@checkbox-site/cli 0.4.4 → 0.4.5

package/dist/checkbox.js

@@ -123,7 +123,37 @@ var init_args = __esm({
 // src/config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+function readEnvValue(text, name) {
+  const re = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*(?:"([^"\\r\\n]*)"|'([^'\\r\\n]*)'|([^\\s#]*))[ \\t]*(?:#.*)?$`, "gm");
+  let found;
+  for (let m = re.exec(text); m; m = re.exec(text)) found = (m[1] ?? m[2] ?? m[3] ?? "").trim();
+  return found || void 0;
+}
+function findProjectKey(cwd, env2 = {}) {
+  const home = resolve(env2.HOME || homedir());
+  let dir = resolve(cwd);
+  for (let depth = 0; depth < 8; depth++) {
+    for (const f of PROJECT_KEY_FILES) {
+      let text;
+      try {
+        text = readFileSync(join(dir, f), "utf8");
+      } catch {
+        continue;
+      }
+      const v = readEnvValue(text, "CHECKBOX_SECRET_KEY");
+      if (v && looksLikeApiKey(v)) {
+        const up = depth === 0 ? "" : "../".repeat(depth);
+        return { apiKey: v, file: `${up}${f}` };
+      }
+    }
+    if (existsSync(join(dir, ".git")) || dir === home) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
 function configDir(env2) {
   if (env2.CHECKBOX_CONFIG_DIR) return env2.CHECKBOX_CONFIG_DIR;
   const base = env2.XDG_CONFIG_HOME || join(env2.HOME || homedir(), ".config");
@@ -167,27 +197,35 @@ function createConfigStore(env2) {
     }
   };
 }
-function resolveCredentials(env2, stored, flags) {
+function resolveCredentials(env2, stored, flags, project) {
   const apiBase = (flags.apiBase || env2.CHECKBOX_API_BASE || stored.api_base || DEFAULT_API_BASE).replace(/\/+$/, "");
   if (flags.apiKey) return { apiKey: flags.apiKey, apiBase, source: "flag" };
   if (env2.CHECKBOX_API_KEY) return { apiKey: env2.CHECKBOX_API_KEY, apiBase, source: "env" };
   if (env2.CHECKBOX_SECRET_KEY) return { apiKey: env2.CHECKBOX_SECRET_KEY, apiBase, source: "env" };
+  if (project) return { apiKey: project.apiKey, apiBase, source: "project", file: project.file };
   if (stored.api_key) return { apiKey: stored.api_key, apiBase, source: "config" };
   return void 0;
 }
+function describeKeySource(c, env2 = {}) {
+  if (c.source === "flag") return "--api-key";
+  if (c.source === "env") return env2.CHECKBOX_API_KEY ? "CHECKBOX_API_KEY" : "CHECKBOX_SECRET_KEY in the environment";
+  if (c.source === "project") return `this project's ${c.file ?? ".env.local"}`;
+  return "your saved login (checkbox login)";
+}
 function maskKey(key) {
-  const m = /^([a-z]{2}_(?:live|test)_)/.exec(key);
+  const m = /^([a-z]{2,3}_(?:live|test)_)/.exec(key);
   const prefix = m?.[1] ?? key.slice(0, 3);
   return `${prefix}\u2026${key.slice(-4)}`;
 }
 function looksLikeApiKey(key) {
   return /^(?:ckr|ck|rk|sk)_(?:live|test)_[A-Za-z0-9_-]{8,}$/.test(key.trim());
 }
-var DEFAULT_API_BASE;
+var DEFAULT_API_BASE, PROJECT_KEY_FILES;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     DEFAULT_API_BASE = "https://app.checkbox.site";
+    PROJECT_KEY_FILES = [".env.local", ".env", ".checkbox/keys.env"];
   }
 });
 
@@ -2972,7 +3010,7 @@ var init_operations = __esm({
       /**
        * Check Stripe Checkout Session params.
        *
-       * Pass exactly the object your code gives stripe.checkout.sessions.create (plus merchant.merchant_name and merchant.cancel_url, and merchant.price/interval when line_items use a Price id). Checkbox models the Stripe-hosted page those params render and returns findings plus `correction`: a JSON Patch (RFC 6902) and the full corrected params (custom_text.submit with the renewal terms, consent_collection.terms_of_service = "required", custom_text.terms_of_service_acceptance as the consent label), verified by the engine. Stripe's own small grey styling keeps "clear and conspicuous" at needs_review on any Stripe-hosted page; also show the terms on your page before redirecting. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
+       * Body: `{ params, merchant }` (or `{ params, site }`). `params` is exactly the object your code gives stripe.checkout.sessions.create; `merchant` adds merchant_name, cancel_url, and price/interval when line_items use a Price id. Checkbox models the Stripe-hosted page those params render and returns findings plus `correction`: a JSON Patch (RFC 6902) and the full corrected params (custom_text.submit with the renewal terms, consent_collection.terms_of_service = "required", custom_text.terms_of_service_acceptance as the consent label), verified by the engine. Stripe's own small grey styling keeps "clear and conspicuous" at needs_review on any Stripe-hosted page; also show the terms on your page before redirecting. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
        *
        * @see POST /v1/checks/stripe_checkout_session (operation `checkStripeCheckoutSession`, scope `checks:read`)
        */
@@ -3365,7 +3403,7 @@ var init_operations = __esm({
       /**
        * Start a lifecycle test run.
        *
-       * Starts a synthetic test subscription in TEST mode and returns it queued. Stripe runs mirror your checkout into a test-mode Checkout Session, subscribe a test customer (card 4242) whose email is a Checkbox inbox, wait for your acknowledgment, advance a test clock through every legal notice window before trial end and renewal, cancel online in the customer portal and wait for the confirmation; then delete the test clock. Usually takes 2-4 minutes (longer when your own emails are slow to arrive): poll retrieveTestRun (next_action says when) or listen for test_run.completed. Each step reports observations, check results and agent-readable fixes; apply them and run again to verify.
+       * Starts a synthetic test subscription in TEST mode and returns it queued. Stripe runs mirror your checkout into a test-mode Checkout Session, subscribe a test customer (card 4242) whose email is a Checkbox inbox, wait for your acknowledgment, advance a test clock through every legal notice window before trial end and renewal, cancel online in the customer portal and wait for the confirmation; then delete the test clock. Usually takes 1-2 minutes; a real_checkout run a few minutes (longer when your own emails are slow to arrive): poll retrieveTestRun (next_action says when) or listen for test_run.completed. Each step reports observations, check results and agent-readable fixes; apply them and run again to verify.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/test_runs (operation `createTestRun`, scope `test_runs:write`, live mode needs an activated account)
@@ -3579,7 +3617,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.2";
+    SDK_VERSION = "0.2.3";
   }
 });
 
@@ -3768,9 +3806,9 @@ var init_client = __esm({
       const p = globalThis.process;
       return p?.env?.[name] || void 0;
     };
-    sleep = (ms, signal) => new Promise((resolve9, reject) => {
+    sleep = (ms, signal) => new Promise((resolve10, reject) => {
       if (signal?.aborted) return reject(signal.reason);
-      const t = setTimeout(resolve9, ms);
+      const t = setTimeout(resolve10, ms);
       signal?.addEventListener("abort", () => (clearTimeout(t), reject(signal.reason)), { once: true });
     });
     Checkbox = class {
@@ -4164,7 +4202,7 @@ var init_types2 = __esm({
 
 // src/run.ts
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 function registerCommands(registry) {
   REGISTRY = registry;
@@ -4208,11 +4246,11 @@ async function listCommands(dir = COMMANDS_DIR) {
 }
 function readAll(stream) {
   if (!stream || stream.isTTY) return Promise.resolve("");
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     let data = "";
     stream.setEncoding?.("utf8");
     stream.on("data", (c) => data += c.toString());
-    stream.on("end", () => resolve9(data));
+    stream.on("end", () => resolve10(data));
     stream.on("error", reject);
   });
 }
@@ -4230,7 +4268,8 @@ async function helpText(dir) {
     "",
     "Global flags:",
     "  --json            One JSON document on stdout (for agents and scripts)",
-    "  --api-key <key>   Use this key (default: $CHECKBOX_API_KEY, then the key saved by `checkbox login`)",
+    "  --api-key <key>   Use this key (default: $CHECKBOX_API_KEY, then CHECKBOX_SECRET_KEY from the environment or",
+    "                    this project's .env.local / .env, then the key saved by `checkbox login`)",
     "  --api-base <url>  API base URL (default: $CHECKBOX_API_BASE or https://app.checkbox.site)",
     "  -q, --quiet       Only print errors",
     "  --no-color        Plain output",
@@ -4293,7 +4332,18 @@ async function run(argv, io) {
   }
   const flags = { json: g.json, quiet: g.quiet, color, help: false, ...g.apiKey ? { apiKey: g.apiKey } : {}, ...g.apiBase ? { apiBase: g.apiBase } : {} };
   const config = createConfigStore(io.env);
-  const credentials = () => resolveCredentials(io.env, config.load(), flags);
+  let projectKey = null;
+  const project = () => projectKey === null ? projectKey = findProjectKey(io.cwd, io.env) : projectKey;
+  const credentials = () => resolveCredentials(io.env, config.load(), flags, project());
+  let saidWhichKey = false;
+  const sayWhichKey = (c) => {
+    if (saidWhichKey || !c) return;
+    saidWhichKey = true;
+    const stored = config.load().api_key;
+    if (c.source !== "config" && stored && stored !== c.apiKey) {
+      out.info(out.c.dim(`Using the key from ${describeKeySource(c, io.env)} (${maskKey(c.apiKey)}), not your saved login (${maskKey(stored)}).`));
+    }
+  };
   const ctx = {
     argv: rest,
     flags,
@@ -4307,6 +4357,7 @@ async function run(argv, io) {
       const c = credentials();
       const apiKey = o.apiKey ?? c?.apiKey;
       if (!apiKey) throw new NotLoggedInError();
+      if (!o.apiKey) sayWhichKey(c);
       return createApiClient({ apiKey, apiBase: o.apiBase ?? c?.apiBase ?? resolveCredentials(io.env, {}, flags)?.apiBase ?? "https://app.checkbox.site", userAgent: `checkbox-cli/${CLI_VERSION}`, ...io.fetch ? { fetch: io.fetch } : {} });
     },
     readStdin: () => readAll(io.stdin),
@@ -4315,10 +4366,21 @@ async function run(argv, io) {
   try {
     return await cmd.run(ctx);
   } catch (err) {
-    return reportError(out, err);
+    return reportError(out, err, { credentials: credentials(), project: project() ?? void 0, env: io.env });
+  }
+}
+function authNextAction(ctxInfo) {
+  const used = ctxInfo?.credentials;
+  const proj = ctxInfo?.project;
+  if (proj && used && proj.apiKey !== used.apiKey) {
+    return {
+      type: "use_project_key",
+      message: `The key from ${describeKeySource(used, ctxInfo?.env)} (${maskKey(used.apiKey)}) was rejected, but this project's ${proj.file} has another key (${maskKey(proj.apiKey)}). Unset ${used.source === "env" ? "that environment variable" : "the --api-key flag"} so the CLI uses it, or check that the right key is in ${proj.file}.`
+    };
   }
+  return void 0;
 }
-function reportError(out, err) {
+function reportError(out, err, auth) {
   if (err instanceof UsageError) {
     out.error({ message: err.message, code: "usage_error", type: "usage_error" });
     return EXIT.usage;
@@ -4341,7 +4403,10 @@ function reportError(out, err) {
       ...err.requestId ? { request_id: err.requestId } : {},
       ...err.docUrl ? { doc_url: err.docUrl } : {},
       status: apiStatus(err),
-      ...apiStatus(err) === 0 ? { next_action: { type: "retry", message: "Check your network (and --api-base / CHECKBOX_API_BASE), or add --offline to run a check locally." } } : err.nextAction ? { next_action: err.nextAction } : isAuthError(err) ? { next_action: { type: "login", message: "The API key was rejected. Run `checkbox login` with a valid key, or set CHECKBOX_API_KEY." } } : {}
+      ...apiStatus(err) === 0 ? { next_action: { type: "retry", message: "Check your network (and --api-base / CHECKBOX_API_BASE), or add --offline to run a check locally." } } : isAuthError(err) && authNextAction(auth) ? (
+        // The server's 401 next step sends agents to device approval; a key this CLI can see locally comes first.
+        { next_action: authNextAction(auth), ...auth?.credentials ? { key_source: auth.credentials.source, ...auth.credentials.file ? { key_file: auth.credentials.file } : {} } : {} }
+      ) : err.nextAction ? { next_action: err.nextAction } : isAuthError(err) ? { next_action: { type: "login", message: "The API key was rejected. Run `checkbox login` with a valid key, or set CHECKBOX_API_KEY." } } : {}
     });
     return isAuthError(err) ? EXIT.auth : apiStatus(err) === 400 ? EXIT.usage : EXIT.error;
   }
@@ -4357,7 +4422,7 @@ var init_run = __esm({
     init_http();
     init_output();
     init_types2();
-    HERE = dirname(fileURLToPath(import.meta.url));
+    HERE = dirname2(fileURLToPath(import.meta.url));
     COMMANDS_DIR = join2(HERE, "commands");
     CLI_VERSION = (() => {
       try {
@@ -4368,7 +4433,7 @@ var init_run = __esm({
     })();
     NotLoggedInError = class extends Error {
       constructor() {
-        super("Not logged in: no API key found (flag --api-key, env CHECKBOX_API_KEY, or `checkbox login`).");
+        super("Not logged in: no API key found (flag --api-key, env CHECKBOX_API_KEY, CHECKBOX_SECRET_KEY in .env.local, or `checkbox login`).");
         this.name = "NotLoggedInError";
       }
     };
@@ -4707,7 +4772,8 @@ var init_secrets = __esm({
       { name: "stripe_webhook_secret", re: /\bwhsec_[A-Za-z0-9+/=_-]{4,}/g, replace: keepPrefix(() => 6) },
       { name: "stripe_publishable_live", re: /\bpk_live_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix(() => 8) },
       // Checkbox API keys (ck_test_ / ck_live_) and scoped tokens.
-      { name: "checkbox_key", re: /\bck_(?:live|test)_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix((m) => m.indexOf("_", 3) + 1) },
+      // ckr_ (restricted) keys too: round 29 found they were left whole.
+      { name: "checkbox_key", re: /\bckr?_(?:live|test)_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix((m) => m.indexOf("_", 4) + 1) },
       // AWS access key ids (and the secret that usually follows them on the same line).
       { name: "aws_access_key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, replace: () => "AKIA[redacted]" },
       { name: "aws_secret", re: /(aws_secret_access_key|AWS_SECRET_ACCESS_KEY|secretAccessKey)(\s*[:=]\s*["']?)[A-Za-z0-9/+=]{30,}/g, replace: (m) => m.replace(/[A-Za-z0-9/+=]{30,}$/, "[redacted]") },
@@ -5126,7 +5192,7 @@ var init_california = __esm({
         sourceUrl: URL_ARTICLE,
         effectiveDate: ORIGINAL,
         lastVerified: LAST_VERIFIED,
-        summary: 'Clear and conspicuous offer terms next to the consent request; affirmative (and since July 2025, express affirmative) consent; retainable acknowledgment; online "click to cancel" for online sign-ups; a notice 3-21 days before a free trial or promotional price lasting more than 31 days ends, and 15-45 days before a term of one year or longer renews; 7-30 day fee-change notice; annual reminder; same-medium cancellation; limits on save offers; consent records kept 3 years, or 1 year after termination if longer. Remedies: civil (UCL) remedies only (\xA7 17604); unconsented goods are gifts (\xA7 17603).',
+        summary: 'Clear and conspicuous offer terms next to the consent request; affirmative (and since July 2025, express affirmative) consent; retainable acknowledgment; online "click to cancel" for online sign-ups; a notice 3-21 days before a free trial or promotional price lasting more than 31 days ends, and 15-45 days before a term of one year or longer renews; 7-30 day fee-change notice; annual reminder; same-medium cancellation; limits on save offers; consent records kept 3 years, or 1 year after termination if longer. No criminal penalties; civil remedies apply (\xA7 17604), in practice through the UCL, FAL and CLRA; unconsented goods are gifts (\xA7 17603).',
         status: "in_force",
         confidence: "high",
         verification: "primary",
@@ -5250,14 +5316,14 @@ var init_federal = __esm({
         effectiveDate: EFTA_EFFECTIVE,
         stage: "reminder",
         title: "Advance notice when a recurring debit will change in amount",
-        summary: "When a preauthorized debit from a consumer's account will vary in amount from the previous transfer or from the authorized amount (e.g. a subscription price increase billed to a debit card or by ACH), the payee must send written notice of the amount and date of the transfer at least 10 days before the scheduled transfer date.",
+        summary: "When a preauthorized debit from a consumer's account will vary in amount from the previous transfer or from the authorized amount (e.g. a subscription price increase billed to a debit card or by ACH), the payee must send written notice of the amount and date of the transfer at least 10 days before the scheduled transfer date (\xA7 1005.10(d)(1)). The payee must tell the consumer of the right to notice of every varying transfer, but may let the consumer choose notice only when a transfer falls outside a specified range of amounts, or differs from the most recent transfer by more than an agreed amount (\xA7 1005.10(d)(2)).",
         appliesWhen: { paymentMethods: ["debit", "ach"] },
         checkIds: ["reminder.price_change"],
         severity: "medium",
         noticeWindow: noticeWindowAtLeast(10, "charge"),
         notes: notes(
           windowNote(noticeWindowAtLeast(10, "charge"), "the changed debit"),
-          "Applies only to debits from consumer asset accounts (debit, prepaid, ACH), not credit cards. The payee may instead let the consumer elect to be notified only when the amount falls outside a specified range or differs from the most recent transfer by more than an agreed amount."
+          "Applies only to debits from consumer asset accounts (debit, prepaid, ACH), not credit cards. A consumer who chose range-only notice under \xA7 1005.10(d)(2) gets no notice for a change inside that range; Checkbox cannot see that choice, so the checks expect the notice for every price change."
         )
       })
     ];
@@ -5406,7 +5472,7 @@ var init_exposure = __esm({
         fees: NO_PRIVATE
       },
       "US-FED.1005.": {
-        privateSuit: "Yes: the Electronic Fund Transfer Act lets consumers sue (15 U.S.C. \xA7 1693m). Applies when the subscription is paid by debit card or ACH.",
+        privateSuit: "Yes, in the law itself: the Electronic Fund Transfer Act lets consumers sue (15 U.S.C. \xA7 1693m). Applies when the subscription is paid by debit card or ACH.",
         damages: "Actual damages, plus statutory damages of $100 to $1,000 in an individual action, or in a class action up to the lesser of $500,000 or 1% of the defendant's net worth (15 U.S.C. \xA7 1693m(a)(1), (2)).",
         penalties: "None in private suits: \xA7 1693m provides damages, costs and fees, not civil penalties. The CFPB enforces the Act (15 U.S.C. \xA7 1693o(a)(5)) and can seek civil money penalties for a violation of federal consumer financial law, which includes the Act (12 U.S.C. \xA7\xA7 5481(12)(C), 5565(a)(2)(H)): up to $5,000 a day, $25,000 a day if reckless and $1,000,000 a day if knowing, before inflation adjustment (12 U.S.C. \xA7 5565(c)(2)).",
         fees: "Costs and reasonable attorney's fees for a successful action (15 U.S.C. \xA7 1693m(a)(3))."
@@ -5418,7 +5484,7 @@ var init_exposure = __esm({
         fees: NO_PRIVATE
       },
       "US-CA": {
-        privateSuit: "Through general consumer law: the ARL has no private right of its own (Mayron v. Google, 2020); plaintiffs sue under the UCL, FAL and CLRA and must show economic injury. Before suing for damages under the CLRA, the consumer must send a written notice and demand by certified or registered mail at least 30 days ahead, and no damages action lies if an appropriate correction is given or agreed within 30 days (Cal. Civ. Code \xA7 1782(a), (b)); a CLRA claim for an injunction needs no prior notice (\xA7 1782(d)).",
+        privateSuit: "Yes, through general consumer law: the ARL has no private right of its own (Mayron v. Google, 2020); plaintiffs sue under the UCL, FAL and CLRA and must show economic injury. Before suing for damages under the CLRA, the consumer must send a written notice and demand by certified or registered mail at least 30 days ahead, and no damages action lies if an appropriate correction is given or agreed within 30 days (Cal. Civ. Code \xA7 1782(a), (b)); a CLRA claim for an injunction needs no prior notice (\xA7 1782(d)).",
         damages: "Goods or services provided without the required consent are an unconditional gift (Cal. Bus. & Prof. Code \xA7 17603); all civil remedies are available (\xA7 17604, with a good-faith-compliance safe harbor). Under the CLRA: actual damages (in a class action, at least $1,000 in total), an injunction, restitution of property, punitive damages and other relief the court deems proper (Cal. Civ. Code \xA7 1780(a)). Under the UCL and the FAL: an injunction and orders restoring money or property acquired by the unlawful practice (restitution) (Cal. Bus. & Prof. Code \xA7\xA7 17203, 17535); a private plaintiff must have suffered injury in fact and lost money or property (\xA7 17535, for the FAL). Neither section provides damages.",
         penalties: "In public actions only (the Attorney General, district attorneys and some county counsel and city attorneys): up to $2,500 per violation under the UCL (Cal. Bus. & Prof. Code \xA7 17206(a)) and up to $2,500 per violation under the FAL (\xA7 17536(a)).",
         fees: "Under the CLRA: the court shall award costs and attorney's fees to a prevailing plaintiff; a prevailing defendant may get reasonable fees only if the suit was not brought in good faith (Cal. Civ. Code \xA7 1780(e)). The UCL and FAL sections provide no attorney's fees (Cal. Bus. & Prof. Code \xA7\xA7 17203, 17535). Plaintiffs sometimes seek fees under the private attorney general statute, which lets a court award fees to a successful party in an action that enforced an important right affecting the public interest, when its conditions are met (Cal. Code Civ. Proc. \xA7 1021.5).",
@@ -5551,7 +5617,7 @@ var init_exposure = __esm({
         fees: OPEN
       },
       "US-ND": {
-        privateSuit: "Yes: a person aggrieved may sue to enjoin the violation or for restitution, or both (N.D. Cent. Code \xA7 51-37-06).",
+        privateSuit: "Yes, in the law itself: a person aggrieved may sue to enjoin the violation or for restitution, or both (N.D. Cent. Code \xA7 51-37-06).",
         damages: "Restitution (N.D. Cent. Code \xA7 51-37-06); goods or services provided under a non-compliant renewal, or after an attempt to cancel, are an unconditional gift (\xA7 51-37-04).",
         penalties: "Each act is a separate violation of N.D. Cent. Code ch. 51-15, enforced by the attorney general with that chapter's remedies (\xA7 51-37-05). Unsettled: the figure is not yet confirmed from the statute text.",
         fees: "Costs, expenses and reasonable attorney's fees (N.D. Cent. Code \xA7 51-37-06)."
@@ -9824,7 +9890,7 @@ var init_catalog = __esm({
     init_states();
     init_terms();
     init_types3();
-    CATALOG_VERSION = "2026.11.09.2";
+    CATALOG_VERSION = "2026.11.09.3";
     CATALOG = [
       ...FEDERAL_REQUIREMENTS,
       ...CALIFORNIA_REQUIREMENTS,
@@ -10645,7 +10711,7 @@ function analyzePolicyText(input) {
 function clausesOf(clauses, code2) {
   return clauses.filter((c) => c.code === code2);
 }
-var POLICY_KINDS, POLICY_FRAGMENT, POLICY_FETCHER_USER_AGENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
+var POLICY_KINDS, POLICY_FRAGMENT, POLICY_FETCHER_USER_AGENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, STOP_SUBSCRIPTION, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
 var init_policy_docs = __esm({
   "../rules/src/policy-docs.ts"() {
     "use strict";
@@ -10666,9 +10732,12 @@ var init_policy_docs = __esm({
       /\bcancell?(?:ations?|ing)?\b[^.]{0,80}\b(?:only|solely|exclusively)\b[^.]{0,60}\b(?:phone|telephone|mail|post|in writing|in person|fax)\b/i,
       /\bcancell?ation requests?\b[^.]{0,60}\b(?:by|via) (?:certified |registered )?(?:mail|post|letter|fax|phone|telephone)\b/i
     ];
+    STOP_SUBSCRIPTION = "(?:stop|end|terminate|discontinue|turn off)\\s+(?:your |the |a |my |this )?(?:paid |monthly |annual |yearly )?(?:subscription|membership|plan|auto-?renewal|automatic renewal|recurring (?:billing|payments?|charges?))";
     CONTACT_TO_CANCEL = [
       /\bto cancel\b[^.]{0,80}\b(?:contact|email|e-mail|reach out to|message)\b/i,
       /\b(?:contact|email|e-mail)\b[^.]{0,60}\bto cancel\b/i,
+      new RegExp(`\\bto ${STOP_SUBSCRIPTION}\\b[^.]{0,80}(?:\\b(?:contact|email|e-mail|reach out to|message|write to)\\b|\\[redacted\\])`, "i"),
+      new RegExp(`(?:\\b(?:contact|email|e-mail|write to)\\b|\\[redacted\\])[^.]{0,60}\\bto ${STOP_SUBSCRIPTION}\\b`, "i"),
       // Round 2 pilot: "You may cancel by contacting support" / "cancellations are handled by emailing us".
       /\bcancel\w*\b[^.]{0,60}\b(?:by|through|via)\s+(?:contacting|emailing|e-mailing|messaging|writing to|reaching out to|calling|phoning|sending (?:us )?an? (?:email|e-mail|message))\b/i,
       // Normal round 2 (nextjs): the scanner redacts e-mail addresses before the rules see the text, so
@@ -11309,7 +11378,7 @@ function noticePlanOptions(ctx, priceChange = false) {
   const newPrices = (ctx.events ?? []).filter((e) => e.type === "price_change_scheduled").map((e) => e.amount).filter((n) => typeof n === "number" && n > 0).map((n) => n / 10 ** currencyDigitsOf(currency));
   if (priceChange && newPrices.length) return { plans: plans.map((p) => ({ ...p, amount: -1 })), extraAmounts: newPrices };
   if (!plans.length) return { plans: [], extraAmounts: [] };
-  return { plans, extraAmounts: newPrices };
+  return { plans, extraAmounts: newPrices, ...ctx.events?.length ? { events: ctx.events } : {} };
 }
 function declaredPlansFrom(plans) {
   const out = [];
@@ -11551,11 +11620,11 @@ function siteOffers(input) {
   };
   for (const d of declared) {
     const price3 = stripe.find((s2) => sameTerms(s2, d));
-    const trial = d.trialDays && d.trialDays > 0 ? d.trialDays : price3?.trialDays && price3.trialDays > 0 ? price3.trialDays : soldTrial({ ...d, ...price3 ? { priceId: price3.id } : {} });
+    const trial = d.trialDays && d.trialDays > 0 ? d.trialDays : soldTrial({ ...d, ...price3 ? { priceId: price3.id } : {} }) || (price3?.trialDays && price3.trialDays > 0 ? price3.trialDays : 0);
     push(toOffer(d, "declared", { trialDays: trial, ...price3 ? { priceId: price3.id } : {} }));
   }
   const chosen = input.facts?.planPriceId ? stripe.find((p) => p.id === input.facts.planPriceId) : void 0;
-  if (chosen) push(toOffer(chosen, "chosen", chosen.trialDays && chosen.trialDays > 0 ? {} : { trialDays: soldTrial(chosen) }));
+  if (chosen) push(toOffer(chosen, "chosen", soldTrial(chosen) > 0 ? { trialDays: soldTrial(chosen) } : {}));
   if (!declared.length) {
     for (const s2 of sold) {
       const price3 = stripe.find((p) => sameTerms(p, s2));
@@ -11570,7 +11639,7 @@ function siteOffers(input) {
     const anchors = stripe.filter((s2) => out.some((o) => o.priceId === s2.id));
     for (const s2 of stripe) {
       if (out.some((o) => o.priceId === s2.id) || !anchors.some((a) => sameProductName(a.name, s2.name))) continue;
-      push(toOffer(s2, "stripe", s2.trialDays && s2.trialDays > 0 ? {} : { trialDays: soldTrial(s2) }));
+      push(toOffer(s2, "stripe", soldTrial(s2) > 0 ? { trialDays: soldTrial(s2) } : {}));
     }
   }
   const facts = input.facts;
@@ -12937,14 +13006,14 @@ var init_visible_html = __esm({
 
 // ../rules/src/checks/context.ts
 function heuristicReader() {
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   return {
     mode: "heuristic",
     async analyze(text) {
-      let a = cache.get(text);
+      let a = cache2.get(text);
       if (!a) {
         a = analyzeTerms(text);
-        cache.set(text, a);
+        cache2.set(text, a);
       }
       return a;
     }
@@ -13793,7 +13862,7 @@ function remediationFor(checkId, platform) {
   if (guide?.snippet) rem.snippet = { ...guide.snippet };
   return rem;
 }
-var DISCLOSURE_COPY_TEMPLATE, CONSENT_COPY_TEMPLATE, ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_REMINDER_COPY_TEMPLATE, RENEWAL_REMINDER_COPY_TEMPLATE, PRICE_CHANGE_COPY_TEMPLATE, ANNUAL_TERMS_COPY_TEMPLATE, CHARGE_NOTICE_COPY_TEMPLATE, CANCELLATION_CONFIRMATION_COPY_TEMPLATE, TERMS_CANCELLATION_COPY_TEMPLATE, TERMS_REFUND_COPY_TEMPLATE, TERMS_RENEWAL_COPY_TEMPLATE, PLACEHOLDER_STEP, CUSTOM_DISCLOSURE_HTML, CUSTOM_CONSENT_HTML, STRIPE_CHECKOUT_TS, STRIPE_ANNUAL_REMINDER_TS, STRIPE_CHARGE_NOTICE_TS, STRIPE_PORTAL_TS, STRIPE_ACK_WEBHOOK_TS, STRIPE_CANCEL_CONFIRMATION_TS, SHOPIFY_LIQUID, SHOPIFY_CHECKOUT_EXTENSION_TSX, CUSTOM_ACCOUNT_CANCEL_HTML, CUSTOM_ACK_EMAIL_HTML, VERIFY, VERIFY_TERMS, VERIFY_EMAIL, CB_CHECKOUT, CB_PORTAL, CB_EMAILS, CHARGEBEE_DISCLOSURE, CHARGEBEE_CONSENT, CHARGEBEE_ACK, CHARGEBEE_PORTAL, CHARGEBEE_TRIAL_REMINDER, CHARGEBEE_RENEWAL_REMINDER, CHARGEBEE_ANNUAL_TERMS, CHARGEBEE_CHARGE_NOTICE, RC_ACCOUNT_PAGES, RC_EMAILS, RECURLY_DISCLOSURE, RECURLY_CONSENT, RECURLY_ACK, RECURLY_PORTAL, RECURLY_TRIAL_REMINDER, RECURLY_RENEWAL_REMINDER, RECURLY_ANNUAL_TERMS, RECURLY_CHARGE_NOTICE, PD_RETAIN, PADDLE_DISCLOSURE, PADDLE_CONSENT, PADDLE_ACK, PADDLE_PORTAL, PADDLE_TRIAL_REMINDER, PADDLE_RENEWAL_REMINDER, PADDLE_ANNUAL_TERMS, PADDLE_CHARGE_NOTICE, STRIPE_DISCLOSURE, SHOPIFY_DISCLOSURE, RECHARGE_DISCLOSURE, CUSTOM_DISCLOSURE, DISCLOSURE_PLATFORMS, STRIPE_ACK, SHOPIFY_ACK, RECHARGE_ACK, CUSTOM_ACK, ACK_PLATFORMS, STRIPE_PORTAL, SHOPIFY_PORTAL, RECHARGE_PORTAL, CUSTOM_PORTAL, PORTAL_PLATFORMS, STRIPE_TRIAL_REMINDER, STRIPE_RENEWAL_REMINDER, STRIPE_ANNUAL_TERMS, STRIPE_CHARGE_NOTICE, SHOPIFY_ANNUAL_TERMS, SHOPIFY_CHARGE_NOTICE, RECHARGE_ANNUAL_TERMS, RECHARGE_CHARGE_NOTICE, CUSTOM_ANNUAL_TERMS, CUSTOM_CHARGE_NOTICE, SHOPIFY_REMINDER, RECHARGE_REMINDER, CUSTOM_REMINDER, SPECS, PLATFORM_LABELS, OFFER_PERMISSION_FIX, OFFER_QUESTION_STOP_FIX, OFFER_PERMISSION_SNIPPET, CANCEL_HANDLER_REMEDIATION, OFFER_PERMISSION_REMEDIATION;
+var DISCLOSURE_COPY_TEMPLATE, CONSENT_COPY_TEMPLATE, ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_REMINDER_COPY_TEMPLATE, RENEWAL_REMINDER_COPY_TEMPLATE, PRICE_CHANGE_COPY_TEMPLATE, ANNUAL_TERMS_COPY_TEMPLATE, CHARGE_NOTICE_COPY_TEMPLATE, CANCELLATION_CONFIRMATION_COPY_TEMPLATE, TERMS_CANCELLATION_COPY_TEMPLATE, TERMS_REFUND_COPY_TEMPLATE, TERMS_RENEWAL_COPY_TEMPLATE, PLACEHOLDER_STEP, CUSTOM_DISCLOSURE_HTML, CUSTOM_CONSENT_HTML, STRIPE_CHECKOUT_TS, STRIPE_ANNUAL_REMINDER_TS, STRIPE_CHARGE_NOTICE_TS, STRIPE_PORTAL_TS, STRIPE_ACK_WEBHOOK_TS, STRIPE_CANCEL_CONFIRMATION_TS, SHOPIFY_LIQUID, SHOPIFY_CHECKOUT_EXTENSION_TSX, CUSTOM_ACCOUNT_CANCEL_HTML, CUSTOM_ACK_EMAIL_HTML, VERIFY, VERIFY_TERMS, VERIFY_EMAIL, CB_CHECKOUT, CB_PORTAL, CB_EMAILS, CHARGEBEE_DISCLOSURE, CHARGEBEE_CONSENT, CHARGEBEE_ACK, CHARGEBEE_PORTAL, CHARGEBEE_TRIAL_REMINDER, CHARGEBEE_RENEWAL_REMINDER, CHARGEBEE_ANNUAL_TERMS, CHARGEBEE_CHARGE_NOTICE, RC_ACCOUNT_PAGES, RC_EMAILS, RECURLY_DISCLOSURE, RECURLY_CONSENT, RECURLY_ACK, RECURLY_PORTAL, RECURLY_TRIAL_REMINDER, RECURLY_RENEWAL_REMINDER, RECURLY_ANNUAL_TERMS, RECURLY_CHARGE_NOTICE, PD_RETAIN, PADDLE_DISCLOSURE, PADDLE_CONSENT_HTML, PADDLE_CONSENT, PADDLE_ACK, PADDLE_PORTAL, PADDLE_TRIAL_REMINDER, PADDLE_RENEWAL_REMINDER, PADDLE_ANNUAL_TERMS, PADDLE_CHARGE_NOTICE, STRIPE_DISCLOSURE, SHOPIFY_DISCLOSURE, RECHARGE_DISCLOSURE, CUSTOM_DISCLOSURE, DISCLOSURE_PLATFORMS, STRIPE_ACK, SHOPIFY_ACK, RECHARGE_ACK, CUSTOM_ACK, ACK_PLATFORMS, STRIPE_PORTAL, SHOPIFY_PORTAL, RECHARGE_PORTAL, CUSTOM_PORTAL, PORTAL_PLATFORMS, STRIPE_TRIAL_REMINDER, STRIPE_RENEWAL_REMINDER, STRIPE_ANNUAL_TERMS, STRIPE_CHARGE_NOTICE, SHOPIFY_ANNUAL_TERMS, SHOPIFY_CHARGE_NOTICE, RECHARGE_ANNUAL_TERMS, RECHARGE_CHARGE_NOTICE, CUSTOM_ANNUAL_TERMS, CUSTOM_CHARGE_NOTICE, SHOPIFY_REMINDER, RECHARGE_REMINDER, CUSTOM_REMINDER, SPECS, PLATFORM_LABELS, OFFER_PERMISSION_FIX, OFFER_QUESTION_STOP_FIX, OFFER_PERMISSION_SNIPPET, CANCEL_HANDLER_REMEDIATION, OFFER_PERMISSION_REMEDIATION;
 var init_remediation = __esm({
   "../rules/src/remediation.ts"() {
     "use strict";
@@ -14109,13 +14178,32 @@ and click \u201CCancel subscription\u201D. You can cancel anytime online.</p>`;
       ],
       snippet: { language: "html", code: CUSTOM_DISCLOSURE_HTML }
     };
+    PADDLE_CONSENT_HTML = `<!-- Replace your button that opens Paddle Checkout with this form (Paddle.js must be loaded and initialized). -->
+<form id="checkbox-paddle-checkout">
+  <label style="display:flex;gap:8px;align-items:flex-start;font-size:14px;color:#1f2937;">
+    <!-- Never add the "checked" attribute: consent must be an affirmative act -->
+    <input type="checkbox" name="auto_renew_consent" value="yes" required>
+    <span>I agree that my subscription will automatically renew every {interval} at {price} until I cancel.</span>
+  </label>
+  <button type="submit">Subscribe</button>
+</form>
+<script>
+  document.getElementById('checkbox-paddle-checkout').addEventListener('submit', function (event) {
+    event.preventDefault(); // the browser only gets here once the required box is ticked
+    var label = this.querySelector('label span').textContent.trim();
+    Paddle.Checkout.open({
+      items: [{ priceId: 'pri_REPLACE_ME', quantity: 1 }],
+      customData: { auto_renew_consent: { at: new Date().toISOString(), label: label } },
+    });
+  });
+</script>`;
     PADDLE_CONSENT = {
       steps: [
         "Add a required, unchecked renewal-consent checkbox (the wording below) on your page, directly above the button that opens Paddle Checkout, and only open checkout once it is ticked.",
-        "Save when it was ticked and the terms that were shown, so you can prove consent later.",
-        "For developers: call Paddle.Checkout.open() only after the box is ticked, and pass the consent time in customData so it is stored on the transaction."
+        'Paddle opens checkout from a button, not a form, so a "required" box alone blocks nothing: put the box and the button in one form (the snippet does) or keep the button disabled until the box is ticked.',
+        "Save when it was ticked and the terms that were shown, so you can prove consent later: the snippet passes them in customData, which Paddle stores on the transaction. On Lemon Squeezy, pass them as checkout[custom][\u2026] on the checkout URL."
       ],
-      snippet: { language: "html", code: CUSTOM_CONSENT_HTML }
+      snippet: { language: "html", code: PADDLE_CONSENT_HTML }
     };
     PADDLE_ACK = {
       steps: [
@@ -16291,15 +16379,34 @@ function offlineOnlyCancelIn(text, cancelMethods) {
   const online = cancelMethods.some((m) => !CONTACT_TO_CANCEL_RE.test(m.text) && !/@|\d{3}[\s.-]\d{4}|\b(?:call|phone|chat|e-?mail|contact|mail|reply)\b/i.test(m.text));
   return online ? null : offline;
 }
+function inForceAmount(e, events, fallbackCurrency = "usd") {
+  const own = e.noticeTerms;
+  if (own && typeof own.amount === "number" && own.amount > 0) return own.amount / 10 ** currencyDigitsOf(typeof own.currency === "string" ? own.currency : fallbackCurrency);
+  const ref = typeof e.subscriptionRef === "string" ? e.subscriptionRef.trim() : "";
+  const sent2 = toDate(e.receivedAt)?.getTime();
+  if (!ref || sent2 === void 0) return void 0;
+  let best;
+  let bestAt = -Infinity;
+  for (const ev of events) {
+    if (ev.subscriptionRef !== ref || !CHARGE_AMOUNT_EVENTS.has(ev.type) || !(typeof ev.amount === "number" && ev.amount > 0)) continue;
+    const at = toDate(ev.occurredAt)?.getTime();
+    if (at === void 0 || at > sent2 + 36e5 || at < bestAt) continue;
+    best = ev;
+    bestAt = at;
+  }
+  return best ? best.amount / 10 ** currencyDigitsOf(best.currency ?? fallbackCurrency) : void 0;
+}
 function noticeContent(e, opts = {}) {
   const body = emailBody(e);
   const a = analyzeTerms(body);
   const quotes = {};
   const wrong = {};
   const plans = opts.plans ?? [];
+  const inForce = opts.events ? inForceAmount(e, opts.events, plans[0]?.currency) : void 0;
   const expected = [
     ...plans.map((p) => p.amount / 10 ** currencyDigitsOf(p.currency)),
-    ...opts.extraAmounts ?? []
+    ...opts.extraAmounts ?? [],
+    ...inForce !== void 0 ? [inForce] : []
   ];
   const amount = a.recurringPrices[0]?.money ?? positiveAmounts(a)[0];
   const stated = positiveAmounts(a).filter((m) => m.amount !== null);
@@ -16364,7 +16471,7 @@ function contentFixFromText(checkId, text) {
   const m = new RegExp(`^the ${noun} \\(.*?\\) .*? does not state (.+?)(?: correctly \\(| \u2014 )`, "i").exec(text.trim());
   return m ? `Add ${m[1]} to the ${noun}; Checkbox's template has every required line.` : void 0;
 }
-var ELEMENT_LABELS, CHARGE_FOLLOWS_RE, DATE_TAG_RE, TRIAL_END_WHEN_RE, PRODUCT_RE, CONTACT_RE, CANCEL_URL_RE, NOTICE_NOUN;
+var ELEMENT_LABELS, CHARGE_FOLLOWS_RE, DATE_TAG_RE, TRIAL_END_WHEN_RE, PRODUCT_RE, CONTACT_RE, CANCEL_URL_RE, CHARGE_AMOUNT_EVENTS, NOTICE_NOUN;
 var init_notice_content = __esm({
   "../rules/src/checks/notice-content.ts"() {
     "use strict";
@@ -16390,6 +16497,7 @@ var init_notice_content = __esm({
     PRODUCT_RE = /\b(?:[Yy]our|[Tt]he|[Tt]his)\s+(?:[A-Z0-9][\w&'’.+-]*\s+){1,5}(?:[Ss]ubscription|[Mm]embership|[Pp]lan|[Bb]ox|[Ss]ervice|[Cc]lub|[Pp]ackage)\b|\b(?:[Pp]lan|[Pp]roduct|[Ss]ubscription|[Mm]embership)\s*:\s*\S[^\n]{1,60}/;
     CONTACT_RE = /[\w.+-]+@[\w-]+(?:\.[\w-]+)+|(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b|\bcontact\s+(?:us|support|our\s+(?:support|customer|help))\b[^\n]{0,80}(?:https?:\/\/\S+|@)|\b(?:support|help)\s+(?:center|centre)\s*:?\s*https?:\/\/\S+/i;
     CANCEL_URL_RE = /https?:\/\/\S*(?:cancel|billing\.stripe\.com|customer[-_]?portal|\/portal|manage|subscription|account)\S*/i;
+    CHARGE_AMOUNT_EVENTS = /* @__PURE__ */ new Set(["subscription_created", "subscription_renewed", "upcoming_renewal", "trial_will_end"]);
     NOTICE_NOUN = {
       "reminder.trial_ending": "trial-ending reminder",
       "reminder.annual_renewal": "renewal reminder",
@@ -16459,6 +16567,64 @@ var init_email_plan = __esm({
   }
 });
 
+// ../rules/src/checks/forwarded.ts
+function headerAddress(block, name) {
+  const m = new RegExp(String.raw`^\s*[*>]*\s*${name}\s*:\s*\*?\s*(.+)$`, "im").exec(block);
+  if (!m) return void 0;
+  const a = ADDRESS_RE.exec(m[1]);
+  return a ? a[0].toLowerCase().replace(/[.>]+$/, "") : void 0;
+}
+function forwardedInfo(e) {
+  const hit = cache.get(e);
+  if (hit) return hit;
+  const text = e.text ?? "";
+  const marker = FWD_MARKER_RE.exec(text);
+  const forwarded = !!marker || FWD_SUBJECT_RE.test(e.subject ?? "");
+  const info = { forwarded };
+  if (forwarded) {
+    const start = marker ? marker.index : 0;
+    const block = text.slice(start, start + 1200);
+    const from = headerAddress(block, "From");
+    const to = headerAddress(block, "To");
+    if (from) info.originalFrom = from;
+    if (to) info.originalTo = to;
+  }
+  cache.set(e, info);
+  return info;
+}
+function domainOf(address) {
+  const m = /@([^\s<>"]+)/.exec(address ?? "");
+  return m ? m[1].toLowerCase().replace(/[>.]+$/, "") : "";
+}
+function isMorDomain(domain) {
+  return !!domain && MERCHANT_OF_RECORD_DOMAINS.some((d) => domain === d || domain.endsWith(`.${d}`));
+}
+function isMerchantOfRecordEmail(e) {
+  return isMorDomain(domainOf(e.from)) || isMorDomain(domainOf(forwardedInfo(e).originalFrom));
+}
+function inboundDomain() {
+  const env2 = typeof process !== "undefined" ? process.env.INBOUND_EMAIL_DOMAIN : void 0;
+  return (env2 ?? "").trim().replace(/^@/, "").replace(/\.$/, "").toLowerCase() || "inbound.subcomply.localhost";
+}
+function sentStraightToCheckbox(e) {
+  if (forwardedInfo(e).originalTo) return false;
+  if (e.scanId || e.relatedSignupAt || e.subscriptionRef || e.testRun) return false;
+  const addresses = (e.to ?? "").match(/[^\s<>,"]+@[^\s<>,"]+/g) ?? [];
+  const domain = inboundDomain();
+  return addresses.length > 0 && addresses.every((a) => domainOf(a) === domain);
+}
+var FWD_SUBJECT_RE, FWD_MARKER_RE, ADDRESS_RE, cache, MERCHANT_OF_RECORD_DOMAINS;
+var init_forwarded = __esm({
+  "../rules/src/checks/forwarded.ts"() {
+    "use strict";
+    FWD_SUBJECT_RE = /^\s*(?:(?:re|aw|sv)\s*:\s*)*(?:fwd?|fw|wg|tr)\s*:/i;
+    FWD_MARKER_RE = /(?:-{2,}\s*Forwarded message\s*-{2,}|Begin forwarded message\s*:|-{2,}\s*Original Message\s*-{2,}|-{2,}\s*Forwarded Message\s*-{2,}|^\s*_{8,}\s*$\s*^\s*From\s*:)/im;
+    ADDRESS_RE = /[^\s<>,"':;()[\]]+@[^\s<>,"':;()[\]]+\.[a-z]{2,}/i;
+    cache = /* @__PURE__ */ new WeakMap();
+    MERCHANT_OF_RECORD_DOMAINS = ["paddle.com", "paddle.net", "lemonsqueezy.com", "fastspring.com"];
+  }
+});
+
 // ../rules/src/checks/confirmation.ts
 function isPostSignupEmail(e) {
   if (e.kind !== "other" || !e.scanId || !e.relatedSignupAt) return false;
@@ -16471,10 +16637,12 @@ function findAcknowledgments(emails) {
   if (cached) return cached;
   const acks = [];
   const receipts = [];
-  const acknowledged = new Set(emails.filter((e) => e.kind === "acknowledgment").map((e) => recipientOf(e)).filter((r) => r !== ""));
+  const explicit = emails.filter((e) => e.kind === "acknowledgment");
+  const acknowledged = new Set(explicit.map((e) => recipientOf(e)).filter((r) => r !== ""));
   for (const e of emails) {
     if (e.kind === "acknowledgment") acks.push(e);
     else if (acknowledged.has(recipientOf(e))) continue;
+    else if (explicit.length && e.kind === "receipt" && (forwardedInfo(e).forwarded || isMerchantOfRecordEmail(e) || sentStraightToCheckbox(e))) continue;
     else if (e.kind === "receipt" || isPostSignupEmail(e)) {
       (looksLikeSubscriptionTerms(analyzeTerms(emailBody(e))) ? acks : receipts).push(e);
     }
@@ -16484,6 +16652,8 @@ function findAcknowledgments(emails) {
   return set;
 }
 function recipientOf(e) {
+  const original = forwardedInfo(e).originalTo;
+  if (original) return original;
   const m = /[^\s<>,"]+@[^\s<>,"]+/.exec(e.to ?? "");
   return m ? m[0].toLowerCase() : "";
 }
@@ -16693,6 +16863,7 @@ var init_confirmation = __esm({
     init_intro_terms();
     init_offer();
     init_email_plan();
+    init_forwarded();
     ACK_MAX_DELAY_HOURS = 24;
     NO_ACK_EMAIL_MESSAGE = "No acknowledgment email captured yet \u2014 BCC your sign-up confirmation email to your Checkbox inbound address (see Install), or add a test purchase to your scan settings so our shopper inbox receives it.";
     ackCache = /* @__PURE__ */ new WeakMap();
@@ -18309,6 +18480,17 @@ function requiredFor(reqs) {
   if (!out.size) for (const el of CHARGE_NOTICE_REQUIRED) out.add(el);
   return [...out];
 }
+function chargeGapPhrase(content, gaps, expected) {
+  const wrong = gaps.filter((g) => content.wrong?.[g]);
+  const absent = gaps.filter((g) => !content.wrong?.[g]);
+  const parts = [];
+  if (absent.length) parts.push(`do not state ${describeMissing(absent)}`);
+  for (const g of wrong) {
+    const said = content.wrong[g];
+    parts.push(g === "amount" ? `states ${ELEMENT_LABELS[g]} as \u201C${said}\u201D${expected ? `, but ${expected}` : ""}` : `states ${ELEMENT_LABELS[g]} as \u201C${said}\u201D, which does not count`);
+  }
+  return parts.join("; ");
+}
 async function runChargeNotice(input) {
   const id = "reminder.charge_notice";
   const configRefs = input.data.configRef ? [input.data.configRef] : [];
@@ -18336,6 +18518,12 @@ async function runChargeNotice(input) {
     }
     return c;
   };
+  const chargeExpected = (e) => {
+    const own = inForceAmount(e, input.ctx.events ?? [], chargePlanOpts.plans[0]?.currency);
+    const cur = (chargePlanOpts.plans[0]?.currency ?? "usd").toUpperCase();
+    if (own !== void 0) return `this subscription\u2019s charge is ${own.toFixed(2)} ${cur}`;
+    return chargePlanOpts.plans.length ? `the plan is ${chargePlanOpts.plans.map((p) => `${planAmount(p).toFixed(2)} ${p.currency.toUpperCase()} ${planEvery(p)}`).join(", ")}` : "";
+  };
   const counted = judged.filter((j) => j.state === "matched" || j.state === "partial" || j.state === "outside_window" || j.state === "missing");
   const matched = counted.filter((j) => j.state === "matched");
   const partial = counted.filter((j) => j.state === "partial");
@@ -18367,10 +18555,12 @@ async function runChargeNotice(input) {
       return makeResult(
         id,
         "fail",
-        `${incompleteMatched.length} of ${matched.length} charge notice(s) do not state ${describeMissing(x.missing)} (e.g. ${emailLabel(x.j.email)})`,
+        `${incompleteMatched.length} of ${matched.length} charge notice(s) ${chargeGapPhrase(content(x.j.email), x.missing, chargeExpected(x.j.email))} (e.g. ${emailLabel(x.j.email)})`,
         [...refs2(incompleteMatched.map((i) => i.j)), ...refs2(missing), ...refs2(outside)],
         0.75,
-        data
+        // Round 29 (pilot 28 item 11): when every failing notice is Checkbox Notices' own send, the plan fixes Checkbox's
+        // template and settings; it never asks the merchant's agent to change an email it does not send.
+        incompleteMatched.every((x2) => isCheckboxSentEmail(x2.j.email)) && !missing.length && !outside.length ? { ...data, contentByCheckbox: true } : data
       );
     }
     if (outside.length) {
@@ -20663,9 +20853,9 @@ function limiter(max) {
       run2();
     }
   };
-  return async (fn) => new Promise((resolve9, reject) => {
+  return async (fn) => new Promise((resolve10, reject) => {
     queue.push(() => {
-      fn().then(resolve9, reject).finally(() => {
+      fn().then(resolve10, reject).finally(() => {
         active--;
         next();
       });
@@ -22361,7 +22551,7 @@ var init_status = __esm({
           )
         })
       },
-      { code: "consent_implied", category: "content", when: has(/consent is implied by clicking/), build: () => ({ status: "needs_fix", fix: 'Add one unchecked checkbox "I agree to the automatic renewal terms above".' }) },
+      { code: "consent_implied", category: "content", when: has(/consent is implied by clicking/), build: () => ({ status: "needs_fix", fix: 'Ask for a separate yes to the renewal: usually one unchecked box, "I agree to the automatic renewal terms above".' }) },
       { code: "consent_general_terms", category: "content", when: has(/covers general terms, not the/), build: () => ({ status: "needs_fix", fix: 'Make the checkbox about the renewal: "I agree to the automatic renewal terms above."' }) },
       // Round 23 (pilot 22 nontech-founder done blocker): "does not appear to be required" means the capture could not see
       // whether the box is enforced (a script may block the purchase, as Stripe's own page does). A person who can try it
@@ -22804,7 +22994,7 @@ var init_status = __esm({
       "signup.disclosure.term_length": 'Say how often it renews ("renews every month until you cancel").',
       "signup.disclosure.proximity": "Put the renewal line under the price, before the card and email fields and the pay button.",
       "signup.disclosure.conspicuous": "Show the renewal line at body size, semibold, in your normal text colour.",
-      "signup.consent.affirmative": 'Add one unchecked checkbox "I agree to the automatic renewal terms above".',
+      "signup.consent.affirmative": 'Ask for a separate yes to the renewal: usually one unchecked box, "I agree to the automatic renewal terms above".',
       "signup.consent.not_prechecked": "Leave the consent checkbox unchecked by default.",
       "confirmation.email.sent": "Send an acknowledgment email right after sign-up (Checkbox has a template).",
       "confirmation.email.terms": "Restate the renewal terms (price, frequency, until cancelled) in the acknowledgment.",
@@ -25904,7 +26094,7 @@ __export(check_exports, {
   default: () => check_default
 });
 import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 function operationFor(endpoint) {
   const op = Object.values(OPERATIONS).find((o) => o.httpMethod === "POST" && o.path === endpoint);
   if (!op) throw new Error(`No API operation for POST ${endpoint}`);
@@ -25913,7 +26103,7 @@ function operationFor(endpoint) {
 async function readInput(ctx, file) {
   if (file === "-") return ctx.readStdin();
   try {
-    return readFileSync3(resolve(ctx.cwd, file), "utf8");
+    return readFileSync3(resolve2(ctx.cwd, file), "utf8");
   } catch (err) {
     throw new UsageError(`Cannot read ${file}: ${err.code ?? err.message}`);
   }
@@ -26201,7 +26391,7 @@ var init_check = __esm({
 
 // src/ci/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, isAbsolute, join as join3, resolve as resolve3 } from "node:path";
 function planList(config, ref) {
   if (Array.isArray(ref)) return ref;
   if (ref === "all" && !(config.plans ?? []).some((p) => p.name === "all")) return (config.plans ?? []).map((p) => p.name);
@@ -26209,7 +26399,7 @@ function planList(config, ref) {
 }
 function findConfig(cwd, explicit) {
   if (explicit) {
-    const p = isAbsolute(explicit) ? explicit : resolve2(cwd, explicit);
+    const p = isAbsolute(explicit) ? explicit : resolve3(cwd, explicit);
     return existsSync3(p) ? p : void 0;
   }
   for (const f of CONFIG_FILES) if (existsSync3(join3(cwd, f))) return join3(cwd, f);
@@ -26230,7 +26420,7 @@ function loadConfig(path) {
   }
   const issues = validateConfig(value);
   if (issues.length) throw new ConfigError(path, issues);
-  return { config: value, path, dir: dirname2(path), raw };
+  return { config: value, path, dir: dirname3(path), raw };
 }
 function validateConfig(value) {
   const is = new Issues();
@@ -26932,11 +27122,17 @@ function findStripeKey(env2, processEnv) {
     sources.push([`${k} (environment)`, processEnv[k]]);
     sources.push([`${k} (.env)`, env2[k]]);
   }
-  const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_test_[A-Za-z0-9]{10,}$/.test(s2[1].trim()));
-  const pick = found.find((s2) => s2[1].startsWith("rk_test_")) ?? found[0];
-  if (!pick) return void 0;
-  const key = pick[1].trim();
-  return { key, hint: `${key.slice(0, 8)}\u2026${key.slice(-4)}`, source: pick[0], restricted: key.startsWith("rk_test_") };
+  const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/.test(s2[1].trim())).map(([src, v]) => [src, v.trim()]);
+  const hint = (key) => `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
+  const pick = found.find((s2) => s2[1].startsWith("rk_test_"));
+  if (pick) return { key: { key: pick[1], hint: hint(pick[1]), source: pick[0], restricted: true } };
+  const other = found.find((s2) => s2[1].startsWith("sk_test_")) ?? found[0];
+  if (!other) return {};
+  return { refused: { hint: hint(other[1]), source: other[0], kind: /_live_/.test(other[1]) ? "live" : "secret" } };
+}
+function stripeKeyRefusedMessage(r) {
+  const what = r.kind === "live" ? `${r.hint} in ${r.source} is a LIVE Stripe key. Live keys are never stored by the CLI or an agent: a person adds them in the Checkbox dashboard.` : `${r.hint} in ${r.source} is the Stripe secret key, which can do everything in your Stripe test account, so Checkbox refuses it.`;
+  return `${what} For test runs, make a restricted TEST key instead: in Stripe, switch to Test mode, open Developers \u2192 API keys \u2192 Create restricted key, tick the permissions on https://checkbox.site/docs/guides/stripe-key, and put the key (rk_test_\u2026) in STRIPE_RESTRICTED_KEY in .env.local (never in a chat). Then run \`checkbox init\` again.`;
 }
 function sessionLiteral(text, index) {
   const open2 = text.indexOf("{", index);
@@ -27018,7 +27214,8 @@ function detectProject(root, processEnv = {}) {
     checkoutCode,
     payButtons,
     checkoutSessions,
-    ...stripeKey ? { stripeTestKey: stripeKey } : {},
+    ...stripeKey.key ? { stripeTestKey: stripeKey.key } : {},
+    ...stripeKey.refused ? { stripeKeyRefused: stripeKey.refused } : {},
     ...brand ? { brand } : {},
     plans: plansFromSessions(checkoutSessions),
     env: env2
@@ -27059,7 +27256,7 @@ var init_detect = __esm({
 
 // src/ci/scaffold.ts
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { basename, dirname as dirname3, join as join5, relative as relative2 } from "node:path";
+import { basename, dirname as dirname4, join as join5, relative as relative2 } from "node:path";
 function walk3(root, visit) {
   let n = 0;
   const go = (dir, depth) => {
@@ -27128,7 +27325,7 @@ function paramsBuilder(root, file, line2) {
   const imp = new RegExp(`import\\s*\\{[^}]*\\b${fn}\\b[^}]*\\}\\s*from\\s*['"](\\.{1,2}/[^'"]+)['"]`).exec(text);
   let target;
   if (imp) {
-    const base = join5(dirname3(file), imp[1]).split("\\").join("/");
+    const base = join5(dirname4(file), imp[1]).split("\\").join("/");
     target = [base, ...[".ts", ".tsx", ".js", ".mjs", "/index.ts", "/index.js"].map((e) => `${base.replace(/\.(?:[cm]?js)$/, "")}${e}`)].find((f) => /\.[cm]?[jt]sx?$/.test(f) && existsSync5(join5(root, f)));
   } else if (new RegExp(`export\\s+(?:async\\s+)?function\\s+${fn}\\b|export\\s+const\\s+${fn}\\b`).test(text)) target = file;
   return target ? { module: `${target}#${fn}`, takesArgs } : void 0;
@@ -27315,7 +27512,7 @@ var init_scaffold = __esm({
 
 // src/ci/coverage.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join6, relative as relative3, resolve as resolve3 } from "node:path";
+import { join as join6, relative as relative3, resolve as resolve4 } from "node:path";
 function callsIn(text, file) {
   const hits = [];
   for (const [re, kind] of PATTERNS) {
@@ -27337,7 +27534,7 @@ function callsIn(text, file) {
 }
 function coverageOf(loaded, root, files) {
   const cfg = loaded.config;
-  const toRoot = (p) => relative3(root, resolve3(loaded.dir, p)).split("\\").join("/");
+  const toRoot = (p) => relative3(root, resolve4(loaded.dir, p)).split("\\").join("/");
   const calls = [];
   const visit = (rel2) => {
     if (!CODE.test(rel2) || TESTISH.test(rel2)) return;
@@ -27438,10 +27635,10 @@ var init_coverage = __esm({
 // src/ci/inputs.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve5 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 function readRel(dir, file) {
-  const abs = isAbsolute2(file) ? file : resolve4(dir, file);
+  const abs = isAbsolute2(file) ? file : resolve5(dir, file);
   try {
     return readFileSync8(abs, "utf8");
   } catch (err) {
@@ -27452,26 +27649,42 @@ function readRel(dir, file) {
 function hasTsx(dir) {
   for (let d = dir, i = 0; i < 8; i++) {
     if (existsSync6(join7(d, "node_modules", "tsx", "package.json"))) return true;
-    const up = dirname4(d);
+    const up = dirname5(d);
+    if (up === d) break;
+    d = up;
+  }
+  return false;
+}
+function declaresTsx(dir) {
+  for (let d = dir, i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse(readFileSync8(join7(d, "package.json"), "utf8"));
+      if (pkg.dependencies?.tsx || pkg.devDependencies?.tsx) return true;
+    } catch {
+    }
+    const up = dirname5(d);
     if (up === d) break;
     d = up;
   }
   return false;
 }
+function addTsx(dir, detail = "") {
+  return declaresTsx(dir) ? NOT_INSTALLED : `Add tsx to the project (npm install -D tsx${detail})`;
+}
 function loaderFlags(file, dir, nodeVersion = process.versions.node, features = process.features) {
   if (/\.[cm]?js$/.test(file)) return [];
   if (hasTsx(dir)) return ["--import", "tsx"];
-  if (/\.[jt]sx$/.test(file)) return `${file}: JSX modules need tsx (npm install -D tsx), or export the rendered { subject, html } from a .js / .ts file`;
+  if (/\.[jt]sx$/.test(file)) return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: JSX modules need tsx (npm install -D tsx), or export the rendered { subject, html } from a .js / .ts file`;
   if (features.typescript) return [];
   const [major, minor] = nodeVersion.split(".").map(Number);
   if (major > 22 || major === 22 && minor >= 6) return ["--experimental-strip-types"];
-  return `${file}: TypeScript modules need Node 22.6+ (type stripping) or tsx in the project (npm install -D tsx); or point "file" at a JSON export`;
+  return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: TypeScript modules need Node 22.6+ (type stripping) or tsx in the project (npm install -D tsx); or point "file" at a JSON export`;
 }
 function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
   const hash = ref.lastIndexOf("#");
   const file = hash > 0 ? ref.slice(0, hash) : ref;
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
-  const abs = resolve4(dir, file);
+  const abs = resolve5(dir, file);
   if (!existsSync6(abs)) return Promise.reject(new InputError(`${file} does not exist (paths are relative to checkbox.json)`));
   const flags = loaderFlags(file, dir);
   if (typeof flags === "string") return Promise.reject(new InputError(flags));
@@ -27512,13 +27725,13 @@ function moduleErrorMessage(stderr, dir, flags = []) {
     }
     const noExt = !/\.[cm]?[jt]sx?$|\.json$/.test(target);
     if (noExt && !tsx) {
-      return `${rel2(from)} imports ${rel2(target)} without a file extension, which Node cannot resolve on its own. Add tsx to the project (npm install -D tsx; checkbox ci then imports modules the way your bundler does), or write the import with its extension (e.g. './${rel2(target).split("/").pop()}.ts').`;
+      return `${rel2(from)} imports ${rel2(target)} without a file extension, which Node cannot resolve on its own. ${addTsx(dir, "; checkbox ci then imports modules the way your bundler does")}, or write the import with its extension (e.g. './${rel2(target).split("/").pop()}.ts').`;
     }
     return `${rel2(from)} imports ${rel2(target)}, which does not exist${noExt ? " (tsx found no .ts / .js file of that name either)" : ""}.`;
   }
   if (/ERR_UNKNOWN_FILE_EXTENSION/.test(text)) {
     const file = /Unknown file extension "([^"]+)" for (\S+)/.exec(text);
-    return `Node cannot import ${file ? `${rel2(file[2])} (${file[1]})` : "a file the module imports"}. Add tsx to the project (npm install -D tsx), or point the entry at a .js / .ts file that imports no ${file?.[1] ?? "such"} files.`;
+    return `Node cannot import ${file ? `${rel2(file[2])} (${file[1]})` : "a file the module imports"}. ${addTsx(dir)}, or point the entry at a .js / .ts file that imports no ${file?.[1] ?? "such"} files.`;
   }
   const lines = text.split("\n").map((l) => l.trim()).filter((l) => l && !/^at /.test(l) && !/^Node\.js v\d/.test(l));
   const first2 = lines.find((l) => /^(?:[A-Z]\w*)?Error\b.*:/.test(l)) ?? lines.find((l) => /error/i.test(l)) ?? lines[lines.length - 1] ?? "";
@@ -27552,7 +27765,7 @@ function exportLine(dir, ref) {
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
   let text;
   try {
-    text = readFileSync8(resolve4(dir, file), "utf8");
+    text = readFileSync8(resolve5(dir, file), "utf8");
   } catch {
     return 1;
   }
@@ -27591,7 +27804,7 @@ function planTerms(config, plan2) {
   return t;
 }
 function rel(loaded, root, file) {
-  return relative4(root, resolve4(loaded.dir, file)).split("\\").join("/") || file;
+  return relative4(root, resolve5(loaded.dir, file)).split("\\").join("/") || file;
 }
 function emailFromFile(content, file, subject) {
   let body = content;
@@ -27726,14 +27939,20 @@ function pageJob(loaded, e, o, root) {
     };
   }
   if (e.url) {
-    if (!o.online) job.skip = "URL pages are fetched by the API: run with --online (and CHECKBOX_SECRET_KEY)";
+    if (!o.online) job.skip = 'URL pages are fetched by the API: run with --online and a live-mode key (ck_live_\u2026 on an activated account), or list the built page under "file" to check it offline';
     else job.body = { url: e.url, ...common3 };
     return job;
   }
   try {
     if (!e.source) job.target = { file: rel(loaded, root, e.file), line: 1 };
     job.inputs.push(e.file);
-    const html = readRel(dir, e.file);
+    let html;
+    try {
+      html = readRel(dir, e.file);
+    } catch (err) {
+      if (!existsSync6(resolve5(dir, e.file))) throw new InputError(`${e.file} does not exist (paths are relative to checkbox.json). If it is build output, build it before checkbox ci: in GitHub Actions, add a build step before the Checkbox step (\`checkbox ci init\` writes one when package.json has a build script).`);
+      throw err;
+    }
     if (!e.source) job.locate = (needles) => lineOfAny(html, needles);
     job.body = { html, ...common3 };
   } catch (err) {
@@ -27800,7 +28019,7 @@ async function resolveJobs(loaded, o) {
   }
   return jobs;
 }
-var InputError, CHILD, jurisdictionsOf;
+var InputError, NOT_INSTALLED, CHILD, jurisdictionsOf;
 var init_inputs = __esm({
   "src/ci/inputs.ts"() {
     "use strict";
@@ -27813,6 +28032,7 @@ var init_inputs = __esm({
         this.name = "InputError";
       }
     };
+    NOT_INSTALLED = "tsx is in package.json but not installed: install the project's dependencies before checkbox ci (npm ci; in GitHub Actions a `- run: npm ci` step before the Checkbox step, which `checkbox ci init` writes)";
     CHILD = `
 const [url, name, argsJson] = process.argv.slice(1);
 const mod = await import(url);
@@ -27831,106 +28051,6 @@ process.exit(0);
   }
 });
 
-// src/ci/report.ts
-function icon(s2, c) {
-  if (s2 === "pass") return c.green("\u2713");
-  if (s2 === "fail" || s2 === "error") return c.red("\u2717");
-  if (s2 === "needs_review") return c.yellow("?");
-  return c.dim("\u2013");
-}
-function overallLine(run2) {
-  const s2 = run2.summary;
-  const parts = [];
-  if (s2.error) parts.push(`${s2.error} could not run`);
-  if (s2.fail) parts.push(`${s2.fail} need${s2.fail === 1 ? "s" : ""} a fix`);
-  if (s2.needs_review) parts.push(`${s2.needs_review} need${s2.needs_review === 1 ? "s" : ""} review${run2.strict ? " (strict)" : ""}`);
-  if (s2.pass) parts.push(`${s2.pass} pass`);
-  if (s2.not_applicable) parts.push(`${s2.not_applicable} not required`);
-  if (s2.skipped) parts.push(`${s2.skipped} skipped`);
-  return parts.join(" \xB7 ") || "nothing checked";
-}
-function renderHuman(run2, c, opts = {}) {
-  const lines = [];
-  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
-  lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
-  const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
-  for (const x of run2.checks) {
-    const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
-    lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
-    if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
-    if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
-    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
-    const alerts = x.alerts ?? [];
-    for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
-    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
-    if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
-  }
-  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
-  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
-  if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
-  lines.push(c.dim(run2.disclaimer));
-  return lines;
-}
-function annotations(run2) {
-  const out = [];
-  for (const x of run2.checks) {
-    const alerts = x.alerts ?? [];
-    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
-    if (!level) continue;
-    const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
-    const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
-${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
-    out.push(`::${level} ${props.join(",")}::${escData(body)}`);
-  }
-  return out;
-}
-function stepSummary(run2) {
-  const lines = [];
-  lines.push("## Checkbox compliance checks", "");
-  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
-  lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
-  lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
-  for (const x of run2.checks) {
-    const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
-    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
-    lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
-  }
-  const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
-  for (const x of detailed) {
-    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.toLowerCase() : `${x.fixes.length} fixes`)}</summary>`, "");
-    if (x.fixes.length) lines.push(...x.fixes.map((f) => `- ${f}`), "");
-    if (x.corrected) {
-      const fence = x.corrected.body.includes("```") ? "````" : "```";
-      lines.push(`${fence}${x.corrected.format === "json" ? "json" : "text"}`, x.corrected.body, fence, "");
-    }
-    lines.push("</details>");
-  }
-  lines.push("", `<sub>${run2.disclaimer} Docs: https://checkbox.site/docs/guides/ci</sub>`, "");
-  return lines.join("\n");
-}
-function escapeHtml(s2) {
-  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
-var init_report = __esm({
-  "src/ci/report.ts"() {
-    "use strict";
-    init_output();
-    TYPE_LABEL = {
-      stripe_checkout: "Stripe Checkout",
-      disclosure: "Disclosure",
-      page: "Page",
-      email: "Email",
-      notice_schedule: "Notice schedule"
-    };
-    where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
-    escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
-    escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
-    cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
-    STATUS_MD = { pass: "\u2705", fail: "\u274C", needs_review: "\u26A0\uFE0F", error: "\u274C", skipped: "\u23ED\uFE0F", not_applicable: "\u2796" };
-  }
-});
-
 // ../rules/src/fixes/conflicts.ts
 var init_conflicts = __esm({
   "../rules/src/fixes/conflicts.ts"() {
@@ -28435,10 +28555,27 @@ function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
 function ciVocabulary(text) {
-  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored");
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+}
+function pricingPageFixes(fixes) {
+  const reworded = fixes.map(
+    (f) => f.replace(/,? before the card and email fields and the (?:pay|purchase) button/g, ", next to the plan's button").replace(/,? before the card and email fields/g, ", next to the plan's button")
+  );
+  const out = [];
+  const renewalLineFor = /* @__PURE__ */ new Set();
+  for (const f of reworded) {
+    const card = /^(Plan card [^:]+): /.exec(f)?.[1] ?? "";
+    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price)/.test(f);
+    if (isRenewalLine) {
+      if (renewalLineFor.has(card)) continue;
+      renewalLineFor.add(card);
+    }
+    if (!out.includes(f)) out.push(f);
+  }
+  return out;
 }
 function stripeConsentFix(text, params) {
-  if (!/^Add one unchecked checkbox/.test(text)) return text;
+  if (!/^(Ask for a separate yes to the renewal|Add one unchecked checkbox)/.test(text)) return text;
   const cc = params?.consent_collection;
   if (cc?.terms_of_service === "required") return text;
   return 'Set consent_collection: { terms_of_service: "required" } in the params: Stripe then shows an unchecked consent checkbox, labelled with custom_text.terms_of_service_acceptance.message.';
@@ -28596,7 +28733,9 @@ async function runJob(job, engine, config, opts = {}) {
   if (alerts.length) Object.assign(base, { alerts });
   const status = ciStatusOf(report);
   const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
-  const fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  let fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  const pricingPage = job.type === "page" && job.body?.page_kind === "pricing";
+  if (pricingPage) fixes = pricingPageFixes(fixes);
   const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b/.test(p));
   const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review" || status === "pass" && unreadText.some((p) => /^(?:custom_text|consent_collection|discounts|subscription_data\.trial)/.test(p)));
   if (unread) {
@@ -28621,7 +28760,15 @@ async function runJob(job, engine, config, opts = {}) {
     const line2 = needles.length ? job.locate(needles) : void 0;
     if (line2) base.target = { ...base.target, line: line2 };
   }
-  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : status;
+  const declaredCoupon = !unread && status === "pass" && job.type === "stripe_checkout" ? (report.warnings ?? []).find((w) => w.code === "coupon_unverified" && /merchant\.intro_\* and are not verified/.test(w.message)) : void 0;
+  if (declaredCoupon) {
+    const id = /discounts use (coupon|promotion code) (\S+?),/.exec(declaredCoupon.message);
+    const what = id ? `${id[1]} ${id[2]}` : "the coupon";
+    fixes.unshift(
+      engine.mode === "offline" ? `The intro price is declared in checkbox.json, not verified: offline, Checkbox cannot read ${what} from Stripe. Run with --online (CHECKBOX_SECRET_KEY, and the site's Stripe key connected) so Checkbox reads it and compares its percent / amount off and duration with the declared intro.` : `The intro price is declared in checkbox.json, not verified: Checkbox could not read ${what} through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?). Until it is read, its percent / amount off and duration are not compared with the declared intro.`
+    );
+  }
+  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon ? "needs_review" : status;
   const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
   if (corrected?.format === "json" && job.placeholders) {
     const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
@@ -28632,17 +28779,17 @@ async function runJob(job, engine, config, opts = {}) {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report),
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
     report
   };
 }
-function countedLabel(label, r) {
+function countedLabel(label, r, adjust) {
   const m = /^(\d+) fix(?:es)? needed/.exec(label);
   if (!m) return label;
-  const n = fixesOf(r, true).length;
+  const n = (adjust ? adjust(fixesOf(r, true)) : fixesOf(r, true)).length;
   if (!n || n === Number(m[1])) return label;
   return label.replace(m[0], `${n} fix${n === 1 ? "" : "es"} needed`);
 }
@@ -28652,6 +28799,7 @@ function exitCodeOf(checks, strict) {
   if (checks.some((c) => c.status === "error")) return { status: "error", exit: EXIT.usage };
   if (checks.some((c) => c.status === "fail")) return { status: "fail", exit: EXIT.fail };
   if (checks.some((c) => c.status === "needs_review")) return { status: "needs_review", exit: strict || checks.some((c) => c.blocking) ? EXIT.needs_review : EXIT.ok };
+  if (!checks.some((c) => c.status === "pass")) return { status: "skipped", exit: EXIT.needs_review };
   return { status: "pass", exit: EXIT.ok };
 }
 function mergeSourcePatches(checks) {
@@ -28673,6 +28821,11 @@ function mergeSourcePatches(checks) {
     }
   }
 }
+function nothingCheckedMessage(run2) {
+  const urlSkipped = run2.checks.some((c) => c.status === "skipped" && /^URL pages/.test(c.message ?? ""));
+  const how = urlSkipped ? run2.mode === "offline" ? ' Page entries with a "url" are fetched only with --online and an API key (CHECKBOX_SECRET_KEY); offline, point them at the built HTML with "file" instead.' : ' Page entries with a "url" need a key that can read that site (a live key for a live site); or point them at the built HTML with "file".' : ' Add a check checkbox.json can run (a "file" page, a disclosure, Stripe Checkout params or an email).';
+  return `Nothing was checked: every check was skipped or does not apply, so this run is not a pass (exit 2).${how}`;
+}
 async function runCi(jobs, engine, opts) {
   const checks = [...opts.extra ?? []];
   for (const j of jobs) checks.push(await runJob(j, engine, opts.config, { ...opts.notices ? { notices: opts.notices } : {} }));
@@ -28738,8 +28891,112 @@ var init_runner = __esm({
   }
 });
 
+// src/ci/report.ts
+function icon(s2, c) {
+  if (s2 === "pass") return c.green("\u2713");
+  if (s2 === "fail" || s2 === "error") return c.red("\u2717");
+  if (s2 === "needs_review") return c.yellow("?");
+  return c.dim("\u2013");
+}
+function overallLine(run2) {
+  const s2 = run2.summary;
+  const parts = [];
+  if (s2.error) parts.push(`${s2.error} could not run`);
+  if (s2.fail) parts.push(`${s2.fail} need${s2.fail === 1 ? "s" : ""} a fix`);
+  if (s2.needs_review) parts.push(`${s2.needs_review} need${s2.needs_review === 1 ? "s" : ""} review${run2.strict ? " (strict)" : ""}`);
+  if (s2.pass) parts.push(`${s2.pass} pass`);
+  if (s2.not_applicable) parts.push(`${s2.not_applicable} not required`);
+  if (s2.skipped) parts.push(`${s2.skipped} skipped`);
+  return parts.join(" \xB7 ") || "nothing checked";
+}
+function renderHuman(run2, c, opts = {}) {
+  const lines = [];
+  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
+  lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
+  const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
+  for (const x of run2.checks) {
+    const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
+    lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
+    if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
+    if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
+    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
+    const alerts = x.alerts ?? [];
+    for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
+    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
+  }
+  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
+  if (run2.status === "skipped") lines.push("", c.red(wrap(nothingCheckedMessage(run2), 110, "")));
+  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
+  if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
+  lines.push(c.dim(run2.disclaimer));
+  return lines;
+}
+function annotations(run2) {
+  const out = [];
+  for (const x of run2.checks) {
+    const alerts = x.alerts ?? [];
+    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
+    if (!level) continue;
+    const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
+    const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+    out.push(`::${level} ${props.join(",")}::${escData(body)}`);
+  }
+  if (run2.status === "skipped") out.push(`::error file=${escProp(run2.config)},title=${escProp("Checkbox: nothing was checked")}::${escData(nothingCheckedMessage(run2))}`);
+  return out;
+}
+function stepSummary(run2) {
+  const lines = [];
+  lines.push("## Checkbox compliance checks", "");
+  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
+  lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
+  if (run2.status === "skipped") lines.push(`\u274C ${nothingCheckedMessage(run2)}`, "");
+  lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
+  for (const x of run2.checks) {
+    const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
+    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
+    lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
+  }
+  const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
+  for (const x of detailed) {
+    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.toLowerCase() : `${x.fixes.length} fixes`)}</summary>`, "");
+    if (x.fixes.length) lines.push(...x.fixes.map((f) => `- ${f}`), "");
+    if (x.corrected) {
+      const fence = x.corrected.body.includes("```") ? "````" : "```";
+      lines.push(`${fence}${x.corrected.format === "json" ? "json" : "text"}`, x.corrected.body, fence, "");
+    }
+    lines.push("</details>");
+  }
+  lines.push("", `<sub>${run2.disclaimer} Docs: https://checkbox.site/docs/guides/ci</sub>`, "");
+  return lines.join("\n");
+}
+function escapeHtml(s2) {
+  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
+var init_report = __esm({
+  "src/ci/report.ts"() {
+    "use strict";
+    init_output();
+    init_runner();
+    TYPE_LABEL = {
+      stripe_checkout: "Stripe Checkout",
+      disclosure: "Disclosure",
+      page: "Page",
+      email: "Email",
+      notice_schedule: "Notice schedule"
+    };
+    where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
+    escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+    escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
+    cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
+    STATUS_MD = { pass: "\u2705", fail: "\u274C", needs_review: "\u26A0\uFE0F", error: "\u274C", skipped: "\u23ED\uFE0F", not_applicable: "\u2796" };
+  }
+});
+
 // src/commands/plan/lib.ts
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
 async function resolveSite(ctx, flag, client) {
   const explicit = flag ?? ctx.env.CHECKBOX_SITE;
   if (explicit) {
@@ -28747,10 +29004,10 @@ async function resolveSite(ctx, flag, client) {
     return explicit;
   }
   const projects = ctx.config.load().init?.projects ?? {};
-  for (let dir = resolve5(ctx.cwd); ; dir = dirname5(dir)) {
+  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
     const site = projects[dir]?.site;
     if (site) return site;
-    if (dirname5(dir) === dir) break;
+    if (dirname6(dir) === dir) break;
   }
   const list2 = await client.sdk.sites.list({ limit: 3 });
   const sites = list2?.data ?? [];
@@ -28807,12 +29064,28 @@ var init_lib = __esm({
 });
 
 // src/ci/workflow.ts
-var WORKFLOW_PATH, WORKFLOW_YAML;
-var init_workflow = __esm({
-  "src/ci/workflow.ts"() {
-    "use strict";
-    WORKFLOW_PATH = ".github/workflows/checkbox.yml";
-    WORKFLOW_YAML = `# Checkbox: automatic-renewal law checks on every pull request (https://checkbox.site/docs/guides/ci).
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+function workflowYaml(needs = {}) {
+  const node = !!(needs.install || needs.build);
+  const steps = ["      - uses: actions/checkout@v4"];
+  if (node) {
+    steps.push("      - uses: actions/setup-node@v4", "        with:", "          node-version: 20");
+    if (needs.install) steps.push(`      # ${needs.why?.install ?? 'checkbox.json "module" entries import your code and its dependencies.'}`, `      - run: ${needs.install}`);
+    if (needs.build) steps.push(`      # ${needs.why?.build ?? 'checkbox.json "pages" read built HTML, which a fresh clone does not have.'}`, `      - run: ${needs.build}`);
+  } else {
+    steps.push('      # Only needed when checkbox.json uses "module" entries that import your dependencies:', "      # - run: npm ci");
+  }
+  steps.push("      - uses: checkbox-site/checkbox@v1", "        # with:", "        #   strict: true          # also fail when a check needs review");
+  if (needs.urlPages) {
+    steps.push(
+      '        #   args: --online        # "url" pages are fetched by the API: needs a LIVE key (ck_live_\u2026) on an',
+      '        #                         # activated account. Without one, list the built page as "file" instead.'
+    );
+  } else steps.push("        #   args: --online        # URL pages via the API; needs the env below");
+  steps.push("        # env:", "        #   CHECKBOX_SECRET_KEY: ${{ secrets.CHECKBOX_SECRET_KEY }}");
+  return `# Checkbox: automatic-renewal law checks on every pull request (https://checkbox.site/docs/guides/ci).
 # Runs the checks listed in checkbox.json with the Checkbox rules engine, offline (no key, no network), annotates the
 # lines that need a fix and writes a summary with the corrected params / text to the job page.
 name: Checkbox
@@ -28830,35 +29103,85 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      # Only needed when checkbox.json uses "module" entries that import your dependencies:
-      # - run: npm ci
-      - uses: checkbox-site/checkbox@v1
-        # with:
-        #   strict: true          # also fail when a check needs review
-        #   args: --online        # URL pages via the API; needs the env below
-        # env:
-        #   CHECKBOX_SECRET_KEY: \${{ secrets.CHECKBOX_SECRET_KEY }}
+${steps.join("\n")}
 `;
+}
+function installCommand(root) {
+  if (existsSync7(join8(root, "pnpm-lock.yaml"))) return "corepack enable && pnpm install --frozen-lockfile";
+  if (existsSync7(join8(root, "yarn.lock"))) return "corepack enable && yarn install --immutable";
+  if (existsSync7(join8(root, "bun.lockb")) || existsSync7(join8(root, "bun.lock"))) return "npx --yes bun install --frozen-lockfile";
+  if (existsSync7(join8(root, "package-lock.json")) || existsSync7(join8(root, "npm-shrinkwrap.json"))) return "npm ci";
+  return "npm install";
+}
+function runScript(root, script) {
+  if (existsSync7(join8(root, "pnpm-lock.yaml"))) return `pnpm run ${script}`;
+  if (existsSync7(join8(root, "yarn.lock"))) return `yarn run ${script}`;
+  return `npm run ${script}`;
+}
+function notInClone(root, files) {
+  if (!files.length) return [];
+  let tracked = null;
+  try {
+    const out = execFileSync("git", ["ls-files", "-z", "--", ...files], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+    tracked = new Set(out.split("\0").filter(Boolean));
+  } catch {
+    tracked = null;
+  }
+  return files.filter((f) => tracked ? !tracked.has(f.replace(/^\.\//, "")) : !existsSync7(join8(root, f)));
+}
+function workflowNeeds(root, config) {
+  const checks = config.checks ?? {};
+  const list2 = (k) => Array.isArray(checks[k]) ? checks[k] : [];
+  const modules = [...list2("stripe_checkout"), ...list2("emails"), ...list2("disclosures")].some((e) => typeof e.module === "string" && !!e.module);
+  const pageFiles = list2("pages").flatMap((e) => typeof e.file === "string" && !e.file.startsWith("TODO") ? [e.file] : []);
+  const urlPages = list2("pages").some((e) => typeof e.url === "string");
+  let pkg = null;
+  try {
+    pkg = JSON.parse(readFileSync9(join8(root, "package.json"), "utf8"));
+  } catch {
+    pkg = null;
+  }
+  const built = notInClone(root, pageFiles);
+  const buildScript = pkg?.scripts?.build ? "build" : void 0;
+  const needs = { why: {} };
+  if (built.length && buildScript) {
+    needs.build = runScript(root, buildScript);
+    needs.why.build = `checkbox.json "pages" read ${built.slice(0, 2).join(", ")}${built.length > 2 ? ", \u2026" : ""}, built here (not in git).`;
+  }
+  if (pkg && (modules || needs.build)) {
+    needs.install = installCommand(root);
+    needs.why.install = modules ? 'checkbox.json "module" entries import your code and its dependencies.' : "The build needs your dependencies.";
+  }
+  if (urlPages) needs.urlPages = true;
+  return needs;
+}
+var WORKFLOW_PATH, WORKFLOW_YAML;
+var init_workflow = __esm({
+  "src/ci/workflow.ts"() {
+    "use strict";
+    WORKFLOW_PATH = ".github/workflows/checkbox.yml";
+    WORKFLOW_YAML = workflowYaml();
   }
 });
 
 // src/commands/ci/index.ts
 var ci_exports = {};
 __export(ci_exports, {
+  attachSiteForCoupons: () => attachSiteForCoupons,
+  couponIdsIn: () => couponIdsIn,
   default: () => ci_default,
   touchesConfig: () => touchesConfig,
   undiffableInputs: () => undiffableInputs
 });
-import { execFileSync } from "node:child_process";
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname6, join as join8, relative as relative5, resolve as resolve6 } from "node:path";
+import { dirname as dirname7, join as join9, relative as relative5, resolve as resolve7 } from "node:path";
 function gitChanged(cwd, base) {
   try {
-    const root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-    const out = execFileSync("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve6(root, f)) };
+    const root = execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    const out = execFileSync2("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve7(root, f)) };
   } catch (err) {
     const msg2 = String(err.stderr || err.message).trim().split("\n")[0];
     return `git diff ${base}...HEAD failed (${msg2}); fetch the base branch (actions/checkout with fetch-depth: 0)`;
@@ -28868,13 +29191,13 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   const need = [];
   const out = [];
   for (const e of loaded.config.checks.pages ?? []) {
-    if (e.source) need.push({ path: resolve6(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
+    if (e.source) need.push({ path: resolve7(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
     else if (e.url) out.push(`pages "${e.name}" is a URL with no "source" file to diff`);
-    else if (e.file) need.push({ path: resolve6(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
+    else if (e.file) need.push({ path: resolve7(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
   }
   for (const j of jobs) {
     if (j.type === "page") continue;
-    for (const f of j.inputs) need.push({ path: resolve6(loaded.dir, f), label: `"${j.name}" reads ${f}` });
+    for (const f of j.inputs) need.push({ path: resolve7(loaded.dir, f), label: `"${j.name}" reads ${f}` });
   }
   if (!need.length) return out;
   const real = (p) => {
@@ -28889,8 +29212,8 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   let tracked;
   try {
     const rels = [...new Set(need.map((n) => relative5(gitRoot, n.path)))];
-    const listed = execFileSync("git", ["ls-files", "-z", "--", ...rels], { cwd: gitRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve6(gitRoot, f)));
+    const listed = execFileSync2("git", ["ls-files", "-z", "--", ...rels], { cwd: gitRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve7(gitRoot, f)));
   } catch (err) {
     return `git ls-files failed (${String(err.stderr || err.message).trim().split("\n")[0]})`;
   }
@@ -28902,7 +29225,7 @@ function touchesConfig(loaded, jobs, changed) {
   if (set.has(loaded.path)) return true;
   const codeChanged = changed.some((f) => /\.(?:[cm]?[jt]sx?)$/.test(f));
   for (const j of jobs) {
-    for (const f of j.inputs) if (set.has(resolve6(loaded.dir, f))) return true;
+    for (const f of j.inputs) if (set.has(resolve7(loaded.dir, f))) return true;
   }
   const hasModules = [...loaded.config.checks.stripe_checkout ?? [], ...loaded.config.checks.emails ?? []].some((e) => "module" in e && e.module);
   return hasModules && codeChanged;
@@ -28927,24 +29250,26 @@ async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
   const explicit = str(p.flags, "config");
-  const configPath = explicit ? resolve6(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join8(ctx.cwd, f)).find((f) => existsSync7(f)) ?? join8(ctx.cwd, CONFIG_FILES[0]);
-  const workflowPath = join8(ctx.cwd, WORKFLOW_PATH);
+  const configPath = explicit ? resolve7(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join9(ctx.cwd, f)).find((f) => existsSync8(f)) ?? join9(ctx.cwd, CONFIG_FILES[0]);
+  const workflowPath = join9(ctx.cwd, WORKFLOW_PATH);
   const force = bool(p.flags, "force") === true;
   const withWorkflow = bool(p.flags, "workflow") !== false;
   const projects = ctx.config.load().init?.projects ?? {};
   let facts = {};
-  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
+  for (let dir = resolve7(ctx.cwd); ; dir = dirname7(dir)) {
     if (projects[dir]?.facts) {
       facts = projects[dir].facts;
       break;
     }
-    if (dirname6(dir) === dir) break;
+    if (dirname7(dir) === dir) break;
   }
   const s2 = scaffoldConfig(ctx.cwd, ctx.env, facts);
-  const actionFor = (f) => existsSync7(f) ? force ? "overwrite" : "keep" : "create";
+  const actionFor = (f) => existsSync8(f) ? force ? "overwrite" : "keep" : "create";
   const files = [{ path: configPath, content: `${JSON.stringify(s2.config, null, 2)}
 `, action: actionFor(configPath) }];
-  if (withWorkflow) files.push({ path: workflowPath, content: WORKFLOW_YAML, action: actionFor(workflowPath) });
+  const needs = workflowNeeds(ctx.cwd, s2.config);
+  const workflowSteps = [...needs.install ? [needs.install] : [], ...needs.build ? [needs.build] : []];
+  if (withWorkflow) files.push({ path: workflowPath, content: workflowYaml(needs), action: actionFor(workflowPath) });
   const toWrite = files.filter((f) => f.action !== "keep");
   const dry = bool(p.flags, "dry-run") === true;
   let write = !dry && toWrite.length > 0;
@@ -28956,7 +29281,7 @@ async function runInit(ctx, argv) {
   }
   if (write) {
     for (const f of toWrite) {
-      mkdirSync2(dirname6(f.path), { recursive: true });
+      mkdirSync2(dirname7(f.path), { recursive: true });
       writeFileSync2(f.path, f.content);
     }
   }
@@ -28967,6 +29292,7 @@ async function runInit(ctx, argv) {
     kept: files.filter((f) => f.action === "keep").map((f) => relName(f.path)),
     ...write ? {} : { would_write: toWrite.map((f) => relName(f.path)) },
     found: s2.found,
+    ...withWorkflow ? { workflow_steps: workflowSteps } : {},
     todos: s2.todos,
     config: s2.config,
     next_action: s2.todos.length ? { type: "edit_config", message: `Fill in the ${s2.todos.length} TODO item(s) in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
@@ -28976,6 +29302,8 @@ async function runInit(ctx, argv) {
     for (const f of files) lines.push(`${f.action === "keep" ? ctx.out.c.dim("kept   ") : write ? ctx.out.c.green(f.action === "create" ? "created" : "wrote  ") : ctx.out.c.yellow("would write")} ${relName(f.path)}${f.action === "keep" ? ctx.out.c.dim(" (exists; --force overwrites)") : ""}`);
     if (!write && toWrite.length && !dry) lines.push(ctx.out.c.dim("Nothing written: add --yes to write without asking."));
     if (s2.found.length) lines.push("", "Found:", ...s2.found.map((f) => `  - ${f}`));
+    if (withWorkflow && workflowSteps.length) lines.push("", `The workflow runs ${workflowSteps.map((c) => `\`${c}\``).join(" and ")} before the checks, so they work on a fresh clone.`);
+    if (needs.urlPages) lines.push("", 'Note: "url" pages are fetched by the API (checkbox ci --online), which needs a LIVE key (ck_live_\u2026) on an activated account. Without one, list the built page as "file".');
     if (s2.todos.length) lines.push("", "To do:", ...s2.todos.map((t) => `  - ${t}`));
     lines.push("", `${ctx.out.c.cyan("Next:")} ${result.next_action.message}`);
     if (!write) lines.push("", ctx.out.c.dim(`${relName(configPath)}:`), ...JSON.stringify(s2.config, null, 2).split("\n").map((l) => ctx.out.c.dim(`  ${l}`)));
@@ -28997,6 +29325,22 @@ async function readNotices(ctx, client, siteFlag) {
     return { error: `Could not read the Notice settings of ${site} (${err.message}).` };
   }
 }
+async function attachSiteForCoupons(ctx, client, jobs, siteFlag) {
+  const withCoupon = jobs.filter((j) => j.type === "stripe_checkout" && j.body && couponIdsIn(j.body.params).length);
+  if (!withCoupon.length) return;
+  let site;
+  try {
+    site = await resolveSite(ctx, siteFlag, client);
+  } catch (err) {
+    for (const j of withCoupon) j.warnings.push(`The coupon was not read from Stripe: ${err.message} --online reads it through the site's connected Stripe key once it knows the site (--site or CHECKBOX_SITE).`);
+    return;
+  }
+  for (const j of withCoupon) j.body = { ...j.body, site };
+}
+function couponIdsIn(params) {
+  const discounts = params?.discounts;
+  return (Array.isArray(discounts) ? discounts : []).flatMap((d) => d && typeof d === "object" && typeof d.coupon === "string" ? [d.coupon] : []);
+}
 var HELP2, NOTICE_KIND_TO_EMAIL, ci_default;
 var init_ci = __esm({
   "src/commands/ci/index.ts"() {
@@ -29017,7 +29361,8 @@ var init_ci = __esm({
       "",
       "Flags:",
       "  --config <path>     Config file (default: checkbox.json, then .checkbox.json)",
-      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages and site-aware checks;",
+      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages (these need a live-mode",
+      '                      key on an activated account; with a test key list the built page as "file") and site-aware checks;',
       `                      with "notices" in checkbox.json, also checks that the site's Checkbox Notices really send them`,
       "  --site <site_\u2026>     The site for --online (default: $CHECKBOX_SITE, the site `checkbox init` saved, or the only one)",
       '  --strict            "Needs review" fails too (exit 2)',
@@ -29033,12 +29378,14 @@ var init_ci = __esm({
       "",
       "Exit: 0 pass (or needs review without --strict) \xB7 1 a check needs a fix \xB7 2 needs review with --strict, or a",
       "      page / disclosure with no renewal terms to judge, a checkout whose coupon / trial is not verified, or a",
-      '      checkout entry with "strict": true that needs review \xB7',
+      '      checkout entry with "strict": true that needs review, or nothing was checked (every check skipped or',
+      "      not applicable, e.g. url pages without --online) \xB7",
       "      3 config / usage error \xB7 4 auth (--online) \xB7 5 API or network error",
       "",
       "checkbox ci init [--yes] [--force] [--dry-run] [--no-workflow]",
       '  Writes checkbox.json from the project (Stripe Checkout calls, plans, email templates, pages; "TODO" where it',
-      "  cannot tell) and .github/workflows/checkbox.yml. Asks first on a terminal; --yes writes without asking (agents).",
+      '  cannot tell) and .github/workflows/checkbox.yml (with the install and build steps a fresh clone needs for "module"',
+      "  entries and built pages). Asks first on a terminal; --yes writes without asking (agents).",
       "",
       "Docs: https://checkbox.site/docs/guides/ci"
     ].join("\n");
@@ -29081,7 +29428,7 @@ var init_ci = __esm({
         const workspace = ctx.env.GITHUB_WORKSPACE ?? ctx.cwd;
         const extra = (loaded.config.coverage === false ? [] : coverageResults(coverageOf(loaded, loaded.dir))).map((r) => ({
           ...r,
-          target: { ...r.target, file: relative5(workspace, join8(loaded.dir, r.target.file)).split("\\").join("/") || r.target.file }
+          target: { ...r.target, file: relative5(workspace, join9(loaded.dir, r.target.file)).split("\\").join("/") || r.target.file }
         }));
         if (bool(p.flags, "changed-only")) {
           const base = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
@@ -29118,6 +29465,7 @@ ${message}
             return EXIT.auth;
           }
         }
+        if (client) await attachSiteForCoupons(ctx, client, jobs, str(p.flags, "site"));
         const engine = client ? onlineEngine(client) : offlineEngine();
         const notices = client && declaredByCheckbox(loaded.config).length ? await readNotices(ctx, client, str(p.flags, "site")) : void 0;
         const noticesLine = Math.max(1, loaded.raw.split("\n").findIndex((l) => l.includes('"sent_by_checkbox"')) + 1);
@@ -29353,8 +29701,8 @@ var init_patch = __esm({
 });
 
 // src/commands/plan/fix.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { relative as relative6, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
+import { relative as relative6, resolve as resolve8 } from "node:path";
 function fixForTask(task, cwd, file) {
   const base = {
     object: "task_fix",
@@ -29366,12 +29714,12 @@ function fixForTask(task, cwd, file) {
     verify: task.verify
   };
   const verifyCmd = `checkbox verify ${task.id} --wait`;
-  const candidate = file ?? (task.where.file_hint && existsSync8(resolve7(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
+  const candidate = file ?? (task.where.file_hint && existsSync9(resolve8(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
   if (task.change.type === "patch" && task.change.edits.length && candidate) {
-    const path = resolve7(cwd, candidate);
+    const path = resolve8(cwd, candidate);
     let src;
     try {
-      src = readFileSync9(path, "utf8");
+      src = readFileSync10(path, "utf8");
     } catch (err) {
       throw new UsageError(`Cannot read ${candidate}: ${err.code ?? err.message}`);
     }
@@ -29431,7 +29779,7 @@ var init_fix = __esm({
         const task = await ctx.client().sdk.tasks.retrieve(id);
         const result = fixForTask(task, ctx.cwd, str(flags, "file"));
         const out = str(flags, "out");
-        if (out && result.diff) writeFileSync3(resolve7(ctx.cwd, out), result.diff);
+        if (out && result.diff) writeFileSync3(resolve8(ctx.cwd, out), result.diff);
         ctx.out.result({ ...result, task_object: task }, () => {
           const c = ctx.out.c;
           const lines = [`${c.bold(task.title)} ${c.dim(`(${task.priority}, ${task.id})`)}`, c.dim(`${task.requirement.citation}`), task.why, ""];
@@ -29533,12 +29881,12 @@ var init_device = __esm({
 });
 
 // src/commands/init/patch.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, join as join10 } from "node:path";
 function read(root, rel2) {
   try {
-    return readFileSync10(join9(root, rel2), "utf8");
+    return readFileSync11(join10(root, rel2), "utf8");
   } catch {
     return null;
   }
@@ -29716,7 +30064,7 @@ function mask(v) {
 }
 function isGitTracked(root, file) {
   try {
-    execFileSync2("git", ["ls-files", "--error-unmatch", "--", file], { cwd: root, stdio: "ignore", timeout: 5e3 });
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", file], { cwd: root, stdio: "ignore", timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -29733,7 +30081,7 @@ function planGitignore(d) {
     const covered = lines.some((l) => l === env2 || l === `/${env2}` || l === ".env*" || l === "*.env" || env2 === ".env.local" && (l === ".env*.local" || l === "*.local" || l === ".env.local*") || env2 === ".env" && l === ".env*");
     if (covered) return null;
   }
-  if (existing === null && !existsSync9(join9(d.root, ".git"))) return null;
+  if (existing === null && !existsSync10(join10(d.root, ".git"))) return null;
   const text = `${existing ?? ""}${existing && !existing.endsWith("\n") ? "\n" : ""}# Checkbox keys (checkbox init)
 ${env2}
 `;
@@ -29749,8 +30097,8 @@ function planWellKnown(d, token) {
 }
 function applyChange(root, c) {
   if (c.action === "unchanged" || c.contents === void 0) return;
-  const abs = join9(root, c.file);
-  mkdirSync3(dirname7(abs), { recursive: true });
+  const abs = join10(root, c.file);
+  mkdirSync3(dirname8(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
 var MARK_START, MARK_END, NEXT_DOCUMENT, NUXT_PLUGIN;
@@ -29797,8 +30145,8 @@ __export(init_exports, {
   parsePlanFlag: () => parsePlanFlag,
   syncCheckoutConfigs: () => syncCheckoutConfigs
 });
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join11 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function loadState(ctx, root) {
   const cfg = ctx.config.load().init ?? {};
@@ -29818,7 +30166,7 @@ function saveState(ctx, root, patch) {
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve9) => rl.question(question, resolve9));
+    return await new Promise((resolve10) => rl.question(question, resolve10));
   } finally {
     rl.close();
   }
@@ -29896,7 +30244,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const from = configFileOf(c.name);
     if (!from) continue;
     const sameFile = perFile.has(from.file);
-    const gone = !sameFile && !existsSync10(join10(root, from.file));
+    const gone = !sameFile && !existsSync11(join11(root, from.file));
     const current = sameFile && from.call !== void 0 && from.call <= perFile.get(from.file) && c.name === configNameOf(from.file, from.call);
     if (!sameFile && !gone || current) continue;
     if (await client.sdk.stripeCheckoutConfigs.del(c.id).then(() => true, () => false)) {
@@ -29936,6 +30284,7 @@ function detectionSummary(d, siteUrl) {
     pay_buttons: d.payButtons.map((c) => ({ file: c.file, line: c.line })),
     checkout_sessions: d.checkoutSessions.map((s2) => ({ file: s2.file, line: s2.line, readable: !!s2.params, unresolved: s2.unresolved })),
     stripe_test_key: d.stripeTestKey ? { hint: d.stripeTestKey.hint, source: d.stripeTestKey.source, restricted: d.stripeTestKey.restricted } : null,
+    ...d.stripeKeyRefused ? { stripe_key_refused: { ...d.stripeKeyRefused, message: stripeKeyRefusedMessage(d.stripeKeyRefused) } } : {},
     merchant_name: d.brand ?? null,
     plans: d.plans
   };
@@ -30030,7 +30379,7 @@ var init_init = __esm({
         "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it)",
         "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments)",
         "  5. registers the site, Terms / refund / cancellation policy URLs (fetched and checked by Checkbox)",
-        "  6. with your permission, uses the project's Stripe TEST key for a synthetic test subscription",
+        "  6. with your permission, uses the project's Stripe restricted TEST key (rk_test_\u2026; sk_test_ and live keys are refused) for a synthetic test subscription",
         "  7. runs the first checks and prints the next step (`checkbox plan --json`); the human gets the summary email",
         "     when the setup is finished (every check passes, or `checkbox init --complete`)",
         "",
@@ -30226,7 +30575,20 @@ var init_init = __esm({
         }
         const policyFromPaths = (kind) => siteUrl && d.policyPaths[kind] ? `${siteUrl}${d.policyPaths[kind]}` : void 0;
         const agent = detectAgent(ctx.env, agentName);
-        const plans = flagPlans ?? (d.plans.length ? d.plans.map(({ source: _source, ...p }) => p) : void 0);
+        let plans = flagPlans ?? (d.plans.length ? d.plans.map(({ source: _source, ...p }) => p) : void 0);
+        if (plans?.length && !planFlag) {
+          let current = null;
+          try {
+            current = await client.sdk.setupSessions.retrieve(sessionId);
+          } catch {
+            current = null;
+          }
+          const saved = Array.isArray(current?.business?.plans) ? current.business.plans : [];
+          if (saved.length) {
+            plans = void 0;
+            out.info(`Kept the ${saved.length} plan${saved.length === 1 ? "" : "s"} already saved for this site (pass --plan to replace ${saved.length === 1 ? "it" : "them"}).`);
+          }
+        }
         const brand = merchantName ?? d.brand?.name;
         const update = {
           ...siteUrl ? { site_url: siteUrl } : {},
@@ -30292,13 +30654,16 @@ var init_init = __esm({
           if (consent && d.stripeTestKey && !session.stripe.test_credential_stored) {
             try {
               await client.sdk.testCredentials.create(site, { type: "stripe_test", secret_key: d.stripeTestKey.key });
-              stripe.test_credential = { stored: true, key: d.stripeTestKey.hint, restricted: d.stripeTestKey.restricted };
-              if (!d.stripeTestKey.restricted) warnings.push(`Stored your full Stripe TEST key (${d.stripeTestKey.hint}) because no restricted key was found. Recommended: create a restricted test key (${session.stripe.restricted_key.create_url}) with ${session.stripe.restricted_key.permissions.map((p) => `${p.resource} ${p.access}`).join(", ")}, put it in STRIPE_RESTRICTED_KEY and run \`checkbox init\` again.`);
+              stripe.test_credential = { stored: true, key: d.stripeTestKey.hint, restricted: true };
             } catch (err) {
               stripe.test_credential = { stored: false, error: err instanceof ApiError ? `${err.code ?? ""} ${err.message}`.trim() : String(err) };
               warnings.push(`Stripe test key not stored: ${stripe.test_credential.error}`);
             }
           }
+          if (!d.stripeTestKey && d.stripeKeyRefused) {
+            stripe.test_credential = { stored: false, refused: d.stripeKeyRefused.kind };
+            warnings.push(stripeKeyRefusedMessage(d.stripeKeyRefused));
+          }
           const configs = await syncCheckoutConfigs(client, site, d.checkoutSessions, root);
           if (configs.length) stripe.checkout_configs = configs;
           const registered = configs.find((c) => c.id);
@@ -30401,10 +30766,11 @@ var init_whoami = __esm({
             object: "whoami",
             key: creds ? maskKey(creds.apiKey) : null,
             key_source: creds?.source ?? null,
+            ...creds?.file ? { key_file: creds.file } : {},
             api_base: client.apiBase,
             account: account.raw
           },
-          () => [describeAccount(account), ctx.out.c.dim(`key ${creds ? maskKey(creds.apiKey) : "?"} from ${creds?.source ?? "?"} \xB7 ${client.apiBase}`)]
+          () => [describeAccount(account), ctx.out.c.dim(`key ${creds ? maskKey(creds.apiKey) : "?"} from ${creds ? describeKeySource(creds, ctx.env) : "?"} \xB7 ${client.apiBase}`)]
         );
         return EXIT.ok;
       }
@@ -30421,7 +30787,7 @@ import { createInterface as createInterface3 } from "node:readline";
 async function prompt(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve9) => rl.question(question, resolve9));
+    return await new Promise((resolve10) => rl.question(question, resolve10));
   } finally {
     rl.close();
   }
@@ -30555,11 +30921,11 @@ var init_plan = __esm({
 });
 
 // src/commands/plan/verify.ts
-import { readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 function readJson2(ctx, file, what) {
   try {
-    const v = JSON.parse(readFileSync11(resolve8(ctx.cwd, file), "utf8"));
+    const v = JSON.parse(readFileSync12(resolve9(ctx.cwd, file), "utf8"));
     if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("not a JSON object");
     return v;
   } catch (err) {
@@ -30605,7 +30971,7 @@ var init_verify2 = __esm({
           const htmlFile = str(flags, "html-file");
           if (htmlFile) {
             try {
-              body.html = readFileSync11(resolve8(ctx.cwd, htmlFile), "utf8");
+              body.html = readFileSync12(resolve9(ctx.cwd, htmlFile), "utf8");
             } catch (err) {
               throw new UsageError(`Cannot read ${htmlFile}: ${err.code ?? err.message}`);
             }