. When the key's Stripe account looks like another site's (the site's prices or Payment Links are not in it, or it is already connected in another workspace), nothing is connected and the error billing_account_mismatch asks the human to confirm; retry with confirm_account_mismatch: true only after they said yes; the key is then held until a person confirms the account in the dashboard (an agent cannot confirm it). The account owner is emailed about every key connected.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/integrations (operation `connectBillingPlatform`, scope `sites:write`)
@@ -2874,7 +2874,7 @@ var init_operations = __esm({
       /**
        * List due notices.
        *
-       * The legally required emails you owe subscribers (sites in "You send" mode, the default): kind, the subscriber (billing-platform ids), the legal window for the subscriber's state, the recommended send date, the copy-ready email and the BCC address. Default: everything not yet sent (upcoming, due, overdue), soonest first. Live keys list live subscribers' notices, test keys test-mode ones. Send each one on its send_date (inside its window), then call markNoticeSent (or BCC the notice's bcc address). Subscribe to the notice.due webhook to get each one on its send date.
+       * The legally required emails you owe subscribers (sites in "You send" mode, the default): kind, the subscriber (billing-platform ids), the legal window for the subscriber's state, the recommended send date, the email (ready to send once email.missing_fields is empty) and the BCC address. Default: everything not yet sent (upcoming, due, overdue), soonest first. Live keys list live subscribers' notices, test keys test-mode ones. Send each one on its send_date (inside its window), then call markNoticeSent (or BCC the notice's bcc address). Subscribe to the notice.due webhook to get each one on its send date.
        *
        * @see GET /v1/notices/due (operation `listDueNotices`, scope `notices:read`)
        */
@@ -2904,7 +2904,7 @@ var init_operations = __esm({
       /**
        * Retrieve a due notice.
        *
-       * One notice you owe a subscriber, with its window, recommended send date, copy-ready email, BCC address and send status.
+       * One notice you owe a subscriber, with its window, recommended send date, email (ready to send once email.missing_fields is empty), BCC address and send status.
        *
        * @param notice Unique identifier of the due notice (ntd_…).
        * @see GET /v1/notices/{notice} (operation `retrieveDueNotice`, scope `notices:read`)
@@ -3257,7 +3257,7 @@ var init_operations = __esm({
       /**
        * Store a billing test-mode key.
        *
-       * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); a key whose Stripe account looks like another site's is refused with billing_account_mismatch until the human confirms (confirm_account_mismatch: true); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
+       * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked "Let your agent store a Stripe test-mode key" on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/test_credentials (operation `createTestCredential`, scope `test_runs:write`)
@@ -3579,7 +3579,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.1";
+    SDK_VERSION = "0.2.2";
   }
 });
 
@@ -13103,6 +13103,14 @@ function offerSlice(c, g) {
     links: keep(c.links)
   };
 }
+function offerCardName(text, cta, index) {
+  const t = normalizeText(text).replace(/\s+/g, " ").trim();
+  const money3 = /(?:[$€£]\s?\d[\d,]*(?:\.\d{1,2})?|\d[\d,]*(?:\.\d{1,2})?\s?(?:USD|EUR|GBP))(?:\s*(?:\/|per|a|an|every)\s*(?:month|mo|year|yr|week|day|quarter)\b)?/i.exec(t);
+  const before = (money3 ? t.slice(0, money3.index) : "").replace(new RegExp(`^${cta.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*`, "i"), "").replace(/[\s:·|–—-]+$/, "").trim();
+  const heading = before && before.length <= 40 ? before : before ? before.split(" ").slice(0, 4).join(" ") : "";
+  const price3 = money3?.[0].trim();
+  return heading && price3 ? `${heading}, ${price3}` : heading || price3 || `card ${index + 1}`;
+}
 function buildSignupView(capture, offer) {
   const c = offer === void 0 ? capture : offerSlice(capture, offer);
   const device = c.device === "mobile" ? "mobile" : "desktop";
@@ -13127,9 +13135,11 @@ function buildSignupView(capture, offer) {
     [...c.disclosures ?? [], ...checkboxes, ...allLinks].filter(isVisible).map((e) => e.style?.fontSizePx ?? NaN)
   );
   const offerCta = offer === void 0 ? void 0 : capture.offers?.[offer]?.cta ?? primaryCta2?.text;
+  const sameCta = offer !== void 0 && offerCta ? (capture.offers ?? []).filter((o) => normalizeText(o.cta) === normalizeText(offerCta)).length > 1 : false;
+  const card = sameCta ? offerCardName(capture.offers[offer].text, offerCta, offer) : void 0;
   return {
     capture,
-    label: offerCta ? `${captureLabel(c)} \u2014 plan button \u201C${normalizeText(offerCta).slice(0, 60)}\u201D` : captureLabel(c),
+    label: offerCta ? `${captureLabel(c)} \u2014 plan button \u201C${normalizeText(offerCta).slice(0, 60)}\u201D${card ? ` in the card \u201C${card}\u201D` : ""}` : captureLabel(c),
     ...offer !== void 0 ? { offer: { index: offer, cta: normalizeText(offerCta ?? "").slice(0, 120) } } : {},
     device,
     viewport,
@@ -15056,6 +15066,11 @@ function offerQuestionStop(flow) {
   const last = [...flow.steps ?? []].reverse().find((s2) => s2.pageKind !== "account");
   return last && OFFER_PERMISSION_RE.test(normalizeText(last.text)) ? last : void 0;
 }
+function stuckHint(flow) {
+  const blockers = flow.blockers ?? [];
+  if (flow.completed || blockers.some((b) => /answered the cancel request with an error/i.test(b))) return "";
+  return blockers.some((b) => /no further cancel option|not completed within \d+ steps/i.test(b)) ? `. ${CANCEL_STEPS_HINT}` : "";
+}
 function offerQuestionStopResult(id, stop, refs2, data) {
   return makeResult(
     id,
@@ -15345,7 +15360,7 @@ function notRefreshedUnits(stale, fresh) {
     };
   });
 }
-var CANCEL_MAX_STEPS, CANCEL_MAX_RETENTION_OFFERS, CANCEL_LINK_MIN_FONT_PX, CANCEL_LINK_MIN_CONTRAST, CANCEL_FLOW_MAX_AGE_DAYS, CLICK_TO_CANCEL_JURISDICTIONS, OFFER_PERMISSION_JURISDICTIONS, RETENTION_PAGE_RE, OFFER_PERMISSION_RE, ONLINE_ALTERNATIVE_RE, NO_CANCEL_ATTEMPT_MESSAGE, OBSTACLE_BLOCKER_RE, CONTACT_BLOCKER_RE, NOT_FOUND_BLOCKER_RE, RETENTION_BLOCKER_RE, TECHNICAL_BLOCKER_RE, CONTACT_TO_CANCEL_RE, CANCEL_CONTROL_RE, ORDER_ONLY_RE, MANAGE_RE, HOSTED_FLOW_NOTE, onlineAvailable, SUBSCRIPTION_CANCEL_LINK_RE, BILLING_ITEM_RE, NO_ACTIVE_SUBSCRIPTION_RE, FIND_RANK, mechanismFindable, flowFriction, CANCEL_CONFIRM_EMAIL_RE, confirmation, CANCELLATION_CHECKS;
+var CANCEL_MAX_STEPS, CANCEL_MAX_RETENTION_OFFERS, CANCEL_LINK_MIN_FONT_PX, CANCEL_LINK_MIN_CONTRAST, CANCEL_FLOW_MAX_AGE_DAYS, CLICK_TO_CANCEL_JURISDICTIONS, OFFER_PERMISSION_JURISDICTIONS, RETENTION_PAGE_RE, OFFER_PERMISSION_RE, ONLINE_ALTERNATIVE_RE, NO_CANCEL_ATTEMPT_MESSAGE, OBSTACLE_BLOCKER_RE, CONTACT_BLOCKER_RE, NOT_FOUND_BLOCKER_RE, RETENTION_BLOCKER_RE, TECHNICAL_BLOCKER_RE, CONTACT_TO_CANCEL_RE, CANCEL_CONTROL_RE, ORDER_ONLY_RE, MANAGE_RE, HOSTED_FLOW_NOTE, CANCEL_STEPS_HINT, onlineAvailable, SUBSCRIPTION_CANCEL_LINK_RE, BILLING_ITEM_RE, NO_ACTIVE_SUBSCRIPTION_RE, FIND_RANK, mechanismFindable, flowFriction, CANCEL_CONFIRM_EMAIL_RE, confirmation, CANCELLATION_CHECKS;
 var init_cancellation = __esm({
   "../rules/src/checks/cancellation.ts"() {
     "use strict";
@@ -15379,6 +15394,7 @@ var init_cancellation = __esm({
     ORDER_ONLY_RE = /\bcancel\s+(?:this\s+|my\s+)?order\b/i;
     MANAGE_RE = /\b(?:manage\s+(?:my\s+|your\s+)?(?:subscriptions?|membership|plan|billing)|billing\s+portal|customer\s+portal|subscription\s+settings|my\s+subscriptions?|membership\s+settings|billing\s+(?:&|and)\s+plans?)\b/i;
     HOSTED_FLOW_NOTE = "Checkbox-hosted cancellation page: subscribers confirm their email through a one-time link, then cancel in two clicks (choose the subscription, confirm), with at most one save offer shown behind a continuously displayed cancel button and an on-screen and emailed confirmation";
+    CANCEL_STEPS_HINT = `If Checkbox took a wrong turn on your pages, list the clicks in the site's scan settings as cancel_steps (for example: click "Cancel membership", then click "No thanks, cancel") and re-check`;
     onlineAvailable = {
       id: "cancel.online_available",
       usesText: false,
@@ -15485,10 +15501,10 @@ var init_cancellation = __esm({
           return makeResult(
             id,
             "needs_review",
-            `The test cancellation did not complete${flow.blockers?.length ? ` (${flow.blockers.join("; ")})` : ""}, so online cancellation could not be confirmed`,
+            `The test cancellation did not complete${flow.blockers?.length ? ` (${flow.blockers.join("; ")})` : ""}, so online cancellation could not be confirmed${stuckHint(flow)}`,
             refs2,
             0.4,
-            data
+            stuckHint(flow) ? { ...data, suggestCancelSteps: true } : data
           );
         }
         const offline = offlineOnlyCancellation(input);
@@ -15734,13 +15750,13 @@ var init_cancellation = __esm({
         const offerStop = offerQuestionStop(flow);
         if (offerStop) return offerQuestionStopResult(id, offerStop, refs2, data);
         if (b.other.length) {
-          return makeResult(id, "needs_review", `The cancellation flow reported: ${b.other.join("; ")}`, refs2, 0.6, data);
+          return makeResult(id, "needs_review", `The cancellation flow reported: ${b.other.join("; ")}${stuckHint(flow)}`, refs2, 0.6, stuckHint(flow) ? { ...data, suggestCancelSteps: true } : data);
         }
         if (!flow.completed) {
           return makeResult(
             id,
             "needs_review",
-            `The test cancellation did not complete${flow.blockers?.length ? ` (${flow.blockers.join("; ")})` : ""}; friction could not be fully assessed`,
+            `The test cancellation did not complete${flow.blockers?.length ? ` (${flow.blockers.join("; ")})` : ""}; friction could not be fully assessed${stuckHint(flow)}`,
             refs2,
             0.4,
             data
@@ -15999,6 +16015,19 @@ var init_config2 = __esm({
           }
           return makeResult(id, "fail", `Self-serve cancellation is turned off in ${name}'s customer portal`, refs(input), 0.9, { ...data, cancelPath: "portal_only" });
         }
+        if (model.otherOnlineWorks) {
+          const flow = input.ctx.cancellation;
+          const works = inApp?.state === "works" && !!flow;
+          const via = works ? "subscribers cancel online through your own page (a test cancellation completed; see \u201Ccancel online\u201D)" : model.hosted?.state === "offered" ? `subscribers cancel through the Checkbox hosted cancellation page (${model.hosted.url}); see \u201Ccancel online\u201D` : `your own page offers a cancel option (${inApp?.url}); online cancellation is judged on that page (see \u201Ccancel online\u201D), so the portal setting is not required`;
+          return makeResult(
+            id,
+            "not_applicable",
+            `Checkbox could not read whether self-serve cancellation is on in ${name}'s portal, but ${via}`,
+            [...refs(input), ...works ? [flow.id] : []],
+            works ? 0.75 : 0.6,
+            { ...data, verifiedBy: "cancel.online_available", ...works ? { cancellationId: flow.id } : { ownCancelPage: true }, ...inApp ? { cancelsInApp: true } : {} }
+          );
+        }
         return makeResult(id, "needs_review", `Could not read whether self-serve cancellation is enabled in ${name}`, refs(input), 0.4, data);
       }
     };
@@ -18529,7 +18558,12 @@ async function overViews(checkId, input, headlines, evaluateView) {
   for (const view of views) outcomes.push({ view, unit: await evaluateView(view) });
   const failing = outcomes.filter((o) => o.unit.status === "fail");
   const introOnly = checkId === "signup.disclosure.price" && failing.length > 0 && failing.every((o) => typeof o.unit.meta?.introFix === "string");
-  return aggregateViews(checkId, outcomes, introOnly ? { ...headlines, fail: "The introductory offer next to the purchase button is missing or misstated" } : headlines);
+  const mismatchOnly = checkId === "signup.disclosure.price" && !introOnly && failing.length > 0 && failing.every((o) => o.unit.meta?.priceMismatch === true);
+  return aggregateViews(
+    checkId,
+    outcomes,
+    introOnly ? { ...headlines, fail: "The introductory offer next to the purchase button is missing or misstated" } : mismatchOnly ? { ...headlines, fail: "The recurring charge stated next to the purchase button is not what the plan charges" } : headlines
+  );
 }
 function pageAnalysis(view) {
   const entry = heuristicCache.get(view) ?? {};
@@ -18821,6 +18855,12 @@ function introPriceUnit(u, view, plans, promosDeclared = false) {
     { quote: said, meta: { ...u.meta ?? {}, priceMismatch: true, introPriceMismatch: true, introFix: introFixLine(p.plan) } }
   );
 }
+function setOffAdvice(sizePx, contrast, weight, ref) {
+  const refWeight = ref.fontWeight ?? 400;
+  const larger = Math.ceil(ref.fontSizePx * SET_OFF_MIN_SIZE_RATIO);
+  const ways = [`${larger}px or larger (the surrounding text is about ${ref.fontSizePx}px)`, ...refWeight < 600 ? ["semibold or bold (weight 600+; the surrounding text is weight " + refWeight + ")"] : [], "a contrasting colour", "a border or shaded box (confirm by eye: borders and symbols cannot be measured from a capture)"];
+  return `the renewal terms are legible (${sizePx}px, weight ${weight}${contrast !== null ? `, ${contrast}:1 contrast` : ""}) but look like the surrounding text (about ${ref.fontSizePx}px, weight ${refWeight}${refWeight >= 600 ? ": already bold, so a bolder weight cannot set them apart" : ""}, similar colour) \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border. Any one of these would: ${ways.join("; ")}`;
+}
 function trialObservedOutsideCheckout(input) {
   const ctx = input.ctx;
   return [...ctx.config?.plans ?? [], ...ctx.referencePlans ?? []].some((p) => (p.trialDays ?? 0) > 0) || (ctx.events ?? []).some((e) => e.type === "trial_will_end" || (e.trialDays ?? 0) > 0) || input.data.emails.some((e) => e.kind === "trial_ending");
@@ -19767,7 +19807,7 @@ ${view.pageText}`;
             if (setOff && !setOff.differentiators.length) {
               return unit(
                 "needs_review",
-                setOff.referenceUnknown ? `the renewal terms are legible (${best.a.fontSizePx}px, ${best.a.contrastRatio}:1 contrast), but there is no surrounding text to show they are set apart from it \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border` : `the renewal terms are legible (${best.a.fontSizePx}px, ${best.a.contrastRatio}:1 contrast) but look like the surrounding text (about ${setOff.reference.fontSizePx}px, same weight and color) \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border (borders and symbols cannot be measured from a capture: confirm by eye)`,
+                setOff.referenceUnknown ? `the renewal terms are legible (${best.a.fontSizePx}px, ${best.a.contrastRatio}:1 contrast), but there is no surrounding text to show they are set apart from it \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border` : setOffAdvice(best.a.fontSizePx, best.a.contrastRatio, best.el.style?.fontWeight ?? 400, setOff.reference),
                 0.55,
                 { meta: { ...meta, ...setOffMeta }, quote: q2 }
               );
@@ -20472,7 +20512,7 @@ var NOTICES_TEST_MODE_NOTE, NOTICE_KIND_CHECKS, NOT_SEEN_RE;
 var init_notices_on = __esm({
   "../rules/src/checks/notices-on.ts"() {
     "use strict";
-    NOTICES_TEST_MODE_NOTE = "Test mode: Checkbox Notices does not email test customers. Use 'Send me a test' or a test run to see it work.";
+    NOTICES_TEST_MODE_NOTE = "Test mode: emails for a Stripe test customer go to you as a marked \u201CTest mode copy\u201D (and to the test-run inbox during a test run), never to the test customer. Use 'Send me a test' or a test run to see it work.";
     NOTICE_KIND_CHECKS = {
       acknowledgment: ["confirmation.email.sent", "confirmation.email.terms", "confirmation.email.cancellation_instructions", "confirmation.email.trial_terms"],
       trial_ending: ["reminder.trial_ending", "config.trial_reminder_enabled"],
@@ -22016,6 +22056,9 @@ function planFrequencyFix(c) {
   const every = /\bplans? (?:is|are) billed (every [a-z0-9 ]+?)(?= \/ | —|[.;,]|$)/i.exec(c.detail)?.[1];
   return every ? `State how often it is charged ("${every}").` : void 0;
 }
+function billingUnread(findings) {
+  return findings.some((f) => String(f.checkId).startsWith("config.") && /^No billing platform (?:connected|settings to read)/i.test(f.detail ?? ""));
+}
 function rollup(items, opts = {}) {
   const counts = { needs_fix: 0, your_call: 0, pending_live_check: 0, verified_live: 0, compliant: 0, not_applicable: 0, not_set_up: 0, not_checked: 0 };
   const pending = [];
@@ -22059,7 +22102,8 @@ function rollup(items, opts = {}) {
     label = `${counts.not_checked} not checked yet${counts.pending_live_check ? ` \xB7 ${plural2(counts.pending_live_check, "live check", "live checks")} pending` : ""}`;
   } else {
     status = "compliant";
-    label = counts.pending_live_check ? `Checks pass \xB7 ${plural2(counts.pending_live_check, "live check", "live checks")} pending` : counts.verified_live ? "Checks pass \xB7 verified live" : "Checks pass";
+    const pass = opts.billingUnread ? CHECKS_PASS_UNREAD_LABEL : "Checks pass";
+    label = counts.pending_live_check ? `${pass} \xB7 ${plural2(counts.pending_live_check, "live check", "live checks")} pending` : counts.verified_live ? `${pass} \xB7 verified live` : pass;
   }
   return { status, label, counts, pending, suggestions, ...opts.groupOf ? { byTask: Object.fromEntries(groups) } : {} };
 }
@@ -22092,7 +22136,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -22781,6 +22825,7 @@ var init_status = __esm({
       "terms.refund_policy_consistent": "Make the refund policy match the money-back promise on your site.",
       "terms.renewal_terms_present": "Add a short automatic-renewal section to your Terms."
     };
+    CHECKS_PASS_UNREAD_LABEL = "Checks pass on what we can see";
     STATUS_RANK = { needs_fix: 0, not_set_up: 1, your_call: 2, not_checked: 3, pending_live_check: 4, verified_live: 5, compliant: 6, not_applicable: 7 };
   }
 });
@@ -23140,7 +23185,7 @@ async function runEvaluationInScope(input, opts) {
   }
   const classified = classifyFindings(findings);
   for (const { finding, info } of classified) finding.compliance = info;
-  const complianceRollup = rollup(classified.map(({ finding, info }) => ({ checkId: finding.checkId, info })), { groupOf: taskGroupOf });
+  const complianceRollup = rollup(classified.map(({ finding, info }) => ({ checkId: finding.checkId, info })), { groupOf: taskGroupOf, billingUnread: billingUnread(findings) });
   const { score, insurable } = scoreFindings(findings);
   const summary = { pass: 0, fail: 0, needs_review: 0, not_applicable: 0 };
   for (const f of findings) summary[f.status]++;
@@ -24488,16 +24533,24 @@ function readParams(params, merchant, kind, asOf) {
     throw new PreflightInputError("The billing interval is unknown: pass line_items[].price_data.recurring.interval or merchant.interval", "merchant.interval");
   }
   const plan2 = resolvePlan(merged, "merchant.");
-  if (coupon && merchantIntro && coupon.duration !== "forever" && plan2.introAmount !== void 0) {
+  if (coupon && merchantIntro && plan2.introAmount !== void 0) {
     const pct = typeof coupon.percent_off === "number" ? coupon.percent_off : void 0;
     const off = typeof coupon.amount_off === "number" ? coupon.amount_off : void 0;
     const fromCoupon = pct !== void 0 ? Math.round(plan2.amount * (1 - pct / 100)) : off !== void 0 ? plan2.amount - off : void 0;
-    if (fromCoupon !== void 0 && Math.abs(fromCoupon - plan2.introAmount) >= 1) {
+    const months = plan2.interval === "year" ? 12 * plan2.intervalCount : plan2.interval === "month" ? plan2.intervalCount : void 0;
+    const couponPeriods = coupon.duration === "forever" ? Infinity : coupon.duration === "once" ? 1 : coupon.duration === "repeating" && typeof coupon.duration_in_months === "number" && months ? Math.max(1, Math.ceil(coupon.duration_in_months / months)) : void 0;
+    const declaredPeriods = plan2.introPeriods ?? 1;
+    const amountDiffers = fromCoupon !== void 0 && Math.abs(fromCoupon - plan2.introAmount) >= 1;
+    const durationDiffers = couponPeriods !== void 0 && couponPeriods !== declaredPeriods;
+    if (amountDiffers || durationDiffers) {
       const id = typeof coupon.id === "string" ? `coupon ${coupon.id}` : "the coupon";
+      const per = (n) => n === Infinity ? "every billing period (forever)" : n === 1 ? "the first billing period" : `the first ${n} billing periods`;
+      const couponSays = `${pct !== void 0 ? `${pct}% off` : off !== void 0 ? `${formatMoney(off, plan2.currency)} off` : "a discount"}${fromCoupon !== void 0 ? ` (${formatMoney(fromCoupon, plan2.currency)})` : ""} for ${couponPeriods !== void 0 ? per(couponPeriods) : `an unknown duration (${String(coupon.duration ?? "not given")})`}`;
+      const declaredSays = `${formatMoney(plan2.introAmount, plan2.currency)} for ${per(declaredPeriods)}`;
       caveats.push({
         checks: ["signup.disclosure.price"],
         status: "needs_review",
-        reason: `discounts apply ${id} (${pct !== void 0 ? `${pct}% off` : `${off} off in minor units`}), which makes the first charge ${fromCoupon} in minor units, but the plan's declared intro price is ${plan2.introAmount}: the coupon or the declared intro is wrong \u2014 make them the same, then state that promo`,
+        reason: `discounts apply ${id}, which gives ${couponSays}, but the plan's declared intro is ${declaredSays}: the coupon or the declared intro is wrong \u2014 make them the same, then state that promo`,
         param: "params.discounts"
       });
     }
@@ -26460,7 +26513,7 @@ function parseObjectLiteral(source, env2 = {}) {
   const p = new Parser(source, env2);
   if (p.peek() !== "{") return { value: null, unresolved: ["<not an object literal>"] };
   const v = p.object("");
-  return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)] };
+  return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {} };
 }
 var UNKNOWN, Parser;
 var init_literal = __esm({
@@ -26474,6 +26527,7 @@ var init_literal = __esm({
       }
       i = 0;
       unresolved = [];
+      fromEnv = {};
       ws() {
         for (; ; ) {
           while (this.i < this.s.length && /\s/.test(this.s[this.i])) this.i++;
@@ -26560,7 +26614,10 @@ var init_literal = __esm({
           if (name === "null") return null;
           if (name === "undefined") return void 0;
           const env2 = /^(?:process\.env|import\.meta\.env)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(name);
-          if (env2) return this.env[env2[1]] ?? UNKNOWN;
+          if (env2) {
+            if (this.env[env2[1]] !== void 0 && path) this.fromEnv[path] = name;
+            return this.env[env2[1]] ?? UNKNOWN;
+          }
           return UNKNOWN;
         }
         this.skipExpr();
@@ -27001,8 +27058,8 @@ var init_detect = __esm({
 });
 
 // src/ci/scaffold.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { basename, join as join5, relative as relative2 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
+import { basename, dirname as dirname3, join as join5, relative as relative2 } from "node:path";
 function walk3(root, visit) {
   let n = 0;
   const go = (dir, depth) => {
@@ -27035,20 +27092,70 @@ function emailKindOf(file) {
   const name = basename(file).replace(/\.[^.]+$/, "");
   return EMAIL_NAMES.find(([re]) => re.test(name))?.[1];
 }
-function scaffoldConfig(root, env2 = {}) {
+function plansFromLiterals(text, file) {
+  const out = [];
+  for (const m of text.matchAll(/(?:(?:['"]?)([A-Za-z_$][\w$ -]*)['"]?\s*:\s*)?\{([^{}]{0,600})\}/g)) {
+    const body = m[2];
+    const interval = /\binterval\s*:\s*['"](day|week|month|year)['"]/.exec(body)?.[1];
+    if (!interval) continue;
+    const price3 = /\bprice\s*:\s*(\d+(?:\.\d{1,2})?)\b/.exec(body)?.[1];
+    const minor = /\b(?:amount|unit_amount|price_cents|cents)\s*:\s*(\d+)\b/.exec(body)?.[1];
+    const major = price3 !== void 0 ? Number(price3) : minor !== void 0 ? Number(minor) / 100 : void 0;
+    if (major === void 0 || !(major > 0)) continue;
+    const name = /\b(?:name|title|label)\s*:\s*['"]([^'"]{1,80})['"]/.exec(body)?.[1] ?? m[1]?.trim();
+    if (!name) continue;
+    const currency = /\bcurrency\s*:\s*['"]([a-z]{3})['"]/i.exec(body)?.[1]?.toLowerCase() ?? "usd";
+    const count = /\binterval_?count\s*:\s*(\d+)/i.exec(body)?.[1];
+    const trial = /\btrial(?:_period)?_?days\s*:\s*(\d+)/i.exec(body)?.[1];
+    if (out.some((p) => p.name === name)) continue;
+    const key = m[1]?.trim() && /^[A-Za-z_$][\w$]*$/.test(m[1].trim()) ? m[1].trim() : void 0;
+    out.push({ name, ...key ? { key } : {}, price: major, currency, interval, ...count && Number(count) > 1 ? { interval_count: Number(count) } : {}, ...trial && Number(trial) > 0 ? { trial_days: Number(trial) } : {}, source: file });
+  }
+  return out;
+}
+function paramsBuilder(root, file, line2) {
+  let text;
+  try {
+    text = readFileSync6(join5(root, file), "utf8");
+  } catch {
+    return void 0;
+  }
+  const from = text.split("\n").slice(line2 - 1).join("\n");
+  const call = /checkout\.sessions\.create\s*\(\s*(?:await\s+)?([A-Za-z_$][\w$]*)\s*\(([^)]*)\)/.exec(from);
+  if (!call) return void 0;
+  const fn = call[1];
+  const takesArgs = call[2].trim().length > 0;
+  const imp = new RegExp(`import\\s*\\{[^}]*\\b${fn}\\b[^}]*\\}\\s*from\\s*['"](\\.{1,2}/[^'"]+)['"]`).exec(text);
+  let target;
+  if (imp) {
+    const base = join5(dirname3(file), imp[1]).split("\\").join("/");
+    target = [base, ...[".ts", ".tsx", ".js", ".mjs", "/index.ts", "/index.js"].map((e) => `${base.replace(/\.(?:[cm]?js)$/, "")}${e}`)].find((f) => /\.[cm]?[jt]sx?$/.test(f) && existsSync5(join5(root, f)));
+  } else if (new RegExp(`export\\s+(?:async\\s+)?function\\s+${fn}\\b|export\\s+const\\s+${fn}\\b`).test(text)) target = file;
+  return target ? { module: `${target}#${fn}`, takesArgs } : void 0;
+}
+function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
   const found = [];
   const names = /* @__PURE__ */ new Set();
   const merchant = {};
-  merchant.name = det.brand?.name ?? "TODO: the brand subscribers see";
-  if (!det.brand) todos.push("merchant.name: the brand subscribers see");
+  const fact = (k) => typeof facts[k] === "string" && facts[k].trim() ? facts[k].trim() : void 0;
+  const brand = fact("merchant_name") ?? det.brand?.name;
+  merchant.name = brand ?? "TODO: the brand subscribers see";
+  if (!brand) todos.push("merchant.name: the brand subscribers see");
+  if (fact("merchant_name")) found.push(`merchant name "${fact("merchant_name")}" (from checkbox init)`);
   const cancelPath = det.policyPaths.cancellation;
-  if (det.siteUrl && cancelPath) merchant.cancel_url = `${originOf(det.siteUrl)}${cancelPath}`;
+  const siteUrl = fact("site_url") ?? det.siteUrl;
+  const cancelFact = fact("cancellation_url") ?? fact("account_url");
+  if (cancelFact) {
+    merchant.cancel_url = cancelFact;
+    found.push(`cancel URL ${cancelFact} (from checkbox init)`);
+  } else if (siteUrl && cancelPath) merchant.cancel_url = `${originOf(siteUrl)}${cancelPath}`;
   else {
     merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
     todos.push("merchant.cancel_url: the page where subscribers cancel online");
   }
+  if (fact("support_email")) merchant.support_contact = fact("support_email");
   const plans = det.plans.map((p, i) => ({
     name: p.name ?? `Plan ${i + 1}`,
     amount: p.amount,
@@ -27058,6 +27165,32 @@ function scaffoldConfig(root, env2 = {}) {
     ...p.trial_days ? { trial_days: p.trial_days } : {}
   }));
   for (const p of det.plans) found.push(`plan ${p.name ?? ""} ${p.amount / 100} ${p.currency}/${p.interval} (${p.source})`.replace(/\s+/g, " "));
+  const planKeys = /* @__PURE__ */ new Map();
+  if (!plans.length && Array.isArray(facts.plans)) {
+    for (const [i, p] of facts.plans.entries()) {
+      if (typeof p.amount !== "number" || typeof p.interval !== "string") continue;
+      plans.push({ name: typeof p.name === "string" ? p.name : `Plan ${i + 1}`, amount: p.amount, currency: typeof p.currency === "string" ? p.currency : "usd", interval: p.interval, ...typeof p.interval_count === "number" ? { interval_count: p.interval_count } : {}, ...typeof p.trial_days === "number" ? { trial_days: p.trial_days } : {} });
+      found.push(`plan ${String(plans[plans.length - 1].name)} (from checkbox init --plan)`);
+    }
+  }
+  if (!plans.length) {
+    walk3(root, (rel2) => {
+      if (!PLAN_FILE.test(rel2) || plans.length >= 8) return;
+      let text = "";
+      try {
+        text = readFileSync6(join5(root, rel2), "utf8");
+      } catch {
+        return;
+      }
+      for (const p of plansFromLiterals(text, rel2)) {
+        if (plans.some((x) => x.name === p.name)) continue;
+        const { source, key, ...plan2 } = p;
+        plans.push(plan2);
+        if (key) planKeys.set(p.name, key);
+        found.push(`plan ${p.name} ${p.price} ${p.currency}/${p.interval} (${source})`);
+      }
+    });
+  }
   if (!plans.length) {
     plans.push({ name: "TODO: plan name", price: "TODO: e.g. 19.99", currency: "usd", interval: "month" });
     todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
@@ -27071,6 +27204,22 @@ function scaffoldConfig(root, env2 = {}) {
     const call = (perFile.get(s2.file) ?? 0) + 1;
     perFile.set(s2.file, call);
     const entry = { name: unique(names, `Stripe Checkout (${basename(s2.file)}${call > 1 ? ` #${call}` : ""})`), source: s2.file, ...call > 1 ? { call } : {} };
+    const builder = !s2.params ? paramsBuilder(root, s2.file, s2.line) : void 0;
+    if (builder) {
+      found.push(`${s2.file}:${s2.line}: Checkout Session built by ${builder.module}`);
+      const keyed = plans.length > 1 && plans.every((p) => planKeys.has(String(p.name)));
+      if (builder.takesArgs && plans.length > 1) {
+        for (const p of plans) {
+          const n = String(p.name);
+          stripe.push({ name: unique(names, `Checkout (${n})`), module: builder.module, args: [keyed ? planKeys.get(n) : `TODO: the argument for plan ${n}`], plan: n, strict: true });
+        }
+        if (!keyed) todos.push(`${builder.module}: the argument that builds each plan's params ("args")`);
+      } else {
+        stripe.push({ name: entry.name, module: builder.module, ...builder.takesArgs ? { args: [plans.length === 1 && planKeys.size ? [...planKeys.values()][0] : "TODO: the function argument"] } : {}, ...plans.length === 1 ? { plan: String(plans[0].name) } : {}, strict: true });
+        if (builder.takesArgs && !(plans.length === 1 && planKeys.size)) todos.push(`${builder.module}: the argument that builds the params ("args")`);
+      }
+      continue;
+    }
     if (!s2.params) {
       todos.push(`${s2.file}:${s2.line}: the params are not an object literal; use "module" (an exported function returning the params) instead of "source"`);
       delete entry.source;
@@ -27134,7 +27283,7 @@ function scaffoldConfig(root, env2 = {}) {
     found
   };
 }
-var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique;
+var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
 var init_scaffold = __esm({
   "src/ci/scaffold.ts"() {
     "use strict";
@@ -27160,6 +27309,7 @@ var init_scaffold = __esm({
       names.add(n);
       return n;
     };
+    PLAN_FILE = /(?:^|\/)(?:plans?|pricing|prices|tiers|subscriptions?|billing|products?)(?:\.config)?\.(?:[cm]?[jt]sx?|json)$/i;
   }
 });
 
@@ -27287,8 +27437,8 @@ var init_coverage = __esm({
 
 // src/ci/inputs.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 function readRel(dir, file) {
   const abs = isAbsolute2(file) ? file : resolve4(dir, file);
@@ -27301,8 +27451,8 @@ function readRel(dir, file) {
 }
 function hasTsx(dir) {
   for (let d = dir, i = 0; i < 8; i++) {
-    if (existsSync5(join7(d, "node_modules", "tsx", "package.json"))) return true;
-    const up = dirname3(d);
+    if (existsSync6(join7(d, "node_modules", "tsx", "package.json"))) return true;
+    const up = dirname4(d);
     if (up === d) break;
     d = up;
   }
@@ -27322,7 +27472,7 @@ function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
   const file = hash > 0 ? ref.slice(0, hash) : ref;
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
   const abs = resolve4(dir, file);
-  if (!existsSync5(abs)) return Promise.reject(new InputError(`${file} does not exist (paths are relative to checkbox.json)`));
+  if (!existsSync6(abs)) return Promise.reject(new InputError(`${file} does not exist (paths are relative to checkbox.json)`));
   const flags = loaderFlags(file, dir);
   if (typeof flags === "string") return Promise.reject(new InputError(flags));
   return new Promise((resolvePromise, reject) => {
@@ -27341,12 +27491,39 @@ function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
           return;
         }
         const own = /__CHECKBOX_ERR__ (.+)/.exec(stderr)?.[1];
-        const tail = stderr.trim().split("\n").filter((l) => !/^\s+at /.test(l)).slice(-4).join(" / ");
-        reject(new InputError(`${ref}: ${own ?? (err && err.killed ? `did not finish within ${timeoutMs / 1e3}s` : tail || err?.message || "no output")}`));
+        reject(new InputError(`${ref}: ${own ?? (err && err.killed ? `did not finish within ${timeoutMs / 1e3}s` : moduleErrorMessage(stderr, dir, flags) || err?.message || "no output")}`));
       }
     );
   });
 }
+function moduleErrorMessage(stderr, dir, flags = []) {
+  const text = stderr.trim();
+  if (!text) return "";
+  const rel2 = (p) => {
+    const r = relative4(dir, p.replace(/^file:\/\//, ""));
+    return r && !r.startsWith("..") ? r.split("\\").join("/") : p;
+  };
+  const tsx = flags.includes("tsx");
+  const missing = /Cannot find (module|package) '([^']+)' imported from (\S+)/.exec(text);
+  if (missing) {
+    const [, what, target, from] = missing;
+    if (what === "package" || !/^[./]|^[A-Za-z]:[\\/]/.test(target) && !target.startsWith(dir)) {
+      return `${rel2(from)} imports the package "${target}", which is not installed here. Install the project's dependencies before checkbox ci (e.g. npm ci in the workflow).`;
+    }
+    const noExt = !/\.[cm]?[jt]sx?$|\.json$/.test(target);
+    if (noExt && !tsx) {
+      return `${rel2(from)} imports ${rel2(target)} without a file extension, which Node cannot resolve on its own. Add tsx to the project (npm install -D tsx; checkbox ci then imports modules the way your bundler does), or write the import with its extension (e.g. './${rel2(target).split("/").pop()}.ts').`;
+    }
+    return `${rel2(from)} imports ${rel2(target)}, which does not exist${noExt ? " (tsx found no .ts / .js file of that name either)" : ""}.`;
+  }
+  if (/ERR_UNKNOWN_FILE_EXTENSION/.test(text)) {
+    const file = /Unknown file extension "([^"]+)" for (\S+)/.exec(text);
+    return `Node cannot import ${file ? `${rel2(file[2])} (${file[1]})` : "a file the module imports"}. Add tsx to the project (npm install -D tsx), or point the entry at a .js / .ts file that imports no ${file?.[1] ?? "such"} files.`;
+  }
+  const lines = text.split("\n").map((l) => l.trim()).filter((l) => l && !/^at /.test(l) && !/^Node\.js v\d/.test(l));
+  const first2 = lines.find((l) => /^(?:[A-Z]\w*)?Error\b.*:/.test(l)) ?? lines.find((l) => /error/i.test(l)) ?? lines[lines.length - 1] ?? "";
+  return first2.replace(/file:\/\/\S+/g, (u) => rel2(u)).replace(/\s+/g, " ").slice(0, 400);
+}
 function paramsFromSource(text, file, call = 1, env2 = {}) {
   const calls = [...text.matchAll(/checkout\.sessions\.create\s*\(/g)];
   if (!calls.length) throw new InputError(`${file} has no stripe.checkout.sessions.create( call`);
@@ -27357,7 +27534,32 @@ function paramsFromSource(text, file, call = 1, env2 = {}) {
   if (!lit) throw new InputError(`${file}:${line2}: the params are not an object literal; use "module" (a function returning the params) or "file" instead`);
   const parsed = parseObjectLiteral(lit, env2);
   if (!parsed.value) throw new InputError(`${file}:${line2}: could not read the params object`);
-  return { params: parsed.value, line: line2, unresolved: parsed.unresolved };
+  return { params: parsed.value, line: line2, unresolved: parsed.unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
+}
+function lineOfAny(text, needles) {
+  const lower2 = text.toLowerCase();
+  for (const n of needles) {
+    const k = n.trim().toLowerCase();
+    if (k.length < 2) continue;
+    const i = lower2.indexOf(k);
+    if (i >= 0) return text.slice(0, i).split("\n").length;
+  }
+  return void 0;
+}
+function exportLine(dir, ref) {
+  const hash = ref.lastIndexOf("#");
+  const file = hash > 0 ? ref.slice(0, hash) : ref;
+  const name = hash > 0 ? ref.slice(hash + 1) : "default";
+  let text;
+  try {
+    text = readFileSync8(resolve4(dir, file), "utf8");
+  } catch {
+    return 1;
+  }
+  const esc3 = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = name === "default" ? /^\s*export\s+default\b/m : new RegExp(`^\\s*export\\s+(?:async\\s+)?(?:function\\*?|const|let|var|class)\\s+${esc3}\\b|^\\s*export\\s*\\{[^}]*\\b${esc3}\\b`, "m");
+  const m = re.exec(text);
+  return m ? text.slice(0, m.index).split("\n").length + (m[0].startsWith("\n") ? 1 : 0) : 1;
 }
 function projectEnv(dir) {
   const out = {};
@@ -27423,15 +27625,22 @@ async function stripeJob(loaded, e, o, root) {
       }
     } else if (e.module) {
       const file = e.module.replace(/#.*$/, "");
-      job.target = { file: rel(loaded, root, file), line: 1 };
+      job.target = { file: rel(loaded, root, file), line: exportLine(dir, e.module) };
       job.inputs.push(file);
       params = await runModule(dir, e.module, e.args ?? [], o.env);
+      const unset = (Array.isArray(params?.line_items) ? params.line_items : []).flatMap((li, i) => li && typeof li === "object" && !Array.isArray(li) && li.price === void 0 && li.price_data === void 0 ? [`line_items[${i}].price`] : []);
+      if (unset.length) {
+        job.placeholders = Object.fromEntries(unset.map((p) => [p, "{{your Stripe Price id: unset when checkbox ci ran the module}}"]));
+        job.warnings.push(`${unset.join(", ")} ${unset.length === 1 ? "was" : "were"} not set when Checkbox ran ${e.module} (an environment variable this job does not set?). The checks use "plan" in checkbox.json for the price, and corrected params keep a placeholder there for your own value.`);
+      }
     } else {
       const src = e.source;
       job.inputs.push(src);
       const r = paramsFromSource(readRel(dir, src), src, e.call ?? 1, projectEnv(dir));
       job.target = { file: rel(loaded, root, src), line: r.line };
+      job.fromSource = true;
       params = r.params;
+      if (r.fromEnv) job.placeholders = Object.fromEntries(Object.entries(r.fromEnv).map(([p, expr]) => [p, `{{${expr}}}`]));
       if (r.unresolved.length) {
         job.partial = true;
         job.unresolved = r.unresolved;
@@ -27507,6 +27716,14 @@ function pageJob(loaded, e, o, root) {
   if (e.source) {
     job.target = { file: rel(loaded, root, e.source), line: 1 };
     job.inputs.push(e.source);
+    const src = e.source;
+    job.locate = (needles) => {
+      try {
+        return lineOfAny(readRel(dir, src), needles);
+      } catch {
+        return void 0;
+      }
+    };
   }
   if (e.url) {
     if (!o.online) job.skip = "URL pages are fetched by the API: run with --online (and CHECKBOX_SECRET_KEY)";
@@ -27516,7 +27733,9 @@ function pageJob(loaded, e, o, root) {
   try {
     if (!e.source) job.target = { file: rel(loaded, root, e.file), line: 1 };
     job.inputs.push(e.file);
-    job.body = { html: readRel(dir, e.file), ...common3 };
+    const html = readRel(dir, e.file);
+    if (!e.source) job.locate = (needles) => lineOfAny(html, needles);
+    job.body = { html, ...common3 };
   } catch (err) {
     job.error = err.message;
   }
@@ -27533,7 +27752,7 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
       msg2 = emailFromFile(readRel(dir, e.file), e.file, e.subject);
     } else if (e.module) {
       const file = e.module.replace(/#.*$/, "");
-      job.target = { file: rel(loaded, root, file), line: 1 };
+      job.target = { file: rel(loaded, root, file), line: exportLine(dir, e.module) };
       job.inputs.push(file);
       const v = await runModule(dir, e.module, e.args ?? [], o.env);
       if (typeof v === "string") msg2 = emailFromFile(v, /^\s*</.test(v) ? "x.html" : "x.txt", e.subject);
@@ -27641,7 +27860,9 @@ function renderHuman(run2, c, opts = {}) {
     if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
     if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
     if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
-    for (const w of x.warnings.slice(0, opts.verbose ? 10 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    const alerts = x.alerts ?? [];
+    for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
+    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
     if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
   }
   const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
@@ -27653,11 +27874,12 @@ function renderHuman(run2, c, opts = {}) {
 function annotations(run2) {
   const out = [];
   for (const x of run2.checks) {
-    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : void 0;
+    const alerts = x.alerts ?? [];
+    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
     if (!level) continue;
     const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
     const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
-${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
     out.push(`::${level} ${props.join(",")}::${escData(body)}`);
   }
   return out;
@@ -27669,7 +27891,8 @@ function stepSummary(run2) {
   lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
   lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
   for (const x of run2.checks) {
-    const fix = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : "";
+    const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
+    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
     lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
   }
   const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
@@ -27874,6 +28097,10 @@ function pickDaysBefore(kind, range) {
   if (open2) return lo + OPEN_WINDOW_MARGIN_DAYS;
   return lo + Math.floor((range.maxDays - lo) / 2);
 }
+function sendLeadDays(range, days) {
+  if (range.maxDays >= OPEN_ENDED_DAYS2 || !Number.isInteger(days) || days <= 0) return days;
+  return days <= range.maxDays ? days + BOUNDED_SEND_MARGIN_DAYS : days;
+}
 function stabWindows(windows) {
   const sorted = [...windows].sort((a, b) => a.window.maxDays - b.window.maxDays || a.window.minDays - b.window.minDays);
   const groups = [];
@@ -27891,11 +28118,15 @@ function stabWindows(windows) {
 function slotOf(kind, anchorAt, range, members, daysBefore) {
   const days = daysBefore ?? pickDaysBefore(kind, range);
   const maxDays = Math.min(range.maxDays, OPEN_ENDED_DAYS2);
+  const lead = sendLeadDays(range, days);
+  const sendAt = new Date(anchorAt.getTime() - lead * DAY_MS5);
+  const opensAt = new Date(anchorAt.getTime() - maxDays * DAY_MS5);
   return {
     slot: `d${days}`,
     daysBefore: days,
-    sendAt: new Date(anchorAt.getTime() - days * DAY_MS5),
-    opensAt: new Date(anchorAt.getTime() - maxDays * DAY_MS5),
+    sendAt,
+    // The send time is inside [opensAt, closesAt] (a bounded window's send sits inside its maximum's rounding).
+    opensAt: sendAt.getTime() < opensAt.getTime() ? sendAt : opensAt,
     closesAt: new Date(anchorAt.getTime() - range.minDays * DAY_MS5),
     range: { minDays: range.minDays, maxDays },
     jurisdictions: [...new Set(members.map((m) => m.jurisdiction))].sort(),
@@ -27976,7 +28207,7 @@ function renewalReminderApplies(termMonths2, jurisdictions, asOf, requirements)
     (r) => r.appliesWhen?.minTermMonths !== void 0 && r.appliesWhen.minTermMonths <= termMonths2
   );
 }
-var DAY_MS5, HOUR_MS2, OPEN_ENDED_DAYS2, OPEN_WINDOW_MARGIN_DAYS, TRIAL_MIN_MARGIN_DAYS, TRIAL_SIGNUP_GAP_DAYS, PRICE_CHANGE_MAX_LEAD_DAYS, ANNUAL_TERMS_DEFAULT_WINDOW, NOTICE_CHECKS2, isImmediateKind, KIND_ANCHORS, FALLBACK_WINDOWS, BUSINESS_DAY_MINIMUMS;
+var DAY_MS5, HOUR_MS2, OPEN_ENDED_DAYS2, OPEN_WINDOW_MARGIN_DAYS, TRIAL_MIN_MARGIN_DAYS, TRIAL_SIGNUP_GAP_DAYS, BOUNDED_SEND_MARGIN_DAYS, PRICE_CHANGE_MAX_LEAD_DAYS, ANNUAL_TERMS_DEFAULT_WINDOW, NOTICE_CHECKS2, isImmediateKind, KIND_ANCHORS, FALLBACK_WINDOWS, BUSINESS_DAY_MINIMUMS;
 var init_timing = __esm({
   "../../apps/api/src/notices/timing.ts"() {
     "use strict";
@@ -27987,6 +28218,7 @@ var init_timing = __esm({
     OPEN_WINDOW_MARGIN_DAYS = 2;
     TRIAL_MIN_MARGIN_DAYS = 0.5;
     TRIAL_SIGNUP_GAP_DAYS = 1 / 24;
+    BOUNDED_SEND_MARGIN_DAYS = 0.25;
     PRICE_CHANGE_MAX_LEAD_DAYS = 60;
     ANNUAL_TERMS_DEFAULT_WINDOW = { minDays: 15, maxDays: 45 };
     NOTICE_CHECKS2 = {
@@ -28039,7 +28271,7 @@ function singleDayNote(requirementIds, days) {
   const lower2 = [...new Set(windows.filter((w) => w.minDays === days).map((w) => jur(w.id)))];
   const upper = [...new Set(windows.filter((w) => w.maxDays === days).map((w) => jur(w.id)))];
   const why = lower2.length && upper.length ? `at least ${days} days (${lower2.slice(0, 4).join(", ")}) and at most ${days} days (${upper.slice(0, 4).join(", ")}) leave a single day` : `the states' windows meet on a single day`;
-  return `Exactly ${days} days before: ${why}. Send at send_at (the anchor's time of day, ${days} days earlier). Checkbox counts whole days, so a send within a few hours of send_at still counts as ${days} days; half a day or more never does.`;
+  return `Exactly ${days} days before: ${why}. Send at send_at, ${days} days and 6 hours before the anchor. The one rule: a minimum counts only full days, less a 2-hour allowance for delivery; a maximum is rounded to the nearest day. So a send counts as ${days} days when it goes out less than ${days + 0.5} days and at least ${days} days less 2 hours before the anchor; anything earlier or later does not.`;
 }
 function addInterval(d, interval, n) {
   if (interval === "day") return new Date(d.getTime() + n * DAY_MS5);
@@ -28202,6 +28434,15 @@ function operationFor2(kind) {
 function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
+function ciVocabulary(text) {
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored");
+}
+function stripeConsentFix(text, params) {
+  if (!/^Add one unchecked checkbox/.test(text)) return text;
+  const cc = params?.consent_collection;
+  if (cc?.terms_of_service === "required") return text;
+  return 'Set consent_collection: { terms_of_service: "required" } in the params: Stripe then shows an unchecked consent checkbox, labelled with custom_text.terms_of_service_acceptance.message.';
+}
 function ciStatusOf(r) {
   const cs = r.compliance_status;
   if (r.verdict === "not_applicable") return "not_applicable";
@@ -28210,9 +28451,9 @@ function ciStatusOf(r) {
   if (cs && OK_STATUSES.has(cs)) return "pass";
   return "needs_review";
 }
-function fixesOf(r) {
+function fixesOf(r, onlyNeedsFix = false) {
   const out = [];
-  const failing = (r.checks ?? []).filter((c) => (c.status === "fail" || c.status === "needs_review") && !(c.compliance_status && OK_STATUSES.has(c.compliance_status)));
+  const failing = (r.checks ?? []).filter((c) => (c.status === "fail" || c.status === "needs_review") && !(c.compliance_status && OK_STATUSES.has(c.compliance_status)) && (!onlyNeedsFix || c.compliance_status === "needs_fix"));
   failing.sort((a, b) => (a.compliance_status === "needs_fix" ? 0 : 1) - (b.compliance_status === "needs_fix" ? 0 : 1) || (RANK2[a.status] ?? 2) - (RANK2[b.status] ?? 2));
   for (const c of failing) {
     const base = c.compliance?.fix || c.fix || c.compliance?.question?.text || c.explanation || c.title || c.check_id;
@@ -28225,14 +28466,25 @@ function fixesOf(r) {
 function failingCards(explanation) {
   if (!explanation) return [];
   if (/\(\d+ checkout page views? checked\) — e\.g\./.test(explanation)) return [];
-  return [...new Set([...explanation.matchAll(/plan button “([^”]{1,80})”/g)].map((m) => m[1]))];
+  return [...new Set([...explanation.matchAll(/plan button “([^”]{1,80})”(?: in the card “([^”]{1,80})”)?/g)].map((m) => m[2] ?? m[1]))];
 }
-function correctedOf(type, r, partial = false) {
+function withPlaceholders(params, placeholders) {
+  if (!placeholders || !params || typeof params !== "object") return params;
+  const copy = JSON.parse(JSON.stringify(params));
+  for (const [path, value] of Object.entries(placeholders)) {
+    const keys = path.split(/\.|\[(\d+)\]/).filter((k) => k !== void 0 && k !== "");
+    let node = copy;
+    for (const k of keys.slice(0, -1)) node = node && typeof node === "object" ? node[k] : void 0;
+    if (node && typeof node === "object") node[keys[keys.length - 1]] = value;
+  }
+  return copy;
+}
+function correctedOf(type, r, partial = false, placeholders) {
   if (type === "stripe_checkout" && r.correction?.patch?.length && partial) {
     return { format: "json", title: `Changes to make to the params (JSON Patch; keep your other values)${r.correction.verification?.passes ? ", verified by the rules engine" : ""}`, body: JSON.stringify(r.correction.patch, null, 2) };
   }
   if (type === "stripe_checkout" && r.correction?.patch?.length) {
-    return { format: "json", title: `Corrected params${r.correction.verification?.passes ? " (verified by the rules engine)" : ""}`, body: JSON.stringify(r.correction.corrected_params, null, 2) };
+    return { format: "json", title: `Corrected params${r.correction.verification?.passes ? " (verified by the rules engine)" : ""}${placeholders ? "; keep your own values where it says {{\u2026}}" : ""}`, body: JSON.stringify(withPlaceholders(r.correction.corrected_params, placeholders), null, 2) };
   }
   const perPlan = (r.plan_replacements ?? []).filter((p) => p.disclosure_text);
   if (type === "page" && perPlan.length >= 2 && ciStatusOf(r) !== "pass") {
@@ -28264,11 +28516,38 @@ ${r.template.text}` };
   }
   return void 0;
 }
-function noticeCoverage(config, planName, schedule) {
+function declaredByCheckbox(config) {
+  const sb = config.notices?.sent_by_checkbox;
+  return sb === true ? Object.values(NOTICE_TO_EMAIL) : Array.isArray(sb) ? sb : [];
+}
+function sentByNotices(seen) {
+  if ("error" in seen || seen.mode !== "checkbox" || seen.real_sends === "off") return /* @__PURE__ */ new Set();
+  return new Set(seen.enabled);
+}
+function noticesCrossCheck(config, seen, target) {
+  const declared = declaredByCheckbox(config);
+  if (!declared.length) return void 0;
+  const base = { name: "Checkbox Notices (site settings)", type: "notice_schedule", target, warnings: [] };
+  if ("error" in seen) {
+    return { ...base, status: "needs_review", label: "Not checked: could not read the site's Notice settings", message: seen.error, fixes: [] };
+  }
+  const real = sentByNotices(seen);
+  const all = config.notices?.sent_by_checkbox === true;
+  const missing = all ? real.size ? [] : declared : declared.filter((k) => !real.has(k));
+  if (!missing.length) {
+    const note = seen.real_sends === "needs_confirmation" ? " (a person still has to confirm sending to real subscribers once in the dashboard: Emails tab)" : seen.real_sends === "test_mode" ? " (test mode: they go to test-run inboxes only)" : "";
+    return { ...base, status: "pass", label: `Checks pass \xB7 Checkbox Notices is on for ${seen.site}${all ? ` (${real.size} kind${real.size === 1 ? "" : "s"} turned on)` : ` and sends the ${declared.length} email${declared.length === 1 ? "" : "s"} checkbox.json declares`}${note}`, fixes: [] };
+  }
+  const why = seen.mode !== "checkbox" ? `${seen.site} is in "You send" mode (Checkbox Notices sends nothing)` : seen.real_sends === "off" || !real.size ? `Checkbox Notices is off for ${seen.site}` : `${seen.site} does not have ${missing.map((k) => `"${k}"`).join(", ")} turned on in Checkbox Notices`;
+  const fix = `checkbox.json says Checkbox Notices sends ${all ? "the required emails" : missing.map((k) => `"${k}"`).join(", ")}, but ${why}. Turn ${missing.length === 1 ? "it" : "them"} on in the dashboard (Emails tab) or with updateNoticeSettings, or remove ${missing.length === 1 ? "it" : "them"} from "notices.sent_by_checkbox" and add the templates to checks.emails.`;
+  return { ...base, status: "fail", label: all ? "Checkbox Notices sends nothing for this site" : `${missing.length} declared email${missing.length === 1 ? " is" : "s are"} not sent by Checkbox Notices`, fix, fixes: [fix] };
+}
+function noticeCoverage(config, planName, schedule, opts = {}) {
   const plan2 = (config.plans ?? []).find((p) => p.name === planName);
   const have = new Set((config.checks.emails ?? []).filter((e) => !e.plan || e.plan === planName || planList(config, e.plan)?.includes(planName)).map((e) => e.kind));
-  const sb = config.notices?.sent_by_checkbox;
-  const byCheckbox = new Set(sb === true ? Object.values(NOTICE_TO_EMAIL) : Array.isArray(sb) ? sb : []);
+  const declared = declaredByCheckbox(config);
+  const real = opts.notices && !("error" in opts.notices) ? sentByNotices(opts.notices) : void 0;
+  const byCheckbox = new Set(real ? declared.filter((k) => real.has(k)) : declared);
   for (const k of byCheckbox) have.add(k);
   const yearly = plan2 ? (plan2.interval === "year" ? 12 * (plan2.interval_count ?? 1) : plan2.interval === "month" ? plan2.interval_count ?? 1 : 0) >= 12 : false;
   if (yearly && have.has("renewal_reminder")) have.add("annual_terms");
@@ -28280,8 +28559,8 @@ function noticeCoverage(config, planName, schedule) {
   const missing = [...required].filter(([k]) => !have.has(k));
   if (!required.size) return { status: "not_applicable", label: "No reminder emails required", fixes: [] };
   const sent2 = [...required.keys()].filter((k) => byCheckbox.has(k)).length;
-  if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered${sent2 ? ` (${sent2} sent by Checkbox Notices, as checkbox.json declares)` : ""}`, fixes: [] };
-  const fixes = missing.map(([k, w]) => `Add a ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it.`);
+  if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered${sent2 ? ` (${sent2} sent by Checkbox Notices, ${real ? "as the site's Notice settings confirm" : "as checkbox.json declares; --online confirms it against the site"})` : ""}`, fixes: [] };
+  const fixes = missing.map(([k, w]) => `Add ${/^[aeiou]/i.test(EMAIL_LABEL[k]) ? "an" : "a"} ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it${declared.includes(k) ? " (checkbox.json says it does, but the site's Notice settings do not send it)" : ""}.`);
   return { status: "needs_review", label: `${missing.length} required email${missing.length === 1 ? "" : "s"} not in checkbox.json`, fix: fixes[0], fixes };
 }
 function unverifiedOffer(r) {
@@ -28295,8 +28574,8 @@ function unverifiedOffer(r) {
   if (coupon && open2.length) return coupon.message;
   return void 0;
 }
-async function runJob(job, engine, config) {
-  const base = { name: job.name, type: job.type, ...job.plan ? { plan: job.plan } : {}, target: job.target, warnings: [...job.warnings] };
+async function runJob(job, engine, config, opts = {}) {
+  const base = { name: job.name, type: job.type, ...job.plan ? { plan: job.plan } : {}, target: { ...job.target }, ...job.fromSource ? { fromSource: true } : {}, warnings: [...job.warnings] };
   if (job.error) return { ...base, status: "error", label: "Could not run", message: job.error, fixes: [] };
   if (job.skip || !job.body) return { ...base, status: "skipped", label: "Skipped", message: job.skip ?? "nothing to check", fixes: [] };
   let report;
@@ -28305,37 +28584,68 @@ async function runJob(job, engine, config) {
   } catch (err) {
     const e = err;
     const failure = isAuthError(err) ? "auth" : err instanceof CheckboxError && (!e.statusCode || e.statusCode >= 500 || e.statusCode === 429) ? "api" : void 0;
-    return { ...base, status: "error", label: "Could not run", message: `${e.message}${e.param ? ` (${e.param})` : ""}`, fixes: [], ...failure ? { failure } : {} };
+    return { ...base, status: "error", label: "Could not run", message: `${ciVocabulary(e.message)}${e.param && !failure && /^merchant\./.test(e.param) ? "" : e.param ? ` (${e.param})` : ""}`, fixes: [], ...failure ? { failure } : {} };
   }
-  if (job.type === "notice_schedule") return { ...base, ...noticeCoverage(config, job.plan, report), report };
-  for (const w of report.warnings ?? []) base.warnings.push(w.message);
+  if (job.type === "notice_schedule") return { ...base, ...noticeCoverage(config, job.plan, report, opts), report };
+  const alerts = job.warnings.filter((w) => /^The params and checkbox\.json disagree/.test(w));
+  for (const w of report.warnings ?? []) {
+    const text = ciVocabulary(w.message);
+    base.warnings.push(text);
+    if (ALERT_CODES.has(w.code)) alerts.push(text);
+  }
+  if (alerts.length) Object.assign(base, { alerts });
   const status = ciStatusOf(report);
-  const fixes = status === "pass" || status === "not_applicable" ? [] : fixesOf(report);
+  const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
+  const fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
   const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b/.test(p));
   const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review" || status === "pass" && unreadText.some((p) => /^(?:custom_text|consent_collection|discounts|subscription_data\.trial)/.test(p)));
   if (unread) {
     fixes.splice(0, fixes.length, `${unreadText.slice(0, 3).join(", ")} ${unreadText.length === 1 ? "is an expression" : "are expressions"} Checkbox cannot read statically (e.g. a ternary or PLANS.monthly.*), so the checks that depend on ${unreadText.length === 1 ? "it were" : "them were"} not checked (no fix is given for a value Checkbox did not read). Use "module" (a function returning the exact params for each plan) or "file" instead of "source".`);
   }
+  const literal = [];
+  if (unread) {
+    const consentRead = !(job.unresolved ?? []).some((p) => /^(?:consent_collection|\.\.\.)/.test(p));
+    const consentFails = (report.checks ?? []).some((c) => c.check_id === "signup.consent.affirmative" && (c.status === "fail" || c.compliance_status === "needs_fix"));
+    if (consentRead && consentFails && params?.consent_collection?.terms_of_service !== "required") literal.push(stripeConsentFix("Add one unchecked checkbox", params));
+    fixes.unshift(...literal);
+  }
   const offer = !unread && status === "needs_review" && job.type === "stripe_checkout" ? unverifiedOffer(report) : void 0;
   if (offer) {
     fixes.unshift(
       `What the shopper is charged first is not verified (${offer.replace(/\.$/, "")}). Declare the discount on the plan in checkbox.json (intro_percent_off, intro_amount_off or intro_price, with intro_periods) and state it in custom_text.submit, or remove the discount. This fails the run (exit 2) until it is resolved.`
     );
   }
-  const finalStatus = unread ? "needs_review" : status;
-  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial);
+  if (job.locate && (status === "fail" || status === "needs_review")) {
+    const named = (report.checks ?? []).filter((c) => c.status === "fail" || c.status === "needs_review").flatMap((c) => failingCards(c.explanation));
+    const needles = named.flatMap((n) => [n.split(", ")[0], ...n.split(", ").slice(1)]);
+    const line2 = needles.length ? job.locate(needles) : void 0;
+    if (line2) base.target = { ...base.target, line: line2 };
+  }
+  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : status;
+  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
+  if (corrected?.format === "json" && job.placeholders) {
+    const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
+    if (unset.length) Object.assign(base, { alerts: [...unset, ...base.alerts ?? []] });
+  }
   const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || status === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
   return {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `Not checked: ${unreadText[0]} is an expression` : report.compliance?.label || DEFAULT_LABEL[status],
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
     report
   };
 }
+function countedLabel(label, r) {
+  const m = /^(\d+) fix(?:es)? needed/.exec(label);
+  if (!m) return label;
+  const n = fixesOf(r, true).length;
+  if (!n || n === Number(m[1])) return label;
+  return label.replace(m[0], `${n} fix${n === 1 ? "" : "es"} needed`);
+}
 function exitCodeOf(checks, strict) {
   if (checks.some((c) => c.failure === "auth")) return { status: "error", exit: EXIT.auth };
   if (checks.some((c) => c.failure === "api")) return { status: "error", exit: EXIT.error };
@@ -28347,7 +28657,7 @@ function exitCodeOf(checks, strict) {
 function mergeSourcePatches(checks) {
   const groups = /* @__PURE__ */ new Map();
   for (const c of checks) {
-    if (c.type !== "stripe_checkout" || c.corrected?.format !== "json" || !c.target.line) continue;
+    if (c.type !== "stripe_checkout" || c.corrected?.format !== "json" || !c.target.line || !c.fromSource) continue;
     const key = `${c.target.file}:${c.target.line}`;
     groups.set(key, [...groups.get(key) ?? [], c]);
   }
@@ -28365,7 +28675,9 @@ function mergeSourcePatches(checks) {
 }
 async function runCi(jobs, engine, opts) {
   const checks = [...opts.extra ?? []];
-  for (const j of jobs) checks.push(await runJob(j, engine, opts.config));
+  for (const j of jobs) checks.push(await runJob(j, engine, opts.config, { ...opts.notices ? { notices: opts.notices } : {} }));
+  const cross = opts.notices ? noticesCrossCheck(opts.config, opts.notices, opts.noticesTarget ?? { file: opts.configPath }) : void 0;
+  if (cross) checks.push(cross);
   mergeSourcePatches(checks);
   const summary = { pass: 0, fail: 0, needs_review: 0, not_applicable: 0, skipped: 0, error: 0 };
   for (const c of checks) summary[c.status]++;
@@ -28385,7 +28697,7 @@ async function runCi(jobs, engine, opts) {
     disclaimer: CI_DISCLAIMER
   };
 }
-var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL;
+var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -28422,6 +28734,75 @@ var init_runner = __esm({
       cancellation_confirmation: "cancellation confirmation"
     };
     DEFAULT_LABEL = { pass: "Checks pass", fail: "Fixes needed", needs_review: "Needs review", not_applicable: "Not required for this plan" };
+    ALERT_CODES = /* @__PURE__ */ new Set(["coupon_unverified", "coupon_read", "merchant_trial_ignored", "merchant_price_ignored", "price_not_in_site_plans", "price_from_setup_plan", "plan_terms_conflict", "trial_mismatch", "intro_mismatch"]);
+  }
+});
+
+// src/commands/plan/lib.ts
+import { dirname as dirname5, resolve as resolve5 } from "node:path";
+async function resolveSite(ctx, flag, client) {
+  const explicit = flag ?? ctx.env.CHECKBOX_SITE;
+  if (explicit) {
+    if (!SITE_RE.test(explicit) && !/^[0-9a-f-]{36}$/i.test(explicit)) throw new UsageError(`--site must be a site id (site_\u2026), got "${explicit}"`);
+    return explicit;
+  }
+  const projects = ctx.config.load().init?.projects ?? {};
+  for (let dir = resolve5(ctx.cwd); ; dir = dirname5(dir)) {
+    const site = projects[dir]?.site;
+    if (site) return site;
+    if (dirname5(dir) === dir) break;
+  }
+  const list2 = await client.sdk.sites.list({ limit: 3 });
+  const sites = list2?.data ?? [];
+  if (sites.length === 1) return sites[0].id;
+  throw new UsageError(
+    sites.length ? `This account has several sites; pass --site <id> (e.g. ${sites.map((s2) => s2.id).join(", ")}) or set CHECKBOX_SITE.` : "No site yet: run `checkbox init` in your project first (it creates the site and remembers it here)."
+  );
+}
+function nextLine(n) {
+  const text = n.description ?? n.message ?? n.type;
+  return `${text}${n.command ? `
+      $ ${n.command}` : n.endpoint ? `
+      ${n.endpoint}` : ""}`;
+}
+function renderPlan(p, c, opts = {}) {
+  const head = `${c.bold(`Compliance plan ${p.site}`)} \u2014 ${p.compliance?.label ? p.status === "compliant" ? c.green(p.compliance.label) : p.status === "action_required" ? c.red(p.compliance.label) : c.yellow(p.compliance.label) : statusColor(p.status, c)}`;
+  const tasks = opts.all ? p.tasks : p.tasks.filter((t) => t.status !== "done" && t.status !== "wont_fix");
+  const lines = [head, p.summary, ""];
+  for (const t of tasks) {
+    lines.push(`${STATUS_MARK[t.status] ?? "[ ]"} ${String(t.order).padStart(2)}. ${t.title} ${c.dim(`(${t.priority}, ${t.id})`)}`);
+    if (t.status === "manual" && t.next_action?.type === "ask_human_to_confirm") lines.push(`        ${c.yellow("waiting for the human to confirm:")} ${t.next_action.description}`);
+    else if (t.status === "manual" && t.question) lines.push(`        ${c.yellow("ask the human:")} ${t.question.text}  ${c.dim(`\u2192 checkbox answer ${t.id} <${t.question.options?.join("|") ?? "yes|no"}>`)}`);
+    else if ((t.status === "done" || t.status === "wont_fix") && t.closed_reason) lines.push(c.dim(`        closed: ${t.closed_reason.replace(/_/g, " ")}`));
+    else if (t.blocked_by.length) lines.push(c.dim(`        after ${t.blocked_by.join(", ")}`));
+    else if (t.status === "open" || t.status === "in_progress") lines.push(c.dim(`        ${t.where.file_hint ?? t.where.url ?? t.where.stripe_object ?? t.where.kind} \xB7 ${t.change.type} \xB7 checkbox fix ${t.id}`));
+  }
+  const hidden = p.tasks.length - tasks.length;
+  if (hidden) lines.push(c.dim(`   \u2026 ${hidden} done / declined (--all to show)`));
+  lines.push("", `${c.cyan("next")}  ${nextLine(p.next_action)}`);
+  return lines;
+}
+function statusColor(s2, c) {
+  return s2 === "compliant" ? c.green("all observed checks passing") : s2 === "action_required" ? c.red(s2) : c.yellow(s2);
+}
+function renderVerification(v, c) {
+  const mark = v.status === "passed" ? c.green("passed") : v.status === "failed" ? c.red("failed") : v.status === "passed_with_gaps" ? c.yellow("passed with gaps (not verified)") : v.status === "passed_with_notes" ? c.yellow("passed with notes (a check outside your control needs review)") : v.status === "not_checked" ? c.yellow("not checked yet (missing evidence, nothing to change)") : v.status === "pending_live_check" ? c.yellow("live check pending (content passes; waiting for a real send)") : c.yellow("pending");
+  const firstCheck = !v.task && v.next_action?.type === "first_check_complete";
+  const lines = [`${c.bold(`Verification ${v.id}`)}${v.task ? ` for ${v.task}` : ""}: ${firstCheck ? c.cyan("first check complete") : mark} (${v.method})`];
+  if (v.precheck) lines.push(`  pre-check (${v.precheck.source}): ${v.precheck.verdict} \u2014 ${v.precheck.note}`);
+  if (v.scan) lines.push(c.dim(`  confirming scan ${v.scan}`));
+  for (const d of v.diff.slice(0, 12)) lines.push(`  ${d.observed === "fail" ? c.red("\u2717") : c.yellow("?")} ${d.check_id}: expected ${d.expected}, observed ${d.observed} \u2014 ${d.detail}`);
+  if (v.diff.length > 12) lines.push(c.dim(`  \u2026 ${v.diff.length - 12} more`));
+  lines.push(`${c.cyan("next")}  ${nextLine(v.next_action)}`);
+  return lines;
+}
+var SITE_RE, STATUS_MARK;
+var init_lib = __esm({
+  "src/commands/plan/lib.ts"() {
+    "use strict";
+    init_args();
+    SITE_RE = /^site_[0-9a-f]{32}$/;
+    STATUS_MARK = { open: "[ ]", in_progress: "[~]", verifying: "[?]", done: "[x]", wont_fix: "[-]", manual: "[!]" };
   }
 });
 
@@ -28470,14 +28851,14 @@ __export(ci_exports, {
   undiffableInputs: () => undiffableInputs
 });
 import { execFileSync } from "node:child_process";
-import { appendFileSync, existsSync as existsSync6, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname4, join as join8, relative as relative5, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, join as join8, relative as relative5, resolve as resolve6 } from "node:path";
 function gitChanged(cwd, base) {
   try {
     const root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
     const out = execFileSync("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve5(root, f)) };
+    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve6(root, f)) };
   } catch (err) {
     const msg2 = String(err.stderr || err.message).trim().split("\n")[0];
     return `git diff ${base}...HEAD failed (${msg2}); fetch the base branch (actions/checkout with fetch-depth: 0)`;
@@ -28487,13 +28868,13 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   const need = [];
   const out = [];
   for (const e of loaded.config.checks.pages ?? []) {
-    if (e.source) need.push({ path: resolve5(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
+    if (e.source) need.push({ path: resolve6(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
     else if (e.url) out.push(`pages "${e.name}" is a URL with no "source" file to diff`);
-    else if (e.file) need.push({ path: resolve5(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
+    else if (e.file) need.push({ path: resolve6(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
   }
   for (const j of jobs) {
     if (j.type === "page") continue;
-    for (const f of j.inputs) need.push({ path: resolve5(loaded.dir, f), label: `"${j.name}" reads ${f}` });
+    for (const f of j.inputs) need.push({ path: resolve6(loaded.dir, f), label: `"${j.name}" reads ${f}` });
   }
   if (!need.length) return out;
   const real = (p) => {
@@ -28509,7 +28890,7 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   try {
     const rels = [...new Set(need.map((n) => relative5(gitRoot, n.path)))];
     const listed = execFileSync("git", ["ls-files", "-z", "--", ...rels], { cwd: gitRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve5(gitRoot, f)));
+    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve6(gitRoot, f)));
   } catch (err) {
     return `git ls-files failed (${String(err.stderr || err.message).trim().split("\n")[0]})`;
   }
@@ -28521,7 +28902,7 @@ function touchesConfig(loaded, jobs, changed) {
   if (set.has(loaded.path)) return true;
   const codeChanged = changed.some((f) => /\.(?:[cm]?[jt]sx?)$/.test(f));
   for (const j of jobs) {
-    for (const f of j.inputs) if (set.has(resolve5(loaded.dir, f))) return true;
+    for (const f of j.inputs) if (set.has(resolve6(loaded.dir, f))) return true;
   }
   const hasModules = [...loaded.config.checks.stripe_checkout ?? [], ...loaded.config.checks.emails ?? []].some((e) => "module" in e && e.module);
   return hasModules && codeChanged;
@@ -28546,12 +28927,21 @@ async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
   const explicit = str(p.flags, "config");
-  const configPath = explicit ? resolve5(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join8(ctx.cwd, f)).find((f) => existsSync6(f)) ?? join8(ctx.cwd, CONFIG_FILES[0]);
+  const configPath = explicit ? resolve6(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join8(ctx.cwd, f)).find((f) => existsSync7(f)) ?? join8(ctx.cwd, CONFIG_FILES[0]);
   const workflowPath = join8(ctx.cwd, WORKFLOW_PATH);
   const force = bool(p.flags, "force") === true;
   const withWorkflow = bool(p.flags, "workflow") !== false;
-  const s2 = scaffoldConfig(ctx.cwd, ctx.env);
-  const actionFor = (f) => existsSync6(f) ? force ? "overwrite" : "keep" : "create";
+  const projects = ctx.config.load().init?.projects ?? {};
+  let facts = {};
+  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
+    if (projects[dir]?.facts) {
+      facts = projects[dir].facts;
+      break;
+    }
+    if (dirname6(dir) === dir) break;
+  }
+  const s2 = scaffoldConfig(ctx.cwd, ctx.env, facts);
+  const actionFor = (f) => existsSync7(f) ? force ? "overwrite" : "keep" : "create";
   const files = [{ path: configPath, content: `${JSON.stringify(s2.config, null, 2)}
 `, action: actionFor(configPath) }];
   if (withWorkflow) files.push({ path: workflowPath, content: WORKFLOW_YAML, action: actionFor(workflowPath) });
@@ -28566,7 +28956,7 @@ async function runInit(ctx, argv) {
   }
   if (write) {
     for (const f of toWrite) {
-      mkdirSync2(dirname4(f.path), { recursive: true });
+      mkdirSync2(dirname6(f.path), { recursive: true });
       writeFileSync2(f.path, f.content);
     }
   }
@@ -28593,7 +28983,21 @@ async function runInit(ctx, argv) {
   });
   return EXIT.ok;
 }
-var HELP2, ci_default;
+async function readNotices(ctx, client, siteFlag) {
+  let site;
+  try {
+    site = await resolveSite(ctx, siteFlag, client);
+  } catch (err) {
+    return { error: `${err.message} checkbox.json says Checkbox Notices sends emails; --online checks that against the site's Notice settings once it knows the site (--site or CHECKBOX_SITE).` };
+  }
+  try {
+    const s2 = await client.sdk.noticeSettings.retrieve(site);
+    return { site, mode: s2.mode, enabled: (s2.enabled_kinds ?? []).map((k) => NOTICE_KIND_TO_EMAIL[k] ?? k), real_sends: s2.real_sends };
+  } catch (err) {
+    return { error: `Could not read the Notice settings of ${site} (${err.message}).` };
+  }
+}
+var HELP2, NOTICE_KIND_TO_EMAIL, ci_default;
 var init_ci = __esm({
   "src/commands/ci/index.ts"() {
     "use strict";
@@ -28603,6 +29007,8 @@ var init_ci = __esm({
     init_inputs();
     init_report();
     init_runner();
+    init_run();
+    init_lib();
     init_scaffold();
     init_workflow();
     init_types2();
@@ -28611,7 +29017,9 @@ var init_ci = __esm({
       "",
       "Flags:",
       "  --config <path>     Config file (default: checkbox.json, then .checkbox.json)",
-      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages and site-aware checks",
+      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages and site-aware checks;",
+      `                      with "notices" in checkbox.json, also checks that the site's Checkbox Notices really send them`,
+      "  --site <site_\u2026>     The site for --online (default: $CHECKBOX_SITE, the site `checkbox init` saved, or the only one)",
       '  --strict            "Needs review" fails too (exit 2)',
       "  --changed-only      Skip when no file the config reads changed (git diff against --base, or",
       "                      origin/$GITHUB_BASE_REF in a pull request). Never skips while a page or file it reads",
@@ -28634,6 +29042,7 @@ var init_ci = __esm({
       "",
       "Docs: https://checkbox.site/docs/guides/ci"
     ].join("\n");
+    NOTICE_KIND_TO_EMAIL = { trial_ending: "trial_reminder" };
     ci_default = defineCommand({
       name: "ci",
       summary: "Run the checks in checkbox.json (CI: annotations + job summary); `ci init` scaffolds the config and workflow",
@@ -28641,7 +29050,7 @@ var init_ci = __esm({
       help: HELP2,
       async run(ctx) {
         if (ctx.argv[0] === "init") return runInit(ctx, ctx.argv.slice(1));
-        const p = parseArgs(ctx.argv, { boolean: ["online", "offline", "strict", "verbose", "changed-only"], string: ["config", "base"] });
+        const p = parseArgs(ctx.argv, { boolean: ["online", "offline", "strict", "verbose", "changed-only"], string: ["config", "base", "site"] });
         if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}" (did you mean \`checkbox ci init\`?)`);
         const gha = ctx.env.GITHUB_ACTIONS === "true";
         const strict = bool(p.flags, "strict") === true;
@@ -28698,8 +29107,21 @@ ${message}
             }
           }
         }
-        const engine = online ? onlineEngine(ctx.client()) : offlineEngine();
-        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra });
+        let client;
+        if (online) {
+          try {
+            client = ctx.client();
+          } catch (err) {
+            if (!(err instanceof NotLoggedInError)) throw err;
+            if (gha) emit("::error title=Checkbox::--online needs CHECKBOX_SECRET_KEY. Add it as a repository secret, or drop --online (checkbox ci runs offline without a key).");
+            ctx.out.error({ message: `${err.message}`, code: "not_logged_in", type: "authentication_error", next_action: { type: "set_key", message: "--online needs an API key: set CHECKBOX_SECRET_KEY (a repository secret in GitHub Actions), or drop --online: checkbox ci runs offline with no key." } });
+            return EXIT.auth;
+          }
+        }
+        const engine = client ? onlineEngine(client) : offlineEngine();
+        const notices = client && declaredByCheckbox(loaded.config).length ? await readNotices(ctx, client, str(p.flags, "site")) : void 0;
+        const noticesLine = Math.max(1, loaded.raw.split("\n").findIndex((l) => l.includes('"sent_by_checkbox"')) + 1);
+        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
         ctx.out.result(run2, () => renderHuman(run2, ctx.out.c, { verbose: bool(p.flags, "verbose") === true }));
         if (gha) {
           for (const a of annotations(run2)) emit(a);
@@ -28931,8 +29353,8 @@ var init_patch = __esm({
 });
 
 // src/commands/plan/fix.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { relative as relative6, resolve as resolve6 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { relative as relative6, resolve as resolve7 } from "node:path";
 function fixForTask(task, cwd, file) {
   const base = {
     object: "task_fix",
@@ -28944,9 +29366,9 @@ function fixForTask(task, cwd, file) {
     verify: task.verify
   };
   const verifyCmd = `checkbox verify ${task.id} --wait`;
-  const candidate = file ?? (task.where.file_hint && existsSync7(resolve6(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
+  const candidate = file ?? (task.where.file_hint && existsSync8(resolve7(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
   if (task.change.type === "patch" && task.change.edits.length && candidate) {
-    const path = resolve6(cwd, candidate);
+    const path = resolve7(cwd, candidate);
     let src;
     try {
       src = readFileSync9(path, "utf8");
@@ -29009,7 +29431,7 @@ var init_fix = __esm({
         const task = await ctx.client().sdk.tasks.retrieve(id);
         const result = fixForTask(task, ctx.cwd, str(flags, "file"));
         const out = str(flags, "out");
-        if (out && result.diff) writeFileSync3(resolve6(ctx.cwd, out), result.diff);
+        if (out && result.diff) writeFileSync3(resolve7(ctx.cwd, out), result.diff);
         ctx.out.result({ ...result, task_object: task }, () => {
           const c = ctx.out.c;
           const lines = [`${c.bold(task.title)} ${c.dim(`(${task.priority}, ${task.id})`)}`, c.dim(`${task.requirement.citation}`), task.why, ""];
@@ -29112,8 +29534,8 @@ var init_device = __esm({
 
 // src/commands/init/patch.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname5, join as join9 } from "node:path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname7, join as join9 } from "node:path";
 function read(root, rel2) {
   try {
     return readFileSync10(join9(root, rel2), "utf8");
@@ -29311,7 +29733,7 @@ function planGitignore(d) {
     const covered = lines.some((l) => l === env2 || l === `/${env2}` || l === ".env*" || l === "*.env" || env2 === ".env.local" && (l === ".env*.local" || l === "*.local" || l === ".env.local*") || env2 === ".env" && l === ".env*");
     if (covered) return null;
   }
-  if (existing === null && !existsSync8(join9(d.root, ".git"))) return null;
+  if (existing === null && !existsSync9(join9(d.root, ".git"))) return null;
   const text = `${existing ?? ""}${existing && !existing.endsWith("\n") ? "\n" : ""}# Checkbox keys (checkbox init)
 ${env2}
 `;
@@ -29328,7 +29750,7 @@ function planWellKnown(d, token) {
 function applyChange(root, c) {
   if (c.action === "unchanged" || c.contents === void 0) return;
   const abs = join9(root, c.file);
-  mkdirSync3(dirname5(abs), { recursive: true });
+  mkdirSync3(dirname7(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
 var MARK_START, MARK_END, NEXT_DOCUMENT, NUXT_PLUGIN;
@@ -29375,7 +29797,7 @@ __export(init_exports, {
   parsePlanFlag: () => parsePlanFlag,
   syncCheckoutConfigs: () => syncCheckoutConfigs
 });
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import { join as join10 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function loadState(ctx, root) {
@@ -29474,7 +29896,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const from = configFileOf(c.name);
     if (!from) continue;
     const sameFile = perFile.has(from.file);
-    const gone = !sameFile && !existsSync9(join10(root, from.file));
+    const gone = !sameFile && !existsSync10(join10(root, from.file));
     const current = sameFile && from.call !== void 0 && from.call <= perFile.get(from.file) && c.name === configNameOf(from.file, from.call);
     if (!sameFile && !gone || current) continue;
     if (await client.sdk.stripeCheckoutConfigs.del(c.id).then(() => true, () => false)) {
@@ -30093,74 +30515,6 @@ var init_logout = __esm({
   }
 });
 
-// src/commands/plan/lib.ts
-import { dirname as dirname6, resolve as resolve7 } from "node:path";
-async function resolveSite(ctx, flag, client) {
-  const explicit = flag ?? ctx.env.CHECKBOX_SITE;
-  if (explicit) {
-    if (!SITE_RE.test(explicit) && !/^[0-9a-f-]{36}$/i.test(explicit)) throw new UsageError(`--site must be a site id (site_\u2026), got "${explicit}"`);
-    return explicit;
-  }
-  const projects = ctx.config.load().init?.projects ?? {};
-  for (let dir = resolve7(ctx.cwd); ; dir = dirname6(dir)) {
-    const site = projects[dir]?.site;
-    if (site) return site;
-    if (dirname6(dir) === dir) break;
-  }
-  const list2 = await client.sdk.sites.list({ limit: 3 });
-  const sites = list2?.data ?? [];
-  if (sites.length === 1) return sites[0].id;
-  throw new UsageError(
-    sites.length ? `This account has several sites; pass --site <id> (e.g. ${sites.map((s2) => s2.id).join(", ")}) or set CHECKBOX_SITE.` : "No site yet: run `checkbox init` in your project first (it creates the site and remembers it here)."
-  );
-}
-function nextLine(n) {
-  const text = n.description ?? n.message ?? n.type;
-  return `${text}${n.command ? `
-      $ ${n.command}` : n.endpoint ? `
-      ${n.endpoint}` : ""}`;
-}
-function renderPlan(p, c, opts = {}) {
-  const head = `${c.bold(`Compliance plan ${p.site}`)} \u2014 ${p.compliance?.label ? p.status === "compliant" ? c.green(p.compliance.label) : p.status === "action_required" ? c.red(p.compliance.label) : c.yellow(p.compliance.label) : statusColor(p.status, c)}`;
-  const tasks = opts.all ? p.tasks : p.tasks.filter((t) => t.status !== "done" && t.status !== "wont_fix");
-  const lines = [head, p.summary, ""];
-  for (const t of tasks) {
-    lines.push(`${STATUS_MARK[t.status] ?? "[ ]"} ${String(t.order).padStart(2)}. ${t.title} ${c.dim(`(${t.priority}, ${t.id})`)}`);
-    if (t.status === "manual" && t.next_action?.type === "ask_human_to_confirm") lines.push(`        ${c.yellow("waiting for the human to confirm:")} ${t.next_action.description}`);
-    else if (t.status === "manual" && t.question) lines.push(`        ${c.yellow("ask the human:")} ${t.question.text}  ${c.dim(`\u2192 checkbox answer ${t.id} <${t.question.options?.join("|") ?? "yes|no"}>`)}`);
-    else if ((t.status === "done" || t.status === "wont_fix") && t.closed_reason) lines.push(c.dim(`        closed: ${t.closed_reason.replace(/_/g, " ")}`));
-    else if (t.blocked_by.length) lines.push(c.dim(`        after ${t.blocked_by.join(", ")}`));
-    else if (t.status === "open" || t.status === "in_progress") lines.push(c.dim(`        ${t.where.file_hint ?? t.where.url ?? t.where.stripe_object ?? t.where.kind} \xB7 ${t.change.type} \xB7 checkbox fix ${t.id}`));
-  }
-  const hidden = p.tasks.length - tasks.length;
-  if (hidden) lines.push(c.dim(`   \u2026 ${hidden} done / declined (--all to show)`));
-  lines.push("", `${c.cyan("next")}  ${nextLine(p.next_action)}`);
-  return lines;
-}
-function statusColor(s2, c) {
-  return s2 === "compliant" ? c.green("all observed checks passing") : s2 === "action_required" ? c.red(s2) : c.yellow(s2);
-}
-function renderVerification(v, c) {
-  const mark = v.status === "passed" ? c.green("passed") : v.status === "failed" ? c.red("failed") : v.status === "passed_with_gaps" ? c.yellow("passed with gaps (not verified)") : v.status === "passed_with_notes" ? c.yellow("passed with notes (a check outside your control needs review)") : v.status === "not_checked" ? c.yellow("not checked yet (missing evidence, nothing to change)") : v.status === "pending_live_check" ? c.yellow("live check pending (content passes; waiting for a real send)") : c.yellow("pending");
-  const firstCheck = !v.task && v.next_action?.type === "first_check_complete";
-  const lines = [`${c.bold(`Verification ${v.id}`)}${v.task ? ` for ${v.task}` : ""}: ${firstCheck ? c.cyan("first check complete") : mark} (${v.method})`];
-  if (v.precheck) lines.push(`  pre-check (${v.precheck.source}): ${v.precheck.verdict} \u2014 ${v.precheck.note}`);
-  if (v.scan) lines.push(c.dim(`  confirming scan ${v.scan}`));
-  for (const d of v.diff.slice(0, 12)) lines.push(`  ${d.observed === "fail" ? c.red("\u2717") : c.yellow("?")} ${d.check_id}: expected ${d.expected}, observed ${d.observed} \u2014 ${d.detail}`);
-  if (v.diff.length > 12) lines.push(c.dim(`  \u2026 ${v.diff.length - 12} more`));
-  lines.push(`${c.cyan("next")}  ${nextLine(v.next_action)}`);
-  return lines;
-}
-var SITE_RE, STATUS_MARK;
-var init_lib = __esm({
-  "src/commands/plan/lib.ts"() {
-    "use strict";
-    init_args();
-    SITE_RE = /^site_[0-9a-f]{32}$/;
-    STATUS_MARK = { open: "[ ]", in_progress: "[~]", verifying: "[?]", done: "[x]", wont_fix: "[-]", manual: "[!]" };
-  }
-});
-
 // src/commands/plan/index.ts
 var plan_exports = {};
 __export(plan_exports, {