@checkbox-site/cli 0.4.4 → 0.4.6

package/dist/checkbox.js

@@ -123,7 +123,37 @@ var init_args = __esm({
 // src/config.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+function readEnvValue(text, name) {
+  const re = new RegExp(`^[ \\t]*(?:export[ \\t]+)?${name}[ \\t]*=[ \\t]*(?:"([^"\\r\\n]*)"|'([^'\\r\\n]*)'|([^\\s#]*))[ \\t]*(?:#.*)?$`, "gm");
+  let found;
+  for (let m = re.exec(text); m; m = re.exec(text)) found = (m[1] ?? m[2] ?? m[3] ?? "").trim();
+  return found || void 0;
+}
+function findProjectKey(cwd, env2 = {}) {
+  const home = resolve(env2.HOME || homedir());
+  let dir = resolve(cwd);
+  for (let depth = 0; depth < 8; depth++) {
+    for (const f of PROJECT_KEY_FILES) {
+      let text;
+      try {
+        text = readFileSync(join(dir, f), "utf8");
+      } catch {
+        continue;
+      }
+      const v = readEnvValue(text, "CHECKBOX_SECRET_KEY");
+      if (v && looksLikeApiKey(v)) {
+        const up = depth === 0 ? "" : "../".repeat(depth);
+        return { apiKey: v, file: `${up}${f}` };
+      }
+    }
+    if (existsSync(join(dir, ".git")) || dir === home) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return void 0;
+}
 function configDir(env2) {
   if (env2.CHECKBOX_CONFIG_DIR) return env2.CHECKBOX_CONFIG_DIR;
   const base = env2.XDG_CONFIG_HOME || join(env2.HOME || homedir(), ".config");
@@ -167,27 +197,35 @@ function createConfigStore(env2) {
     }
   };
 }
-function resolveCredentials(env2, stored, flags) {
+function resolveCredentials(env2, stored, flags, project) {
   const apiBase = (flags.apiBase || env2.CHECKBOX_API_BASE || stored.api_base || DEFAULT_API_BASE).replace(/\/+$/, "");
   if (flags.apiKey) return { apiKey: flags.apiKey, apiBase, source: "flag" };
   if (env2.CHECKBOX_API_KEY) return { apiKey: env2.CHECKBOX_API_KEY, apiBase, source: "env" };
   if (env2.CHECKBOX_SECRET_KEY) return { apiKey: env2.CHECKBOX_SECRET_KEY, apiBase, source: "env" };
+  if (project) return { apiKey: project.apiKey, apiBase, source: "project", file: project.file };
   if (stored.api_key) return { apiKey: stored.api_key, apiBase, source: "config" };
   return void 0;
 }
+function describeKeySource(c, env2 = {}) {
+  if (c.source === "flag") return "--api-key";
+  if (c.source === "env") return env2.CHECKBOX_API_KEY ? "CHECKBOX_API_KEY" : "CHECKBOX_SECRET_KEY in the environment";
+  if (c.source === "project") return `this project's ${c.file ?? ".env.local"}`;
+  return "your saved login (checkbox login)";
+}
 function maskKey(key) {
-  const m = /^([a-z]{2}_(?:live|test)_)/.exec(key);
+  const m = /^([a-z]{2,3}_(?:live|test)_)/.exec(key);
   const prefix = m?.[1] ?? key.slice(0, 3);
   return `${prefix}\u2026${key.slice(-4)}`;
 }
 function looksLikeApiKey(key) {
   return /^(?:ckr|ck|rk|sk)_(?:live|test)_[A-Za-z0-9_-]{8,}$/.test(key.trim());
 }
-var DEFAULT_API_BASE;
+var DEFAULT_API_BASE, PROJECT_KEY_FILES;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     DEFAULT_API_BASE = "https://app.checkbox.site";
+    PROJECT_KEY_FILES = [".env.local", ".env", ".checkbox/keys.env"];
   }
 });
 
@@ -2972,7 +3010,7 @@ var init_operations = __esm({
       /**
        * Check Stripe Checkout Session params.
        *
-       * Pass exactly the object your code gives stripe.checkout.sessions.create (plus merchant.merchant_name and merchant.cancel_url, and merchant.price/interval when line_items use a Price id). Checkbox models the Stripe-hosted page those params render and returns findings plus `correction`: a JSON Patch (RFC 6902) and the full corrected params (custom_text.submit with the renewal terms, consent_collection.terms_of_service = "required", custom_text.terms_of_service_acceptance as the consent label), verified by the engine. Stripe's own small grey styling keeps "clear and conspicuous" at needs_review on any Stripe-hosted page; also show the terms on your page before redirecting. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
+       * Body: `{ params, merchant }` (or `{ params, site }`). `params` is exactly the object your code gives stripe.checkout.sessions.create; `merchant` adds merchant_name, cancel_url, and price/interval when line_items use a Price id. Checkbox models the Stripe-hosted page those params render and returns findings plus `correction`: a JSON Patch (RFC 6902) and the full corrected params (custom_text.submit with the renewal terms, consent_collection.terms_of_service = "required", custom_text.terms_of_service_acceptance as the consent label), verified by the engine. Stripe's own small grey styling keeps "clear and conspicuous" at needs_review on any Stripe-hosted page; also show the terms on your page before redirecting. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
        *
        * @see POST /v1/checks/stripe_checkout_session (operation `checkStripeCheckoutSession`, scope `checks:read`)
        */
@@ -3297,7 +3335,7 @@ var init_operations = __esm({
       /**
        * Register the Checkout Session params your code uses.
        *
-       * Registers exactly the object your code passes to stripe.checkout.sessions.create (customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
+       * Registers exactly the object your code passes to stripe.checkout.sessions.create, as `params` (that object sent alone as the body is accepted too; customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/stripe_checkout_configs (operation `createStripeCheckoutConfig`, scope `test_runs:write`)
@@ -3365,7 +3403,7 @@ var init_operations = __esm({
       /**
        * Start a lifecycle test run.
        *
-       * Starts a synthetic test subscription in TEST mode and returns it queued. Stripe runs mirror your checkout into a test-mode Checkout Session, subscribe a test customer (card 4242) whose email is a Checkbox inbox, wait for your acknowledgment, advance a test clock through every legal notice window before trial end and renewal, cancel online in the customer portal and wait for the confirmation; then delete the test clock. Usually takes 2-4 minutes (longer when your own emails are slow to arrive): poll retrieveTestRun (next_action says when) or listen for test_run.completed. Each step reports observations, check results and agent-readable fixes; apply them and run again to verify.
+       * Starts a synthetic test subscription in TEST mode and returns it queued. Stripe runs mirror your checkout into a test-mode Checkout Session, subscribe a test customer (card 4242) whose email is a Checkbox inbox, wait for your acknowledgment, advance a test clock through every legal notice window before trial end and renewal, cancel online in the customer portal and wait for the confirmation; then delete the test clock. Usually takes 1-2 minutes; a real_checkout run a few minutes (longer when your own emails are slow to arrive): poll retrieveTestRun (next_action says when) or listen for test_run.completed. Each step reports observations, check results and agent-readable fixes; apply them and run again to verify.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/test_runs (operation `createTestRun`, scope `test_runs:write`, live mode needs an activated account)
@@ -3579,7 +3617,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.2";
+    SDK_VERSION = "0.2.4";
   }
 });
 
@@ -3768,9 +3806,9 @@ var init_client = __esm({
       const p = globalThis.process;
       return p?.env?.[name] || void 0;
     };
-    sleep = (ms, signal) => new Promise((resolve9, reject) => {
+    sleep = (ms, signal) => new Promise((resolve10, reject) => {
       if (signal?.aborted) return reject(signal.reason);
-      const t = setTimeout(resolve9, ms);
+      const t = setTimeout(resolve10, ms);
       signal?.addEventListener("abort", () => (clearTimeout(t), reject(signal.reason)), { once: true });
     });
     Checkbox = class {
@@ -4164,7 +4202,7 @@ var init_types2 = __esm({
 
 // src/run.ts
 import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join2 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 function registerCommands(registry) {
   REGISTRY = registry;
@@ -4208,11 +4246,11 @@ async function listCommands(dir = COMMANDS_DIR) {
 }
 function readAll(stream) {
   if (!stream || stream.isTTY) return Promise.resolve("");
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     let data = "";
     stream.setEncoding?.("utf8");
     stream.on("data", (c) => data += c.toString());
-    stream.on("end", () => resolve9(data));
+    stream.on("end", () => resolve10(data));
     stream.on("error", reject);
   });
 }
@@ -4230,7 +4268,8 @@ async function helpText(dir) {
     "",
     "Global flags:",
     "  --json            One JSON document on stdout (for agents and scripts)",
-    "  --api-key <key>   Use this key (default: $CHECKBOX_API_KEY, then the key saved by `checkbox login`)",
+    "  --api-key <key>   Use this key (default: $CHECKBOX_API_KEY, then CHECKBOX_SECRET_KEY from the environment or",
+    "                    this project's .env.local / .env, then the key saved by `checkbox login`)",
     "  --api-base <url>  API base URL (default: $CHECKBOX_API_BASE or https://app.checkbox.site)",
     "  -q, --quiet       Only print errors",
     "  --no-color        Plain output",
@@ -4293,7 +4332,18 @@ async function run(argv, io) {
   }
   const flags = { json: g.json, quiet: g.quiet, color, help: false, ...g.apiKey ? { apiKey: g.apiKey } : {}, ...g.apiBase ? { apiBase: g.apiBase } : {} };
   const config = createConfigStore(io.env);
-  const credentials = () => resolveCredentials(io.env, config.load(), flags);
+  let projectKey = null;
+  const project = () => projectKey === null ? projectKey = findProjectKey(io.cwd, io.env) : projectKey;
+  const credentials = () => resolveCredentials(io.env, config.load(), flags, project());
+  let saidWhichKey = false;
+  const sayWhichKey = (c) => {
+    if (saidWhichKey || !c) return;
+    saidWhichKey = true;
+    const stored = config.load().api_key;
+    if (c.source !== "config" && stored && stored !== c.apiKey) {
+      out.info(out.c.dim(`Using the key from ${describeKeySource(c, io.env)} (${maskKey(c.apiKey)}), not your saved login (${maskKey(stored)}).`));
+    }
+  };
   const ctx = {
     argv: rest,
     flags,
@@ -4307,6 +4357,7 @@ async function run(argv, io) {
       const c = credentials();
       const apiKey = o.apiKey ?? c?.apiKey;
       if (!apiKey) throw new NotLoggedInError();
+      if (!o.apiKey) sayWhichKey(c);
       return createApiClient({ apiKey, apiBase: o.apiBase ?? c?.apiBase ?? resolveCredentials(io.env, {}, flags)?.apiBase ?? "https://app.checkbox.site", userAgent: `checkbox-cli/${CLI_VERSION}`, ...io.fetch ? { fetch: io.fetch } : {} });
     },
     readStdin: () => readAll(io.stdin),
@@ -4315,10 +4366,21 @@ async function run(argv, io) {
   try {
     return await cmd.run(ctx);
   } catch (err) {
-    return reportError(out, err);
+    return reportError(out, err, { credentials: credentials(), project: project() ?? void 0, env: io.env });
   }
 }
-function reportError(out, err) {
+function authNextAction(ctxInfo) {
+  const used = ctxInfo?.credentials;
+  const proj = ctxInfo?.project;
+  if (proj && used && proj.apiKey !== used.apiKey) {
+    return {
+      type: "use_project_key",
+      message: `The key from ${describeKeySource(used, ctxInfo?.env)} (${maskKey(used.apiKey)}) was rejected, but this project's ${proj.file} has another key (${maskKey(proj.apiKey)}). Unset ${used.source === "env" ? "that environment variable" : "the --api-key flag"} so the CLI uses it, or check that the right key is in ${proj.file}.`
+    };
+  }
+  return void 0;
+}
+function reportError(out, err, auth) {
   if (err instanceof UsageError) {
     out.error({ message: err.message, code: "usage_error", type: "usage_error" });
     return EXIT.usage;
@@ -4341,7 +4403,10 @@ function reportError(out, err) {
       ...err.requestId ? { request_id: err.requestId } : {},
       ...err.docUrl ? { doc_url: err.docUrl } : {},
       status: apiStatus(err),
-      ...apiStatus(err) === 0 ? { next_action: { type: "retry", message: "Check your network (and --api-base / CHECKBOX_API_BASE), or add --offline to run a check locally." } } : err.nextAction ? { next_action: err.nextAction } : isAuthError(err) ? { next_action: { type: "login", message: "The API key was rejected. Run `checkbox login` with a valid key, or set CHECKBOX_API_KEY." } } : {}
+      ...apiStatus(err) === 0 ? { next_action: { type: "retry", message: "Check your network (and --api-base / CHECKBOX_API_BASE), or add --offline to run a check locally." } } : isAuthError(err) && authNextAction(auth) ? (
+        // The server's 401 next step sends agents to device approval; a key this CLI can see locally comes first.
+        { next_action: authNextAction(auth), ...auth?.credentials ? { key_source: auth.credentials.source, ...auth.credentials.file ? { key_file: auth.credentials.file } : {} } : {} }
+      ) : err.nextAction ? { next_action: err.nextAction } : isAuthError(err) ? { next_action: { type: "login", message: "The API key was rejected. Run `checkbox login` with a valid key, or set CHECKBOX_API_KEY." } } : {}
     });
     return isAuthError(err) ? EXIT.auth : apiStatus(err) === 400 ? EXIT.usage : EXIT.error;
   }
@@ -4357,7 +4422,7 @@ var init_run = __esm({
     init_http();
     init_output();
     init_types2();
-    HERE = dirname(fileURLToPath(import.meta.url));
+    HERE = dirname2(fileURLToPath(import.meta.url));
     COMMANDS_DIR = join2(HERE, "commands");
     CLI_VERSION = (() => {
       try {
@@ -4368,7 +4433,7 @@ var init_run = __esm({
     })();
     NotLoggedInError = class extends Error {
       constructor() {
-        super("Not logged in: no API key found (flag --api-key, env CHECKBOX_API_KEY, or `checkbox login`).");
+        super("Not logged in: no API key found (flag --api-key, env CHECKBOX_API_KEY, CHECKBOX_SECRET_KEY in .env.local, or `checkbox login`).");
         this.name = "NotLoggedInError";
       }
     };
@@ -4707,7 +4772,8 @@ var init_secrets = __esm({
       { name: "stripe_webhook_secret", re: /\bwhsec_[A-Za-z0-9+/=_-]{4,}/g, replace: keepPrefix(() => 6) },
       { name: "stripe_publishable_live", re: /\bpk_live_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix(() => 8) },
       // Checkbox API keys (ck_test_ / ck_live_) and scoped tokens.
-      { name: "checkbox_key", re: /\bck_(?:live|test)_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix((m) => m.indexOf("_", 3) + 1) },
+      // ckr_ (restricted) keys too: round 29 found they were left whole.
+      { name: "checkbox_key", re: /\bckr?_(?:live|test)_[A-Za-z0-9_-]{4,}/g, replace: keepPrefix((m) => m.indexOf("_", 4) + 1) },
       // AWS access key ids (and the secret that usually follows them on the same line).
       { name: "aws_access_key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, replace: () => "AKIA[redacted]" },
       { name: "aws_secret", re: /(aws_secret_access_key|AWS_SECRET_ACCESS_KEY|secretAccessKey)(\s*[:=]\s*["']?)[A-Za-z0-9/+=]{30,}/g, replace: (m) => m.replace(/[A-Za-z0-9/+=]{30,}$/, "[redacted]") },
@@ -5126,7 +5192,7 @@ var init_california = __esm({
         sourceUrl: URL_ARTICLE,
         effectiveDate: ORIGINAL,
         lastVerified: LAST_VERIFIED,
-        summary: 'Clear and conspicuous offer terms next to the consent request; affirmative (and since July 2025, express affirmative) consent; retainable acknowledgment; online "click to cancel" for online sign-ups; a notice 3-21 days before a free trial or promotional price lasting more than 31 days ends, and 15-45 days before a term of one year or longer renews; 7-30 day fee-change notice; annual reminder; same-medium cancellation; limits on save offers; consent records kept 3 years, or 1 year after termination if longer. Remedies: civil (UCL) remedies only (\xA7 17604); unconsented goods are gifts (\xA7 17603).',
+        summary: 'Clear and conspicuous offer terms next to the consent request; affirmative (and since July 2025, express affirmative) consent; retainable acknowledgment; online "click to cancel" for online sign-ups; a notice 3-21 days before a free trial or promotional price lasting more than 31 days ends, and 15-45 days before a term of one year or longer renews; 7-30 day fee-change notice; annual reminder; same-medium cancellation; limits on save offers; consent records kept 3 years, or 1 year after termination if longer. No criminal penalties; civil remedies apply (\xA7 17604), in practice through the UCL, FAL and CLRA; unconsented goods are gifts (\xA7 17603).',
         status: "in_force",
         confidence: "high",
         verification: "primary",
@@ -5250,14 +5316,14 @@ var init_federal = __esm({
         effectiveDate: EFTA_EFFECTIVE,
         stage: "reminder",
         title: "Advance notice when a recurring debit will change in amount",
-        summary: "When a preauthorized debit from a consumer's account will vary in amount from the previous transfer or from the authorized amount (e.g. a subscription price increase billed to a debit card or by ACH), the payee must send written notice of the amount and date of the transfer at least 10 days before the scheduled transfer date.",
+        summary: "When a preauthorized debit from a consumer's account will vary in amount from the previous transfer or from the authorized amount (e.g. a subscription price increase billed to a debit card or by ACH), the payee must send written notice of the amount and date of the transfer at least 10 days before the scheduled transfer date (\xA7 1005.10(d)(1)). The payee must tell the consumer of the right to notice of every varying transfer, but may let the consumer choose notice only when a transfer falls outside a specified range of amounts, or differs from the most recent transfer by more than an agreed amount (\xA7 1005.10(d)(2)).",
         appliesWhen: { paymentMethods: ["debit", "ach"] },
         checkIds: ["reminder.price_change"],
         severity: "medium",
         noticeWindow: noticeWindowAtLeast(10, "charge"),
         notes: notes(
           windowNote(noticeWindowAtLeast(10, "charge"), "the changed debit"),
-          "Applies only to debits from consumer asset accounts (debit, prepaid, ACH), not credit cards. The payee may instead let the consumer elect to be notified only when the amount falls outside a specified range or differs from the most recent transfer by more than an agreed amount."
+          "Applies only to debits from consumer asset accounts (debit, prepaid, ACH), not credit cards. A consumer who chose range-only notice under \xA7 1005.10(d)(2) gets no notice for a change inside that range; Checkbox cannot see that choice, so the checks expect the notice for every price change."
         )
       })
     ];
@@ -5406,7 +5472,7 @@ var init_exposure = __esm({
         fees: NO_PRIVATE
       },
       "US-FED.1005.": {
-        privateSuit: "Yes: the Electronic Fund Transfer Act lets consumers sue (15 U.S.C. \xA7 1693m). Applies when the subscription is paid by debit card or ACH.",
+        privateSuit: "Yes, in the law itself: the Electronic Fund Transfer Act lets consumers sue (15 U.S.C. \xA7 1693m). Applies when the subscription is paid by debit card or ACH.",
         damages: "Actual damages, plus statutory damages of $100 to $1,000 in an individual action, or in a class action up to the lesser of $500,000 or 1% of the defendant's net worth (15 U.S.C. \xA7 1693m(a)(1), (2)).",
         penalties: "None in private suits: \xA7 1693m provides damages, costs and fees, not civil penalties. The CFPB enforces the Act (15 U.S.C. \xA7 1693o(a)(5)) and can seek civil money penalties for a violation of federal consumer financial law, which includes the Act (12 U.S.C. \xA7\xA7 5481(12)(C), 5565(a)(2)(H)): up to $5,000 a day, $25,000 a day if reckless and $1,000,000 a day if knowing, before inflation adjustment (12 U.S.C. \xA7 5565(c)(2)).",
         fees: "Costs and reasonable attorney's fees for a successful action (15 U.S.C. \xA7 1693m(a)(3))."
@@ -5418,7 +5484,7 @@ var init_exposure = __esm({
         fees: NO_PRIVATE
       },
       "US-CA": {
-        privateSuit: "Through general consumer law: the ARL has no private right of its own (Mayron v. Google, 2020); plaintiffs sue under the UCL, FAL and CLRA and must show economic injury. Before suing for damages under the CLRA, the consumer must send a written notice and demand by certified or registered mail at least 30 days ahead, and no damages action lies if an appropriate correction is given or agreed within 30 days (Cal. Civ. Code \xA7 1782(a), (b)); a CLRA claim for an injunction needs no prior notice (\xA7 1782(d)).",
+        privateSuit: "Yes, through general consumer law: the ARL has no private right of its own (Mayron v. Google, 2020); plaintiffs sue under the UCL, FAL and CLRA and must show economic injury. Before suing for damages under the CLRA, the consumer must send a written notice and demand by certified or registered mail at least 30 days ahead, and no damages action lies if an appropriate correction is given or agreed within 30 days (Cal. Civ. Code \xA7 1782(a), (b)); a CLRA claim for an injunction needs no prior notice (\xA7 1782(d)).",
         damages: "Goods or services provided without the required consent are an unconditional gift (Cal. Bus. & Prof. Code \xA7 17603); all civil remedies are available (\xA7 17604, with a good-faith-compliance safe harbor). Under the CLRA: actual damages (in a class action, at least $1,000 in total), an injunction, restitution of property, punitive damages and other relief the court deems proper (Cal. Civ. Code \xA7 1780(a)). Under the UCL and the FAL: an injunction and orders restoring money or property acquired by the unlawful practice (restitution) (Cal. Bus. & Prof. Code \xA7\xA7 17203, 17535); a private plaintiff must have suffered injury in fact and lost money or property (\xA7 17535, for the FAL). Neither section provides damages.",
         penalties: "In public actions only (the Attorney General, district attorneys and some county counsel and city attorneys): up to $2,500 per violation under the UCL (Cal. Bus. & Prof. Code \xA7 17206(a)) and up to $2,500 per violation under the FAL (\xA7 17536(a)).",
         fees: "Under the CLRA: the court shall award costs and attorney's fees to a prevailing plaintiff; a prevailing defendant may get reasonable fees only if the suit was not brought in good faith (Cal. Civ. Code \xA7 1780(e)). The UCL and FAL sections provide no attorney's fees (Cal. Bus. & Prof. Code \xA7\xA7 17203, 17535). Plaintiffs sometimes seek fees under the private attorney general statute, which lets a court award fees to a successful party in an action that enforced an important right affecting the public interest, when its conditions are met (Cal. Code Civ. Proc. \xA7 1021.5).",
@@ -5551,7 +5617,7 @@ var init_exposure = __esm({
         fees: OPEN
       },
       "US-ND": {
-        privateSuit: "Yes: a person aggrieved may sue to enjoin the violation or for restitution, or both (N.D. Cent. Code \xA7 51-37-06).",
+        privateSuit: "Yes, in the law itself: a person aggrieved may sue to enjoin the violation or for restitution, or both (N.D. Cent. Code \xA7 51-37-06).",
         damages: "Restitution (N.D. Cent. Code \xA7 51-37-06); goods or services provided under a non-compliant renewal, or after an attempt to cancel, are an unconditional gift (\xA7 51-37-04).",
         penalties: "Each act is a separate violation of N.D. Cent. Code ch. 51-15, enforced by the attorney general with that chapter's remedies (\xA7 51-37-05). Unsettled: the figure is not yet confirmed from the statute text.",
         fees: "Costs, expenses and reasonable attorney's fees (N.D. Cent. Code \xA7 51-37-06)."
@@ -9824,7 +9890,7 @@ var init_catalog = __esm({
     init_states();
     init_terms();
     init_types3();
-    CATALOG_VERSION = "2026.11.09.2";
+    CATALOG_VERSION = "2026.11.09.3";
     CATALOG = [
       ...FEDERAL_REQUIREMENTS,
       ...CALIFORNIA_REQUIREMENTS,
@@ -10645,7 +10711,7 @@ function analyzePolicyText(input) {
 function clausesOf(clauses, code2) {
   return clauses.filter((c) => c.code === code2);
 }
-var POLICY_KINDS, POLICY_FRAGMENT, POLICY_FETCHER_USER_AGENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
+var POLICY_KINDS, POLICY_FRAGMENT, POLICY_FETCHER_USER_AGENT, SUBSCRIPTION_WORDS, NO_CANCEL, OFFLINE_ONLY, STOP_SUBSCRIPTION, CONTACT_TO_CANCEL, ACCOUNT_NOT_PLACE, CANCEL_ONLINE_STRONG, NOTICE_PERIOD, ALL_SALES_FINAL, CANCEL_ONLINE, AUTO_RENEWAL, HOW_TO_CANCEL, NO_REFUNDS, REFUND_WINDOW, GUARANTEE, REFUND_EXCEPTION;
 var init_policy_docs = __esm({
   "../rules/src/policy-docs.ts"() {
     "use strict";
@@ -10666,9 +10732,12 @@ var init_policy_docs = __esm({
       /\bcancell?(?:ations?|ing)?\b[^.]{0,80}\b(?:only|solely|exclusively)\b[^.]{0,60}\b(?:phone|telephone|mail|post|in writing|in person|fax)\b/i,
       /\bcancell?ation requests?\b[^.]{0,60}\b(?:by|via) (?:certified |registered )?(?:mail|post|letter|fax|phone|telephone)\b/i
     ];
+    STOP_SUBSCRIPTION = "(?:stop|end|terminate|discontinue|turn off)\\s+(?:your |the |a |my |this )?(?:paid |monthly |annual |yearly )?(?:subscription|membership|plan|auto-?renewal|automatic renewal|recurring (?:billing|payments?|charges?))";
     CONTACT_TO_CANCEL = [
       /\bto cancel\b[^.]{0,80}\b(?:contact|email|e-mail|reach out to|message)\b/i,
       /\b(?:contact|email|e-mail)\b[^.]{0,60}\bto cancel\b/i,
+      new RegExp(`\\bto ${STOP_SUBSCRIPTION}\\b[^.]{0,80}(?:\\b(?:contact|email|e-mail|reach out to|message|write to)\\b|\\[redacted\\])`, "i"),
+      new RegExp(`(?:\\b(?:contact|email|e-mail|write to)\\b|\\[redacted\\])[^.]{0,60}\\bto ${STOP_SUBSCRIPTION}\\b`, "i"),
       // Round 2 pilot: "You may cancel by contacting support" / "cancellations are handled by emailing us".
       /\bcancel\w*\b[^.]{0,60}\b(?:by|through|via)\s+(?:contacting|emailing|e-mailing|messaging|writing to|reaching out to|calling|phoning|sending (?:us )?an? (?:email|e-mail|message))\b/i,
       // Normal round 2 (nextjs): the scanner redacts e-mail addresses before the rules see the text, so
@@ -11252,6 +11321,9 @@ function introAmountOf(amount, o) {
   return void 0;
 }
 function unverifiedReason(ctx) {
+  const known = ctx.referencePlans ?? [];
+  if (known.length) return `none of your plans (${known.slice(0, 4).map((p) => p.label ?? p.name ?? p.id).join(", ")}) was matched to this checkout's price (the Price id it sells is not one Checkbox has for them)`;
+  if ((ctx.checkoutConfigs?.length ?? 0) > 0) return "the price this checkout sells is not in your registered Checkout configs or your billing platform's prices";
   const chosen = ctx.facts?.planPriceId;
   if (chosen && ctx.config) return `the chosen price ${chosen} is not among the active recurring prices read from your billing platform`;
   if (chosen) return `the chosen price ${chosen} could not be read (no billing platform connected)`;
@@ -11309,7 +11381,7 @@ function noticePlanOptions(ctx, priceChange = false) {
   const newPrices = (ctx.events ?? []).filter((e) => e.type === "price_change_scheduled").map((e) => e.amount).filter((n) => typeof n === "number" && n > 0).map((n) => n / 10 ** currencyDigitsOf(currency));
   if (priceChange && newPrices.length) return { plans: plans.map((p) => ({ ...p, amount: -1 })), extraAmounts: newPrices };
   if (!plans.length) return { plans: [], extraAmounts: [] };
-  return { plans, extraAmounts: newPrices };
+  return { plans, extraAmounts: newPrices, ...ctx.events?.length ? { events: ctx.events } : {} };
 }
 function declaredPlansFrom(plans) {
   const out = [];
@@ -11392,8 +11464,8 @@ function sameProductName(a, b) {
 function declaredPriceIds(x) {
   return [x.price_id, x.stripe_price, x.priceId, x.id].filter((v) => typeof v === "string" && v.trim().length > 0);
 }
-function reconcileDeclaredPlans(raw, billing, platform = "Stripe") {
-  const prices = billing.filter((p) => p && p.amount > 0 && p.interval);
+function reconcileDeclaredPlans(raw, billing, platform = "Stripe", checkoutTrials) {
+  const prices = billing.filter((p) => p && p.amount > 0 && p.interval).map((p) => checkoutTrials?.has(p.id) ? { ...p, trialDays: checkoutTrials.get(p.id) } : p);
   const out = [...raw];
   const conflicts = [];
   if (!prices.length || !raw.length) return { plans: out, conflicts };
@@ -11551,11 +11623,11 @@ function siteOffers(input) {
   };
   for (const d of declared) {
     const price3 = stripe.find((s2) => sameTerms(s2, d));
-    const trial = d.trialDays && d.trialDays > 0 ? d.trialDays : price3?.trialDays && price3.trialDays > 0 ? price3.trialDays : soldTrial({ ...d, ...price3 ? { priceId: price3.id } : {} });
+    const trial = d.trialDays && d.trialDays > 0 ? d.trialDays : soldTrial({ ...d, ...price3 ? { priceId: price3.id } : {} }) || (price3?.trialDays && price3.trialDays > 0 ? price3.trialDays : 0);
     push(toOffer(d, "declared", { trialDays: trial, ...price3 ? { priceId: price3.id } : {} }));
   }
   const chosen = input.facts?.planPriceId ? stripe.find((p) => p.id === input.facts.planPriceId) : void 0;
-  if (chosen) push(toOffer(chosen, "chosen", chosen.trialDays && chosen.trialDays > 0 ? {} : { trialDays: soldTrial(chosen) }));
+  if (chosen) push(toOffer(chosen, "chosen", soldTrial(chosen) > 0 ? { trialDays: soldTrial(chosen) } : {}));
   if (!declared.length) {
     for (const s2 of sold) {
       const price3 = stripe.find((p) => sameTerms(p, s2));
@@ -11570,7 +11642,7 @@ function siteOffers(input) {
     const anchors = stripe.filter((s2) => out.some((o) => o.priceId === s2.id));
     for (const s2 of stripe) {
       if (out.some((o) => o.priceId === s2.id) || !anchors.some((a) => sameProductName(a.name, s2.name))) continue;
-      push(toOffer(s2, "stripe", s2.trialDays && s2.trialDays > 0 ? {} : { trialDays: soldTrial(s2) }));
+      push(toOffer(s2, "stripe", soldTrial(s2) > 0 ? { trialDays: soldTrial(s2) } : {}));
     }
   }
   const facts = input.facts;
@@ -12937,14 +13009,14 @@ var init_visible_html = __esm({
 
 // ../rules/src/checks/context.ts
 function heuristicReader() {
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   return {
     mode: "heuristic",
     async analyze(text) {
-      let a = cache.get(text);
+      let a = cache2.get(text);
       if (!a) {
         a = analyzeTerms(text);
-        cache.set(text, a);
+        cache2.set(text, a);
       }
       return a;
     }
@@ -13793,7 +13865,7 @@ function remediationFor(checkId, platform) {
   if (guide?.snippet) rem.snippet = { ...guide.snippet };
   return rem;
 }
-var DISCLOSURE_COPY_TEMPLATE, CONSENT_COPY_TEMPLATE, ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_REMINDER_COPY_TEMPLATE, RENEWAL_REMINDER_COPY_TEMPLATE, PRICE_CHANGE_COPY_TEMPLATE, ANNUAL_TERMS_COPY_TEMPLATE, CHARGE_NOTICE_COPY_TEMPLATE, CANCELLATION_CONFIRMATION_COPY_TEMPLATE, TERMS_CANCELLATION_COPY_TEMPLATE, TERMS_REFUND_COPY_TEMPLATE, TERMS_RENEWAL_COPY_TEMPLATE, PLACEHOLDER_STEP, CUSTOM_DISCLOSURE_HTML, CUSTOM_CONSENT_HTML, STRIPE_CHECKOUT_TS, STRIPE_ANNUAL_REMINDER_TS, STRIPE_CHARGE_NOTICE_TS, STRIPE_PORTAL_TS, STRIPE_ACK_WEBHOOK_TS, STRIPE_CANCEL_CONFIRMATION_TS, SHOPIFY_LIQUID, SHOPIFY_CHECKOUT_EXTENSION_TSX, CUSTOM_ACCOUNT_CANCEL_HTML, CUSTOM_ACK_EMAIL_HTML, VERIFY, VERIFY_TERMS, VERIFY_EMAIL, CB_CHECKOUT, CB_PORTAL, CB_EMAILS, CHARGEBEE_DISCLOSURE, CHARGEBEE_CONSENT, CHARGEBEE_ACK, CHARGEBEE_PORTAL, CHARGEBEE_TRIAL_REMINDER, CHARGEBEE_RENEWAL_REMINDER, CHARGEBEE_ANNUAL_TERMS, CHARGEBEE_CHARGE_NOTICE, RC_ACCOUNT_PAGES, RC_EMAILS, RECURLY_DISCLOSURE, RECURLY_CONSENT, RECURLY_ACK, RECURLY_PORTAL, RECURLY_TRIAL_REMINDER, RECURLY_RENEWAL_REMINDER, RECURLY_ANNUAL_TERMS, RECURLY_CHARGE_NOTICE, PD_RETAIN, PADDLE_DISCLOSURE, PADDLE_CONSENT, PADDLE_ACK, PADDLE_PORTAL, PADDLE_TRIAL_REMINDER, PADDLE_RENEWAL_REMINDER, PADDLE_ANNUAL_TERMS, PADDLE_CHARGE_NOTICE, STRIPE_DISCLOSURE, SHOPIFY_DISCLOSURE, RECHARGE_DISCLOSURE, CUSTOM_DISCLOSURE, DISCLOSURE_PLATFORMS, STRIPE_ACK, SHOPIFY_ACK, RECHARGE_ACK, CUSTOM_ACK, ACK_PLATFORMS, STRIPE_PORTAL, SHOPIFY_PORTAL, RECHARGE_PORTAL, CUSTOM_PORTAL, PORTAL_PLATFORMS, STRIPE_TRIAL_REMINDER, STRIPE_RENEWAL_REMINDER, STRIPE_ANNUAL_TERMS, STRIPE_CHARGE_NOTICE, SHOPIFY_ANNUAL_TERMS, SHOPIFY_CHARGE_NOTICE, RECHARGE_ANNUAL_TERMS, RECHARGE_CHARGE_NOTICE, CUSTOM_ANNUAL_TERMS, CUSTOM_CHARGE_NOTICE, SHOPIFY_REMINDER, RECHARGE_REMINDER, CUSTOM_REMINDER, SPECS, PLATFORM_LABELS, OFFER_PERMISSION_FIX, OFFER_QUESTION_STOP_FIX, OFFER_PERMISSION_SNIPPET, CANCEL_HANDLER_REMEDIATION, OFFER_PERMISSION_REMEDIATION;
+var DISCLOSURE_COPY_TEMPLATE, CONSENT_COPY_TEMPLATE, ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_ACKNOWLEDGMENT_COPY_TEMPLATE, TRIAL_REMINDER_COPY_TEMPLATE, RENEWAL_REMINDER_COPY_TEMPLATE, PRICE_CHANGE_COPY_TEMPLATE, ANNUAL_TERMS_COPY_TEMPLATE, CHARGE_NOTICE_COPY_TEMPLATE, CANCELLATION_CONFIRMATION_COPY_TEMPLATE, TERMS_CANCELLATION_COPY_TEMPLATE, TERMS_REFUND_COPY_TEMPLATE, TERMS_RENEWAL_COPY_TEMPLATE, PLACEHOLDER_STEP, CUSTOM_DISCLOSURE_HTML, CUSTOM_CONSENT_HTML, STRIPE_CHECKOUT_TS, STRIPE_ANNUAL_REMINDER_TS, STRIPE_CHARGE_NOTICE_TS, STRIPE_PORTAL_TS, STRIPE_ACK_WEBHOOK_TS, STRIPE_CANCEL_CONFIRMATION_TS, SHOPIFY_LIQUID, SHOPIFY_CHECKOUT_EXTENSION_TSX, CUSTOM_ACCOUNT_CANCEL_HTML, CUSTOM_ACK_EMAIL_HTML, VERIFY, VERIFY_TERMS, VERIFY_EMAIL, CB_CHECKOUT, CB_PORTAL, CB_EMAILS, CHARGEBEE_DISCLOSURE, CHARGEBEE_CONSENT, CHARGEBEE_ACK, CHARGEBEE_PORTAL, CHARGEBEE_TRIAL_REMINDER, CHARGEBEE_RENEWAL_REMINDER, CHARGEBEE_ANNUAL_TERMS, CHARGEBEE_CHARGE_NOTICE, RC_ACCOUNT_PAGES, RC_EMAILS, RECURLY_DISCLOSURE, RECURLY_CONSENT, RECURLY_ACK, RECURLY_PORTAL, RECURLY_TRIAL_REMINDER, RECURLY_RENEWAL_REMINDER, RECURLY_ANNUAL_TERMS, RECURLY_CHARGE_NOTICE, PD_RETAIN, PADDLE_DISCLOSURE, PADDLE_CONSENT_HTML, PADDLE_CONSENT, PADDLE_ACK, PADDLE_PORTAL, PADDLE_TRIAL_REMINDER, PADDLE_RENEWAL_REMINDER, PADDLE_ANNUAL_TERMS, PADDLE_CHARGE_NOTICE, STRIPE_DISCLOSURE, SHOPIFY_DISCLOSURE, RECHARGE_DISCLOSURE, CUSTOM_DISCLOSURE, DISCLOSURE_PLATFORMS, STRIPE_ACK, SHOPIFY_ACK, RECHARGE_ACK, CUSTOM_ACK, ACK_PLATFORMS, STRIPE_PORTAL, SHOPIFY_PORTAL, RECHARGE_PORTAL, CUSTOM_PORTAL, PORTAL_PLATFORMS, STRIPE_TRIAL_REMINDER, STRIPE_RENEWAL_REMINDER, STRIPE_ANNUAL_TERMS, STRIPE_CHARGE_NOTICE, SHOPIFY_ANNUAL_TERMS, SHOPIFY_CHARGE_NOTICE, RECHARGE_ANNUAL_TERMS, RECHARGE_CHARGE_NOTICE, CUSTOM_ANNUAL_TERMS, CUSTOM_CHARGE_NOTICE, SHOPIFY_REMINDER, RECHARGE_REMINDER, CUSTOM_REMINDER, SPECS, PLATFORM_LABELS, OFFER_PERMISSION_FIX, OFFER_QUESTION_STOP_FIX, OFFER_PERMISSION_SNIPPET, CANCEL_HANDLER_REMEDIATION, OFFER_PERMISSION_REMEDIATION;
 var init_remediation = __esm({
   "../rules/src/remediation.ts"() {
     "use strict";
@@ -14109,13 +14181,32 @@ and click \u201CCancel subscription\u201D. You can cancel anytime online.</p>`;
       ],
       snippet: { language: "html", code: CUSTOM_DISCLOSURE_HTML }
     };
+    PADDLE_CONSENT_HTML = `<!-- Replace your button that opens Paddle Checkout with this form (Paddle.js must be loaded and initialized). -->
+<form id="checkbox-paddle-checkout">
+  <label style="display:flex;gap:8px;align-items:flex-start;font-size:14px;color:#1f2937;">
+    <!-- Never add the "checked" attribute: consent must be an affirmative act -->
+    <input type="checkbox" name="auto_renew_consent" value="yes" required>
+    <span>I agree that my subscription will automatically renew every {interval} at {price} until I cancel.</span>
+  </label>
+  <button type="submit">Subscribe</button>
+</form>
+<script>
+  document.getElementById('checkbox-paddle-checkout').addEventListener('submit', function (event) {
+    event.preventDefault(); // the browser only gets here once the required box is ticked
+    var label = this.querySelector('label span').textContent.trim();
+    Paddle.Checkout.open({
+      items: [{ priceId: 'pri_REPLACE_ME', quantity: 1 }],
+      customData: { auto_renew_consent: { at: new Date().toISOString(), label: label } },
+    });
+  });
+</script>`;
     PADDLE_CONSENT = {
       steps: [
         "Add a required, unchecked renewal-consent checkbox (the wording below) on your page, directly above the button that opens Paddle Checkout, and only open checkout once it is ticked.",
-        "Save when it was ticked and the terms that were shown, so you can prove consent later.",
-        "For developers: call Paddle.Checkout.open() only after the box is ticked, and pass the consent time in customData so it is stored on the transaction."
+        'Paddle opens checkout from a button, not a form, so a "required" box alone blocks nothing: put the box and the button in one form (the snippet does) or keep the button disabled until the box is ticked.',
+        "Save when it was ticked and the terms that were shown, so you can prove consent later: the snippet passes them in customData, which Paddle stores on the transaction. On Lemon Squeezy, pass them as checkout[custom][\u2026] on the checkout URL."
       ],
-      snippet: { language: "html", code: CUSTOM_CONSENT_HTML }
+      snippet: { language: "html", code: PADDLE_CONSENT_HTML }
     };
     PADDLE_ACK = {
       steps: [
@@ -14829,7 +14920,8 @@ function inAppPath(input) {
       return { kind: "in_app", state: "works", detail: "a test cancellation completed online" };
     }
     if (hostedStep2) return void 0;
-    const kinds = (flow.blockers ?? []).map(classifyBlocker);
+    const onHosted = (flow.steps ?? []).some((s2) => s2.source !== "snippet" && isHostedCancelUrl(s2.url));
+    const kinds = (flow.blockers ?? []).map(classifyBlocker).filter((k) => !(onHosted && k === "contact"));
     if (kinds.some((k) => k === "contact" || k === "not_found" || k === "obstacle")) {
       return { kind: "in_app", state: "broken", detail: `the test cancellation did not complete (${flow.blockers.join("; ")})` };
     }
@@ -14906,7 +14998,7 @@ function offlineOnlyCancellation(input) {
   const hosted = input.ctx.hostedCancel;
   const helpHits = [];
   for (const c of captures) {
-    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout") continue;
+    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout" || isHostedCancelUrl(c.url)) continue;
     const sentence = contactOnlySentence(c.text);
     if (!sentence) continue;
     if (ownOnlineCancelControls(c, hosted).length) continue;
@@ -14917,7 +15009,7 @@ function offlineOnlyCancellation(input) {
     }
     return { where: `${c.pageKind === "account" ? "account page" : c.pageKind === "cancel" ? "cancel page" : "page"} ${c.url.split("#")[0]}`, quote: sentence, capture: c };
   }
-  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
+  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && !isHostedCancelUrl(c.url) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
   const onlineControl = captures.some(
     (c) => !isFetchedDocument(c) && ownOnlineCancelControls(c, hosted).some((el) => !contactOnlyUrls.has(stripUrl(hrefOf(el) ?? "", c.url)))
   );
@@ -16291,15 +16383,34 @@ function offlineOnlyCancelIn(text, cancelMethods) {
   const online = cancelMethods.some((m) => !CONTACT_TO_CANCEL_RE.test(m.text) && !/@|\d{3}[\s.-]\d{4}|\b(?:call|phone|chat|e-?mail|contact|mail|reply)\b/i.test(m.text));
   return online ? null : offline;
 }
+function inForceAmount(e, events, fallbackCurrency = "usd") {
+  const own = e.noticeTerms;
+  if (own && typeof own.amount === "number" && own.amount > 0) return own.amount / 10 ** currencyDigitsOf(typeof own.currency === "string" ? own.currency : fallbackCurrency);
+  const ref = typeof e.subscriptionRef === "string" ? e.subscriptionRef.trim() : "";
+  const sent2 = toDate(e.receivedAt)?.getTime();
+  if (!ref || sent2 === void 0) return void 0;
+  let best;
+  let bestAt = -Infinity;
+  for (const ev of events) {
+    if (ev.subscriptionRef !== ref || !CHARGE_AMOUNT_EVENTS.has(ev.type) || !(typeof ev.amount === "number" && ev.amount > 0)) continue;
+    const at = toDate(ev.occurredAt)?.getTime();
+    if (at === void 0 || at > sent2 + 36e5 || at < bestAt) continue;
+    best = ev;
+    bestAt = at;
+  }
+  return best ? best.amount / 10 ** currencyDigitsOf(best.currency ?? fallbackCurrency) : void 0;
+}
 function noticeContent(e, opts = {}) {
   const body = emailBody(e);
   const a = analyzeTerms(body);
   const quotes = {};
   const wrong = {};
   const plans = opts.plans ?? [];
+  const inForce = opts.events ? inForceAmount(e, opts.events, plans[0]?.currency) : void 0;
   const expected = [
     ...plans.map((p) => p.amount / 10 ** currencyDigitsOf(p.currency)),
-    ...opts.extraAmounts ?? []
+    ...opts.extraAmounts ?? [],
+    ...inForce !== void 0 ? [inForce] : []
   ];
   const amount = a.recurringPrices[0]?.money ?? positiveAmounts(a)[0];
   const stated = positiveAmounts(a).filter((m) => m.amount !== null);
@@ -16364,7 +16475,7 @@ function contentFixFromText(checkId, text) {
   const m = new RegExp(`^the ${noun} \\(.*?\\) .*? does not state (.+?)(?: correctly \\(| \u2014 )`, "i").exec(text.trim());
   return m ? `Add ${m[1]} to the ${noun}; Checkbox's template has every required line.` : void 0;
 }
-var ELEMENT_LABELS, CHARGE_FOLLOWS_RE, DATE_TAG_RE, TRIAL_END_WHEN_RE, PRODUCT_RE, CONTACT_RE, CANCEL_URL_RE, NOTICE_NOUN;
+var ELEMENT_LABELS, CHARGE_FOLLOWS_RE, DATE_TAG_RE, TRIAL_END_WHEN_RE, PRODUCT_RE, CONTACT_RE, CANCEL_URL_RE, CHARGE_AMOUNT_EVENTS, NOTICE_NOUN;
 var init_notice_content = __esm({
   "../rules/src/checks/notice-content.ts"() {
     "use strict";
@@ -16390,6 +16501,7 @@ var init_notice_content = __esm({
     PRODUCT_RE = /\b(?:[Yy]our|[Tt]he|[Tt]his)\s+(?:[A-Z0-9][\w&'’.+-]*\s+){1,5}(?:[Ss]ubscription|[Mm]embership|[Pp]lan|[Bb]ox|[Ss]ervice|[Cc]lub|[Pp]ackage)\b|\b(?:[Pp]lan|[Pp]roduct|[Ss]ubscription|[Mm]embership)\s*:\s*\S[^\n]{1,60}/;
     CONTACT_RE = /[\w.+-]+@[\w-]+(?:\.[\w-]+)+|(?:\+?1[\s.-]?)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b|\bcontact\s+(?:us|support|our\s+(?:support|customer|help))\b[^\n]{0,80}(?:https?:\/\/\S+|@)|\b(?:support|help)\s+(?:center|centre)\s*:?\s*https?:\/\/\S+/i;
     CANCEL_URL_RE = /https?:\/\/\S*(?:cancel|billing\.stripe\.com|customer[-_]?portal|\/portal|manage|subscription|account)\S*/i;
+    CHARGE_AMOUNT_EVENTS = /* @__PURE__ */ new Set(["subscription_created", "subscription_renewed", "upcoming_renewal", "trial_will_end"]);
     NOTICE_NOUN = {
       "reminder.trial_ending": "trial-ending reminder",
       "reminder.annual_renewal": "renewal reminder",
@@ -16459,6 +16571,64 @@ var init_email_plan = __esm({
   }
 });
 
+// ../rules/src/checks/forwarded.ts
+function headerAddress(block, name) {
+  const m = new RegExp(String.raw`^\s*[*>]*\s*${name}\s*:\s*\*?\s*(.+)$`, "im").exec(block);
+  if (!m) return void 0;
+  const a = ADDRESS_RE.exec(m[1]);
+  return a ? a[0].toLowerCase().replace(/[.>]+$/, "") : void 0;
+}
+function forwardedInfo(e) {
+  const hit = cache.get(e);
+  if (hit) return hit;
+  const text = e.text ?? "";
+  const marker = FWD_MARKER_RE.exec(text);
+  const forwarded = !!marker || FWD_SUBJECT_RE.test(e.subject ?? "");
+  const info = { forwarded };
+  if (forwarded) {
+    const start = marker ? marker.index : 0;
+    const block = text.slice(start, start + 1200);
+    const from = headerAddress(block, "From");
+    const to = headerAddress(block, "To");
+    if (from) info.originalFrom = from;
+    if (to) info.originalTo = to;
+  }
+  cache.set(e, info);
+  return info;
+}
+function domainOf(address) {
+  const m = /@([^\s<>"]+)/.exec(address ?? "");
+  return m ? m[1].toLowerCase().replace(/[>.]+$/, "") : "";
+}
+function isMorDomain(domain) {
+  return !!domain && MERCHANT_OF_RECORD_DOMAINS.some((d) => domain === d || domain.endsWith(`.${d}`));
+}
+function isMerchantOfRecordEmail(e) {
+  return isMorDomain(domainOf(e.from)) || isMorDomain(domainOf(forwardedInfo(e).originalFrom));
+}
+function inboundDomain() {
+  const env2 = typeof process !== "undefined" ? process.env.INBOUND_EMAIL_DOMAIN : void 0;
+  return (env2 ?? "").trim().replace(/^@/, "").replace(/\.$/, "").toLowerCase() || "inbound.subcomply.localhost";
+}
+function sentStraightToCheckbox(e) {
+  if (forwardedInfo(e).originalTo) return false;
+  if (e.scanId || e.relatedSignupAt || e.subscriptionRef || e.testRun) return false;
+  const addresses = (e.to ?? "").match(/[^\s<>,"]+@[^\s<>,"]+/g) ?? [];
+  const domain = inboundDomain();
+  return addresses.length > 0 && addresses.every((a) => domainOf(a) === domain);
+}
+var FWD_SUBJECT_RE, FWD_MARKER_RE, ADDRESS_RE, cache, MERCHANT_OF_RECORD_DOMAINS;
+var init_forwarded = __esm({
+  "../rules/src/checks/forwarded.ts"() {
+    "use strict";
+    FWD_SUBJECT_RE = /^\s*(?:(?:re|aw|sv)\s*:\s*)*(?:fwd?|fw|wg|tr)\s*:/i;
+    FWD_MARKER_RE = /(?:-{2,}\s*Forwarded message\s*-{2,}|Begin forwarded message\s*:|-{2,}\s*Original Message\s*-{2,}|-{2,}\s*Forwarded Message\s*-{2,}|^\s*_{8,}\s*$\s*^\s*From\s*:)/im;
+    ADDRESS_RE = /[^\s<>,"':;()[\]]+@[^\s<>,"':;()[\]]+\.[a-z]{2,}/i;
+    cache = /* @__PURE__ */ new WeakMap();
+    MERCHANT_OF_RECORD_DOMAINS = ["paddle.com", "paddle.net", "lemonsqueezy.com", "fastspring.com"];
+  }
+});
+
 // ../rules/src/checks/confirmation.ts
 function isPostSignupEmail(e) {
   if (e.kind !== "other" || !e.scanId || !e.relatedSignupAt) return false;
@@ -16471,10 +16641,12 @@ function findAcknowledgments(emails) {
   if (cached) return cached;
   const acks = [];
   const receipts = [];
-  const acknowledged = new Set(emails.filter((e) => e.kind === "acknowledgment").map((e) => recipientOf(e)).filter((r) => r !== ""));
+  const explicit = emails.filter((e) => e.kind === "acknowledgment");
+  const acknowledged = new Set(explicit.map((e) => recipientOf(e)).filter((r) => r !== ""));
   for (const e of emails) {
     if (e.kind === "acknowledgment") acks.push(e);
     else if (acknowledged.has(recipientOf(e))) continue;
+    else if (explicit.length && e.kind === "receipt" && (forwardedInfo(e).forwarded || isMerchantOfRecordEmail(e) || sentStraightToCheckbox(e))) continue;
     else if (e.kind === "receipt" || isPostSignupEmail(e)) {
       (looksLikeSubscriptionTerms(analyzeTerms(emailBody(e))) ? acks : receipts).push(e);
     }
@@ -16484,6 +16656,8 @@ function findAcknowledgments(emails) {
   return set;
 }
 function recipientOf(e) {
+  const original = forwardedInfo(e).originalTo;
+  if (original) return original;
   const m = /[^\s<>,"]+@[^\s<>,"]+/.exec(e.to ?? "");
   return m ? m[0].toLowerCase() : "";
 }
@@ -16681,6 +16855,17 @@ function cancelBeforeTrialMatch(text) {
   if (byDate && TRIAL_ENDS_DATE_RE.test(text)) return byDate[0];
   return null;
 }
+function statedTrialMismatch(a, p, offers) {
+  const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
+  if (!stated.length) return void 0;
+  const own = p?.offer && p.offer.trialDays > 0 ? [p.offer] : p?.offer ? [] : offers.filter((o) => o.trialDays > 0);
+  if (!own.length) return void 0;
+  const fits = (days, trial) => days === trial || days % 30 === 0 && Math.abs(days - trial) <= Math.max(1, days / 30) * 2;
+  if (stated.some((t) => own.some((o) => fits(t.days, o.trialDays)))) return void 0;
+  const lengths = [...new Set(own.map((o) => o.trialDays))].sort((x, y) => x - y);
+  const plan2 = p?.offer ? `${offerLabel(p.offer)} has a ${p.offer.trialDays}-day free trial` : `the plan${lengths.length > 1 ? "s give" : " gives"} a ${lengths.join("- or ")}-day free trial`;
+  return { stated: `\u201C${stated[0].text}\u201D`, plan: plan2 };
+}
 var ACK_MAX_DELAY_HOURS, NO_ACK_EMAIL_MESSAGE, ackCache, SIGNUP_LINK_TOLERANCE_MS, sent, terms, cancellationInstructions, CANCELLING_RE, CANCEL_BEFORE_TRIAL_RE, MONTH, DATE, CANCEL_BEFORE_NO_CHARGE_RE, CANCEL_BEFORE_DATE_RE, TRIAL_ENDS_DATE_RE, trialTerms, CONFIRMATION_CHECKS;
 var init_confirmation = __esm({
   "../rules/src/checks/confirmation.ts"() {
@@ -16693,6 +16878,7 @@ var init_confirmation = __esm({
     init_intro_terms();
     init_offer();
     init_email_plan();
+    init_forwarded();
     ACK_MAX_DELAY_HOURS = 24;
     NO_ACK_EMAIL_MESSAGE = "No acknowledgment email captured yet \u2014 BCC your sign-up confirmation email to your Checkbox inbound address (see Install), or add a test purchase to your scan settings so our shopper inbox receives it.";
     ackCache = /* @__PURE__ */ new WeakMap();
@@ -16989,6 +17175,15 @@ ${v.pageText}`);
         );
         const units = trialDocs.map((doc) => {
           const a = doc.analysis;
+          const wrongTrial = statedTrialMismatch(a, ackPlan(doc.email, input, offers), offers);
+          if (wrongTrial) {
+            return docUnit(doc, {
+              status: "fail",
+              detail: `says ${wrongTrial.stated}, but ${wrongTrial.plan}: state the trial the subscriber really gets`,
+              confidence: 0.8,
+              meta: { trialLengthMismatch: true }
+            });
+          }
           const method = a.cancelMethod[0];
           const timing = a.trialLengths[0] ?? a.postTrialCharge[0];
           const beforeMatch = cancelBeforeTrialMatch(a.text);
@@ -18309,6 +18504,17 @@ function requiredFor(reqs) {
   if (!out.size) for (const el of CHARGE_NOTICE_REQUIRED) out.add(el);
   return [...out];
 }
+function chargeGapPhrase(content, gaps, expected) {
+  const wrong = gaps.filter((g) => content.wrong?.[g]);
+  const absent = gaps.filter((g) => !content.wrong?.[g]);
+  const parts = [];
+  if (absent.length) parts.push(`do not state ${describeMissing(absent)}`);
+  for (const g of wrong) {
+    const said = content.wrong[g];
+    parts.push(g === "amount" ? `states ${ELEMENT_LABELS[g]} as \u201C${said}\u201D${expected ? `, but ${expected}` : ""}` : `states ${ELEMENT_LABELS[g]} as \u201C${said}\u201D, which does not count`);
+  }
+  return parts.join("; ");
+}
 async function runChargeNotice(input) {
   const id = "reminder.charge_notice";
   const configRefs = input.data.configRef ? [input.data.configRef] : [];
@@ -18336,6 +18542,12 @@ async function runChargeNotice(input) {
     }
     return c;
   };
+  const chargeExpected = (e) => {
+    const own = inForceAmount(e, input.ctx.events ?? [], chargePlanOpts.plans[0]?.currency);
+    const cur = (chargePlanOpts.plans[0]?.currency ?? "usd").toUpperCase();
+    if (own !== void 0) return `this subscription\u2019s charge is ${own.toFixed(2)} ${cur}`;
+    return chargePlanOpts.plans.length ? `the plan is ${chargePlanOpts.plans.map((p) => `${planAmount(p).toFixed(2)} ${p.currency.toUpperCase()} ${planEvery(p)}`).join(", ")}` : "";
+  };
   const counted = judged.filter((j) => j.state === "matched" || j.state === "partial" || j.state === "outside_window" || j.state === "missing");
   const matched = counted.filter((j) => j.state === "matched");
   const partial = counted.filter((j) => j.state === "partial");
@@ -18367,10 +18579,12 @@ async function runChargeNotice(input) {
       return makeResult(
         id,
         "fail",
-        `${incompleteMatched.length} of ${matched.length} charge notice(s) do not state ${describeMissing(x.missing)} (e.g. ${emailLabel(x.j.email)})`,
+        `${incompleteMatched.length} of ${matched.length} charge notice(s) ${chargeGapPhrase(content(x.j.email), x.missing, chargeExpected(x.j.email))} (e.g. ${emailLabel(x.j.email)})`,
         [...refs2(incompleteMatched.map((i) => i.j)), ...refs2(missing), ...refs2(outside)],
         0.75,
-        data
+        // Round 29 (pilot 28 item 11): when every failing notice is Checkbox Notices' own send, the plan fixes Checkbox's
+        // template and settings; it never asks the merchant's agent to change an email it does not send.
+        incompleteMatched.every((x2) => isCheckboxSentEmail(x2.j.email)) && !missing.length && !outside.length ? { ...data, contentByCheckbox: true } : data
       );
     }
     if (outside.length) {
@@ -20663,9 +20877,9 @@ function limiter(max) {
       run2();
     }
   };
-  return async (fn) => new Promise((resolve9, reject) => {
+  return async (fn) => new Promise((resolve10, reject) => {
     queue.push(() => {
-      fn().then(resolve9, reject).finally(() => {
+      fn().then(resolve10, reject).finally(() => {
         active--;
         next();
       });
@@ -22031,7 +22245,7 @@ function classifyRaw(input) {
   }
 }
 function fixFromFail(c) {
-  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
+  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? trialLengthFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
 }
 function withPlanTerms(fix, data) {
   if (!/<(?:price|interval)>/.test(fix)) return fix;
@@ -22051,6 +22265,11 @@ function introFixFromText(c) {
   const m = /introductory price of (\S+?)(?: \(\d+% off\))? for (the first [^—,]+?)\s*(?:,|—)/i.exec(c.detail);
   return m ? `State the introductory price (${m[1]} for ${m[2]}) and when it ends, then the regular price from the next charge, in the renewal line.` : "State the introductory price and how long it lasts, then the regular price from the next charge, in the renewal line.";
 }
+function trialLengthFixFromText(c) {
+  if (c.checkId !== "confirmation.email.trial_terms") return void 0;
+  const m = /says “([^”]+)”, but .*?\b(?:has|gives?) a ([\d -]+?or [\d]+|\d+)-day free trial/.exec(c.detail);
+  return m ? `The acknowledgment says \u201C${m[1]}\u201D, but the plan has a ${m[2]}-day free trial: state the trial the subscriber really gets, and how to cancel before it ends.` : void 0;
+}
 function planFrequencyFix(c) {
   if (c.checkId !== "signup.disclosure.frequency") return void 0;
   const every = /\bplans? (?:is|are) billed (every [a-z0-9 ]+?)(?= \/ | —|[.;,]|$)/i.exec(c.detail)?.[1];
@@ -22136,7 +22355,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, RENEWAL_LINE_EXAMPLE, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -22332,7 +22551,7 @@ var init_status = __esm({
       },
       { code: "receipt_without_terms", category: "content", when: has(/only a receipt without subscription terms/), build: () => ({ status: "needs_fix", fix: "Send an acknowledgment that restates the renewal terms (price, frequency, renews until cancelled) and how to cancel; a plain receipt is not enough." }) },
       // Audit P2: Stripe wording (custom_text) only for Stripe inputs; any other checkout gets the same line, platform-neutral.
-      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "Renews automatically every <interval> at <price> until you cancel. Cancel anytime with your cancel link."`, c.data) }) },
+      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "${RENEWAL_LINE_EXAMPLE} Cancel anytime with your cancel link."`, c.data) }) },
       { code: "renewal_without_until_cancel", category: "content", when: has(/but not that it continues until the customer cancels/), build: () => ({ status: "needs_fix", fix: 'Add "until you cancel" to the renewal line.' }) },
       { code: "terms_hidden", category: "content", when: has(/collapsed <details>|\(nearly\) the colour of its background|nearly the colour of the background|hidden by a stylesheet|sr-only/), build: () => ({ status: "needs_fix", fix: "Show the renewal line as plain visible text next to the button (not collapsed, not faded into the background)." }) },
       // Pilot round 11 (change-guard): an intro / discounted price the Stripe session does not apply.
@@ -22361,7 +22580,7 @@ var init_status = __esm({
           )
         })
       },
-      { code: "consent_implied", category: "content", when: has(/consent is implied by clicking/), build: () => ({ status: "needs_fix", fix: 'Add one unchecked checkbox "I agree to the automatic renewal terms above".' }) },
+      { code: "consent_implied", category: "content", when: has(/consent is implied by clicking/), build: () => ({ status: "needs_fix", fix: 'Ask for a separate yes to the renewal: usually one unchecked box, "I agree to the automatic renewal terms above".' }) },
       { code: "consent_general_terms", category: "content", when: has(/covers general terms, not the/), build: () => ({ status: "needs_fix", fix: 'Make the checkbox about the renewal: "I agree to the automatic renewal terms above."' }) },
       // Round 23 (pilot 22 nontech-founder done blocker): "does not appear to be required" means the capture could not see
       // whether the box is enforced (a script may block the purchase, as Stripe's own page does). A person who can try it
@@ -22795,8 +23014,9 @@ var init_status = __esm({
     PORTAL_OFFLINE_FIX = 'Turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, then replace the "email / call us to cancel" line with "Cancel anytime online in your account".';
     PAYMENT_LINK_PORTAL_FIX = `Turn on "Cancel subscriptions" in the Stripe customer portal (Stripe Dashboard \u2192 Settings \u2192 Billing \u2192 Customer portal), copy its billing.stripe.com login link and add it to your site's footer as a "Cancel subscription" link.`;
     PAYMENT_LINK_OFFLINE_FIX = `${PAYMENT_LINK_PORTAL_FIX} Then replace the "email / call us to cancel" line with "Cancel anytime online" and that link.`;
+    RENEWAL_LINE_EXAMPLE = "<price> every <interval> (plus applicable taxes). Renews automatically until you cancel.";
     FAIL_FIX = {
-      "signup.disclosure.autorenew_language": 'Add one line under the price, before the card and email fields: "Renews automatically every <interval> at <price> until you cancel."',
+      "signup.disclosure.autorenew_language": `Add one line under the price, before the card and email fields: "${RENEWAL_LINE_EXAMPLE}"`,
       "signup.disclosure.price": "State the recurring price in the renewal line (the amount actually charged each time).",
       "signup.disclosure.frequency": `State how often it is charged, in the plan's own interval ("every month", "every year").`,
       "signup.disclosure.cancellation_policy": 'Add "Cancel anytime online" to the renewal line, with your cancel link.',
@@ -22804,7 +23024,7 @@ var init_status = __esm({
       "signup.disclosure.term_length": 'Say how often it renews ("renews every month until you cancel").',
       "signup.disclosure.proximity": "Put the renewal line under the price, before the card and email fields and the pay button.",
       "signup.disclosure.conspicuous": "Show the renewal line at body size, semibold, in your normal text colour.",
-      "signup.consent.affirmative": 'Add one unchecked checkbox "I agree to the automatic renewal terms above".',
+      "signup.consent.affirmative": 'Ask for a separate yes to the renewal: usually one unchecked box, "I agree to the automatic renewal terms above".',
       "signup.consent.not_prechecked": "Leave the consent checkbox unchecked by default.",
       "confirmation.email.sent": "Send an acknowledgment email right after sign-up (Checkbox has a template).",
       "confirmation.email.terms": "Restate the renewal terms (price, frequency, until cancelled) in the acknowledgment.",
@@ -25061,6 +25281,24 @@ var init_stripe2 = __esm({
   }
 });
 
+// ../rules/src/preflight/stripe-verdict.ts
+function stripeParamsVerdict(r) {
+  if (r.verdict === "not_applicable") return { verdict: "not_applicable", open: [] };
+  const open2 = r.checks.filter((c) => c.status === "fail" || c.status === "needs_review" && !(c.compliance_status && SATISFIED_COMPLIANCE.has(c.compliance_status))).map((c) => ({ check_id: c.check_id, status: c.status, title: c.title ?? c.check_id, detail: c.explanation ?? "" })).sort((a, b) => (a.status === "fail" ? 0 : 1) - (b.status === "fail" ? 0 : 1));
+  if (r.verdict === "fail" || r.compliance_status === "needs_fix" || open2.some((c) => c.status === "fail")) return { verdict: "fail", open: open2 };
+  const coupon = (r.warnings ?? []).find((w) => w.code === "coupon_unverified");
+  if (open2.length) return { verdict: "needs_review", open: open2, ...coupon ? { reason: coupon.message } : {} };
+  if (coupon) return { verdict: "needs_review", open: [], reason: coupon.message };
+  return { verdict: "pass", open: [] };
+}
+var SATISFIED_COMPLIANCE;
+var init_stripe_verdict = __esm({
+  "../rules/src/preflight/stripe-verdict.ts"() {
+    "use strict";
+    SATISFIED_COMPLIANCE = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+  }
+});
+
 // ../rules/src/preflight/email.ts
 function linkify(escaped) {
   return escaped.replace(/https?:\/\/[^\s<]+/g, (raw) => {
@@ -25244,6 +25482,10 @@ function contextFor(kind, occ, plan2, jurisdictions, asOf, email) {
 function longDate2(d) {
   return d.toLocaleDateString("en-US", { month: "long", day: "numeric", year: "numeric", timeZone: "UTC" });
 }
+function supportContactLine(contact, opts = {}) {
+  if (contact || opts.required) return `Questions? Reply to this email or contact us at ${contact || SUPPORT_CONTACT_PLACEHOLDER}.`;
+  return "Questions? Reply to this email.";
+}
 function emailTemplate(kind, plan2, opts = {}) {
   const brand = plan2.merchantName ?? "";
   const sub = `${brand ? `${brand} ` : ""}subscription`;
@@ -25251,7 +25493,7 @@ function emailTemplate(kind, plan2, opts = {}) {
   const every = intervalPhrase(plan2.interval, plan2.intervalCount);
   const cancel = plan2.cancelUrl ?? CANCEL_URL_PLACEHOLDER;
   const effect = plan2.cancelTiming === "immediately" ? "cancellation takes effect immediately" : "cancellation takes effect at the end of your current billing period";
-  const contact = opts.supportContact ? `Questions? Contact us at ${opts.supportContact}.` : "Questions? Reply to this email.";
+  const contact = supportContactLine(opts.supportContact);
   const lines = (...l) => l.filter(Boolean).join("\n\n");
   const intro = plan2.introAmount !== void 0 && plan2.introAmount < plan2.amount ? `${formatMoney(plan2.introAmount, plan2.currency)} for ${plan2.introPeriods && plan2.introPeriods > 1 ? `your first ${plan2.introPeriods} billing periods` : `your first ${every}`}` : "";
   const introLine = intro ? `Introductory price: ${intro}, then ${money3} every ${every}.` : "";
@@ -25259,11 +25501,13 @@ function emailTemplate(kind, plan2, opts = {}) {
     case "acknowledgment":
       return {
         subject: `Your ${sub} is confirmed`,
+        // Round 31 (pilot 30 item 22): the same sentences, in the same order, as the "You send" acknowledgment template
+        // (apps/api notices/merchant-templates.ts), so the plan, checkEmail and the due notice give one email.
         text: lines(
-          `Thanks for subscribing${brand ? ` to ${brand}` : ""}! This email confirms your subscription terms.`,
-          introLine,
+          `Thanks for subscribing${brand ? ` to ${brand}` : ""}. This email confirms your subscription terms.`,
           plan2.trialDays ? `Your free trial lasts ${plan2.trialDays} days and ends on {{trial_end_date}}. To avoid being charged, cancel before your trial ends at ${cancel} \u2014 it takes less than a minute. If you do nothing, your subscription starts automatically on {{trial_end_date}} and you will be charged ${money3} every ${every}.` : "",
-          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your next charge is on {{next_charge_date}}.`,
+          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your ${plan2.trialDays ? "first" : "next"} charge is on {{next_charge_date}}.`,
+          introLine,
           `How to cancel: go to ${cancel} \u2014 you can cancel anytime online; ${effect}.`,
           contact
         ),
@@ -25319,7 +25563,7 @@ function emailTemplate(kind, plan2, opts = {}) {
           `To stop future charges, cancel online anytime at ${cancel}.`,
           // Pilot round 11 (invariant test): Georgia's charge notice must give the business's contact information;
           // "reply to this email" is not one, so without a support contact the template asks for it.
-          opts.supportContact ? contact : `Questions? Contact us at ${SUPPORT_CONTACT_PLACEHOLDER}.`
+          supportContactLine(opts.supportContact, { required: true })
         ),
         // Round 12: the template used {{support_contact}} without listing it as a merge tag to fill.
         tags: ["{{charge_date}}", "{{next_charge_date}}", ...opts.supportContact ? [] : [SUPPORT_CONTACT_PLACEHOLDER]]
@@ -25860,6 +26104,7 @@ __export(preflight_exports, {
   PREFLIGHT_DISCLAIMER: () => PREFLIGHT_DISCLAIMER,
   PREFLIGHT_DOCS_URL: () => PREFLIGHT_DOCS_URL,
   PreflightInputError: () => PreflightInputError,
+  SATISFIED_COMPLIANCE: () => SATISFIED_COMPLIANCE,
   STRIPE_HOSTED_STYLING_NOTE: () => STRIPE_HOSTED_STYLING_NOTE,
   checkDisclosure: () => checkDisclosure,
   checkEmail: () => checkEmail,
@@ -25881,6 +26126,8 @@ __export(preflight_exports, {
   runChecks: () => runChecks,
   shapeChecks: () => shapeChecks,
   signupStripeObjects: () => signupStripeObjects,
+  stripeParamsVerdict: () => stripeParamsVerdict,
+  supportContactLine: () => supportContactLine,
   withIntroOffers: () => withIntroOffers
 });
 var init_preflight = __esm({
@@ -25889,6 +26136,7 @@ var init_preflight = __esm({
     init_common();
     init_disclosure();
     init_stripe2();
+    init_stripe_verdict();
     init_email();
     init_html_page();
     init_page();
@@ -25904,7 +26152,7 @@ __export(check_exports, {
   default: () => check_default
 });
 import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 function operationFor(endpoint) {
   const op = Object.values(OPERATIONS).find((o) => o.httpMethod === "POST" && o.path === endpoint);
   if (!op) throw new Error(`No API operation for POST ${endpoint}`);
@@ -25913,7 +26161,7 @@ function operationFor(endpoint) {
 async function readInput(ctx, file) {
   if (file === "-") return ctx.readStdin();
   try {
-    return readFileSync3(resolve(ctx.cwd, file), "utf8");
+    return readFileSync3(resolve2(ctx.cwd, file), "utf8");
   } catch (err) {
     throw new UsageError(`Cannot read ${file}: ${err.code ?? err.message}`);
   }
@@ -26201,7 +26449,7 @@ var init_check = __esm({
 
 // src/ci/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname2, isAbsolute, join as join3, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, isAbsolute, join as join3, resolve as resolve3 } from "node:path";
 function planList(config, ref) {
   if (Array.isArray(ref)) return ref;
   if (ref === "all" && !(config.plans ?? []).some((p) => p.name === "all")) return (config.plans ?? []).map((p) => p.name);
@@ -26209,7 +26457,7 @@ function planList(config, ref) {
 }
 function findConfig(cwd, explicit) {
   if (explicit) {
-    const p = isAbsolute(explicit) ? explicit : resolve2(cwd, explicit);
+    const p = isAbsolute(explicit) ? explicit : resolve3(cwd, explicit);
     return existsSync3(p) ? p : void 0;
   }
   for (const f of CONFIG_FILES) if (existsSync3(join3(cwd, f))) return join3(cwd, f);
@@ -26230,7 +26478,7 @@ function loadConfig(path) {
   }
   const issues = validateConfig(value);
   if (issues.length) throw new ConfigError(path, issues);
-  return { config: value, path, dir: dirname2(path), raw };
+  return { config: value, path, dir: dirname3(path), raw };
 }
 function validateConfig(value) {
   const is = new Issues();
@@ -26509,8 +26757,8 @@ var init_config3 = __esm({
 });
 
 // src/commands/init/literal.ts
-function parseObjectLiteral(source, env2 = {}) {
-  const p = new Parser(source, env2);
+function parseObjectLiteral(source, env2 = {}, consts = {}) {
+  const p = new Parser(source, env2, consts);
   if (p.peek() !== "{") return { value: null, unresolved: ["<not an object literal>"] };
   const v = p.object("");
   return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {} };
@@ -26520,10 +26768,11 @@ var init_literal = __esm({
   "src/commands/init/literal.ts"() {
     "use strict";
     UNKNOWN = Symbol("unknown");
-    Parser = class {
-      constructor(s2, env2) {
+    Parser = class _Parser {
+      constructor(s2, env2, consts = {}) {
         this.s = s2;
         this.env = env2;
+        this.consts = consts;
       }
       i = 0;
       unresolved = [];
@@ -26613,6 +26862,12 @@ var init_literal = __esm({
           if (name === "false") return false;
           if (name === "null") return null;
           if (name === "undefined") return void 0;
+          if (Object.prototype.hasOwnProperty.call(this.consts, name)) {
+            const sub = new _Parser(this.consts[name], this.env);
+            const v = sub.value("");
+            if (v !== UNKNOWN && v !== void 0 && path) this.fromEnv[path] = name;
+            return v;
+          }
           const env2 = /^(?:process\.env|import\.meta\.env)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(name);
           if (env2) {
             if (this.env[env2[1]] !== void 0 && path) this.fromEnv[path] = name;
@@ -26932,11 +27187,17 @@ function findStripeKey(env2, processEnv) {
     sources.push([`${k} (environment)`, processEnv[k]]);
     sources.push([`${k} (.env)`, env2[k]]);
   }
-  const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_test_[A-Za-z0-9]{10,}$/.test(s2[1].trim()));
-  const pick = found.find((s2) => s2[1].startsWith("rk_test_")) ?? found[0];
-  if (!pick) return void 0;
-  const key = pick[1].trim();
-  return { key, hint: `${key.slice(0, 8)}\u2026${key.slice(-4)}`, source: pick[0], restricted: key.startsWith("rk_test_") };
+  const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/.test(s2[1].trim())).map(([src, v]) => [src, v.trim()]);
+  const hint = (key) => `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
+  const pick = found.find((s2) => s2[1].startsWith("rk_test_"));
+  if (pick) return { key: { key: pick[1], hint: hint(pick[1]), source: pick[0], restricted: true } };
+  const other = found.find((s2) => s2[1].startsWith("sk_test_")) ?? found[0];
+  if (!other) return {};
+  return { refused: { hint: hint(other[1]), source: other[0], kind: /_live_/.test(other[1]) ? "live" : "secret" } };
+}
+function stripeKeyRefusedMessage(r) {
+  const what = r.kind === "live" ? `${r.hint} in ${r.source} is a LIVE Stripe key. Live keys are never stored by the CLI or an agent: a person adds them in the Checkbox dashboard.` : `${r.hint} in ${r.source} is the Stripe secret key, which can do everything in your Stripe test account, so Checkbox refuses it.`;
+  return `${what} For test runs, make a restricted TEST key instead: in Stripe, switch to Test mode, open Developers \u2192 API keys \u2192 Create restricted key, tick the permissions on https://checkbox.site/docs/guides/stripe-key, and put the key (rk_test_\u2026) in STRIPE_RESTRICTED_KEY in .env.local (never in a chat). Then run \`checkbox init\` again.`;
 }
 function sessionLiteral(text, index) {
   const open2 = text.indexOf("{", index);
@@ -26951,7 +27212,13 @@ function sessionLiteral(text, index) {
       else if (ch === quote2) quote2 = null;
       continue;
     }
-    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    if (ch === "/" && text[i + 1] === "/") {
+      const nl = text.indexOf("\n", i);
+      i = nl === -1 ? text.length : nl;
+    } else if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      i = end === -1 ? text.length : end + 1;
+    } else if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
     else if (ch === "{") depth++;
     else if (ch === "}") {
       depth--;
@@ -26960,6 +27227,58 @@ function sessionLiteral(text, index) {
   }
   return null;
 }
+function declaredExpr(text, from) {
+  let depth = 0;
+  let quote2 = null;
+  for (let i = from; i < text.length && i - from < 2e3; i++) {
+    const ch = text[i];
+    if (quote2) {
+      if (ch === "\\") i++;
+      else if (ch === quote2) quote2 = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    else if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if ((ch === ";" || ch === "\n") && depth <= 0) return text.slice(from, i).trim();
+  }
+  return text.slice(from, from + 2e3).trim();
+}
+function constDeclarations(text, exportedOnly) {
+  const out = {};
+  const re = exportedOnly ? /(?:^|\n)[ \t]*export\s+const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g : /(?:^|\n)[ \t]*(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g;
+  for (const m of text.matchAll(re)) if (!(m[1] in out)) out[m[1]] = declaredExpr(text, m.index + m[0].length);
+  return out;
+}
+function resolveImport(root, fromFile, spec) {
+  const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+  const bases = spec.startsWith(".") ? [join4(dir, spec)] : /^[@~]\//.test(spec) ? [spec.slice(2), join4("src", spec.slice(2))] : [];
+  for (const b of bases) {
+    const base = b.split("\\").join("/").replace(/\.(?:[cm]?js|jsx)$/, "");
+    for (const f of [b, ...[".ts", ".tsx", ".js", ".mjs", ".jsx", "/index.ts", "/index.js"].map((e) => `${base}${e}`)]) {
+      if (/\.[cm]?[jt]sx?$/.test(f) && existsSync4(join4(root, f))) return f.split("\\").join("/");
+    }
+  }
+  return void 0;
+}
+function constantsFor(root, relFile, text) {
+  const out = {};
+  for (const m of text.matchAll(/import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g)) {
+    const target = resolveImport(root, relFile, m[2]);
+    if (!target) continue;
+    let exported;
+    try {
+      exported = constDeclarations(readFileSync5(join4(root, target), "utf8"), true);
+    } catch {
+      continue;
+    }
+    for (const part of m[1].split(",")) {
+      const [name, alias] = part.trim().split(/\s+as\s+/).map((x) => x.trim());
+      if (name && exported[name] !== void 0) out[alias || name] = exported[name];
+    }
+  }
+  return { ...out, ...constDeclarations(text, false) };
+}
 function detectProject(root, processEnv = {}) {
   const pkg = readJson(join4(root, "package.json"));
   const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
@@ -26996,7 +27315,7 @@ function detectProject(root, processEnv = {}) {
         checkoutSessions.push({ file: rel2, line: line2, unresolved: ["<params are not an object literal>"] });
         continue;
       }
-      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) });
+      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) }, constantsFor(root, rel2, text));
       checkoutSessions.push({ file: rel2, line: line2, ...parsed.value ? { params: redactSecretsDeep(parsed.value) } : {}, unresolved: parsed.unresolved });
     }
   });
@@ -27018,7 +27337,8 @@ function detectProject(root, processEnv = {}) {
     checkoutCode,
     payButtons,
     checkoutSessions,
-    ...stripeKey ? { stripeTestKey: stripeKey } : {},
+    ...stripeKey.key ? { stripeTestKey: stripeKey.key } : {},
+    ...stripeKey.refused ? { stripeKeyRefused: stripeKey.refused } : {},
     ...brand ? { brand } : {},
     plans: plansFromSessions(checkoutSessions),
     env: env2
@@ -27059,7 +27379,7 @@ var init_detect = __esm({
 
 // src/ci/scaffold.ts
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
-import { basename, dirname as dirname3, join as join5, relative as relative2 } from "node:path";
+import { basename, dirname as dirname4, join as join5, relative as relative2 } from "node:path";
 function walk3(root, visit) {
   let n = 0;
   const go = (dir, depth) => {
@@ -27128,11 +27448,38 @@ function paramsBuilder(root, file, line2) {
   const imp = new RegExp(`import\\s*\\{[^}]*\\b${fn}\\b[^}]*\\}\\s*from\\s*['"](\\.{1,2}/[^'"]+)['"]`).exec(text);
   let target;
   if (imp) {
-    const base = join5(dirname3(file), imp[1]).split("\\").join("/");
+    const base = join5(dirname4(file), imp[1]).split("\\").join("/");
     target = [base, ...[".ts", ".tsx", ".js", ".mjs", "/index.ts", "/index.js"].map((e) => `${base.replace(/\.(?:[cm]?js)$/, "")}${e}`)].find((f) => /\.[cm]?[jt]sx?$/.test(f) && existsSync5(join5(root, f)));
   } else if (new RegExp(`export\\s+(?:async\\s+)?function\\s+${fn}\\b|export\\s+const\\s+${fn}\\b`).test(text)) target = file;
   return target ? { module: `${target}#${fn}`, takesArgs } : void 0;
 }
+function plansSoldBy(params, plans) {
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const out = [];
+  for (const li of items) {
+    const pd = li?.price_data;
+    if (!pd || typeof pd.unit_amount !== "number") continue;
+    const match = plans.find((p) => (typeof p.amount === "number" ? p.amount : typeof p.price === "number" ? Math.round(p.price * 100) : NaN) === pd.unit_amount && p.interval === pd.recurring?.interval);
+    if (match && !out.includes(match)) out.push(match);
+  }
+  return out;
+}
+function cancelUrlInCode(sessions) {
+  const urls = /* @__PURE__ */ new Set();
+  for (const s2 of sessions) {
+    const text = JSON.stringify(s2.params?.custom_text ?? "");
+    for (const m of text.matchAll(/cancel[^"]{0,80}?(https:\/\/[^\s"'<>)]+?)(?=[.,;:!?]?(?:[\s"'<>)]|$))/gi)) urls.add(m[1]);
+  }
+  return urls.size === 1 ? [...urls][0] : void 0;
+}
+function pageSource(root, built) {
+  const route = /(?:^|\/)(?:public|dist|out|build|static|_site|www)\/(?:(.*)\/)?([^/]+?)(?:\/index)?\.html?$/i.exec(built);
+  if (!route) return void 0;
+  const path = [route[1], route[2]].filter(Boolean).join("/");
+  const bases = [`app/${path}/page`, `src/app/${path}/page`, `app/(marketing)/${path}/page`, `pages/${path}`, `src/pages/${path}`, `src/routes/${path}/+page`, `pages/${path}/index`, `src/pages/${path}/index`];
+  const hits = bases.flatMap((b) => [".tsx", ".jsx", ".ts", ".js", ".svelte", ".vue", ".astro", ".mdx"].map((e) => `${b}${e}`)).filter((f) => existsSync5(join5(root, f)));
+  return hits.length === 1 ? hits[0] : void 0;
+}
 function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
@@ -27151,13 +27498,21 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     merchant.cancel_url = cancelFact;
     found.push(`cancel URL ${cancelFact} (from checkbox init)`);
   } else if (siteUrl && cancelPath) merchant.cancel_url = `${originOf(siteUrl)}${cancelPath}`;
-  else {
+  else if (cancelUrlInCode(det.checkoutSessions)) {
+    merchant.cancel_url = cancelUrlInCode(det.checkoutSessions);
+    found.push(`cancel URL ${String(merchant.cancel_url)} (from the Checkout custom_text)`);
+  } else {
     merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
     todos.push("merchant.cancel_url: the page where subscribers cancel online");
   }
   if (fact("support_email")) merchant.support_contact = fact("support_email");
+  const initPlans = Array.isArray(facts.plans) ? facts.plans : [];
+  const initName = (p) => {
+    const m = initPlans.find((x) => typeof x.name === "string" && x.amount === p.amount && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (p.interval_count ?? 1));
+    return m ? String(m.name) : void 0;
+  };
   const plans = det.plans.map((p, i) => ({
-    name: p.name ?? `Plan ${i + 1}`,
+    name: p.name ?? initName(p) ?? `Plan ${i + 1}`,
     amount: p.amount,
     currency: p.currency,
     interval: p.interval,
@@ -27196,8 +27551,13 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
   }
   const planNames = plans.map((p) => String(p.name));
-  const planFor = () => plans.length > 1 ? { plan: `TODO: one of ${planNames.map((n) => JSON.stringify(n)).join(", ")}` } : {};
-  if (plans.length > 1) todos.push("plan: pick the plan of each disclosure, page and email entry");
+  const oneOf = planNames.map((n) => JSON.stringify(n)).join(", ");
+  let planTodo = false;
+  const planFor = (kind = "entry") => {
+    if (plans.length <= 1) return {};
+    planTodo = true;
+    return { plan: kind === "page" ? `TODO: "all" (the page shows every plan) or one of ${oneOf}` : `TODO: one of ${oneOf}` };
+  };
   const stripe = [];
   const perFile = /* @__PURE__ */ new Map();
   for (const s2 of det.checkoutSessions) {
@@ -27228,7 +27588,12 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
     else found.push(`${s2.file}:${s2.line}: Checkout Session`);
     entry.strict = true;
-    stripe.push(entry);
+    const sold = s2.params ? plansSoldBy(s2.params, plans) : [];
+    if (plans.length === 1 || sold.length === 1) stripe.push({ ...entry, plan: String((sold[0] ?? plans[0]).name) });
+    else if (s2.params && plans.length > 1 && !plans.some((p) => String(p.name).startsWith("TODO"))) {
+      for (const p of plans) stripe.push({ ...entry, name: unique(names, `${String(entry.name).replace(/\)$/, "")}: ${String(p.name)})`), plan: String(p.name) });
+      names.delete(String(entry.name));
+    } else stripe.push(entry);
   }
   const emails = [];
   const pages = [];
@@ -27248,7 +27613,8 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     }
     if (PAGE_FILE.test(rel2)) {
       const kind = /checkout|subscribe/i.test(rel2) ? "checkout" : "pricing";
-      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor() });
+      const src = pageSource(root, rel2);
+      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor("page"), ...src ? { source: src } : {} });
       found.push(`${rel2}: ${kind} page`);
       return;
     }
@@ -27268,6 +27634,7 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
   if (!disclosures.length && det.payButtons.length) {
     todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
   }
+  if (planTodo) todos.push('plan: pick the plan of each disclosure, page and email entry marked TODO ("all" for a page that shows every plan)');
   const checks = {};
   if (stripe.length) checks.stripe_checkout = stripe;
   if (disclosures.length) checks.disclosures = disclosures;
@@ -27315,7 +27682,7 @@ var init_scaffold = __esm({
 
 // src/ci/coverage.ts
 import { readFileSync as readFileSync7 } from "node:fs";
-import { join as join6, relative as relative3, resolve as resolve3 } from "node:path";
+import { join as join6, relative as relative3, resolve as resolve4 } from "node:path";
 function callsIn(text, file) {
   const hits = [];
   for (const [re, kind] of PATTERNS) {
@@ -27337,7 +27704,7 @@ function callsIn(text, file) {
 }
 function coverageOf(loaded, root, files) {
   const cfg = loaded.config;
-  const toRoot = (p) => relative3(root, resolve3(loaded.dir, p)).split("\\").join("/");
+  const toRoot = (p) => relative3(root, resolve4(loaded.dir, p)).split("\\").join("/");
   const calls = [];
   const visit = (rel2) => {
     if (!CODE.test(rel2) || TESTISH.test(rel2)) return;
@@ -27438,10 +27805,10 @@ var init_coverage = __esm({
 // src/ci/inputs.ts
 import { execFile } from "node:child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve4 } from "node:path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join7, relative as relative4, resolve as resolve5 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 function readRel(dir, file) {
-  const abs = isAbsolute2(file) ? file : resolve4(dir, file);
+  const abs = isAbsolute2(file) ? file : resolve5(dir, file);
   try {
     return readFileSync8(abs, "utf8");
   } catch (err) {
@@ -27452,26 +27819,42 @@ function readRel(dir, file) {
 function hasTsx(dir) {
   for (let d = dir, i = 0; i < 8; i++) {
     if (existsSync6(join7(d, "node_modules", "tsx", "package.json"))) return true;
-    const up = dirname4(d);
+    const up = dirname5(d);
     if (up === d) break;
     d = up;
   }
   return false;
 }
+function declaresTsx(dir) {
+  for (let d = dir, i = 0; i < 8; i++) {
+    try {
+      const pkg = JSON.parse(readFileSync8(join7(d, "package.json"), "utf8"));
+      if (pkg.dependencies?.tsx || pkg.devDependencies?.tsx) return true;
+    } catch {
+    }
+    const up = dirname5(d);
+    if (up === d) break;
+    d = up;
+  }
+  return false;
+}
+function addTsx(dir, detail = "") {
+  return declaresTsx(dir) ? NOT_INSTALLED : `Add tsx to the project (npm install -D tsx${detail})`;
+}
 function loaderFlags(file, dir, nodeVersion = process.versions.node, features = process.features) {
   if (/\.[cm]?js$/.test(file)) return [];
   if (hasTsx(dir)) return ["--import", "tsx"];
-  if (/\.[jt]sx$/.test(file)) return `${file}: JSX modules need tsx (npm install -D tsx), or export the rendered { subject, html } from a .js / .ts file`;
+  if (/\.[jt]sx$/.test(file)) return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: JSX modules need tsx (npm install -D tsx), or export the rendered { subject, html } from a .js / .ts file`;
   if (features.typescript) return [];
   const [major, minor] = nodeVersion.split(".").map(Number);
   if (major > 22 || major === 22 && minor >= 6) return ["--experimental-strip-types"];
-  return `${file}: TypeScript modules need Node 22.6+ (type stripping) or tsx in the project (npm install -D tsx); or point "file" at a JSON export`;
+  return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: TypeScript modules need Node 22.6+ (type stripping) or tsx in the project (npm install -D tsx); or point "file" at a JSON export`;
 }
 function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
   const hash = ref.lastIndexOf("#");
   const file = hash > 0 ? ref.slice(0, hash) : ref;
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
-  const abs = resolve4(dir, file);
+  const abs = resolve5(dir, file);
   if (!existsSync6(abs)) return Promise.reject(new InputError(`${file} does not exist (paths are relative to checkbox.json)`));
   const flags = loaderFlags(file, dir);
   if (typeof flags === "string") return Promise.reject(new InputError(flags));
@@ -27512,19 +27895,19 @@ function moduleErrorMessage(stderr, dir, flags = []) {
     }
     const noExt = !/\.[cm]?[jt]sx?$|\.json$/.test(target);
     if (noExt && !tsx) {
-      return `${rel2(from)} imports ${rel2(target)} without a file extension, which Node cannot resolve on its own. Add tsx to the project (npm install -D tsx; checkbox ci then imports modules the way your bundler does), or write the import with its extension (e.g. './${rel2(target).split("/").pop()}.ts').`;
+      return `${rel2(from)} imports ${rel2(target)} without a file extension, which Node cannot resolve on its own. ${addTsx(dir, "; checkbox ci then imports modules the way your bundler does")}, or write the import with its extension (e.g. './${rel2(target).split("/").pop()}.ts').`;
     }
     return `${rel2(from)} imports ${rel2(target)}, which does not exist${noExt ? " (tsx found no .ts / .js file of that name either)" : ""}.`;
   }
   if (/ERR_UNKNOWN_FILE_EXTENSION/.test(text)) {
     const file = /Unknown file extension "([^"]+)" for (\S+)/.exec(text);
-    return `Node cannot import ${file ? `${rel2(file[2])} (${file[1]})` : "a file the module imports"}. Add tsx to the project (npm install -D tsx), or point the entry at a .js / .ts file that imports no ${file?.[1] ?? "such"} files.`;
+    return `Node cannot import ${file ? `${rel2(file[2])} (${file[1]})` : "a file the module imports"}. ${addTsx(dir)}, or point the entry at a .js / .ts file that imports no ${file?.[1] ?? "such"} files.`;
   }
   const lines = text.split("\n").map((l) => l.trim()).filter((l) => l && !/^at /.test(l) && !/^Node\.js v\d/.test(l));
   const first2 = lines.find((l) => /^(?:[A-Z]\w*)?Error\b.*:/.test(l)) ?? lines.find((l) => /error/i.test(l)) ?? lines[lines.length - 1] ?? "";
   return first2.replace(/file:\/\/\S+/g, (u) => rel2(u)).replace(/\s+/g, " ").slice(0, 400);
 }
-function paramsFromSource(text, file, call = 1, env2 = {}) {
+function paramsFromSource(text, file, call = 1, env2 = {}, consts = {}) {
   const calls = [...text.matchAll(/checkout\.sessions\.create\s*\(/g)];
   if (!calls.length) throw new InputError(`${file} has no stripe.checkout.sessions.create( call`);
   const m = calls[call - 1];
@@ -27532,7 +27915,7 @@ function paramsFromSource(text, file, call = 1, env2 = {}) {
   const line2 = text.slice(0, m.index).split("\n").length;
   const lit = sessionLiteral(text, m.index + m[0].length);
   if (!lit) throw new InputError(`${file}:${line2}: the params are not an object literal; use "module" (a function returning the params) or "file" instead`);
-  const parsed = parseObjectLiteral(lit, env2);
+  const parsed = parseObjectLiteral(lit, env2, consts);
   if (!parsed.value) throw new InputError(`${file}:${line2}: could not read the params object`);
   return { params: parsed.value, line: line2, unresolved: parsed.unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
 }
@@ -27552,7 +27935,7 @@ function exportLine(dir, ref) {
   const name = hash > 0 ? ref.slice(hash + 1) : "default";
   let text;
   try {
-    text = readFileSync8(resolve4(dir, file), "utf8");
+    text = readFileSync8(resolve5(dir, file), "utf8");
   } catch {
     return 1;
   }
@@ -27591,7 +27974,7 @@ function planTerms(config, plan2) {
   return t;
 }
 function rel(loaded, root, file) {
-  return relative4(root, resolve4(loaded.dir, file)).split("\\").join("/") || file;
+  return relative4(root, resolve5(loaded.dir, file)).split("\\").join("/") || file;
 }
 function emailFromFile(content, file, subject) {
   let body = content;
@@ -27636,7 +28019,8 @@ async function stripeJob(loaded, e, o, root) {
     } else {
       const src = e.source;
       job.inputs.push(src);
-      const r = paramsFromSource(readRel(dir, src), src, e.call ?? 1, projectEnv(dir));
+      const srcText = readRel(dir, src);
+      const r = paramsFromSource(srcText, src, e.call ?? 1, projectEnv(dir), constantsFor(dir, src, srcText));
       job.target = { file: rel(loaded, root, src), line: r.line };
       job.fromSource = true;
       params = r.params;
@@ -27648,9 +28032,16 @@ async function stripeJob(loaded, e, o, root) {
       }
     }
     if (!params || typeof params !== "object" || Array.isArray(params)) throw new InputError("the Checkout Session params must be a JSON object");
+    const items0 = Array.isArray(params.line_items) ? params.line_items : [];
+    if (!e.plan && (config.plans?.length ?? 0) > 1 && !items0.some((li) => li && typeof li === "object" && li.price_data)) {
+      throw new InputError(`"${e.name}" does not say which plan it sells, and its price is a Price id or an expression Checkbox cannot read: add "plan": one of ${(config.plans ?? []).map((p) => JSON.stringify(p.name)).join(", ")} to this entry (one entry per plan when one call serves several plans).`);
+    }
     const merchant = planTerms(config, pickPlan(config, e.plan));
     const drift = planDrift(params, pickPlan(config, e.plan));
     if (drift) job.warnings.push(drift);
+    const soldPlan = pickPlan(config, e.plan);
+    const overrides = soldPlan ? planAsSold(params, soldPlan) : void 0;
+    if (soldPlan && overrides) job.sold = { plan: soldPlan.name, overrides };
     const items = Array.isArray(params.line_items) ? params.line_items : [];
     if (items.length && items.every((li) => li && typeof li === "object" && li.price_data)) for (const k of ["price", "amount", "currency", "interval", "interval_count"]) delete merchant[k];
     job.body = { params, ...Object.keys(merchant).length ? { merchant } : {}, ...jurisdictionsOf(config) };
@@ -27659,6 +28050,29 @@ async function stripeJob(loaded, e, o, root) {
   }
   return job;
 }
+function planAsSold(params, plan2) {
+  const sd = params.subscription_data ?? {};
+  const trial = typeof sd.trial_period_days === "number" ? sd.trial_period_days : void 0;
+  const out = {};
+  if (trial !== void 0 && trial !== (plan2.trial_days ?? 0)) out.trial_days = trial;
+  if (trial === void 0 && plan2.trial_days && plan2.trial_days > 0 && sd.trial_end === void 0) out.trial_days = 0;
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const pd = items.map((li) => li && typeof li === "object" ? li.price_data : void 0).find((x) => x && typeof x === "object");
+  const rec = pd && typeof pd.recurring === "object" ? pd.recurring : void 0;
+  if (rec && typeof rec.interval === "string" && rec.interval !== plan2.interval && ["day", "week", "month", "year"].includes(rec.interval)) out.interval = rec.interval;
+  const price3 = typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
+    out.price = pd.unit_amount / 100;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function describeSold(o) {
+  const parts = [];
+  if (o.trial_days !== void 0) parts.push(o.trial_days ? `a ${o.trial_days}-day trial` : "no trial");
+  const charge = [o.price !== void 0 ? Number(o.price).toFixed(2) : "", o.interval ? `every ${o.interval}` : ""].filter(Boolean).join(" ");
+  if (charge) parts.push(charge);
+  return parts.join(", ");
+}
 function planDrift(params, plan2) {
   if (!plan2) return void 0;
   const sd = params.subscription_data ?? {};
@@ -27674,7 +28088,7 @@ function planDrift(params, plan2) {
   if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
     out.push(`the params charge ${(pd.unit_amount / 100).toFixed(2)}, plan "${plan2.name}" ${price3.toFixed(2)}`);
   }
-  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The checks use the params; update "plans" in checkbox.json so the required emails and pages are checked for the plan you really sell.` : void 0;
+  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The Checkout check uses the params, and the emails, pages and disclosures of plan "${plan2.name}" are checked against both until they agree: update "plans" in checkbox.json to the plan you really sell.` : void 0;
 }
 function disclosureJob(loaded, e, root) {
   const { config, dir } = loaded;
@@ -27726,14 +28140,20 @@ function pageJob(loaded, e, o, root) {
     };
   }
   if (e.url) {
-    if (!o.online) job.skip = "URL pages are fetched by the API: run with --online (and CHECKBOX_SECRET_KEY)";
+    if (!o.online) job.skip = 'URL pages are fetched by the API: run with --online and a live-mode key (ck_live_\u2026 on an activated account), or list the built page under "file" to check it offline';
     else job.body = { url: e.url, ...common3 };
     return job;
   }
   try {
     if (!e.source) job.target = { file: rel(loaded, root, e.file), line: 1 };
     job.inputs.push(e.file);
-    const html = readRel(dir, e.file);
+    let html;
+    try {
+      html = readRel(dir, e.file);
+    } catch (err) {
+      if (!existsSync6(resolve5(dir, e.file))) throw new InputError(`${e.file} does not exist (paths are relative to checkbox.json). If it is build output, build it before checkbox ci: in GitHub Actions, add a build step before the Checkbox step (\`checkbox ci init\` writes one when package.json has a build script).`);
+      throw err;
+    }
     if (!e.source) job.locate = (needles) => lineOfAny(html, needles);
     job.body = { html, ...common3 };
   } catch (err) {
@@ -27774,9 +28194,35 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
 }
 async function resolveJobs(loaded, o) {
   const root = o.root ?? loaded.dir;
+  const jobs = [];
+  for (const e of loaded.config.checks.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
+  const dependent = await planJobs(loaded, o, root);
+  jobs.push(...dependent);
+  const seen = /* @__PURE__ */ new Set();
+  for (const sj of jobs.filter((j) => j.type === "stripe_checkout" && j.sold)) {
+    const key = JSON.stringify(sj.sold);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const { plan: planName, overrides } = sj.sold;
+    const config = { ...loaded.config, plans: (loaded.config.plans ?? []).map((p) => p.name === planName ? { ...p, ...overrides } : p) };
+    const variant = await planJobs({ ...loaded, config }, o, root);
+    const sold = describeSold(overrides);
+    variant.forEach((v, i) => {
+      const orig = dependent[i];
+      if (orig.error || orig.skip || !v.body || JSON.stringify(v.body) === JSON.stringify(orig.body)) return;
+      jobs.push({
+        ...v,
+        name: `${orig.name} (as "${sj.name}" sells it: ${sold})`,
+        inputs: [.../* @__PURE__ */ new Set([...v.inputs, ...sj.inputs])],
+        warnings: [`The params and checkbox.json disagree: "${sj.name}" sells plan "${planName}" with ${sold}, which checkbox.json does not say. This check judges ${orig.name} against what the params sell; the same check against checkbox.json runs too, and both must pass. Update "plans" in checkbox.json (or the params) so they agree.`, ...v.warnings]
+      });
+    });
+  }
+  return jobs;
+}
+async function planJobs(loaded, o, root) {
   const c = loaded.config.checks;
   const jobs = [];
-  for (const e of c.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
   for (const e of c.disclosures ?? []) jobs.push(disclosureJob(loaded, e, root));
   for (const e of c.pages ?? []) jobs.push(pageJob(loaded, e, o, root));
   for (const e of c.emails ?? []) {
@@ -27800,7 +28246,7 @@ async function resolveJobs(loaded, o) {
   }
   return jobs;
 }
-var InputError, CHILD, jurisdictionsOf;
+var InputError, NOT_INSTALLED, CHILD, jurisdictionsOf;
 var init_inputs = __esm({
   "src/ci/inputs.ts"() {
     "use strict";
@@ -27813,6 +28259,7 @@ var init_inputs = __esm({
         this.name = "InputError";
       }
     };
+    NOT_INSTALLED = "tsx is in package.json but not installed: install the project's dependencies before checkbox ci (npm ci; in GitHub Actions a `- run: npm ci` step before the Checkbox step, which `checkbox ci init` writes)";
     CHILD = `
 const [url, name, argsJson] = process.argv.slice(1);
 const mod = await import(url);
@@ -27831,106 +28278,6 @@ process.exit(0);
   }
 });
 
-// src/ci/report.ts
-function icon(s2, c) {
-  if (s2 === "pass") return c.green("\u2713");
-  if (s2 === "fail" || s2 === "error") return c.red("\u2717");
-  if (s2 === "needs_review") return c.yellow("?");
-  return c.dim("\u2013");
-}
-function overallLine(run2) {
-  const s2 = run2.summary;
-  const parts = [];
-  if (s2.error) parts.push(`${s2.error} could not run`);
-  if (s2.fail) parts.push(`${s2.fail} need${s2.fail === 1 ? "s" : ""} a fix`);
-  if (s2.needs_review) parts.push(`${s2.needs_review} need${s2.needs_review === 1 ? "s" : ""} review${run2.strict ? " (strict)" : ""}`);
-  if (s2.pass) parts.push(`${s2.pass} pass`);
-  if (s2.not_applicable) parts.push(`${s2.not_applicable} not required`);
-  if (s2.skipped) parts.push(`${s2.skipped} skipped`);
-  return parts.join(" \xB7 ") || "nothing checked";
-}
-function renderHuman(run2, c, opts = {}) {
-  const lines = [];
-  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
-  lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
-  const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
-  for (const x of run2.checks) {
-    const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
-    lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
-    if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
-    if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
-    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
-    const alerts = x.alerts ?? [];
-    for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
-    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
-    if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
-  }
-  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
-  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
-  if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
-  lines.push(c.dim(run2.disclaimer));
-  return lines;
-}
-function annotations(run2) {
-  const out = [];
-  for (const x of run2.checks) {
-    const alerts = x.alerts ?? [];
-    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
-    if (!level) continue;
-    const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
-    const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
-${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
-    out.push(`::${level} ${props.join(",")}::${escData(body)}`);
-  }
-  return out;
-}
-function stepSummary(run2) {
-  const lines = [];
-  lines.push("## Checkbox compliance checks", "");
-  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
-  lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
-  lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
-  for (const x of run2.checks) {
-    const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
-    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
-    lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
-  }
-  const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
-  for (const x of detailed) {
-    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.toLowerCase() : `${x.fixes.length} fixes`)}</summary>`, "");
-    if (x.fixes.length) lines.push(...x.fixes.map((f) => `- ${f}`), "");
-    if (x.corrected) {
-      const fence = x.corrected.body.includes("```") ? "````" : "```";
-      lines.push(`${fence}${x.corrected.format === "json" ? "json" : "text"}`, x.corrected.body, fence, "");
-    }
-    lines.push("</details>");
-  }
-  lines.push("", `<sub>${run2.disclaimer} Docs: https://checkbox.site/docs/guides/ci</sub>`, "");
-  return lines.join("\n");
-}
-function escapeHtml(s2) {
-  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
-var init_report = __esm({
-  "src/ci/report.ts"() {
-    "use strict";
-    init_output();
-    TYPE_LABEL = {
-      stripe_checkout: "Stripe Checkout",
-      disclosure: "Disclosure",
-      page: "Page",
-      email: "Email",
-      notice_schedule: "Notice schedule"
-    };
-    where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
-    escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
-    escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
-    cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
-    STATUS_MD = { pass: "\u2705", fail: "\u274C", needs_review: "\u26A0\uFE0F", error: "\u274C", skipped: "\u23ED\uFE0F", not_applicable: "\u2796" };
-  }
-});
-
 // ../rules/src/fixes/conflicts.ts
 var init_conflicts = __esm({
   "../rules/src/fixes/conflicts.ts"() {
@@ -28435,10 +28782,35 @@ function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
 function ciVocabulary(text) {
-  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored");
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/comes from merchant\.price and is not verified against the Price\. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price\./g, "comes from the plan's price in checkbox.json and is not verified against the Price. Connect Stripe on the site in Checkbox, then run checkbox ci --online (CHECKBOX_SECRET_KEY) so Checkbox reads the Price.").replace(/comes from merchant\.price\b/g, "comes from the plan's price in checkbox.json").replace(/\bmerchant\.price says\b/g, "The plan's price in checkbox.json says").replace(/\(or pass merchant\.cancel_url\)/g, "(or set merchant.cancel_url in checkbox.json)").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+}
+function pricingPageFixes(fixes) {
+  const reworded = fixes.map(
+    (f) => f.replace(/,? before the card and email fields and the (?:pay|purchase) button/g, ", next to the plan's button").replace(/,? before the card and email fields/g, ", next to the plan's button")
+  );
+  const out = [];
+  const renewalLineFor = /* @__PURE__ */ new Set();
+  for (const f of reworded) {
+    const card = /^(Plan card [^:]+): /.exec(f)?.[1] ?? "";
+    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price|Add your own renewal line next to the (?:pay|plan's) button)/.test(f);
+    if (isRenewalLine) {
+      const cards = [...card.matchAll(/“([^”]+)”/g)].map((m) => m[1]);
+      const fresh = cards.filter((c) => !renewalLineFor.has(c));
+      if (cards.length ? !fresh.length : renewalLineFor.has(card)) continue;
+      if (!cards.length) renewalLineFor.add(card);
+      for (const c of fresh) renewalLineFor.add(c);
+      if (cards.length && fresh.length < cards.length) {
+        const g = `Plan card ${fresh.map((c) => `\u201C${c}\u201D`).join(", ")}: ${f.slice(card.length + 2)}`;
+        if (!out.includes(g)) out.push(g);
+        continue;
+      }
+    }
+    if (!out.includes(f)) out.push(f);
+  }
+  return out;
 }
 function stripeConsentFix(text, params) {
-  if (!/^Add one unchecked checkbox/.test(text)) return text;
+  if (!/^(Ask for a separate yes to the renewal|Add one unchecked checkbox)/.test(text)) return text;
   const cc = params?.consent_collection;
   if (cc?.terms_of_service === "required") return text;
   return 'Set consent_collection: { terms_of_service: "required" } in the params: Stripe then shows an unchecked consent checkbox, labelled with custom_text.terms_of_service_acceptance.message.';
@@ -28457,12 +28829,23 @@ function fixesOf(r, onlyNeedsFix = false) {
   failing.sort((a, b) => (a.compliance_status === "needs_fix" ? 0 : 1) - (b.compliance_status === "needs_fix" ? 0 : 1) || (RANK2[a.status] ?? 2) - (RANK2[b.status] ?? 2));
   for (const c of failing) {
     const base = c.compliance?.fix || c.fix || c.compliance?.question?.text || c.explanation || c.title || c.check_id;
-    const cards = failingCards(c.explanation);
+    let cards = failingCards(c.explanation);
+    const plain = cards.length > 1 ? cardClauses(c.explanation).filter((x) => /look like the surrounding text/.test(x.clause)).map((x) => x.card) : [];
+    if (plain.length && plain.length < cards.length && /renewal line/i.test(base)) {
+      cards = cards.filter((x) => !plain.includes(x));
+      const standOut = `Plan card ${plain.map((x) => `\u201C${x}\u201D`).join(", ")}: ${STAND_OUT_FIX}`;
+      if (!out.includes(standOut)) out.push(standOut);
+    }
     const text = cards.length && base ? `Plan card ${cards.map((x) => `\u201C${x}\u201D`).join(", ")}: ${base}` : base;
     if (text && !out.includes(text)) out.push(text);
   }
   return out;
 }
+function cardClauses(explanation) {
+  if (!explanation) return [];
+  const ms = [...explanation.matchAll(/plan button “([^”]{1,80})”(?: in the card “([^”]{1,80})”)?/g)];
+  return ms.map((m, i) => ({ card: m[2] ?? m[1], clause: explanation.slice(m.index + m[0].length, ms[i + 1]?.index ?? explanation.length) }));
+}
 function failingCards(explanation) {
   if (!explanation) return [];
   if (/\(\d+ checkout page views? checked\) — e\.g\./.test(explanation)) return [];
@@ -28596,7 +28979,9 @@ async function runJob(job, engine, config, opts = {}) {
   if (alerts.length) Object.assign(base, { alerts });
   const status = ciStatusOf(report);
   const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
-  const fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  let fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  const pricingPage = job.type === "page" && job.body?.page_kind === "pricing";
+  if (pricingPage) fixes = pricingPageFixes(fixes);
   const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b/.test(p));
   const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review" || status === "pass" && unreadText.some((p) => /^(?:custom_text|consent_collection|discounts|subscription_data\.trial)/.test(p)));
   if (unread) {
@@ -28621,28 +29006,47 @@ async function runJob(job, engine, config, opts = {}) {
     const line2 = needles.length ? job.locate(needles) : void 0;
     if (line2) base.target = { ...base.target, line: line2 };
   }
-  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : status;
+  const declaredCoupon = !unread && status === "pass" && job.type === "stripe_checkout" ? (report.warnings ?? []).find((w) => w.code === "coupon_unverified" && /merchant\.intro_\* and are not verified/.test(w.message)) : void 0;
+  if (declaredCoupon) {
+    const id = /discounts use (coupon|promotion code) (\S+?),/.exec(declaredCoupon.message);
+    const what = id ? `${id[1]} ${id[2]}` : "the coupon";
+    fixes.unshift(
+      engine.mode === "offline" ? `The intro price is declared in checkbox.json, not verified: offline, Checkbox cannot read ${what} from Stripe. Run with --online (CHECKBOX_SECRET_KEY, and the site's Stripe key connected) so Checkbox reads it and compares its percent / amount off and duration with the declared intro.` : `The intro price is declared in checkbox.json, not verified: Checkbox could not read ${what} through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?). Until it is read, its percent / amount off and duration are not compared with the declared intro.`
+    );
+  }
+  const sharedReview = !unread && !declaredCoupon && status === "pass" && job.type === "stripe_checkout" ? stripeParamsVerdict(report) : void 0;
+  const unreadCoupon = sharedReview?.verdict === "needs_review" && sharedReview.reason ? sharedReview.reason : void 0;
+  if (unreadCoupon) {
+    const id = /discounts use (coupon|promotion code) (\S+?),/.exec(unreadCoupon);
+    const what = id ? `${id[1]} ${id[2]}` : "the coupon";
+    fixes.unshift(
+      engine.mode === "offline" ? `The params apply ${what}, which Checkbox cannot read offline, so its discount and duration (what the shopper is charged first) are not checked. Declare the intro on the plan in checkbox.json (intro_percent_off, intro_amount_off or intro_price, with intro_periods) and state it in custom_text.submit, or run with --online so Checkbox reads the coupon.` : `The params apply ${what}, which Checkbox could not read through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?), so its discount and duration are not checked. Declare the intro on the plan in checkbox.json and state it in custom_text.submit, or let Checkbox read the coupon.`
+    );
+  }
+  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon || unreadCoupon ? "needs_review" : status;
   const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
   if (corrected?.format === "json" && job.placeholders) {
     const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
     if (unset.length) Object.assign(base, { alerts: [...unset, ...base.alerts ?? []] });
   }
-  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || status === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
+  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || // Round 31 (pilot 30 item 2, headless-agent-pr false pass: a "strict" entry with a declared-but-unverified coupon exited
+  // 0): the entry's strictness applies to the status the check reports (finalStatus), not the engine's raw verdict.
+  finalStatus === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
   return {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report),
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : unreadCoupon ? "Needs review \xB7 coupon not read" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
     report
   };
 }
-function countedLabel(label, r) {
+function countedLabel(label, r, adjust) {
   const m = /^(\d+) fix(?:es)? needed/.exec(label);
   if (!m) return label;
-  const n = fixesOf(r, true).length;
+  const n = (adjust ? adjust(fixesOf(r, true)) : fixesOf(r, true)).length;
   if (!n || n === Number(m[1])) return label;
   return label.replace(m[0], `${n} fix${n === 1 ? "" : "es"} needed`);
 }
@@ -28652,6 +29056,7 @@ function exitCodeOf(checks, strict) {
   if (checks.some((c) => c.status === "error")) return { status: "error", exit: EXIT.usage };
   if (checks.some((c) => c.status === "fail")) return { status: "fail", exit: EXIT.fail };
   if (checks.some((c) => c.status === "needs_review")) return { status: "needs_review", exit: strict || checks.some((c) => c.blocking) ? EXIT.needs_review : EXIT.ok };
+  if (!checks.some((c) => c.status === "pass")) return { status: "skipped", exit: EXIT.needs_review };
   return { status: "pass", exit: EXIT.ok };
 }
 function mergeSourcePatches(checks) {
@@ -28673,6 +29078,11 @@ function mergeSourcePatches(checks) {
     }
   }
 }
+function nothingCheckedMessage(run2) {
+  const urlSkipped = run2.checks.some((c) => c.status === "skipped" && /^URL pages/.test(c.message ?? ""));
+  const how = urlSkipped ? run2.mode === "offline" ? ' Page entries with a "url" are fetched only with --online and an API key (CHECKBOX_SECRET_KEY); offline, point them at the built HTML with "file" instead.' : ' Page entries with a "url" need a key that can read that site (a live key for a live site); or point them at the built HTML with "file".' : ' Add a check checkbox.json can run (a "file" page, a disclosure, Stripe Checkout params or an email).';
+  return `Nothing was checked: every check was skipped or does not apply, so this run is not a pass (exit 2).${how}`;
+}
 async function runCi(jobs, engine, opts) {
   const checks = [...opts.extra ?? []];
   for (const j of jobs) checks.push(await runJob(j, engine, opts.config, { ...opts.notices ? { notices: opts.notices } : {} }));
@@ -28697,7 +29107,7 @@ async function runCi(jobs, engine, opts) {
     disclaimer: CI_DISCLAIMER
   };
 }
-var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
+var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, STAND_OUT_FIX, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -28705,6 +29115,7 @@ var init_runner = __esm({
     init_http();
     init_src();
     init_types2();
+    init_stripe_verdict();
     init_config3();
     ENGINE_KIND = {
       stripe_checkout: "stripe_checkout_session",
@@ -28716,6 +29127,7 @@ var init_runner = __esm({
     CI_DISCLAIMER = "Automated check against Checkbox's catalog of automatic-renewal laws; not legal advice.";
     RANK2 = { fail: 0, needs_review: 1 };
     OK_STATUSES = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+    STAND_OUT_FIX = "Make its renewal line stand out from the text around it: larger type, bold (weight 600 or more), a contrasting colour, or a border.";
     NOTICE_TO_EMAIL = {
       acknowledgment: "acknowledgment",
       trial_ending: "trial_reminder",
@@ -28738,8 +29150,112 @@ var init_runner = __esm({
   }
 });
 
+// src/ci/report.ts
+function icon(s2, c) {
+  if (s2 === "pass") return c.green("\u2713");
+  if (s2 === "fail" || s2 === "error") return c.red("\u2717");
+  if (s2 === "needs_review") return c.yellow("?");
+  return c.dim("\u2013");
+}
+function overallLine(run2) {
+  const s2 = run2.summary;
+  const parts = [];
+  if (s2.error) parts.push(`${s2.error} could not run`);
+  if (s2.fail) parts.push(`${s2.fail} need${s2.fail === 1 ? "s" : ""} a fix`);
+  if (s2.needs_review) parts.push(`${s2.needs_review} need${s2.needs_review === 1 ? "s" : ""} review${run2.strict ? " (strict)" : ""}`);
+  if (s2.pass) parts.push(`${s2.pass} pass`);
+  if (s2.not_applicable) parts.push(`${s2.not_applicable} not required`);
+  if (s2.skipped) parts.push(`${s2.skipped} skipped`);
+  return parts.join(" \xB7 ") || "nothing checked";
+}
+function renderHuman(run2, c, opts = {}) {
+  const lines = [];
+  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
+  lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
+  const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
+  for (const x of run2.checks) {
+    const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
+    lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
+    if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
+    if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
+    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
+    const alerts = x.alerts ?? [];
+    for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
+    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
+  }
+  const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
+  if (run2.status === "skipped") lines.push("", c.red(wrap(nothingCheckedMessage(run2), 110, "")));
+  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
+  if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
+  lines.push(c.dim(run2.disclaimer));
+  return lines;
+}
+function annotations(run2) {
+  const out = [];
+  for (const x of run2.checks) {
+    const alerts = x.alerts ?? [];
+    const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
+    if (!level) continue;
+    const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
+    const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+    out.push(`::${level} ${props.join(",")}::${escData(body)}`);
+  }
+  if (run2.status === "skipped") out.push(`::error file=${escProp(run2.config)},title=${escProp("Checkbox: nothing was checked")}::${escData(nothingCheckedMessage(run2))}`);
+  return out;
+}
+function stepSummary(run2) {
+  const lines = [];
+  lines.push("## Checkbox compliance checks", "");
+  const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
+  lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
+  if (run2.status === "skipped") lines.push(`\u274C ${nothingCheckedMessage(run2)}`, "");
+  lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
+  for (const x of run2.checks) {
+    const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
+    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
+    lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
+  }
+  const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
+  for (const x of detailed) {
+    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.toLowerCase() : `${x.fixes.length} fixes`)}</summary>`, "");
+    if (x.fixes.length) lines.push(...x.fixes.map((f) => `- ${f}`), "");
+    if (x.corrected) {
+      const fence = x.corrected.body.includes("```") ? "````" : "```";
+      lines.push(`${fence}${x.corrected.format === "json" ? "json" : "text"}`, x.corrected.body, fence, "");
+    }
+    lines.push("</details>");
+  }
+  lines.push("", `<sub>${run2.disclaimer} Docs: https://checkbox.site/docs/guides/ci</sub>`, "");
+  return lines.join("\n");
+}
+function escapeHtml(s2) {
+  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
+var init_report = __esm({
+  "src/ci/report.ts"() {
+    "use strict";
+    init_output();
+    init_runner();
+    TYPE_LABEL = {
+      stripe_checkout: "Stripe Checkout",
+      disclosure: "Disclosure",
+      page: "Page",
+      email: "Email",
+      notice_schedule: "Notice schedule"
+    };
+    where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
+    escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+    escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
+    cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
+    STATUS_MD = { pass: "\u2705", fail: "\u274C", needs_review: "\u26A0\uFE0F", error: "\u274C", skipped: "\u23ED\uFE0F", not_applicable: "\u2796" };
+  }
+});
+
 // src/commands/plan/lib.ts
-import { dirname as dirname5, resolve as resolve5 } from "node:path";
+import { dirname as dirname6, resolve as resolve6 } from "node:path";
 async function resolveSite(ctx, flag, client) {
   const explicit = flag ?? ctx.env.CHECKBOX_SITE;
   if (explicit) {
@@ -28747,10 +29263,10 @@ async function resolveSite(ctx, flag, client) {
     return explicit;
   }
   const projects = ctx.config.load().init?.projects ?? {};
-  for (let dir = resolve5(ctx.cwd); ; dir = dirname5(dir)) {
+  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
     const site = projects[dir]?.site;
     if (site) return site;
-    if (dirname5(dir) === dir) break;
+    if (dirname6(dir) === dir) break;
   }
   const list2 = await client.sdk.sites.list({ limit: 3 });
   const sites = list2?.data ?? [];
@@ -28807,12 +29323,28 @@ var init_lib = __esm({
 });
 
 // src/ci/workflow.ts
-var WORKFLOW_PATH, WORKFLOW_YAML;
-var init_workflow = __esm({
-  "src/ci/workflow.ts"() {
-    "use strict";
-    WORKFLOW_PATH = ".github/workflows/checkbox.yml";
-    WORKFLOW_YAML = `# Checkbox: automatic-renewal law checks on every pull request (https://checkbox.site/docs/guides/ci).
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync9 } from "node:fs";
+import { join as join8 } from "node:path";
+function workflowYaml(needs = {}) {
+  const node = !!(needs.install || needs.build);
+  const steps = ["      - uses: actions/checkout@v4"];
+  if (node) {
+    steps.push("      - uses: actions/setup-node@v4", "        with:", "          node-version: 20");
+    if (needs.install) steps.push(`      # ${needs.why?.install ?? 'checkbox.json "module" entries import your code and its dependencies.'}`, `      - run: ${needs.install}`);
+    if (needs.build) steps.push(`      # ${needs.why?.build ?? 'checkbox.json "pages" read built HTML, which a fresh clone does not have.'}`, `      - run: ${needs.build}`);
+  } else {
+    steps.push('      # Only needed when checkbox.json uses "module" entries that import your dependencies:', "      # - run: npm ci");
+  }
+  steps.push("      - uses: checkbox-site/checkbox@v1", "        # with:", "        #   strict: true          # also fail when a check needs review");
+  if (needs.urlPages) {
+    steps.push(
+      '        #   args: --online        # "url" pages are fetched by the API: needs a LIVE key (ck_live_\u2026) on an',
+      '        #                         # activated account. Without one, list the built page as "file" instead.'
+    );
+  } else steps.push("        #   args: --online        # URL pages via the API; needs the env below");
+  steps.push("        # env:", "        #   CHECKBOX_SECRET_KEY: ${{ secrets.CHECKBOX_SECRET_KEY }}");
+  return `# Checkbox: automatic-renewal law checks on every pull request (https://checkbox.site/docs/guides/ci).
 # Runs the checks listed in checkbox.json with the Checkbox rules engine, offline (no key, no network), annotates the
 # lines that need a fix and writes a summary with the corrected params / text to the job page.
 name: Checkbox
@@ -28830,35 +29362,85 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      # Only needed when checkbox.json uses "module" entries that import your dependencies:
-      # - run: npm ci
-      - uses: checkbox-site/checkbox@v1
-        # with:
-        #   strict: true          # also fail when a check needs review
-        #   args: --online        # URL pages via the API; needs the env below
-        # env:
-        #   CHECKBOX_SECRET_KEY: \${{ secrets.CHECKBOX_SECRET_KEY }}
+${steps.join("\n")}
 `;
+}
+function installCommand(root) {
+  if (existsSync7(join8(root, "pnpm-lock.yaml"))) return "corepack enable && pnpm install --frozen-lockfile";
+  if (existsSync7(join8(root, "yarn.lock"))) return "corepack enable && yarn install --immutable";
+  if (existsSync7(join8(root, "bun.lockb")) || existsSync7(join8(root, "bun.lock"))) return "npx --yes bun install --frozen-lockfile";
+  if (existsSync7(join8(root, "package-lock.json")) || existsSync7(join8(root, "npm-shrinkwrap.json"))) return "npm ci";
+  return "npm install";
+}
+function runScript(root, script) {
+  if (existsSync7(join8(root, "pnpm-lock.yaml"))) return `pnpm run ${script}`;
+  if (existsSync7(join8(root, "yarn.lock"))) return `yarn run ${script}`;
+  return `npm run ${script}`;
+}
+function notInClone(root, files) {
+  if (!files.length) return [];
+  let tracked = null;
+  try {
+    const out = execFileSync("git", ["ls-files", "-z", "--", ...files], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+    tracked = new Set(out.split("\0").filter(Boolean));
+  } catch {
+    tracked = null;
+  }
+  return files.filter((f) => tracked ? !tracked.has(f.replace(/^\.\//, "")) : !existsSync7(join8(root, f)));
+}
+function workflowNeeds(root, config) {
+  const checks = config.checks ?? {};
+  const list2 = (k) => Array.isArray(checks[k]) ? checks[k] : [];
+  const modules = [...list2("stripe_checkout"), ...list2("emails"), ...list2("disclosures")].some((e) => typeof e.module === "string" && !!e.module);
+  const pageFiles = list2("pages").flatMap((e) => typeof e.file === "string" && !e.file.startsWith("TODO") ? [e.file] : []);
+  const urlPages = list2("pages").some((e) => typeof e.url === "string");
+  let pkg = null;
+  try {
+    pkg = JSON.parse(readFileSync9(join8(root, "package.json"), "utf8"));
+  } catch {
+    pkg = null;
+  }
+  const built = notInClone(root, pageFiles);
+  const buildScript = pkg?.scripts?.build ? "build" : void 0;
+  const needs = { why: {} };
+  if (built.length && buildScript) {
+    needs.build = runScript(root, buildScript);
+    needs.why.build = `checkbox.json "pages" read ${built.slice(0, 2).join(", ")}${built.length > 2 ? ", \u2026" : ""}, built here (not in git).`;
+  }
+  if (pkg && (modules || needs.build)) {
+    needs.install = installCommand(root);
+    needs.why.install = modules ? 'checkbox.json "module" entries import your code and its dependencies.' : "The build needs your dependencies.";
+  }
+  if (urlPages) needs.urlPages = true;
+  return needs;
+}
+var WORKFLOW_PATH, WORKFLOW_YAML;
+var init_workflow = __esm({
+  "src/ci/workflow.ts"() {
+    "use strict";
+    WORKFLOW_PATH = ".github/workflows/checkbox.yml";
+    WORKFLOW_YAML = workflowYaml();
   }
 });
 
 // src/commands/ci/index.ts
 var ci_exports = {};
 __export(ci_exports, {
+  attachSiteForCoupons: () => attachSiteForCoupons,
+  couponIdsIn: () => couponIdsIn,
   default: () => ci_default,
   touchesConfig: () => touchesConfig,
   undiffableInputs: () => undiffableInputs
 });
-import { execFileSync } from "node:child_process";
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
-import { dirname as dirname6, join as join8, relative as relative5, resolve as resolve6 } from "node:path";
+import { dirname as dirname7, join as join9, relative as relative5, resolve as resolve7 } from "node:path";
 function gitChanged(cwd, base) {
   try {
-    const root = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-    const out = execFileSync("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve6(root, f)) };
+    const root = execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    const out = execFileSync2("git", ["diff", "--name-only", `${base}...HEAD`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return { root, files: out.split("\n").map((l) => l.trim()).filter(Boolean).map((f) => resolve7(root, f)) };
   } catch (err) {
     const msg2 = String(err.stderr || err.message).trim().split("\n")[0];
     return `git diff ${base}...HEAD failed (${msg2}); fetch the base branch (actions/checkout with fetch-depth: 0)`;
@@ -28868,13 +29450,13 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   const need = [];
   const out = [];
   for (const e of loaded.config.checks.pages ?? []) {
-    if (e.source) need.push({ path: resolve6(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
+    if (e.source) need.push({ path: resolve7(loaded.dir, e.source), label: `pages "${e.name}" source ${e.source}` });
     else if (e.url) out.push(`pages "${e.name}" is a URL with no "source" file to diff`);
-    else if (e.file) need.push({ path: resolve6(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
+    else if (e.file) need.push({ path: resolve7(loaded.dir, e.file), label: `pages "${e.name}" file ${e.file}` });
   }
   for (const j of jobs) {
     if (j.type === "page") continue;
-    for (const f of j.inputs) need.push({ path: resolve6(loaded.dir, f), label: `"${j.name}" reads ${f}` });
+    for (const f of j.inputs) need.push({ path: resolve7(loaded.dir, f), label: `"${j.name}" reads ${f}` });
   }
   if (!need.length) return out;
   const real = (p) => {
@@ -28889,8 +29471,8 @@ function undiffableInputs(loaded, jobs, gitRoot) {
   let tracked;
   try {
     const rels = [...new Set(need.map((n) => relative5(gitRoot, n.path)))];
-    const listed = execFileSync("git", ["ls-files", "-z", "--", ...rels], { cwd: gitRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve6(gitRoot, f)));
+    const listed = execFileSync2("git", ["ls-files", "-z", "--", ...rels], { cwd: gitRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    tracked = new Set(listed.split("\0").filter(Boolean).map((f) => resolve7(gitRoot, f)));
   } catch (err) {
     return `git ls-files failed (${String(err.stderr || err.message).trim().split("\n")[0]})`;
   }
@@ -28902,7 +29484,7 @@ function touchesConfig(loaded, jobs, changed) {
   if (set.has(loaded.path)) return true;
   const codeChanged = changed.some((f) => /\.(?:[cm]?[jt]sx?)$/.test(f));
   for (const j of jobs) {
-    for (const f of j.inputs) if (set.has(resolve6(loaded.dir, f))) return true;
+    for (const f of j.inputs) if (set.has(resolve7(loaded.dir, f))) return true;
   }
   const hasModules = [...loaded.config.checks.stripe_checkout ?? [], ...loaded.config.checks.emails ?? []].some((e) => "module" in e && e.module);
   return hasModules && codeChanged;
@@ -28927,24 +29509,26 @@ async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
   const explicit = str(p.flags, "config");
-  const configPath = explicit ? resolve6(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join8(ctx.cwd, f)).find((f) => existsSync7(f)) ?? join8(ctx.cwd, CONFIG_FILES[0]);
-  const workflowPath = join8(ctx.cwd, WORKFLOW_PATH);
+  const configPath = explicit ? resolve7(ctx.cwd, explicit) : CONFIG_FILES.map((f) => join9(ctx.cwd, f)).find((f) => existsSync8(f)) ?? join9(ctx.cwd, CONFIG_FILES[0]);
+  const workflowPath = join9(ctx.cwd, WORKFLOW_PATH);
   const force = bool(p.flags, "force") === true;
   const withWorkflow = bool(p.flags, "workflow") !== false;
   const projects = ctx.config.load().init?.projects ?? {};
   let facts = {};
-  for (let dir = resolve6(ctx.cwd); ; dir = dirname6(dir)) {
+  for (let dir = resolve7(ctx.cwd); ; dir = dirname7(dir)) {
     if (projects[dir]?.facts) {
       facts = projects[dir].facts;
       break;
     }
-    if (dirname6(dir) === dir) break;
+    if (dirname7(dir) === dir) break;
   }
   const s2 = scaffoldConfig(ctx.cwd, ctx.env, facts);
-  const actionFor = (f) => existsSync7(f) ? force ? "overwrite" : "keep" : "create";
+  const actionFor = (f) => existsSync8(f) ? force ? "overwrite" : "keep" : "create";
   const files = [{ path: configPath, content: `${JSON.stringify(s2.config, null, 2)}
 `, action: actionFor(configPath) }];
-  if (withWorkflow) files.push({ path: workflowPath, content: WORKFLOW_YAML, action: actionFor(workflowPath) });
+  const needs = workflowNeeds(ctx.cwd, s2.config);
+  const workflowSteps = [...needs.install ? [needs.install] : [], ...needs.build ? [needs.build] : []];
+  if (withWorkflow) files.push({ path: workflowPath, content: workflowYaml(needs), action: actionFor(workflowPath) });
   const toWrite = files.filter((f) => f.action !== "keep");
   const dry = bool(p.flags, "dry-run") === true;
   let write = !dry && toWrite.length > 0;
@@ -28956,7 +29540,7 @@ async function runInit(ctx, argv) {
   }
   if (write) {
     for (const f of toWrite) {
-      mkdirSync2(dirname6(f.path), { recursive: true });
+      mkdirSync2(dirname7(f.path), { recursive: true });
       writeFileSync2(f.path, f.content);
     }
   }
@@ -28967,6 +29551,7 @@ async function runInit(ctx, argv) {
     kept: files.filter((f) => f.action === "keep").map((f) => relName(f.path)),
     ...write ? {} : { would_write: toWrite.map((f) => relName(f.path)) },
     found: s2.found,
+    ...withWorkflow ? { workflow_steps: workflowSteps } : {},
     todos: s2.todos,
     config: s2.config,
     next_action: s2.todos.length ? { type: "edit_config", message: `Fill in the ${s2.todos.length} TODO item(s) in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
@@ -28976,6 +29561,8 @@ async function runInit(ctx, argv) {
     for (const f of files) lines.push(`${f.action === "keep" ? ctx.out.c.dim("kept   ") : write ? ctx.out.c.green(f.action === "create" ? "created" : "wrote  ") : ctx.out.c.yellow("would write")} ${relName(f.path)}${f.action === "keep" ? ctx.out.c.dim(" (exists; --force overwrites)") : ""}`);
     if (!write && toWrite.length && !dry) lines.push(ctx.out.c.dim("Nothing written: add --yes to write without asking."));
     if (s2.found.length) lines.push("", "Found:", ...s2.found.map((f) => `  - ${f}`));
+    if (withWorkflow && workflowSteps.length) lines.push("", `The workflow runs ${workflowSteps.map((c) => `\`${c}\``).join(" and ")} before the checks, so they work on a fresh clone.`);
+    if (needs.urlPages) lines.push("", 'Note: "url" pages are fetched by the API (checkbox ci --online), which needs a LIVE key (ck_live_\u2026) on an activated account. Without one, list the built page as "file".');
     if (s2.todos.length) lines.push("", "To do:", ...s2.todos.map((t) => `  - ${t}`));
     lines.push("", `${ctx.out.c.cyan("Next:")} ${result.next_action.message}`);
     if (!write) lines.push("", ctx.out.c.dim(`${relName(configPath)}:`), ...JSON.stringify(s2.config, null, 2).split("\n").map((l) => ctx.out.c.dim(`  ${l}`)));
@@ -28997,6 +29584,22 @@ async function readNotices(ctx, client, siteFlag) {
     return { error: `Could not read the Notice settings of ${site} (${err.message}).` };
   }
 }
+async function attachSiteForCoupons(ctx, client, jobs, siteFlag) {
+  const withCoupon = jobs.filter((j) => j.type === "stripe_checkout" && j.body && couponIdsIn(j.body.params).length);
+  if (!withCoupon.length) return;
+  let site;
+  try {
+    site = await resolveSite(ctx, siteFlag, client);
+  } catch (err) {
+    for (const j of withCoupon) j.warnings.push(`The coupon was not read from Stripe: ${err.message} --online reads it through the site's connected Stripe key once it knows the site (--site or CHECKBOX_SITE).`);
+    return;
+  }
+  for (const j of withCoupon) j.body = { ...j.body, site };
+}
+function couponIdsIn(params) {
+  const discounts = params?.discounts;
+  return (Array.isArray(discounts) ? discounts : []).flatMap((d) => d && typeof d === "object" && typeof d.coupon === "string" ? [d.coupon] : []);
+}
 var HELP2, NOTICE_KIND_TO_EMAIL, ci_default;
 var init_ci = __esm({
   "src/commands/ci/index.ts"() {
@@ -29017,7 +29620,8 @@ var init_ci = __esm({
       "",
       "Flags:",
       "  --config <path>     Config file (default: checkbox.json, then .checkbox.json)",
-      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages and site-aware checks;",
+      "  --online            Use the API (CHECKBOX_SECRET_KEY / CHECKBOX_API_KEY): URL pages (these need a live-mode",
+      '                      key on an activated account; with a test key list the built page as "file") and site-aware checks;',
       `                      with "notices" in checkbox.json, also checks that the site's Checkbox Notices really send them`,
       "  --site <site_\u2026>     The site for --online (default: $CHECKBOX_SITE, the site `checkbox init` saved, or the only one)",
       '  --strict            "Needs review" fails too (exit 2)',
@@ -29033,12 +29637,14 @@ var init_ci = __esm({
       "",
       "Exit: 0 pass (or needs review without --strict) \xB7 1 a check needs a fix \xB7 2 needs review with --strict, or a",
       "      page / disclosure with no renewal terms to judge, a checkout whose coupon / trial is not verified, or a",
-      '      checkout entry with "strict": true that needs review \xB7',
+      '      checkout entry with "strict": true that needs review, or nothing was checked (every check skipped or',
+      "      not applicable, e.g. url pages without --online) \xB7",
       "      3 config / usage error \xB7 4 auth (--online) \xB7 5 API or network error",
       "",
       "checkbox ci init [--yes] [--force] [--dry-run] [--no-workflow]",
       '  Writes checkbox.json from the project (Stripe Checkout calls, plans, email templates, pages; "TODO" where it',
-      "  cannot tell) and .github/workflows/checkbox.yml. Asks first on a terminal; --yes writes without asking (agents).",
+      '  cannot tell) and .github/workflows/checkbox.yml (with the install and build steps a fresh clone needs for "module"',
+      "  entries and built pages). Asks first on a terminal; --yes writes without asking (agents).",
       "",
       "Docs: https://checkbox.site/docs/guides/ci"
     ].join("\n");
@@ -29081,7 +29687,7 @@ var init_ci = __esm({
         const workspace = ctx.env.GITHUB_WORKSPACE ?? ctx.cwd;
         const extra = (loaded.config.coverage === false ? [] : coverageResults(coverageOf(loaded, loaded.dir))).map((r) => ({
           ...r,
-          target: { ...r.target, file: relative5(workspace, join8(loaded.dir, r.target.file)).split("\\").join("/") || r.target.file }
+          target: { ...r.target, file: relative5(workspace, join9(loaded.dir, r.target.file)).split("\\").join("/") || r.target.file }
         }));
         if (bool(p.flags, "changed-only")) {
           const base = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
@@ -29118,6 +29724,7 @@ ${message}
             return EXIT.auth;
           }
         }
+        if (client) await attachSiteForCoupons(ctx, client, jobs, str(p.flags, "site"));
         const engine = client ? onlineEngine(client) : offlineEngine();
         const notices = client && declaredByCheckbox(loaded.config).length ? await readNotices(ctx, client, str(p.flags, "site")) : void 0;
         const noticesLine = Math.max(1, loaded.raw.split("\n").findIndex((l) => l.includes('"sent_by_checkbox"')) + 1);
@@ -29353,8 +29960,8 @@ var init_patch = __esm({
 });
 
 // src/commands/plan/fix.ts
-import { existsSync as existsSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
-import { relative as relative6, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
+import { relative as relative6, resolve as resolve8 } from "node:path";
 function fixForTask(task, cwd, file) {
   const base = {
     object: "task_fix",
@@ -29366,12 +29973,12 @@ function fixForTask(task, cwd, file) {
     verify: task.verify
   };
   const verifyCmd = `checkbox verify ${task.id} --wait`;
-  const candidate = file ?? (task.where.file_hint && existsSync8(resolve7(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
+  const candidate = file ?? (task.where.file_hint && existsSync9(resolve8(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
   if (task.change.type === "patch" && task.change.edits.length && candidate) {
-    const path = resolve7(cwd, candidate);
+    const path = resolve8(cwd, candidate);
     let src;
     try {
-      src = readFileSync9(path, "utf8");
+      src = readFileSync10(path, "utf8");
     } catch (err) {
       throw new UsageError(`Cannot read ${candidate}: ${err.code ?? err.message}`);
     }
@@ -29431,7 +30038,7 @@ var init_fix = __esm({
         const task = await ctx.client().sdk.tasks.retrieve(id);
         const result = fixForTask(task, ctx.cwd, str(flags, "file"));
         const out = str(flags, "out");
-        if (out && result.diff) writeFileSync3(resolve7(ctx.cwd, out), result.diff);
+        if (out && result.diff) writeFileSync3(resolve8(ctx.cwd, out), result.diff);
         ctx.out.result({ ...result, task_object: task }, () => {
           const c = ctx.out.c;
           const lines = [`${c.bold(task.title)} ${c.dim(`(${task.priority}, ${task.id})`)}`, c.dim(`${task.requirement.citation}`), task.why, ""];
@@ -29533,30 +30140,41 @@ var init_device = __esm({
 });
 
 // src/commands/init/patch.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname8, join as join10 } from "node:path";
+function pinnedRelease(body) {
+  const b = body;
+  if (!b || typeof b.version !== "string" || !/^\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(b.version)) return void 0;
+  if (typeof b.integrity !== "string" || !/^sha384-[A-Za-z0-9+/]{64}$/.test(b.integrity)) return void 0;
+  return { version: b.version, integrity: b.integrity };
+}
+function snippetScriptTag(s2, jsx = false, attrs = "") {
+  const pin = s2.pinned ? ` integrity="${s2.pinned.integrity}" ${jsx ? "crossOrigin" : "crossorigin"}="anonymous"` : "";
+  return `<script${attrs} async src="${srcOf(s2)}"${pin} data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`;
+}
 function read(root, rel2) {
   try {
-    return readFileSync10(join9(root, rel2), "utf8");
+    return readFileSync11(join10(root, rel2), "utf8");
   } catch {
     return null;
   }
 }
 function srcOf(s2) {
-  return `${s2.apiBase.replace(/\/+$/, "")}/s.js`;
+  const api = s2.apiBase.replace(/\/+$/, "");
+  return s2.pinned ? `${api}/s/${s2.pinned.version}.js` : `${api}/s.js`;
 }
 function jsxBlock(s2, indent) {
   return [
     `${indent}{/* ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) */}`,
-    `${indent}<script async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, true)}`,
     `${indent}{/* ${MARK_END} */}`
   ];
 }
 function htmlBlock(s2, indent, attrs = "") {
   return [
     `${indent}<!-- ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) -->`,
-    `${indent}<script${attrs} async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, false, attrs)}`,
     `${indent}<!-- ${MARK_END} -->`
   ];
 }
@@ -29615,7 +30233,7 @@ function planSnippet(d, s2) {
   const root = d.root;
   const file = d.layoutFile;
   const manual = `Add this tag inside <head> on every page (your root layout / template):
-  ${s2.scriptTag}`;
+  ${s2.pinned ? snippetScriptTag(s2) : s2.scriptTag}`;
   if (!file) return { change: null, manual };
   const existing = read(root, file);
   const jsx = (f) => f === "nextjs-app" || f === "nextjs-pages" || f === "remix" || f === "react-router";
@@ -29631,15 +30249,15 @@ function planSnippet(d, s2) {
     }
     return { change: null, manual };
   }
-  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START)) {
-    return { change: { file, action: "unchanged", summary: "Snippet already installed", added: [] } };
+  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START) && existing.includes(`src="${srcOf(s2)}"`) && (!s2.pinned || existing.includes(s2.pinned.integrity))) {
+    return { change: { file, action: "unchanged", summary: s2.pinned ? `Snippet already installed (pinned release ${s2.pinned.version} with SRI)` : "Snippet already installed", added: [] } };
   }
   const isJsx = jsx(d.framework);
   const indentRe = isJsx ? d.framework === "nextjs-pages" ? /<Head\b[^>]*>/ : /<head\b[^>]*>/ : /<\/head>/i;
   const indent = isJsx ? indentOf2(existing, indentRe) : indentOf2(existing, /<\/head>/i, "  ");
   const block = isJsx ? jsxBlock(s2, indent) : htmlBlock(s2, indent, d.framework === "astro" ? " is:inline" : "");
   const replaced = replaceMarked(existing, block);
-  if (replaced !== null) return { change: { file, action: "modify", summary: "Snippet tag updated (new site key)", contents: replaced, added: block } };
+  if (replaced !== null) return { change: { file, action: "modify", summary: existing.includes(`data-key="${s2.snippetKey}"`) ? s2.pinned ? `Snippet tag pinned to release ${s2.pinned.version} with SRI` : "Snippet tag updated" : "Snippet tag updated (new site key)", contents: replaced, added: block } };
   let next = null;
   switch (d.framework) {
     case "nextjs-app": {
@@ -29670,7 +30288,7 @@ ${indentOf2(existing, /<Head\s*\/>/, "")}</Head>`) : null);
   }
   if (!next) return { change: null, manual: `Could not find <head> in ${file}. ${manual}` };
   if (!snippetPlacedSafely(next, isJsx)) return { change: null, manual: `Could not place the snippet safely in ${file} (its <head> is not where Checkbox can patch it without breaking the file), so ${file} was NOT changed. ${manual}` };
-  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}`, contents: next, added: block } };
+  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}${s2.pinned ? ` (pinned release ${s2.pinned.version} with SRI)` : ""}`, contents: next, added: block } };
 }
 function envVarNames(d) {
   return {
@@ -29716,7 +30334,7 @@ function mask(v) {
 }
 function isGitTracked(root, file) {
   try {
-    execFileSync2("git", ["ls-files", "--error-unmatch", "--", file], { cwd: root, stdio: "ignore", timeout: 5e3 });
+    execFileSync3("git", ["ls-files", "--error-unmatch", "--", file], { cwd: root, stdio: "ignore", timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -29733,7 +30351,7 @@ function planGitignore(d) {
     const covered = lines.some((l) => l === env2 || l === `/${env2}` || l === ".env*" || l === "*.env" || env2 === ".env.local" && (l === ".env*.local" || l === "*.local" || l === ".env.local*") || env2 === ".env" && l === ".env*");
     if (covered) return null;
   }
-  if (existing === null && !existsSync9(join9(d.root, ".git"))) return null;
+  if (existing === null && !existsSync10(join10(d.root, ".git"))) return null;
   const text = `${existing ?? ""}${existing && !existing.endsWith("\n") ? "\n" : ""}# Checkbox keys (checkbox init)
 ${env2}
 `;
@@ -29749,8 +30367,8 @@ function planWellKnown(d, token) {
 }
 function applyChange(root, c) {
   if (c.action === "unchanged" || c.contents === void 0) return;
-  const abs = join9(root, c.file);
-  mkdirSync3(dirname7(abs), { recursive: true });
+  const abs = join10(root, c.file);
+  mkdirSync3(dirname8(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
 var MARK_START, MARK_END, NEXT_DOCUMENT, NUXT_PLUGIN;
@@ -29778,7 +30396,7 @@ ${jsxBlock(s2, "        ").join("\n")}
     NUXT_PLUGIN = (s2) => `// ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet)
 export default defineNuxtPlugin(() => {
   useHead({
-    script: [{ src: '${srcOf(s2)}', async: true, 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
+    script: [{ src: '${srcOf(s2)}', async: true,${s2.pinned ? ` integrity: '${s2.pinned.integrity}', crossorigin: 'anonymous',` : ""} 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
   });
 });
 // ${MARK_END}
@@ -29797,8 +30415,8 @@ __export(init_exports, {
   parsePlanFlag: () => parsePlanFlag,
   syncCheckoutConfigs: () => syncCheckoutConfigs
 });
-import { existsSync as existsSync10 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11 } from "node:fs";
+import { join as join11 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 function loadState(ctx, root) {
   const cfg = ctx.config.load().init ?? {};
@@ -29818,7 +30436,7 @@ function saveState(ctx, root, patch) {
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve9) => rl.question(question, resolve9));
+    return await new Promise((resolve10) => rl.question(question, resolve10));
   } finally {
     rl.close();
   }
@@ -29879,7 +30497,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const call = (perFile.get(s2.file) ?? 0) + 1;
     perFile.set(s2.file, call);
     if (!registrable(s2.params, s2.unresolved)) {
-      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")}` : "not a subscription-mode Checkout Session" });
+      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")} (a variable, call or template string). Next: register the exact params your server sends with createStripeCheckoutConfig (POST /v1/sites/{site}/stripe_checkout_configs), or, once Stripe is connected, create one Checkout Session in Stripe test mode so Checkbox reads it` : "not a subscription-mode Checkout Session" });
       continue;
     }
     try {
@@ -29896,7 +30514,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const from = configFileOf(c.name);
     if (!from) continue;
     const sameFile = perFile.has(from.file);
-    const gone = !sameFile && !existsSync10(join10(root, from.file));
+    const gone = !sameFile && !existsSync11(join11(root, from.file));
     const current = sameFile && from.call !== void 0 && from.call <= perFile.get(from.file) && c.name === configNameOf(from.file, from.call);
     if (!sameFile && !gone || current) continue;
     if (await client.sdk.stripeCheckoutConfigs.del(c.id).then(() => true, () => false)) {
@@ -29917,6 +30535,13 @@ function configLines(configs, now = Date.now()) {
   };
   return ["Checkout params registered:", ...configs.map((c) => c.id ? `  ${c.file}:${c.line} \u2192 ${c.id}${age(c.registered_at)}${c.replaced?.length ? ` (replaced ${c.replaced.length} older config${c.replaced.length === 1 ? "" : "s"})` : ""}` : `  ${c.file}${c.line ? `:${c.line}` : ""}: ${c.skipped}`)];
 }
+async function snippetRelease(client) {
+  try {
+    return pinnedRelease(await client.get("/s/latest.json"));
+  } catch {
+    return void 0;
+  }
+}
 function registrable(params, unresolved) {
   if (!params) return false;
   if (unresolved.some((u) => /^(mode|line_items|subscription_data|custom_text|consent_collection)\b/.test(u))) return false;
@@ -29936,6 +30561,7 @@ function detectionSummary(d, siteUrl) {
     pay_buttons: d.payButtons.map((c) => ({ file: c.file, line: c.line })),
     checkout_sessions: d.checkoutSessions.map((s2) => ({ file: s2.file, line: s2.line, readable: !!s2.params, unresolved: s2.unresolved })),
     stripe_test_key: d.stripeTestKey ? { hint: d.stripeTestKey.hint, source: d.stripeTestKey.source, restricted: d.stripeTestKey.restricted } : null,
+    ...d.stripeKeyRefused ? { stripe_key_refused: { ...d.stripeKeyRefused, message: stripeKeyRefusedMessage(d.stripeKeyRefused) } } : {},
     merchant_name: d.brand ?? null,
     plans: d.plans
   };
@@ -30015,7 +30641,7 @@ var init_init = __esm({
     init_patch2();
     VERSION_FLAGS = {
       string: ["site-url", "checkout-url", "account-url", "terms-url", "privacy-url", "refund-url", "cancellation-url", "wait-seconds", "agent", "support-email", "merchant-name", "plan"],
-      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "relogin"],
+      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "pin", "relogin"],
       alias: { y: "yes" }
     };
     interactive = (ctx) => !ctx.flags.json && !!process.stdin.isTTY && !!process.stderr.isTTY;
@@ -30027,10 +30653,13 @@ var init_init = __esm({
         "Run it in the project root. What it does (idempotent; re-run any time):",
         "  1. detects the framework, billing platform, checkout code and pay buttons",
         '  2. signs you in: prints ONE link ("Open \u2026 and click Approve") and opens the browser; new accounts are free',
-        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it)",
-        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments)",
+        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it); when that file is",
+        "     tracked by git, or the folder is deployed as it is, the key is not written to it and stays only in the CLI config",
+        "     (~/.config/checkbox/config.json), which the output says",
+        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments): the pinned release",
+        "     (/s/<version>.js with integrity= and crossorigin=, Subresource Integrity); --no-pin uses the unpinned /s.js",
         "  5. registers the site, Terms / refund / cancellation policy URLs (fetched and checked by Checkbox)",
-        "  6. with your permission, uses the project's Stripe TEST key for a synthetic test subscription",
+        "  6. with your permission, uses the project's Stripe restricted TEST key (rk_test_\u2026; sk_test_ and live keys are refused) for a synthetic test subscription",
         "  7. runs the first checks and prints the next step (`checkbox plan --json`); the human gets the summary email",
         "     when the setup is finished (every check passes, or `checkbox init --complete`)",
         "",
@@ -30226,7 +30855,20 @@ var init_init = __esm({
         }
         const policyFromPaths = (kind) => siteUrl && d.policyPaths[kind] ? `${siteUrl}${d.policyPaths[kind]}` : void 0;
         const agent = detectAgent(ctx.env, agentName);
-        const plans = flagPlans ?? (d.plans.length ? d.plans.map(({ source: _source, ...p }) => p) : void 0);
+        let plans = flagPlans ?? (d.plans.length ? d.plans.map(({ source: _source, ...p }) => p) : void 0);
+        if (plans?.length && !planFlag) {
+          let current = null;
+          try {
+            current = await client.sdk.setupSessions.retrieve(sessionId);
+          } catch {
+            current = null;
+          }
+          const saved = Array.isArray(current?.business?.plans) ? current.business.plans : [];
+          if (saved.length) {
+            plans = void 0;
+            out.info(`Kept the ${saved.length} plan${saved.length === 1 ? "" : "s"} already saved for this site (pass --plan to replace ${saved.length === 1 ? "it" : "them"}).`);
+          }
+        }
         const brand = merchantName ?? d.brand?.name;
         const update = {
           ...siteUrl ? { site_url: siteUrl } : {},
@@ -30261,7 +30903,9 @@ var init_init = __esm({
         if (session.install.script_tag && session.install.snippet_key) {
           if (bool(flags, "snippet") === false) manualSnippet = session.install.script_tag;
           else {
-            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase });
+            const pinned = bool(flags, "pin") === false ? void 0 : await snippetRelease(client);
+            if (!pinned && bool(flags, "pin") !== false) warnings.push("The pinned snippet release (/s/latest.json) could not be read, so the unpinned /s.js tag was used. Run `checkbox init` again to pin it with Subresource Integrity.");
+            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase, ...pinned ? { pinned } : {} });
             if (plan2.change) changes.push(plan2.change);
             if (plan2.manual) manualSnippet = plan2.manual;
           }
@@ -30292,13 +30936,16 @@ var init_init = __esm({
           if (consent && d.stripeTestKey && !session.stripe.test_credential_stored) {
             try {
               await client.sdk.testCredentials.create(site, { type: "stripe_test", secret_key: d.stripeTestKey.key });
-              stripe.test_credential = { stored: true, key: d.stripeTestKey.hint, restricted: d.stripeTestKey.restricted };
-              if (!d.stripeTestKey.restricted) warnings.push(`Stored your full Stripe TEST key (${d.stripeTestKey.hint}) because no restricted key was found. Recommended: create a restricted test key (${session.stripe.restricted_key.create_url}) with ${session.stripe.restricted_key.permissions.map((p) => `${p.resource} ${p.access}`).join(", ")}, put it in STRIPE_RESTRICTED_KEY and run \`checkbox init\` again.`);
+              stripe.test_credential = { stored: true, key: d.stripeTestKey.hint, restricted: true };
             } catch (err) {
               stripe.test_credential = { stored: false, error: err instanceof ApiError ? `${err.code ?? ""} ${err.message}`.trim() : String(err) };
               warnings.push(`Stripe test key not stored: ${stripe.test_credential.error}`);
             }
           }
+          if (!d.stripeTestKey && d.stripeKeyRefused) {
+            stripe.test_credential = { stored: false, refused: d.stripeKeyRefused.kind };
+            warnings.push(stripeKeyRefusedMessage(d.stripeKeyRefused));
+          }
           const configs = await syncCheckoutConfigs(client, site, d.checkoutSessions, root);
           if (configs.length) stripe.checkout_configs = configs;
           const registered = configs.find((c) => c.id);
@@ -30401,10 +31048,11 @@ var init_whoami = __esm({
             object: "whoami",
             key: creds ? maskKey(creds.apiKey) : null,
             key_source: creds?.source ?? null,
+            ...creds?.file ? { key_file: creds.file } : {},
             api_base: client.apiBase,
             account: account.raw
           },
-          () => [describeAccount(account), ctx.out.c.dim(`key ${creds ? maskKey(creds.apiKey) : "?"} from ${creds?.source ?? "?"} \xB7 ${client.apiBase}`)]
+          () => [describeAccount(account), ctx.out.c.dim(`key ${creds ? maskKey(creds.apiKey) : "?"} from ${creds ? describeKeySource(creds, ctx.env) : "?"} \xB7 ${client.apiBase}`)]
         );
         return EXIT.ok;
       }
@@ -30421,7 +31069,7 @@ import { createInterface as createInterface3 } from "node:readline";
 async function prompt(question) {
   const rl = createInterface3({ input: process.stdin, output: process.stderr, terminal: true });
   try {
-    return await new Promise((resolve9) => rl.question(question, resolve9));
+    return await new Promise((resolve10) => rl.question(question, resolve10));
   } finally {
     rl.close();
   }
@@ -30555,11 +31203,11 @@ var init_plan = __esm({
 });
 
 // src/commands/plan/verify.ts
-import { readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 function readJson2(ctx, file, what) {
   try {
-    const v = JSON.parse(readFileSync11(resolve8(ctx.cwd, file), "utf8"));
+    const v = JSON.parse(readFileSync12(resolve9(ctx.cwd, file), "utf8"));
     if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error("not a JSON object");
     return v;
   } catch (err) {
@@ -30605,7 +31253,7 @@ var init_verify2 = __esm({
           const htmlFile = str(flags, "html-file");
           if (htmlFile) {
             try {
-              body.html = readFileSync11(resolve8(ctx.cwd, htmlFile), "utf8");
+              body.html = readFileSync12(resolve9(ctx.cwd, htmlFile), "utf8");
             } catch (err) {
               throw new UsageError(`Cannot read ${htmlFile}: ${err.code ?? err.message}`);
             }