@checkbox-site/cli 0.4.5 → 0.4.6

package/README.md

@@ -75,7 +75,7 @@ both exist, the CLI prints which one it used (stderr), and `checkbox whoami` sho
 
 | Command | What it does |
 |---|---|
-| `checkbox init [--yes] [--json]` | one browser approval (device login), then keys in `.env.local`, snippet in the root layout, site + Terms / policies registered, Stripe test subscription (with permission; only a Stripe restricted TEST key, `rk_test_…` in `STRIPE_RESTRICTED_KEY`, is used: `sk_test_` and live keys are refused with how to make one), first checks, owner email; `--verify` re-checks after a deploy; `--ci` only adds CI (`checkbox ci init`) |
+| `checkbox init [--yes] [--json]` | one browser approval (device login), then keys in `.env.local` (not when that file is tracked by git or the folder is deployed as it is: the key then stays only in `~/.config/checkbox/config.json`), the SRI-pinned snippet in the root layout, site + Terms / policies registered, Stripe test subscription (with permission; only a Stripe restricted TEST key, `rk_test_…` in `STRIPE_RESTRICTED_KEY`, is used: `sk_test_` and live keys are refused with how to make one), first checks, owner email; `--verify` re-checks after a deploy; `--ci` only adds CI (`checkbox ci init`) |
 | `checkbox login [--api-key <key>\|--stdin]` | verifies the key with `GET /v1/account`, then saves it |
 | `checkbox whoami` | account, mode (test/live) and where the key came from |
 | `checkbox logout` | forgets the stored key |

package/dist/checkbox.js

@@ -3335,7 +3335,7 @@ var init_operations = __esm({
       /**
        * Register the Checkout Session params your code uses.
        *
-       * Registers exactly the object your code passes to stripe.checkout.sessions.create (customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
+       * Registers exactly the object your code passes to stripe.checkout.sessions.create, as `params` (that object sent alone as the body is accepted too; customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/stripe_checkout_configs (operation `createStripeCheckoutConfig`, scope `test_runs:write`)
@@ -3617,7 +3617,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.3";
+    SDK_VERSION = "0.2.4";
   }
 });
 
@@ -11321,6 +11321,9 @@ function introAmountOf(amount, o) {
   return void 0;
 }
 function unverifiedReason(ctx) {
+  const known = ctx.referencePlans ?? [];
+  if (known.length) return `none of your plans (${known.slice(0, 4).map((p) => p.label ?? p.name ?? p.id).join(", ")}) was matched to this checkout's price (the Price id it sells is not one Checkbox has for them)`;
+  if ((ctx.checkoutConfigs?.length ?? 0) > 0) return "the price this checkout sells is not in your registered Checkout configs or your billing platform's prices";
   const chosen = ctx.facts?.planPriceId;
   if (chosen && ctx.config) return `the chosen price ${chosen} is not among the active recurring prices read from your billing platform`;
   if (chosen) return `the chosen price ${chosen} could not be read (no billing platform connected)`;
@@ -11461,8 +11464,8 @@ function sameProductName(a, b) {
 function declaredPriceIds(x) {
   return [x.price_id, x.stripe_price, x.priceId, x.id].filter((v) => typeof v === "string" && v.trim().length > 0);
 }
-function reconcileDeclaredPlans(raw, billing, platform = "Stripe") {
-  const prices = billing.filter((p) => p && p.amount > 0 && p.interval);
+function reconcileDeclaredPlans(raw, billing, platform = "Stripe", checkoutTrials) {
+  const prices = billing.filter((p) => p && p.amount > 0 && p.interval).map((p) => checkoutTrials?.has(p.id) ? { ...p, trialDays: checkoutTrials.get(p.id) } : p);
   const out = [...raw];
   const conflicts = [];
   if (!prices.length || !raw.length) return { plans: out, conflicts };
@@ -14917,7 +14920,8 @@ function inAppPath(input) {
       return { kind: "in_app", state: "works", detail: "a test cancellation completed online" };
     }
     if (hostedStep2) return void 0;
-    const kinds = (flow.blockers ?? []).map(classifyBlocker);
+    const onHosted = (flow.steps ?? []).some((s2) => s2.source !== "snippet" && isHostedCancelUrl(s2.url));
+    const kinds = (flow.blockers ?? []).map(classifyBlocker).filter((k) => !(onHosted && k === "contact"));
     if (kinds.some((k) => k === "contact" || k === "not_found" || k === "obstacle")) {
       return { kind: "in_app", state: "broken", detail: `the test cancellation did not complete (${flow.blockers.join("; ")})` };
     }
@@ -14994,7 +14998,7 @@ function offlineOnlyCancellation(input) {
   const hosted = input.ctx.hostedCancel;
   const helpHits = [];
   for (const c of captures) {
-    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout") continue;
+    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout" || isHostedCancelUrl(c.url)) continue;
     const sentence = contactOnlySentence(c.text);
     if (!sentence) continue;
     if (ownOnlineCancelControls(c, hosted).length) continue;
@@ -15005,7 +15009,7 @@ function offlineOnlyCancellation(input) {
     }
     return { where: `${c.pageKind === "account" ? "account page" : c.pageKind === "cancel" ? "cancel page" : "page"} ${c.url.split("#")[0]}`, quote: sentence, capture: c };
   }
-  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
+  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && !isHostedCancelUrl(c.url) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
   const onlineControl = captures.some(
     (c) => !isFetchedDocument(c) && ownOnlineCancelControls(c, hosted).some((el) => !contactOnlyUrls.has(stripUrl(hrefOf(el) ?? "", c.url)))
   );
@@ -16851,6 +16855,17 @@ function cancelBeforeTrialMatch(text) {
   if (byDate && TRIAL_ENDS_DATE_RE.test(text)) return byDate[0];
   return null;
 }
+function statedTrialMismatch(a, p, offers) {
+  const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
+  if (!stated.length) return void 0;
+  const own = p?.offer && p.offer.trialDays > 0 ? [p.offer] : p?.offer ? [] : offers.filter((o) => o.trialDays > 0);
+  if (!own.length) return void 0;
+  const fits = (days, trial) => days === trial || days % 30 === 0 && Math.abs(days - trial) <= Math.max(1, days / 30) * 2;
+  if (stated.some((t) => own.some((o) => fits(t.days, o.trialDays)))) return void 0;
+  const lengths = [...new Set(own.map((o) => o.trialDays))].sort((x, y) => x - y);
+  const plan2 = p?.offer ? `${offerLabel(p.offer)} has a ${p.offer.trialDays}-day free trial` : `the plan${lengths.length > 1 ? "s give" : " gives"} a ${lengths.join("- or ")}-day free trial`;
+  return { stated: `\u201C${stated[0].text}\u201D`, plan: plan2 };
+}
 var ACK_MAX_DELAY_HOURS, NO_ACK_EMAIL_MESSAGE, ackCache, SIGNUP_LINK_TOLERANCE_MS, sent, terms, cancellationInstructions, CANCELLING_RE, CANCEL_BEFORE_TRIAL_RE, MONTH, DATE, CANCEL_BEFORE_NO_CHARGE_RE, CANCEL_BEFORE_DATE_RE, TRIAL_ENDS_DATE_RE, trialTerms, CONFIRMATION_CHECKS;
 var init_confirmation = __esm({
   "../rules/src/checks/confirmation.ts"() {
@@ -17160,6 +17175,15 @@ ${v.pageText}`);
         );
         const units = trialDocs.map((doc) => {
           const a = doc.analysis;
+          const wrongTrial = statedTrialMismatch(a, ackPlan(doc.email, input, offers), offers);
+          if (wrongTrial) {
+            return docUnit(doc, {
+              status: "fail",
+              detail: `says ${wrongTrial.stated}, but ${wrongTrial.plan}: state the trial the subscriber really gets`,
+              confidence: 0.8,
+              meta: { trialLengthMismatch: true }
+            });
+          }
           const method = a.cancelMethod[0];
           const timing = a.trialLengths[0] ?? a.postTrialCharge[0];
           const beforeMatch = cancelBeforeTrialMatch(a.text);
@@ -22221,7 +22245,7 @@ function classifyRaw(input) {
   }
 }
 function fixFromFail(c) {
-  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
+  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? trialLengthFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
 }
 function withPlanTerms(fix, data) {
   if (!/<(?:price|interval)>/.test(fix)) return fix;
@@ -22241,6 +22265,11 @@ function introFixFromText(c) {
   const m = /introductory price of (\S+?)(?: \(\d+% off\))? for (the first [^—,]+?)\s*(?:,|—)/i.exec(c.detail);
   return m ? `State the introductory price (${m[1]} for ${m[2]}) and when it ends, then the regular price from the next charge, in the renewal line.` : "State the introductory price and how long it lasts, then the regular price from the next charge, in the renewal line.";
 }
+function trialLengthFixFromText(c) {
+  if (c.checkId !== "confirmation.email.trial_terms") return void 0;
+  const m = /says “([^”]+)”, but .*?\b(?:has|gives?) a ([\d -]+?or [\d]+|\d+)-day free trial/.exec(c.detail);
+  return m ? `The acknowledgment says \u201C${m[1]}\u201D, but the plan has a ${m[2]}-day free trial: state the trial the subscriber really gets, and how to cancel before it ends.` : void 0;
+}
 function planFrequencyFix(c) {
   if (c.checkId !== "signup.disclosure.frequency") return void 0;
   const every = /\bplans? (?:is|are) billed (every [a-z0-9 ]+?)(?= \/ | —|[.;,]|$)/i.exec(c.detail)?.[1];
@@ -22326,7 +22355,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, RENEWAL_LINE_EXAMPLE, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -22522,7 +22551,7 @@ var init_status = __esm({
       },
       { code: "receipt_without_terms", category: "content", when: has(/only a receipt without subscription terms/), build: () => ({ status: "needs_fix", fix: "Send an acknowledgment that restates the renewal terms (price, frequency, renews until cancelled) and how to cancel; a plain receipt is not enough." }) },
       // Audit P2: Stripe wording (custom_text) only for Stripe inputs; any other checkout gets the same line, platform-neutral.
-      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "Renews automatically every <interval> at <price> until you cancel. Cancel anytime with your cancel link."`, c.data) }) },
+      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "${RENEWAL_LINE_EXAMPLE} Cancel anytime with your cancel link."`, c.data) }) },
       { code: "renewal_without_until_cancel", category: "content", when: has(/but not that it continues until the customer cancels/), build: () => ({ status: "needs_fix", fix: 'Add "until you cancel" to the renewal line.' }) },
       { code: "terms_hidden", category: "content", when: has(/collapsed <details>|\(nearly\) the colour of its background|nearly the colour of the background|hidden by a stylesheet|sr-only/), build: () => ({ status: "needs_fix", fix: "Show the renewal line as plain visible text next to the button (not collapsed, not faded into the background)." }) },
       // Pilot round 11 (change-guard): an intro / discounted price the Stripe session does not apply.
@@ -22985,8 +23014,9 @@ var init_status = __esm({
     PORTAL_OFFLINE_FIX = 'Turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, then replace the "email / call us to cancel" line with "Cancel anytime online in your account".';
     PAYMENT_LINK_PORTAL_FIX = `Turn on "Cancel subscriptions" in the Stripe customer portal (Stripe Dashboard \u2192 Settings \u2192 Billing \u2192 Customer portal), copy its billing.stripe.com login link and add it to your site's footer as a "Cancel subscription" link.`;
     PAYMENT_LINK_OFFLINE_FIX = `${PAYMENT_LINK_PORTAL_FIX} Then replace the "email / call us to cancel" line with "Cancel anytime online" and that link.`;
+    RENEWAL_LINE_EXAMPLE = "<price> every <interval> (plus applicable taxes). Renews automatically until you cancel.";
     FAIL_FIX = {
-      "signup.disclosure.autorenew_language": 'Add one line under the price, before the card and email fields: "Renews automatically every <interval> at <price> until you cancel."',
+      "signup.disclosure.autorenew_language": `Add one line under the price, before the card and email fields: "${RENEWAL_LINE_EXAMPLE}"`,
       "signup.disclosure.price": "State the recurring price in the renewal line (the amount actually charged each time).",
       "signup.disclosure.frequency": `State how often it is charged, in the plan's own interval ("every month", "every year").`,
       "signup.disclosure.cancellation_policy": 'Add "Cancel anytime online" to the renewal line, with your cancel link.',
@@ -25251,6 +25281,24 @@ var init_stripe2 = __esm({
   }
 });
 
+// ../rules/src/preflight/stripe-verdict.ts
+function stripeParamsVerdict(r) {
+  if (r.verdict === "not_applicable") return { verdict: "not_applicable", open: [] };
+  const open2 = r.checks.filter((c) => c.status === "fail" || c.status === "needs_review" && !(c.compliance_status && SATISFIED_COMPLIANCE.has(c.compliance_status))).map((c) => ({ check_id: c.check_id, status: c.status, title: c.title ?? c.check_id, detail: c.explanation ?? "" })).sort((a, b) => (a.status === "fail" ? 0 : 1) - (b.status === "fail" ? 0 : 1));
+  if (r.verdict === "fail" || r.compliance_status === "needs_fix" || open2.some((c) => c.status === "fail")) return { verdict: "fail", open: open2 };
+  const coupon = (r.warnings ?? []).find((w) => w.code === "coupon_unverified");
+  if (open2.length) return { verdict: "needs_review", open: open2, ...coupon ? { reason: coupon.message } : {} };
+  if (coupon) return { verdict: "needs_review", open: [], reason: coupon.message };
+  return { verdict: "pass", open: [] };
+}
+var SATISFIED_COMPLIANCE;
+var init_stripe_verdict = __esm({
+  "../rules/src/preflight/stripe-verdict.ts"() {
+    "use strict";
+    SATISFIED_COMPLIANCE = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+  }
+});
+
 // ../rules/src/preflight/email.ts
 function linkify(escaped) {
   return escaped.replace(/https?:\/\/[^\s<]+/g, (raw) => {
@@ -25434,6 +25482,10 @@ function contextFor(kind, occ, plan2, jurisdictions, asOf, email) {
 function longDate2(d) {
   return d.toLocaleDateString("en-US", { month: "long", day: "numeric", year: "numeric", timeZone: "UTC" });
 }
+function supportContactLine(contact, opts = {}) {
+  if (contact || opts.required) return `Questions? Reply to this email or contact us at ${contact || SUPPORT_CONTACT_PLACEHOLDER}.`;
+  return "Questions? Reply to this email.";
+}
 function emailTemplate(kind, plan2, opts = {}) {
   const brand = plan2.merchantName ?? "";
   const sub = `${brand ? `${brand} ` : ""}subscription`;
@@ -25441,7 +25493,7 @@ function emailTemplate(kind, plan2, opts = {}) {
   const every = intervalPhrase(plan2.interval, plan2.intervalCount);
   const cancel = plan2.cancelUrl ?? CANCEL_URL_PLACEHOLDER;
   const effect = plan2.cancelTiming === "immediately" ? "cancellation takes effect immediately" : "cancellation takes effect at the end of your current billing period";
-  const contact = opts.supportContact ? `Questions? Contact us at ${opts.supportContact}.` : "Questions? Reply to this email.";
+  const contact = supportContactLine(opts.supportContact);
   const lines = (...l) => l.filter(Boolean).join("\n\n");
   const intro = plan2.introAmount !== void 0 && plan2.introAmount < plan2.amount ? `${formatMoney(plan2.introAmount, plan2.currency)} for ${plan2.introPeriods && plan2.introPeriods > 1 ? `your first ${plan2.introPeriods} billing periods` : `your first ${every}`}` : "";
   const introLine = intro ? `Introductory price: ${intro}, then ${money3} every ${every}.` : "";
@@ -25449,11 +25501,13 @@ function emailTemplate(kind, plan2, opts = {}) {
     case "acknowledgment":
       return {
         subject: `Your ${sub} is confirmed`,
+        // Round 31 (pilot 30 item 22): the same sentences, in the same order, as the "You send" acknowledgment template
+        // (apps/api notices/merchant-templates.ts), so the plan, checkEmail and the due notice give one email.
         text: lines(
-          `Thanks for subscribing${brand ? ` to ${brand}` : ""}! This email confirms your subscription terms.`,
-          introLine,
+          `Thanks for subscribing${brand ? ` to ${brand}` : ""}. This email confirms your subscription terms.`,
           plan2.trialDays ? `Your free trial lasts ${plan2.trialDays} days and ends on {{trial_end_date}}. To avoid being charged, cancel before your trial ends at ${cancel} \u2014 it takes less than a minute. If you do nothing, your subscription starts automatically on {{trial_end_date}} and you will be charged ${money3} every ${every}.` : "",
-          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your next charge is on {{next_charge_date}}.`,
+          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your ${plan2.trialDays ? "first" : "next"} charge is on {{next_charge_date}}.`,
+          introLine,
           `How to cancel: go to ${cancel} \u2014 you can cancel anytime online; ${effect}.`,
           contact
         ),
@@ -25509,7 +25563,7 @@ function emailTemplate(kind, plan2, opts = {}) {
           `To stop future charges, cancel online anytime at ${cancel}.`,
           // Pilot round 11 (invariant test): Georgia's charge notice must give the business's contact information;
           // "reply to this email" is not one, so without a support contact the template asks for it.
-          opts.supportContact ? contact : `Questions? Contact us at ${SUPPORT_CONTACT_PLACEHOLDER}.`
+          supportContactLine(opts.supportContact, { required: true })
         ),
         // Round 12: the template used {{support_contact}} without listing it as a merge tag to fill.
         tags: ["{{charge_date}}", "{{next_charge_date}}", ...opts.supportContact ? [] : [SUPPORT_CONTACT_PLACEHOLDER]]
@@ -26050,6 +26104,7 @@ __export(preflight_exports, {
   PREFLIGHT_DISCLAIMER: () => PREFLIGHT_DISCLAIMER,
   PREFLIGHT_DOCS_URL: () => PREFLIGHT_DOCS_URL,
   PreflightInputError: () => PreflightInputError,
+  SATISFIED_COMPLIANCE: () => SATISFIED_COMPLIANCE,
   STRIPE_HOSTED_STYLING_NOTE: () => STRIPE_HOSTED_STYLING_NOTE,
   checkDisclosure: () => checkDisclosure,
   checkEmail: () => checkEmail,
@@ -26071,6 +26126,8 @@ __export(preflight_exports, {
   runChecks: () => runChecks,
   shapeChecks: () => shapeChecks,
   signupStripeObjects: () => signupStripeObjects,
+  stripeParamsVerdict: () => stripeParamsVerdict,
+  supportContactLine: () => supportContactLine,
   withIntroOffers: () => withIntroOffers
 });
 var init_preflight = __esm({
@@ -26079,6 +26136,7 @@ var init_preflight = __esm({
     init_common();
     init_disclosure();
     init_stripe2();
+    init_stripe_verdict();
     init_email();
     init_html_page();
     init_page();
@@ -26699,8 +26757,8 @@ var init_config3 = __esm({
 });
 
 // src/commands/init/literal.ts
-function parseObjectLiteral(source, env2 = {}) {
-  const p = new Parser(source, env2);
+function parseObjectLiteral(source, env2 = {}, consts = {}) {
+  const p = new Parser(source, env2, consts);
   if (p.peek() !== "{") return { value: null, unresolved: ["<not an object literal>"] };
   const v = p.object("");
   return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {} };
@@ -26710,10 +26768,11 @@ var init_literal = __esm({
   "src/commands/init/literal.ts"() {
     "use strict";
     UNKNOWN = Symbol("unknown");
-    Parser = class {
-      constructor(s2, env2) {
+    Parser = class _Parser {
+      constructor(s2, env2, consts = {}) {
         this.s = s2;
         this.env = env2;
+        this.consts = consts;
       }
       i = 0;
       unresolved = [];
@@ -26803,6 +26862,12 @@ var init_literal = __esm({
           if (name === "false") return false;
           if (name === "null") return null;
           if (name === "undefined") return void 0;
+          if (Object.prototype.hasOwnProperty.call(this.consts, name)) {
+            const sub = new _Parser(this.consts[name], this.env);
+            const v = sub.value("");
+            if (v !== UNKNOWN && v !== void 0 && path) this.fromEnv[path] = name;
+            return v;
+          }
           const env2 = /^(?:process\.env|import\.meta\.env)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(name);
           if (env2) {
             if (this.env[env2[1]] !== void 0 && path) this.fromEnv[path] = name;
@@ -27147,7 +27212,13 @@ function sessionLiteral(text, index) {
       else if (ch === quote2) quote2 = null;
       continue;
     }
-    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    if (ch === "/" && text[i + 1] === "/") {
+      const nl = text.indexOf("\n", i);
+      i = nl === -1 ? text.length : nl;
+    } else if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      i = end === -1 ? text.length : end + 1;
+    } else if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
     else if (ch === "{") depth++;
     else if (ch === "}") {
       depth--;
@@ -27156,6 +27227,58 @@ function sessionLiteral(text, index) {
   }
   return null;
 }
+function declaredExpr(text, from) {
+  let depth = 0;
+  let quote2 = null;
+  for (let i = from; i < text.length && i - from < 2e3; i++) {
+    const ch = text[i];
+    if (quote2) {
+      if (ch === "\\") i++;
+      else if (ch === quote2) quote2 = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    else if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if ((ch === ";" || ch === "\n") && depth <= 0) return text.slice(from, i).trim();
+  }
+  return text.slice(from, from + 2e3).trim();
+}
+function constDeclarations(text, exportedOnly) {
+  const out = {};
+  const re = exportedOnly ? /(?:^|\n)[ \t]*export\s+const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g : /(?:^|\n)[ \t]*(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g;
+  for (const m of text.matchAll(re)) if (!(m[1] in out)) out[m[1]] = declaredExpr(text, m.index + m[0].length);
+  return out;
+}
+function resolveImport(root, fromFile, spec) {
+  const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+  const bases = spec.startsWith(".") ? [join4(dir, spec)] : /^[@~]\//.test(spec) ? [spec.slice(2), join4("src", spec.slice(2))] : [];
+  for (const b of bases) {
+    const base = b.split("\\").join("/").replace(/\.(?:[cm]?js|jsx)$/, "");
+    for (const f of [b, ...[".ts", ".tsx", ".js", ".mjs", ".jsx", "/index.ts", "/index.js"].map((e) => `${base}${e}`)]) {
+      if (/\.[cm]?[jt]sx?$/.test(f) && existsSync4(join4(root, f))) return f.split("\\").join("/");
+    }
+  }
+  return void 0;
+}
+function constantsFor(root, relFile, text) {
+  const out = {};
+  for (const m of text.matchAll(/import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g)) {
+    const target = resolveImport(root, relFile, m[2]);
+    if (!target) continue;
+    let exported;
+    try {
+      exported = constDeclarations(readFileSync5(join4(root, target), "utf8"), true);
+    } catch {
+      continue;
+    }
+    for (const part of m[1].split(",")) {
+      const [name, alias] = part.trim().split(/\s+as\s+/).map((x) => x.trim());
+      if (name && exported[name] !== void 0) out[alias || name] = exported[name];
+    }
+  }
+  return { ...out, ...constDeclarations(text, false) };
+}
 function detectProject(root, processEnv = {}) {
   const pkg = readJson(join4(root, "package.json"));
   const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
@@ -27192,7 +27315,7 @@ function detectProject(root, processEnv = {}) {
         checkoutSessions.push({ file: rel2, line: line2, unresolved: ["<params are not an object literal>"] });
         continue;
       }
-      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) });
+      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) }, constantsFor(root, rel2, text));
       checkoutSessions.push({ file: rel2, line: line2, ...parsed.value ? { params: redactSecretsDeep(parsed.value) } : {}, unresolved: parsed.unresolved });
     }
   });
@@ -27330,6 +27453,33 @@ function paramsBuilder(root, file, line2) {
   } else if (new RegExp(`export\\s+(?:async\\s+)?function\\s+${fn}\\b|export\\s+const\\s+${fn}\\b`).test(text)) target = file;
   return target ? { module: `${target}#${fn}`, takesArgs } : void 0;
 }
+function plansSoldBy(params, plans) {
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const out = [];
+  for (const li of items) {
+    const pd = li?.price_data;
+    if (!pd || typeof pd.unit_amount !== "number") continue;
+    const match = plans.find((p) => (typeof p.amount === "number" ? p.amount : typeof p.price === "number" ? Math.round(p.price * 100) : NaN) === pd.unit_amount && p.interval === pd.recurring?.interval);
+    if (match && !out.includes(match)) out.push(match);
+  }
+  return out;
+}
+function cancelUrlInCode(sessions) {
+  const urls = /* @__PURE__ */ new Set();
+  for (const s2 of sessions) {
+    const text = JSON.stringify(s2.params?.custom_text ?? "");
+    for (const m of text.matchAll(/cancel[^"]{0,80}?(https:\/\/[^\s"'<>)]+?)(?=[.,;:!?]?(?:[\s"'<>)]|$))/gi)) urls.add(m[1]);
+  }
+  return urls.size === 1 ? [...urls][0] : void 0;
+}
+function pageSource(root, built) {
+  const route = /(?:^|\/)(?:public|dist|out|build|static|_site|www)\/(?:(.*)\/)?([^/]+?)(?:\/index)?\.html?$/i.exec(built);
+  if (!route) return void 0;
+  const path = [route[1], route[2]].filter(Boolean).join("/");
+  const bases = [`app/${path}/page`, `src/app/${path}/page`, `app/(marketing)/${path}/page`, `pages/${path}`, `src/pages/${path}`, `src/routes/${path}/+page`, `pages/${path}/index`, `src/pages/${path}/index`];
+  const hits = bases.flatMap((b) => [".tsx", ".jsx", ".ts", ".js", ".svelte", ".vue", ".astro", ".mdx"].map((e) => `${b}${e}`)).filter((f) => existsSync5(join5(root, f)));
+  return hits.length === 1 ? hits[0] : void 0;
+}
 function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
@@ -27348,13 +27498,21 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     merchant.cancel_url = cancelFact;
     found.push(`cancel URL ${cancelFact} (from checkbox init)`);
   } else if (siteUrl && cancelPath) merchant.cancel_url = `${originOf(siteUrl)}${cancelPath}`;
-  else {
+  else if (cancelUrlInCode(det.checkoutSessions)) {
+    merchant.cancel_url = cancelUrlInCode(det.checkoutSessions);
+    found.push(`cancel URL ${String(merchant.cancel_url)} (from the Checkout custom_text)`);
+  } else {
     merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
     todos.push("merchant.cancel_url: the page where subscribers cancel online");
   }
   if (fact("support_email")) merchant.support_contact = fact("support_email");
+  const initPlans = Array.isArray(facts.plans) ? facts.plans : [];
+  const initName = (p) => {
+    const m = initPlans.find((x) => typeof x.name === "string" && x.amount === p.amount && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (p.interval_count ?? 1));
+    return m ? String(m.name) : void 0;
+  };
   const plans = det.plans.map((p, i) => ({
-    name: p.name ?? `Plan ${i + 1}`,
+    name: p.name ?? initName(p) ?? `Plan ${i + 1}`,
     amount: p.amount,
     currency: p.currency,
     interval: p.interval,
@@ -27393,8 +27551,13 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
   }
   const planNames = plans.map((p) => String(p.name));
-  const planFor = () => plans.length > 1 ? { plan: `TODO: one of ${planNames.map((n) => JSON.stringify(n)).join(", ")}` } : {};
-  if (plans.length > 1) todos.push("plan: pick the plan of each disclosure, page and email entry");
+  const oneOf = planNames.map((n) => JSON.stringify(n)).join(", ");
+  let planTodo = false;
+  const planFor = (kind = "entry") => {
+    if (plans.length <= 1) return {};
+    planTodo = true;
+    return { plan: kind === "page" ? `TODO: "all" (the page shows every plan) or one of ${oneOf}` : `TODO: one of ${oneOf}` };
+  };
   const stripe = [];
   const perFile = /* @__PURE__ */ new Map();
   for (const s2 of det.checkoutSessions) {
@@ -27425,7 +27588,12 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
     else found.push(`${s2.file}:${s2.line}: Checkout Session`);
     entry.strict = true;
-    stripe.push(entry);
+    const sold = s2.params ? plansSoldBy(s2.params, plans) : [];
+    if (plans.length === 1 || sold.length === 1) stripe.push({ ...entry, plan: String((sold[0] ?? plans[0]).name) });
+    else if (s2.params && plans.length > 1 && !plans.some((p) => String(p.name).startsWith("TODO"))) {
+      for (const p of plans) stripe.push({ ...entry, name: unique(names, `${String(entry.name).replace(/\)$/, "")}: ${String(p.name)})`), plan: String(p.name) });
+      names.delete(String(entry.name));
+    } else stripe.push(entry);
   }
   const emails = [];
   const pages = [];
@@ -27445,7 +27613,8 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     }
     if (PAGE_FILE.test(rel2)) {
       const kind = /checkout|subscribe/i.test(rel2) ? "checkout" : "pricing";
-      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor() });
+      const src = pageSource(root, rel2);
+      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor("page"), ...src ? { source: src } : {} });
       found.push(`${rel2}: ${kind} page`);
       return;
     }
@@ -27465,6 +27634,7 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
   if (!disclosures.length && det.payButtons.length) {
     todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
   }
+  if (planTodo) todos.push('plan: pick the plan of each disclosure, page and email entry marked TODO ("all" for a page that shows every plan)');
   const checks = {};
   if (stripe.length) checks.stripe_checkout = stripe;
   if (disclosures.length) checks.disclosures = disclosures;
@@ -27737,7 +27907,7 @@ function moduleErrorMessage(stderr, dir, flags = []) {
   const first2 = lines.find((l) => /^(?:[A-Z]\w*)?Error\b.*:/.test(l)) ?? lines.find((l) => /error/i.test(l)) ?? lines[lines.length - 1] ?? "";
   return first2.replace(/file:\/\/\S+/g, (u) => rel2(u)).replace(/\s+/g, " ").slice(0, 400);
 }
-function paramsFromSource(text, file, call = 1, env2 = {}) {
+function paramsFromSource(text, file, call = 1, env2 = {}, consts = {}) {
   const calls = [...text.matchAll(/checkout\.sessions\.create\s*\(/g)];
   if (!calls.length) throw new InputError(`${file} has no stripe.checkout.sessions.create( call`);
   const m = calls[call - 1];
@@ -27745,7 +27915,7 @@ function paramsFromSource(text, file, call = 1, env2 = {}) {
   const line2 = text.slice(0, m.index).split("\n").length;
   const lit = sessionLiteral(text, m.index + m[0].length);
   if (!lit) throw new InputError(`${file}:${line2}: the params are not an object literal; use "module" (a function returning the params) or "file" instead`);
-  const parsed = parseObjectLiteral(lit, env2);
+  const parsed = parseObjectLiteral(lit, env2, consts);
   if (!parsed.value) throw new InputError(`${file}:${line2}: could not read the params object`);
   return { params: parsed.value, line: line2, unresolved: parsed.unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
 }
@@ -27849,7 +28019,8 @@ async function stripeJob(loaded, e, o, root) {
     } else {
       const src = e.source;
       job.inputs.push(src);
-      const r = paramsFromSource(readRel(dir, src), src, e.call ?? 1, projectEnv(dir));
+      const srcText = readRel(dir, src);
+      const r = paramsFromSource(srcText, src, e.call ?? 1, projectEnv(dir), constantsFor(dir, src, srcText));
       job.target = { file: rel(loaded, root, src), line: r.line };
       job.fromSource = true;
       params = r.params;
@@ -27861,9 +28032,16 @@ async function stripeJob(loaded, e, o, root) {
       }
     }
     if (!params || typeof params !== "object" || Array.isArray(params)) throw new InputError("the Checkout Session params must be a JSON object");
+    const items0 = Array.isArray(params.line_items) ? params.line_items : [];
+    if (!e.plan && (config.plans?.length ?? 0) > 1 && !items0.some((li) => li && typeof li === "object" && li.price_data)) {
+      throw new InputError(`"${e.name}" does not say which plan it sells, and its price is a Price id or an expression Checkbox cannot read: add "plan": one of ${(config.plans ?? []).map((p) => JSON.stringify(p.name)).join(", ")} to this entry (one entry per plan when one call serves several plans).`);
+    }
     const merchant = planTerms(config, pickPlan(config, e.plan));
     const drift = planDrift(params, pickPlan(config, e.plan));
     if (drift) job.warnings.push(drift);
+    const soldPlan = pickPlan(config, e.plan);
+    const overrides = soldPlan ? planAsSold(params, soldPlan) : void 0;
+    if (soldPlan && overrides) job.sold = { plan: soldPlan.name, overrides };
     const items = Array.isArray(params.line_items) ? params.line_items : [];
     if (items.length && items.every((li) => li && typeof li === "object" && li.price_data)) for (const k of ["price", "amount", "currency", "interval", "interval_count"]) delete merchant[k];
     job.body = { params, ...Object.keys(merchant).length ? { merchant } : {}, ...jurisdictionsOf(config) };
@@ -27872,6 +28050,29 @@ async function stripeJob(loaded, e, o, root) {
   }
   return job;
 }
+function planAsSold(params, plan2) {
+  const sd = params.subscription_data ?? {};
+  const trial = typeof sd.trial_period_days === "number" ? sd.trial_period_days : void 0;
+  const out = {};
+  if (trial !== void 0 && trial !== (plan2.trial_days ?? 0)) out.trial_days = trial;
+  if (trial === void 0 && plan2.trial_days && plan2.trial_days > 0 && sd.trial_end === void 0) out.trial_days = 0;
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const pd = items.map((li) => li && typeof li === "object" ? li.price_data : void 0).find((x) => x && typeof x === "object");
+  const rec = pd && typeof pd.recurring === "object" ? pd.recurring : void 0;
+  if (rec && typeof rec.interval === "string" && rec.interval !== plan2.interval && ["day", "week", "month", "year"].includes(rec.interval)) out.interval = rec.interval;
+  const price3 = typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
+    out.price = pd.unit_amount / 100;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function describeSold(o) {
+  const parts = [];
+  if (o.trial_days !== void 0) parts.push(o.trial_days ? `a ${o.trial_days}-day trial` : "no trial");
+  const charge = [o.price !== void 0 ? Number(o.price).toFixed(2) : "", o.interval ? `every ${o.interval}` : ""].filter(Boolean).join(" ");
+  if (charge) parts.push(charge);
+  return parts.join(", ");
+}
 function planDrift(params, plan2) {
   if (!plan2) return void 0;
   const sd = params.subscription_data ?? {};
@@ -27887,7 +28088,7 @@ function planDrift(params, plan2) {
   if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
     out.push(`the params charge ${(pd.unit_amount / 100).toFixed(2)}, plan "${plan2.name}" ${price3.toFixed(2)}`);
   }
-  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The checks use the params; update "plans" in checkbox.json so the required emails and pages are checked for the plan you really sell.` : void 0;
+  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The Checkout check uses the params, and the emails, pages and disclosures of plan "${plan2.name}" are checked against both until they agree: update "plans" in checkbox.json to the plan you really sell.` : void 0;
 }
 function disclosureJob(loaded, e, root) {
   const { config, dir } = loaded;
@@ -27993,9 +28194,35 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
 }
 async function resolveJobs(loaded, o) {
   const root = o.root ?? loaded.dir;
+  const jobs = [];
+  for (const e of loaded.config.checks.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
+  const dependent = await planJobs(loaded, o, root);
+  jobs.push(...dependent);
+  const seen = /* @__PURE__ */ new Set();
+  for (const sj of jobs.filter((j) => j.type === "stripe_checkout" && j.sold)) {
+    const key = JSON.stringify(sj.sold);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const { plan: planName, overrides } = sj.sold;
+    const config = { ...loaded.config, plans: (loaded.config.plans ?? []).map((p) => p.name === planName ? { ...p, ...overrides } : p) };
+    const variant = await planJobs({ ...loaded, config }, o, root);
+    const sold = describeSold(overrides);
+    variant.forEach((v, i) => {
+      const orig = dependent[i];
+      if (orig.error || orig.skip || !v.body || JSON.stringify(v.body) === JSON.stringify(orig.body)) return;
+      jobs.push({
+        ...v,
+        name: `${orig.name} (as "${sj.name}" sells it: ${sold})`,
+        inputs: [.../* @__PURE__ */ new Set([...v.inputs, ...sj.inputs])],
+        warnings: [`The params and checkbox.json disagree: "${sj.name}" sells plan "${planName}" with ${sold}, which checkbox.json does not say. This check judges ${orig.name} against what the params sell; the same check against checkbox.json runs too, and both must pass. Update "plans" in checkbox.json (or the params) so they agree.`, ...v.warnings]
+      });
+    });
+  }
+  return jobs;
+}
+async function planJobs(loaded, o, root) {
   const c = loaded.config.checks;
   const jobs = [];
-  for (const e of c.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
   for (const e of c.disclosures ?? []) jobs.push(disclosureJob(loaded, e, root));
   for (const e of c.pages ?? []) jobs.push(pageJob(loaded, e, o, root));
   for (const e of c.emails ?? []) {
@@ -28555,7 +28782,7 @@ function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
 function ciVocabulary(text) {
-  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/comes from merchant\.price and is not verified against the Price\. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price\./g, "comes from the plan's price in checkbox.json and is not verified against the Price. Connect Stripe on the site in Checkbox, then run checkbox ci --online (CHECKBOX_SECRET_KEY) so Checkbox reads the Price.").replace(/comes from merchant\.price\b/g, "comes from the plan's price in checkbox.json").replace(/\bmerchant\.price says\b/g, "The plan's price in checkbox.json says").replace(/\(or pass merchant\.cancel_url\)/g, "(or set merchant.cancel_url in checkbox.json)").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
 }
 function pricingPageFixes(fixes) {
   const reworded = fixes.map(
@@ -28565,10 +28792,18 @@ function pricingPageFixes(fixes) {
   const renewalLineFor = /* @__PURE__ */ new Set();
   for (const f of reworded) {
     const card = /^(Plan card [^:]+): /.exec(f)?.[1] ?? "";
-    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price)/.test(f);
+    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price|Add your own renewal line next to the (?:pay|plan's) button)/.test(f);
     if (isRenewalLine) {
-      if (renewalLineFor.has(card)) continue;
-      renewalLineFor.add(card);
+      const cards = [...card.matchAll(/“([^”]+)”/g)].map((m) => m[1]);
+      const fresh = cards.filter((c) => !renewalLineFor.has(c));
+      if (cards.length ? !fresh.length : renewalLineFor.has(card)) continue;
+      if (!cards.length) renewalLineFor.add(card);
+      for (const c of fresh) renewalLineFor.add(c);
+      if (cards.length && fresh.length < cards.length) {
+        const g = `Plan card ${fresh.map((c) => `\u201C${c}\u201D`).join(", ")}: ${f.slice(card.length + 2)}`;
+        if (!out.includes(g)) out.push(g);
+        continue;
+      }
     }
     if (!out.includes(f)) out.push(f);
   }
@@ -28594,12 +28829,23 @@ function fixesOf(r, onlyNeedsFix = false) {
   failing.sort((a, b) => (a.compliance_status === "needs_fix" ? 0 : 1) - (b.compliance_status === "needs_fix" ? 0 : 1) || (RANK2[a.status] ?? 2) - (RANK2[b.status] ?? 2));
   for (const c of failing) {
     const base = c.compliance?.fix || c.fix || c.compliance?.question?.text || c.explanation || c.title || c.check_id;
-    const cards = failingCards(c.explanation);
+    let cards = failingCards(c.explanation);
+    const plain = cards.length > 1 ? cardClauses(c.explanation).filter((x) => /look like the surrounding text/.test(x.clause)).map((x) => x.card) : [];
+    if (plain.length && plain.length < cards.length && /renewal line/i.test(base)) {
+      cards = cards.filter((x) => !plain.includes(x));
+      const standOut = `Plan card ${plain.map((x) => `\u201C${x}\u201D`).join(", ")}: ${STAND_OUT_FIX}`;
+      if (!out.includes(standOut)) out.push(standOut);
+    }
     const text = cards.length && base ? `Plan card ${cards.map((x) => `\u201C${x}\u201D`).join(", ")}: ${base}` : base;
     if (text && !out.includes(text)) out.push(text);
   }
   return out;
 }
+function cardClauses(explanation) {
+  if (!explanation) return [];
+  const ms = [...explanation.matchAll(/plan button “([^”]{1,80})”(?: in the card “([^”]{1,80})”)?/g)];
+  return ms.map((m, i) => ({ card: m[2] ?? m[1], clause: explanation.slice(m.index + m[0].length, ms[i + 1]?.index ?? explanation.length) }));
+}
 function failingCards(explanation) {
   if (!explanation) return [];
   if (/\(\d+ checkout page views? checked\) — e\.g\./.test(explanation)) return [];
@@ -28768,18 +29014,29 @@ async function runJob(job, engine, config, opts = {}) {
       engine.mode === "offline" ? `The intro price is declared in checkbox.json, not verified: offline, Checkbox cannot read ${what} from Stripe. Run with --online (CHECKBOX_SECRET_KEY, and the site's Stripe key connected) so Checkbox reads it and compares its percent / amount off and duration with the declared intro.` : `The intro price is declared in checkbox.json, not verified: Checkbox could not read ${what} through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?). Until it is read, its percent / amount off and duration are not compared with the declared intro.`
     );
   }
-  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon ? "needs_review" : status;
+  const sharedReview = !unread && !declaredCoupon && status === "pass" && job.type === "stripe_checkout" ? stripeParamsVerdict(report) : void 0;
+  const unreadCoupon = sharedReview?.verdict === "needs_review" && sharedReview.reason ? sharedReview.reason : void 0;
+  if (unreadCoupon) {
+    const id = /discounts use (coupon|promotion code) (\S+?),/.exec(unreadCoupon);
+    const what = id ? `${id[1]} ${id[2]}` : "the coupon";
+    fixes.unshift(
+      engine.mode === "offline" ? `The params apply ${what}, which Checkbox cannot read offline, so its discount and duration (what the shopper is charged first) are not checked. Declare the intro on the plan in checkbox.json (intro_percent_off, intro_amount_off or intro_price, with intro_periods) and state it in custom_text.submit, or run with --online so Checkbox reads the coupon.` : `The params apply ${what}, which Checkbox could not read through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?), so its discount and duration are not checked. Declare the intro on the plan in checkbox.json and state it in custom_text.submit, or let Checkbox read the coupon.`
+    );
+  }
+  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon || unreadCoupon ? "needs_review" : status;
   const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
   if (corrected?.format === "json" && job.placeholders) {
     const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
     if (unset.length) Object.assign(base, { alerts: [...unset, ...base.alerts ?? []] });
   }
-  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || status === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
+  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || // Round 31 (pilot 30 item 2, headless-agent-pr false pass: a "strict" entry with a declared-but-unverified coupon exited
+  // 0): the entry's strictness applies to the status the check reports (finalStatus), not the engine's raw verdict.
+  finalStatus === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
   return {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : unreadCoupon ? "Needs review \xB7 coupon not read" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
@@ -28850,7 +29107,7 @@ async function runCi(jobs, engine, opts) {
     disclaimer: CI_DISCLAIMER
   };
 }
-var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
+var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, STAND_OUT_FIX, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -28858,6 +29115,7 @@ var init_runner = __esm({
     init_http();
     init_src();
     init_types2();
+    init_stripe_verdict();
     init_config3();
     ENGINE_KIND = {
       stripe_checkout: "stripe_checkout_session",
@@ -28869,6 +29127,7 @@ var init_runner = __esm({
     CI_DISCLAIMER = "Automated check against Checkbox's catalog of automatic-renewal laws; not legal advice.";
     RANK2 = { fail: 0, needs_review: 1 };
     OK_STATUSES = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+    STAND_OUT_FIX = "Make its renewal line stand out from the text around it: larger type, bold (weight 600 or more), a contrasting colour, or a border.";
     NOTICE_TO_EMAIL = {
       acknowledgment: "acknowledgment",
       trial_ending: "trial_reminder",
@@ -29884,6 +30143,16 @@ var init_device = __esm({
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname8, join as join10 } from "node:path";
+function pinnedRelease(body) {
+  const b = body;
+  if (!b || typeof b.version !== "string" || !/^\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(b.version)) return void 0;
+  if (typeof b.integrity !== "string" || !/^sha384-[A-Za-z0-9+/]{64}$/.test(b.integrity)) return void 0;
+  return { version: b.version, integrity: b.integrity };
+}
+function snippetScriptTag(s2, jsx = false, attrs = "") {
+  const pin = s2.pinned ? ` integrity="${s2.pinned.integrity}" ${jsx ? "crossOrigin" : "crossorigin"}="anonymous"` : "";
+  return `<script${attrs} async src="${srcOf(s2)}"${pin} data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`;
+}
 function read(root, rel2) {
   try {
     return readFileSync11(join10(root, rel2), "utf8");
@@ -29892,19 +30161,20 @@ function read(root, rel2) {
   }
 }
 function srcOf(s2) {
-  return `${s2.apiBase.replace(/\/+$/, "")}/s.js`;
+  const api = s2.apiBase.replace(/\/+$/, "");
+  return s2.pinned ? `${api}/s/${s2.pinned.version}.js` : `${api}/s.js`;
 }
 function jsxBlock(s2, indent) {
   return [
     `${indent}{/* ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) */}`,
-    `${indent}<script async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, true)}`,
     `${indent}{/* ${MARK_END} */}`
   ];
 }
 function htmlBlock(s2, indent, attrs = "") {
   return [
     `${indent}<!-- ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) -->`,
-    `${indent}<script${attrs} async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, false, attrs)}`,
     `${indent}<!-- ${MARK_END} -->`
   ];
 }
@@ -29963,7 +30233,7 @@ function planSnippet(d, s2) {
   const root = d.root;
   const file = d.layoutFile;
   const manual = `Add this tag inside <head> on every page (your root layout / template):
-  ${s2.scriptTag}`;
+  ${s2.pinned ? snippetScriptTag(s2) : s2.scriptTag}`;
   if (!file) return { change: null, manual };
   const existing = read(root, file);
   const jsx = (f) => f === "nextjs-app" || f === "nextjs-pages" || f === "remix" || f === "react-router";
@@ -29979,15 +30249,15 @@ function planSnippet(d, s2) {
     }
     return { change: null, manual };
   }
-  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START)) {
-    return { change: { file, action: "unchanged", summary: "Snippet already installed", added: [] } };
+  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START) && existing.includes(`src="${srcOf(s2)}"`) && (!s2.pinned || existing.includes(s2.pinned.integrity))) {
+    return { change: { file, action: "unchanged", summary: s2.pinned ? `Snippet already installed (pinned release ${s2.pinned.version} with SRI)` : "Snippet already installed", added: [] } };
   }
   const isJsx = jsx(d.framework);
   const indentRe = isJsx ? d.framework === "nextjs-pages" ? /<Head\b[^>]*>/ : /<head\b[^>]*>/ : /<\/head>/i;
   const indent = isJsx ? indentOf2(existing, indentRe) : indentOf2(existing, /<\/head>/i, "  ");
   const block = isJsx ? jsxBlock(s2, indent) : htmlBlock(s2, indent, d.framework === "astro" ? " is:inline" : "");
   const replaced = replaceMarked(existing, block);
-  if (replaced !== null) return { change: { file, action: "modify", summary: "Snippet tag updated (new site key)", contents: replaced, added: block } };
+  if (replaced !== null) return { change: { file, action: "modify", summary: existing.includes(`data-key="${s2.snippetKey}"`) ? s2.pinned ? `Snippet tag pinned to release ${s2.pinned.version} with SRI` : "Snippet tag updated" : "Snippet tag updated (new site key)", contents: replaced, added: block } };
   let next = null;
   switch (d.framework) {
     case "nextjs-app": {
@@ -30018,7 +30288,7 @@ ${indentOf2(existing, /<Head\s*\/>/, "")}</Head>`) : null);
   }
   if (!next) return { change: null, manual: `Could not find <head> in ${file}. ${manual}` };
   if (!snippetPlacedSafely(next, isJsx)) return { change: null, manual: `Could not place the snippet safely in ${file} (its <head> is not where Checkbox can patch it without breaking the file), so ${file} was NOT changed. ${manual}` };
-  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}`, contents: next, added: block } };
+  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}${s2.pinned ? ` (pinned release ${s2.pinned.version} with SRI)` : ""}`, contents: next, added: block } };
 }
 function envVarNames(d) {
   return {
@@ -30126,7 +30396,7 @@ ${jsxBlock(s2, "        ").join("\n")}
     NUXT_PLUGIN = (s2) => `// ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet)
 export default defineNuxtPlugin(() => {
   useHead({
-    script: [{ src: '${srcOf(s2)}', async: true, 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
+    script: [{ src: '${srcOf(s2)}', async: true,${s2.pinned ? ` integrity: '${s2.pinned.integrity}', crossorigin: 'anonymous',` : ""} 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
   });
 });
 // ${MARK_END}
@@ -30227,7 +30497,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const call = (perFile.get(s2.file) ?? 0) + 1;
     perFile.set(s2.file, call);
     if (!registrable(s2.params, s2.unresolved)) {
-      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")}` : "not a subscription-mode Checkout Session" });
+      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")} (a variable, call or template string). Next: register the exact params your server sends with createStripeCheckoutConfig (POST /v1/sites/{site}/stripe_checkout_configs), or, once Stripe is connected, create one Checkout Session in Stripe test mode so Checkbox reads it` : "not a subscription-mode Checkout Session" });
       continue;
     }
     try {
@@ -30265,6 +30535,13 @@ function configLines(configs, now = Date.now()) {
   };
   return ["Checkout params registered:", ...configs.map((c) => c.id ? `  ${c.file}:${c.line} \u2192 ${c.id}${age(c.registered_at)}${c.replaced?.length ? ` (replaced ${c.replaced.length} older config${c.replaced.length === 1 ? "" : "s"})` : ""}` : `  ${c.file}${c.line ? `:${c.line}` : ""}: ${c.skipped}`)];
 }
+async function snippetRelease(client) {
+  try {
+    return pinnedRelease(await client.get("/s/latest.json"));
+  } catch {
+    return void 0;
+  }
+}
 function registrable(params, unresolved) {
   if (!params) return false;
   if (unresolved.some((u) => /^(mode|line_items|subscription_data|custom_text|consent_collection)\b/.test(u))) return false;
@@ -30364,7 +30641,7 @@ var init_init = __esm({
     init_patch2();
     VERSION_FLAGS = {
       string: ["site-url", "checkout-url", "account-url", "terms-url", "privacy-url", "refund-url", "cancellation-url", "wait-seconds", "agent", "support-email", "merchant-name", "plan"],
-      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "relogin"],
+      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "pin", "relogin"],
       alias: { y: "yes" }
     };
     interactive = (ctx) => !ctx.flags.json && !!process.stdin.isTTY && !!process.stderr.isTTY;
@@ -30376,8 +30653,11 @@ var init_init = __esm({
         "Run it in the project root. What it does (idempotent; re-run any time):",
         "  1. detects the framework, billing platform, checkout code and pay buttons",
         '  2. signs you in: prints ONE link ("Open \u2026 and click Approve") and opens the browser; new accounts are free',
-        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it)",
-        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments)",
+        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it); when that file is",
+        "     tracked by git, or the folder is deployed as it is, the key is not written to it and stays only in the CLI config",
+        "     (~/.config/checkbox/config.json), which the output says",
+        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments): the pinned release",
+        "     (/s/<version>.js with integrity= and crossorigin=, Subresource Integrity); --no-pin uses the unpinned /s.js",
         "  5. registers the site, Terms / refund / cancellation policy URLs (fetched and checked by Checkbox)",
         "  6. with your permission, uses the project's Stripe restricted TEST key (rk_test_\u2026; sk_test_ and live keys are refused) for a synthetic test subscription",
         "  7. runs the first checks and prints the next step (`checkbox plan --json`); the human gets the summary email",
@@ -30623,7 +30903,9 @@ var init_init = __esm({
         if (session.install.script_tag && session.install.snippet_key) {
           if (bool(flags, "snippet") === false) manualSnippet = session.install.script_tag;
           else {
-            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase });
+            const pinned = bool(flags, "pin") === false ? void 0 : await snippetRelease(client);
+            if (!pinned && bool(flags, "pin") !== false) warnings.push("The pinned snippet release (/s/latest.json) could not be read, so the unpinned /s.js tag was used. Run `checkbox init` again to pin it with Subresource Integrity.");
+            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase, ...pinned ? { pinned } : {} });
             if (plan2.change) changes.push(plan2.change);
             if (plan2.manual) manualSnippet = plan2.manual;
           }

package/package.json

@@ -1,32 +1,35 @@
 {
   "name": "@checkbox-site/cli",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "The checkbox CLI: auto-renewal law and subscription compliance checks (FTC ROSCA, California ARL, New York and other states) for Stripe Checkout params, pages, disclosures and emails, from a terminal, CI or an AI coding agent. Runs offline.",
   "keywords": [
+    "checkbox",
     "subscription",
     "subscription-compliance",
-    "subscription compliance",
     "auto-renewal",
-    "auto renewal",
-    "autorenewal",
     "automatic-renewal",
+    "auto-renewal-law",
     "compliance",
     "rosca",
-    "click-to-cancel",
     "california-arl",
-    "auto-renewal-law",
+    "click-to-cancel",
+    "stripe",
+    "stripe-checkout",
+    "ci",
+    "github-actions",
+    "cli",
+    "mcp",
+    "model-context-protocol",
+    "ai-agent",
+    "subscription compliance",
+    "auto renewal",
+    "autorenewal",
     "auto-renewal-compliance",
     "subscription-cancellation",
     "renewal-reminder",
     "stripe-subscriptions",
     "ftc",
-    "negative-option",
-    "stripe",
-    "stripe-checkout",
-    "mcp",
-    "ci",
-    "github-actions",
-    "cli"
+    "negative-option"
   ],
   "license": "MIT",
   "author": "Checkbox <support@checkbox.site>",