@checkbox-site/cli 0.4.5 → 0.4.7

package/dist/checkbox.js

@@ -3335,7 +3335,7 @@ var init_operations = __esm({
       /**
        * Register the Checkout Session params your code uses.
        *
-       * Registers exactly the object your code passes to stripe.checkout.sessions.create (customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
+       * Registers exactly the object your code passes to stripe.checkout.sessions.create, as `params` (that object sent alone as the body is accepted too; customer, URLs and secrets are not needed and are ignored; `warnings` says what was not stored). It is judged exactly like checkStripeCheckoutSession, discounts included. A config with the same name, or for the same Price ids, replaces the older one (`replaced`). Test runs mirror it into Stripe test mode; when it matches your latest live checkout, the scanned test page counts as an observation of your live checkout. Re-register after changing your checkout code, then call createTestRun.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/stripe_checkout_configs (operation `createStripeCheckoutConfig`, scope `test_runs:write`)
@@ -3617,7 +3617,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.3";
+    SDK_VERSION = "0.2.5";
   }
 });
 
@@ -4484,7 +4484,23 @@ function exitCodeFor(report, strict) {
   if (report.verdict === "needs_review" && strict) return EXIT.needs_review;
   return EXIT.ok;
 }
+function renderSchedule(report, out, opts) {
+  const c = out.c;
+  const notices = report.notices ?? [];
+  const where2 = report.jurisdictions === "all" || !report.jurisdictions ? "all jurisdictions" : report.jurisdictions.join(", ");
+  const lines = [`${c.bold("NOTICE SCHEDULE")}  ${notices.length} notice${notices.length === 1 ? "" : "s"} to send \xB7 ${where2} \xB7 rules ${report.rules_version ?? "?"} \xB7 catalog ${report.catalog_version ?? "?"}`];
+  for (const n of notices.slice(0, opts.verbose ? 200 : 12)) {
+    lines.push(`  ${n.send_date ?? "?"}  ${n.kind ?? "notice"}${n.occasion ? c.dim(` \xB7 ${n.occasion}`) : ""}${n.days_before ? c.dim(` (${n.days_before} days before)`) : ""}${n.citations?.length ? c.dim(` \xB7 ${n.citations.slice(0, 2).join("; ")}${n.citations.length > 2 ? " \u2026" : ""}`) : ""}`);
+  }
+  if (!opts.verbose && notices.length > 12) lines.push(c.dim(`  \u2026 ${notices.length - 12} more (--verbose or --json)`));
+  const notRequired = report.not_required ?? [];
+  if (notRequired.length && opts.verbose) for (const n of notRequired) lines.push(c.dim(`  not required: ${n.kind ?? ""}${n.reason ? ` \u2014 ${n.reason}` : ""}`));
+  if (report.next_action?.message) lines.push("", `${c.cyan("Next:")} ${wrap(report.next_action.message, 110, "      ")}`);
+  if (report.disclaimer) lines.push(c.dim(report.disclaimer));
+  return lines;
+}
 function renderReport(report, out, opts) {
+  if (!report.verdict && Array.isArray(report.notices)) return renderSchedule(report, out, opts);
   const c = out.c;
   const icon2 = (s2) => s2 === "pass" ? c.green("\u2713") : s2 === "fail" ? c.red("\u2717") : s2 === "needs_review" ? c.yellow("?") : c.dim("\u2013");
   const verdict = report.verdict ?? "unknown";
@@ -4518,7 +4534,9 @@ function renderReport(report, out, opts) {
     lines.push(...JSON.stringify(report.correction.patch, null, 2).split("\n").map((l) => `  ${l}`));
   }
   if (report.template && verdict !== "pass" && verdict !== "not_applicable") {
-    lines.push("", report.template.verified ? `${c.bold("Suggested template (passes the checks)")} ${c.green("(verified)")}` : c.bold("Suggested template"), `  Subject: ${report.template.subject}`, ...report.template.text.split("\n").map((l) => `  ${l}`));
+    const toFill = report.template.placeholders ?? [];
+    const label = !report.template.verified ? c.bold("Suggested template") : toFill.length ? `${c.bold(`Suggested template (passes the checks once you replace ${toFill.join(", ")} with your real value${toFill.length === 1 ? "" : "s"})`)}` : `${c.bold("Suggested template (passes the checks)")} ${c.green("(verified)")}`;
+    lines.push("", label, `  Subject: ${report.template.subject}`, ...report.template.text.split("\n").map((l) => `  ${l}`));
   }
   if (report.next_action?.message) lines.push("", `${c.cyan("Next:")} ${wrap(report.next_action.message, 110, "      ")}`);
   if (report.disclaimer) lines.push(c.dim(report.disclaimer));
@@ -4736,16 +4754,63 @@ var init_stripe_ids = __esm({
 });
 
 // ../core/src/stripe-key.ts
+function stripeKeyPermissionLine(filter) {
+  return STRIPE_KEY_PERMISSIONS.filter(filter ?? (() => true)).map((p) => `${p.resource}: ${p.access}`).join(", ");
+}
+function approvalKeyAsk(opts = {}) {
+  if (opts.stripe === false) return "";
+  const create = `create a restricted key in Stripe Test mode (${STRIPE_TEST_API_KEYS_URL} \u2192 Create restricted key) ticking ${stripeKeyPermissionLine()}, and put it in the project's env file (never in the chat)`;
+  return `${opts.stripe ? "In the same message" : "If the site sells through Stripe, in the same message"}, ask them to tick \u201CLet your agent store a Stripe test-mode key\u201D on that page${opts.keyFound ? "" : ` and, if the project has no rk_test_ key yet, to ${create}`}: one approval then covers the key and the test subscription.`;
+}
+var STRIPE_KEY_PERMISSIONS, STRIPE_TEST_API_KEYS_URL;
 var init_stripe_key = __esm({
   "../core/src/stripe-key.ts"() {
     "use strict";
+    STRIPE_KEY_PERMISSIONS = [
+      { resource: "Customers", access: "Write", why: "Hosted cancellation page: finds the subscriber by email (Read). Test runs: create a test customer (Write, test mode only).", uses: ["fixes", "test_runs"], optional: true, writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Products", access: "Read", why: "Plan names next to your prices.", uses: ["checks", "test_runs"] },
+      { resource: "Prices", access: "Read", why: "Amounts, billing intervals and trial lengths, compared with what your pages say.", uses: ["checks", "test_runs"] },
+      { resource: "Coupons", access: "Read", why: "Only when your hosted cancellation page offers a coupon as the save offer.", uses: ["fixes"], optional: true },
+      { resource: "Subscriptions", access: "Write", why: "Read: which trials subscribers actually get. Write: cancels when a subscriber asks on your hosted cancellation page, and test runs create test subscriptions.", uses: ["checks", "fixes", "test_runs"], writeWhen: "Used only after you turn on the hosted cancellation page (you approve it in one click), or in test mode." },
+      { resource: "Test clocks", access: "Write", why: "Test runs fast-forward through trial end and renewal (test-mode keys only; nothing is charged).", uses: ["test_runs"], optional: true, writeWhen: "Used only in test mode." },
+      { resource: "Customer portal", access: "Write", why: "Read: whether subscribers can cancel online and your portal link. Write: test runs open the portal to cancel the test subscription.", uses: ["checks", "test_runs"], writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Checkout Sessions", access: "Write", why: "Read: your checkout text and terms-consent setting. Write: test runs start a test checkout.", uses: ["checks", "test_runs"], writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Payment Links", access: "Write", why: "Read: consent and renewal text on your Payment Links. Write: the Payment Link fix, only when you click Approve.", uses: ["checks", "fixes"], writeWhen: "Used only after you click Approve on the Payment Link fix, or in test mode." },
+      { resource: "Webhook Endpoints", access: "Write", why: "Registers Checkbox\u2019s webhook endpoint, so renewals and cancellations are seen as they happen.", uses: ["checks"], writeWhen: "Used once, when you connect the key, to add Checkbox\u2019s own webhook endpoint (and to remove it when you disconnect); nothing else." }
+    ];
+    STRIPE_TEST_API_KEYS_URL = "https://dashboard.stripe.com/test/apikeys";
   }
 });
 
 // ../core/src/go-live.ts
+function goLiveSteps(input = {}) {
+  const out = [];
+  if (!input.domainVerified) out.push({ key: "verify_domain", who: "person", text: "Verify your domain (a DNS record or a file on your site). Live checks start only on a verified public domain." });
+  if (input.termsOfServiceRequired && !input.termsOfServiceUrlSet) out.push({ key: "stripe_terms_url", who: "person", text: GO_LIVE_TERMS_URL_STEP, url: STRIPE_PUBLIC_DETAILS });
+  if (!input.liveKeyConnected)
+    out.push({
+      key: "live_stripe_key",
+      who: "person",
+      text: "Switch the dashboard to Live mode and connect your live Stripe key (rk_live_\u2026) with the same permissions as your test key (the checklist next to the key field: Read for the checks; Write only for fixes you approve and to add Checkbox\u2019s webhook endpoint). Only a person adds live keys; an agent never does."
+    });
+  if (input.checkoutKind === "payment_link")
+    out.push({ key: "live_checkout", who: "person", text: "Create the live Payment Link in Stripe live mode with the same settings as the test link Checkbox checked (renewal terms, consent checkbox, cancellation link); then your agent puts the live link on your site in place of the test link." });
+  else if (input.checkoutKind === "stripe_checkout")
+    out.push({ key: "live_checkout", who: "agent", text: "Ship the same Checkout Session params Checkbox checked with your live Price ids (the live Stripe secret key in your production settings is set by a person)." });
+  out.push({
+    key: "promote_site",
+    who: "person",
+    text: `Promote the site to live: Checkbox copies your Checkbox Notices settings, confirmed cancellation policy, support email and New York answers.${input.checkboxSends === false ? "" : " If Checkbox sends your emails, preview them and confirm once that it may email your real subscribers."}`
+  });
+  return out;
+}
+var STRIPE_PUBLIC_DETAILS, GO_LIVE_TERMS_URL_STEP, GO_LIVE_STEPS;
 var init_go_live = __esm({
   "../core/src/go-live.ts"() {
     "use strict";
+    STRIPE_PUBLIC_DETAILS = "https://dashboard.stripe.com/settings/public";
+    GO_LIVE_TERMS_URL_STEP = 'Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details). Your checkout asks shoppers to accept your terms (consent_collection.terms_of_service = "required"), and Stripe refuses those Checkout Sessions until that URL is set.';
+    GO_LIVE_STEPS = goLiveSteps().map((s2) => s2.text);
   }
 });
 
@@ -4988,7 +5053,7 @@ var init_california = __esm({
         notes: notes(
           AB2863_APPLICABILITY,
           "Misrepresentation is only partly machine-detectable; the auto-renewal language check catches the most common case (offers that hide or deny the renewal).",
-          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock, $35M), a hidden early-termination fee (Adobe: Justice Department complaint filed June 2024).',
+          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock: proposed $35M order filed May 2026), a hidden early-termination fee (Adobe: Justice Department complaint filed June 2024).',
           'CHECK GAP: no check yet flags "cancel anytime" / "no commitment" copy contradicted by the refund or term policy, or a one-time purchase that enrolls the buyer in a subscription (product opportunity: a rollover and misrepresentation check). terms.refund_policy_consistent covers advertised refund promises.'
         )
       }),
@@ -11321,6 +11386,9 @@ function introAmountOf(amount, o) {
   return void 0;
 }
 function unverifiedReason(ctx) {
+  const known = ctx.referencePlans ?? [];
+  if (known.length) return `none of your plans (${known.slice(0, 4).map((p) => p.label ?? p.name ?? p.id).join(", ")}) was matched to this checkout's price (the Price id it sells is not one Checkbox has for them)`;
+  if ((ctx.checkoutConfigs?.length ?? 0) > 0) return "the price this checkout sells is not in your registered Checkout configs or your billing platform's prices";
   const chosen = ctx.facts?.planPriceId;
   if (chosen && ctx.config) return `the chosen price ${chosen} is not among the active recurring prices read from your billing platform`;
   if (chosen) return `the chosen price ${chosen} could not be read (no billing platform connected)`;
@@ -11461,8 +11529,8 @@ function sameProductName(a, b) {
 function declaredPriceIds(x) {
   return [x.price_id, x.stripe_price, x.priceId, x.id].filter((v) => typeof v === "string" && v.trim().length > 0);
 }
-function reconcileDeclaredPlans(raw, billing, platform = "Stripe") {
-  const prices = billing.filter((p) => p && p.amount > 0 && p.interval);
+function reconcileDeclaredPlans(raw, billing, platform = "Stripe", checkoutTrials) {
+  const prices = billing.filter((p) => p && p.amount > 0 && p.interval).map((p) => checkoutTrials?.has(p.id) ? { ...p, trialDays: checkoutTrials.get(p.id) } : p);
   const out = [...raw];
   const conflicts = [];
   if (!prices.length || !raw.length) return { plans: out, conflicts };
@@ -12103,6 +12171,13 @@ function checkoutSessionsOf(config) {
   if (!Array.isArray(raw)) return [];
   return raw.filter((s2) => !!s2 && typeof s2 === "object" && typeof s2.id === "string" && Array.isArray(s2.lineItems));
 }
+function withTestRunSessions(sessions, runSessionIds) {
+  if (!runSessionIds.size) return [...sessions];
+  return sessions.map((s2) => !s2.checkboxTestRun && runSessionIds.has(s2.id) ? { ...s2, checkboxTestRun: true } : s2);
+}
+function testRunSessionIds(runs) {
+  return new Set(runs.map((r) => r.state?.sessionId).filter((x) => typeof x === "string" && x.startsWith("cs_")));
+}
 function newestFirst(sessions) {
   return sessions.map((s2, i) => ({ s: s2, i })).sort((a, b) => (typeof b.s.created === "number" ? b.s.created : -Infinity) - (typeof a.s.created === "number" ? a.s.created : -Infinity) || a.i - b.i).map((x) => x.s);
 }
@@ -14917,7 +14992,8 @@ function inAppPath(input) {
       return { kind: "in_app", state: "works", detail: "a test cancellation completed online" };
     }
     if (hostedStep2) return void 0;
-    const kinds = (flow.blockers ?? []).map(classifyBlocker);
+    const onHosted = (flow.steps ?? []).some((s2) => s2.source !== "snippet" && isHostedCancelUrl(s2.url));
+    const kinds = (flow.blockers ?? []).map(classifyBlocker).filter((k) => !(onHosted && k === "contact"));
     if (kinds.some((k) => k === "contact" || k === "not_found" || k === "obstacle")) {
       return { kind: "in_app", state: "broken", detail: `the test cancellation did not complete (${flow.blockers.join("; ")})` };
     }
@@ -14994,7 +15070,7 @@ function offlineOnlyCancellation(input) {
   const hosted = input.ctx.hostedCancel;
   const helpHits = [];
   for (const c of captures) {
-    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout") continue;
+    if (isFetchedDocument(c) || c.pageProblem || c.pageKind === "checkout" || isHostedCancelUrl(c.url)) continue;
     const sentence = contactOnlySentence(c.text);
     if (!sentence) continue;
     if (ownOnlineCancelControls(c, hosted).length) continue;
@@ -15005,7 +15081,7 @@ function offlineOnlyCancellation(input) {
     }
     return { where: `${c.pageKind === "account" ? "account page" : c.pageKind === "cancel" ? "cancel page" : "page"} ${c.url.split("#")[0]}`, quote: sentence, capture: c };
   }
-  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
+  const contactOnlyUrls = new Set(captures.filter((c) => !isFetchedDocument(c) && !isHostedCancelUrl(c.url) && contactOnlySentence(c.text)).map((c) => stripUrl(c.url)));
   const onlineControl = captures.some(
     (c) => !isFetchedDocument(c) && ownOnlineCancelControls(c, hosted).some((el) => !contactOnlyUrls.has(stripUrl(hrefOf(el) ?? "", c.url)))
   );
@@ -16372,6 +16448,73 @@ var init_intro_terms = __esm({
   }
 });
 
+// ../rules/src/checks/charge-claims.ts
+function sentenceSpan(text, index) {
+  const dot = text.lastIndexOf(". ", index);
+  const start = Math.max(dot >= 0 ? dot + 2 : 0, text.lastIndexOf("\n", index) + 1);
+  const ends = [text.indexOf(". ", index), text.indexOf("\n", index)].filter((n) => n >= 0);
+  return { start: Math.min(start, index), end: ends.length ? Math.min(...ends) + 1 : text.length };
+}
+function misstatedRecurringCharge(text, prices, plans, others = []) {
+  const usable = plans.filter((p) => p.amount > 0 && p.interval);
+  if (!usable.length) return void 0;
+  const known = [...usable.map((p) => p.amount), ...others].filter((n) => n > 0);
+  const same = (a, b) => Math.abs(a - b) < 5e-3;
+  const statesPlanPrice = prices.some((r) => r.money.amount !== null && known.some((k) => same(k, r.money.amount)));
+  if (!statesPlanPrice) return void 0;
+  return prices.find((r) => {
+    const amount = r.money.amount;
+    const unit2 = r.frequency.unit;
+    if (amount === null || !(amount > 0) || !unit2) return false;
+    if (known.some((k) => same(k, amount))) return false;
+    const cur = (r.money.currency || "").toLowerCase();
+    const plansHere = usable.filter((p) => !cur || !p.currency || p.currency.toLowerCase() === cur);
+    if (!plansHere.some((p) => frequencyMatchesPlan(unit2, r.frequency.count, p))) return false;
+    if (plansHere.some((p) => {
+      const k = amount / p.amount;
+      return k >= 2 && Math.abs(k - Math.round(k)) < 1e-3;
+    })) return false;
+    if (isPerPeriodEquivalent(r, plansHere)) return false;
+    const at = r.money.index;
+    if (!(at >= 0) || text.slice(at, at + r.money.text.length) !== r.money.text) return false;
+    {
+      const { start, end } = sentenceSpan(text, at);
+      const sentence = text.slice(start, end);
+      const around = text.slice(Math.max(start, at - 24), Math.min(end, at + r.money.text.length + 40));
+      if (NOT_THE_CHARGE_AROUND_RE.test(around) || NOT_A_PRICE_AROUND_RE.test(around)) return false;
+      if (INTRO_CUE_RE.test(sentence) || INTRO_SENTENCE_RE.test(sentence)) return false;
+      const before = text.slice(Math.max(start, at - 32), at);
+      const adjacent = prices.some((o) => {
+        if (o === r || o.money.amount === null || o.money.index < 0 || !known.some((k) => same(k, o.money.amount))) return false;
+        const [a, b] = o.money.index < at ? [o.money, r.money] : [r.money, o.money];
+        return /^[\s()[\]/,:–—-]*$/.test(text.slice(a.index + a.text.length, b.index));
+      });
+      if (!adjacent && !CHARGE_CUE_BEFORE_RE.test(before)) return false;
+    }
+    return true;
+  });
+}
+function isPerPeriodEquivalent(r, plans) {
+  const amount = r.money.amount;
+  const unit2 = r.frequency.unit;
+  if (amount === null || !(amount > 0) || !unit2) return false;
+  const cur = (r.money.currency || "").toLowerCase();
+  return plans.some(
+    (p) => p.amount > 0 && (!cur || !p.currency || p.currency.toLowerCase() === cur) && !frequencyMatchesPlan(unit2, r.frequency.count, p) && Math.abs(amount * periodDays(p.interval, p.intervalCount) / periodDays(unit2, r.frequency.count) - p.amount) <= Math.max(0.02 * p.amount, 0.05)
+  );
+}
+var NOT_THE_CHARGE_AROUND_RE, INTRO_SENTENCE_RE, CHARGE_CUE_BEFORE_RE;
+var init_charge_claims = __esm({
+  "../rules/src/checks/charge-claims.ts"() {
+    "use strict";
+    init_plan_terms();
+    init_intro_terms();
+    NOT_THE_CHARGE_AROUND_RE = /\b(?:off|save[sd]?|saving|savings|value[sd]?|worth|reward|bonus|max(?:imum)?|up\s+to|prorat\w*|earlier|previous(?:ly)?|used\s+to|last\s+(?:year|month|week|period|time)|from|was|were|previously|formerly|regular(?:ly)?|normally|usually|instead\s+of|compared|vs\.?|versus|old|reg\.|retail|list\s+price|add-?ons?|extra|additional|per\s+(?:seat|user|member|license|licence|unit))\b/i;
+    INTRO_SENTENCE_RE = /\btrial\b|\bfree\b|\buntil\b[^.]*\bthen\b|\bfor\s+(?:the\s+|your\s+)?first\b|\bafter\s+(?:the\s+)?(?:first|trial|intro)/i;
+    CHARGE_CUE_BEFORE_RE = /\b(?:charg\w*|bill(?:s|ed|ing)?|pay(?:s|ing|ment)?|renew(?:s|al|ing)?|costs?|total|due|amount|price)\b[^$€£\d]*$/i;
+  }
+});
+
 // ../rules/src/checks/notice-content.ts
 function offlineOnlyCancelIn(text, cancelMethods) {
   const offline = contactOnlySentence(text);
@@ -16410,11 +16553,21 @@ function noticeContent(e, opts = {}) {
   ];
   const amount = a.recurringPrices[0]?.money ?? positiveAmounts(a)[0];
   const stated = positiveAmounts(a).filter((m) => m.amount !== null);
+  const toMajor = (p, minor) => minor / 10 ** currencyDigitsOf(p.currency);
+  const chargePlans = plans.map((p) => ({ amount: toMajor(p, p.amount), currency: p.currency, interval: p.interval, intervalCount: p.intervalCount }));
+  const misstated = plans.length ? misstatedRecurringCharge(
+    a.text,
+    a.recurringPrices,
+    chargePlans,
+    [...expected, ...plans.flatMap((p) => typeof p.introAmount === "number" && p.introAmount > 0 ? [toMajor(p, p.introAmount)] : [])]
+  ) : void 0;
   if (amount && expected.length && stated.length && !stated.some((m) => expected.some((x) => Math.abs(x - m.amount) < 5e-3))) wrong.amount = quote(amount);
+  else if (misstated) wrong.amount = quote(misstated.money);
   else if (amount) quotes.amount = quote(amount);
   const freq = a.recurringPrices[0]?.frequency ?? a.frequencies[0];
   const freqs = [...a.recurringPrices.map((r) => r.frequency), ...a.frequencies].filter((f) => f.unit);
-  const charged = a.recurringPrices.map((r) => r.frequency).filter((f) => !!f?.unit);
+  const planPriceStated = stated.some((m) => chargePlans.some((p) => Math.abs(p.amount - m.amount) < 5e-3));
+  const charged = a.recurringPrices.filter((r) => !!r.frequency?.unit && !(planPriceStated && isPerPeriodEquivalent(r, chargePlans))).map((r) => r.frequency);
   const misses = (f) => !plans.some((p) => frequencyMatchesPlan(f.unit, f.count, p));
   const wrongCharged = plans.length ? charged.find(misses) : void 0;
   if (wrongCharged) wrong.frequency = quote(wrongCharged);
@@ -16481,6 +16634,7 @@ var init_notice_content = __esm({
     init_context();
     init_intro_terms();
     init_result();
+    init_charge_claims();
     ELEMENT_LABELS = {
       amount: "the amount charged",
       frequency: "how often the subscription is charged",
@@ -16851,6 +17005,17 @@ function cancelBeforeTrialMatch(text) {
   if (byDate && TRIAL_ENDS_DATE_RE.test(text)) return byDate[0];
   return null;
 }
+function statedTrialMismatch(a, p, offers) {
+  const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
+  if (!stated.length) return void 0;
+  const own = p?.offer && p.offer.trialDays > 0 ? [p.offer] : p?.offer ? [] : offers.filter((o) => o.trialDays > 0);
+  if (!own.length) return void 0;
+  const fits = (days, trial) => days === trial || days % 30 === 0 && Math.abs(days - trial) <= Math.max(1, days / 30) * 2;
+  if (stated.some((t) => own.some((o) => fits(t.days, o.trialDays)))) return void 0;
+  const lengths = [...new Set(own.map((o) => o.trialDays))].sort((x, y) => x - y);
+  const plan2 = p?.offer ? `${offerLabel(p.offer)} has a ${p.offer.trialDays}-day free trial` : `the plan${lengths.length > 1 ? "s give" : " gives"} a ${lengths.join("- or ")}-day free trial`;
+  return { stated: `\u201C${stated[0].text}\u201D`, plan: plan2 };
+}
 var ACK_MAX_DELAY_HOURS, NO_ACK_EMAIL_MESSAGE, ackCache, SIGNUP_LINK_TOLERANCE_MS, sent, terms, cancellationInstructions, CANCELLING_RE, CANCEL_BEFORE_TRIAL_RE, MONTH, DATE, CANCEL_BEFORE_NO_CHARGE_RE, CANCEL_BEFORE_DATE_RE, TRIAL_ENDS_DATE_RE, trialTerms, CONFIRMATION_CHECKS;
 var init_confirmation = __esm({
   "../rules/src/checks/confirmation.ts"() {
@@ -17160,6 +17325,15 @@ ${v.pageText}`);
         );
         const units = trialDocs.map((doc) => {
           const a = doc.analysis;
+          const wrongTrial = statedTrialMismatch(a, ackPlan(doc.email, input, offers), offers);
+          if (wrongTrial) {
+            return docUnit(doc, {
+              status: "fail",
+              detail: `says ${wrongTrial.stated}, but ${wrongTrial.plan}: state the trial the subscriber really gets`,
+              confidence: 0.8,
+              meta: { trialLengthMismatch: true }
+            });
+          }
           const method = a.cancelMethod[0];
           const timing = a.trialLengths[0] ?? a.postTrialCharge[0];
           const beforeMatch = cancelBeforeTrialMatch(a.text);
@@ -19199,6 +19373,7 @@ var init_signup = __esm({
     init_offer_view();
     init_plan_terms();
     init_cancellation();
+    init_charge_claims();
     init_intro_terms();
     init_intro_terms();
     init_result();
@@ -19364,6 +19539,29 @@ var init_signup = __esm({
                 const pl = view.plan?.plan;
                 return !!pl && hasIntro(pl) && r.money.amount !== null && Math.abs(r.money.amount - pl.introAmount / 10 ** currencyDigits(pl.currency || "usd")) < 5e-3;
               };
+              if (!tied && plans.length) {
+                const sitePrices = withAccountPrices(referencePlans(input.ctx), input.ctx).map((p) => p.amount / 10 ** currencyDigits((p.currency || "usd").toLowerCase()));
+                const intros = [...plans.map((p) => p.plan), ...view.plan ? [view.plan.plan] : []].flatMap(
+                  (pl) => hasIntro(pl) ? [pl.introAmount / 10 ** currencyDigits((pl.currency || "usd").toLowerCase())] : []
+                );
+                const misstated = misstatedRecurringCharge(
+                  near2.text,
+                  parsed,
+                  plans.map((p) => ({ amount: p.amount, currency: p.currency, interval: p.plan.interval, intervalCount: p.plan.intervalCount })),
+                  [...sitePrices, ...intros]
+                );
+                if (misstated && !NON_CHARGE_AMOUNT_RE.test(quote(misstated) ?? "") && !INTRO_PRICE_RE.test(quote(misstated) ?? "")) {
+                  const said = misstated.money.text;
+                  const own = quote(parsed.find(recurringMatches) ?? rp) ?? "";
+                  const firm = decisive && input.ctx.facts?.partialPlans !== true && !otherPlanCard(view, input);
+                  return unit(
+                    firm ? "fail" : "needs_review",
+                    `the terms state \u201C${own}\u201D but also \u201C${said}\u201D for the same billing period, and ${plans.length === 1 ? "the plan charges" : "the plans charge"} ${plans.slice(0, 4).map((p) => p.label).join(", ")} \u2014 state only the recurring charge subscribers will actually pay`,
+                    firm ? 0.85 : 0.6,
+                    { quote: said, meta: { ...meta(misstated.money.amount, misstated.money.currency), priceMismatch: true, secondCharge: true } }
+                  );
+                }
+              }
               const foreign = tied && plans.length ? parsed.find((r) => r.frequency.unit && !recurringMatches(r) && !equivalentOfPlan(r) && !ownIntro(r) && !INTRO_PRICE_RE.test(quote(r) ?? "")) : void 0;
               if (foreign) {
                 const own = parsed.find(recurringMatches) ?? rp;
@@ -22221,7 +22419,7 @@ function classifyRaw(input) {
   }
 }
 function fixFromFail(c) {
-  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
+  return withPlanTerms(contentFixLine(String(c.checkId), c.data) ?? contentFixFromText(String(c.checkId), c.detail) ?? introFixFromText(c) ?? trialLengthFixFromText(c) ?? planFrequencyFix(c) ?? FAIL_FIX[String(c.checkId)] ?? "Apply the change in the task for this check.", c.data);
 }
 function withPlanTerms(fix, data) {
   if (!/<(?:price|interval)>/.test(fix)) return fix;
@@ -22241,6 +22439,11 @@ function introFixFromText(c) {
   const m = /introductory price of (\S+?)(?: \(\d+% off\))? for (the first [^—,]+?)\s*(?:,|—)/i.exec(c.detail);
   return m ? `State the introductory price (${m[1]} for ${m[2]}) and when it ends, then the regular price from the next charge, in the renewal line.` : "State the introductory price and how long it lasts, then the regular price from the next charge, in the renewal line.";
 }
+function trialLengthFixFromText(c) {
+  if (c.checkId !== "confirmation.email.trial_terms") return void 0;
+  const m = /says “([^”]+)”, but .*?\b(?:has|gives?) a ([\d -]+?or [\d]+|\d+)-day free trial/.exec(c.detail);
+  return m ? `The acknowledgment says \u201C${m[1]}\u201D, but the plan has a ${m[2]}-day free trial: state the trial the subscriber really gets, and how to cancel before it ends.` : void 0;
+}
 function planFrequencyFix(c) {
   if (c.checkId !== "signup.disclosure.frequency") return void 0;
   const every = /\bplans? (?:is|are) billed (every [a-z0-9 ]+?)(?= \/ | —|[.;,]|$)/i.exec(c.detail)?.[1];
@@ -22326,7 +22529,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, RENEWAL_LINE_EXAMPLE, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -22522,7 +22725,7 @@ var init_status = __esm({
       },
       { code: "receipt_without_terms", category: "content", when: has(/only a receipt without subscription terms/), build: () => ({ status: "needs_fix", fix: "Send an acknowledgment that restates the renewal terms (price, frequency, renews until cancelled) and how to cancel; a plain receipt is not enough." }) },
       // Audit P2: Stripe wording (custom_text) only for Stripe inputs; any other checkout gets the same line, platform-neutral.
-      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "Renews automatically every <interval> at <price> until you cancel. Cancel anytime with your cancel link."`, c.data) }) },
+      { code: "processor_default_line", category: "content", when: has(/payment processor.s default line|authorization line is not the renewal terms|no automatic-renewal statement was found/), build: (c) => ({ status: "needs_fix", fix: withPlanTerms(`Add your own renewal line next to the pay button${isStripeInput(c) ? " (Stripe custom_text.submit)" : ""}: "${RENEWAL_LINE_EXAMPLE} Cancel anytime with your cancel link."`, c.data) }) },
       { code: "renewal_without_until_cancel", category: "content", when: has(/but not that it continues until the customer cancels/), build: () => ({ status: "needs_fix", fix: 'Add "until you cancel" to the renewal line.' }) },
       { code: "terms_hidden", category: "content", when: has(/collapsed <details>|\(nearly\) the colour of its background|nearly the colour of the background|hidden by a stylesheet|sr-only/), build: () => ({ status: "needs_fix", fix: "Show the renewal line as plain visible text next to the button (not collapsed, not faded into the background)." }) },
       // Pilot round 11 (change-guard): an intro / discounted price the Stripe session does not apply.
@@ -22985,8 +23188,9 @@ var init_status = __esm({
     PORTAL_OFFLINE_FIX = 'Turn on "Cancel subscriptions" in the Stripe customer portal and link it from your account page, then replace the "email / call us to cancel" line with "Cancel anytime online in your account".';
     PAYMENT_LINK_PORTAL_FIX = `Turn on "Cancel subscriptions" in the Stripe customer portal (Stripe Dashboard \u2192 Settings \u2192 Billing \u2192 Customer portal), copy its billing.stripe.com login link and add it to your site's footer as a "Cancel subscription" link.`;
     PAYMENT_LINK_OFFLINE_FIX = `${PAYMENT_LINK_PORTAL_FIX} Then replace the "email / call us to cancel" line with "Cancel anytime online" and that link.`;
+    RENEWAL_LINE_EXAMPLE = "<price> every <interval> (plus applicable taxes). Renews automatically until you cancel.";
     FAIL_FIX = {
-      "signup.disclosure.autorenew_language": 'Add one line under the price, before the card and email fields: "Renews automatically every <interval> at <price> until you cancel."',
+      "signup.disclosure.autorenew_language": `Add one line under the price, before the card and email fields: "${RENEWAL_LINE_EXAMPLE}"`,
       "signup.disclosure.price": "State the recurring price in the renewal line (the amount actually charged each time).",
       "signup.disclosure.frequency": `State how often it is charged, in the plan's own interval ("every month", "every year").`,
       "signup.disclosure.cancellation_policy": 'Add "Cancel anytime online" to the renewal line, with your cancel link.',
@@ -23835,6 +24039,10 @@ function fixTextsFor(t, style2) {
   if (style2 === "full") return fixTexts(t);
   return { disclosure: compactDisclosureText(t), consentLabel: COMPACT_CONSENT_LABEL, cta: compactCtaLabel(t) };
 }
+function stripeCompactConsent(t) {
+  const trial = t.trialDays && t.trialDays > 0 ? ` after the ${t.trialDays}-day free trial` : "";
+  return `I agree that my subscription renews automatically at ${formatMoney(t.amount, t.currency)} every ${intervalPhrase(t.interval, t.intervalCount)}${trial} until I cancel.`;
+}
 var COMPACT_CONSENT_LABEL;
 var init_compact = __esm({
   "../rules/src/fixes/compact.ts"() {
@@ -23851,9 +24059,10 @@ function shortDisclosureText(t) {
   const trial = !!t.trialDays && t.trialDays > 0;
   const intro = introPhrase(t);
   const cancel = `Cancel anytime online at ${t.cancelUrl}`;
-  if (trial) return `${t.trialDays} days free, then ${intro ?? `${price3} every ${every}`}. Renews automatically until you cancel. ${cancel} before the trial ends to avoid being charged.`;
-  if (intro) return `${intro[0].toUpperCase()}${intro.slice(1)}. Renews automatically until you cancel. ${cancel}.`;
-  return `Renews automatically every ${every} at ${price3} until you cancel. ${cancel}.`;
+  const tax = " (plus applicable taxes)";
+  if (trial) return `${t.trialDays} days free, then ${intro ?? `${price3} every ${every}`}${tax}. Renews automatically until you cancel. ${cancel} before the trial ends to avoid being charged.`;
+  if (intro) return `${intro[0].toUpperCase()}${intro.slice(1)}${tax}. Renews automatically until you cancel. ${cancel}.`;
+  return `Renews automatically every ${every} at ${price3}${tax} until you cancel. ${cancel}.`;
 }
 var init_short = __esm({
   "../rules/src/fixes/short.ts"() {
@@ -24565,6 +24774,45 @@ var init_stripe = __esm({
   }
 });
 
+// ../rules/src/preflight/price-hint.ts
+function intervalHintOf(ref) {
+  if (typeof ref !== "string" || !ref.trim() || ref.length > 200) return void 0;
+  const s2 = ref.trim();
+  if (GENERATED.test(s2)) return void 0;
+  const tokens = s2.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  const hits = /* @__PURE__ */ new Set();
+  for (const t of tokens) for (const [k, re] of WORDS2) if (re.test(t)) hits.add(k);
+  return hits.size === 1 ? [...hits][0] : void 0;
+}
+function priceIntervalConflict(ids, plan2) {
+  const interval = plan2?.interval;
+  if (!interval || !ids.length) return void 0;
+  const count = Number(plan2?.interval_count ?? 1) || 1;
+  for (const id of ids) {
+    const hint = intervalHintOf(id);
+    if (!hint) continue;
+    const planUnit = interval === "month" && count === 12 ? "year" : interval;
+    if (hint !== planUnit) {
+      const name = plan2?.plan_name ?? plan2?.name;
+      return `line_items use ${id}, whose name says it bills every ${hint}, but the plan terms given${name ? ` (plan "${name}")` : ""} bill every ${count > 1 ? `${count} ${interval}s` : interval}`;
+    }
+  }
+  return void 0;
+}
+var WORDS2, GENERATED;
+var init_price_hint = __esm({
+  "../rules/src/preflight/price-hint.ts"() {
+    "use strict";
+    WORDS2 = [
+      ["year", /^(?:annual|annually|yearly|year|years|yr|yrly|12mo|12m|1y|1yr)$/],
+      ["month", /^(?:monthly|month|months|mo|mth|1m|1mo)$/],
+      ["week", /^(?:weekly|week|weeks|wk)$/],
+      ["day", /^(?:daily|day|days)$/]
+    ];
+    GENERATED = /^(?:price|plan|prod)_1[A-Za-z0-9]{12,}$/;
+  }
+});
+
 // ../rules/src/preflight/stripe.ts
 function clone(v) {
   return JSON.parse(JSON.stringify(v));
@@ -24957,10 +25205,6 @@ function correct(params, shape, checks, forLink, style2 = "full") {
   }
   return { patch, corrected: out, texts, needText, needConsent };
 }
-function stripeCompactConsent(t) {
-  const trial = t.trialDays && t.trialDays > 0 ? ` after the ${t.trialDays}-day free trial` : "";
-  return `I agree that my subscription renews automatically at ${formatMoney(t.amount, t.currency)} every ${intervalPhrase(t.interval, t.intervalCount)}${trial} until I cancel.`;
-}
 async function bestCorrection(params, shape, checks, forLink, judgeAfter) {
   const none = () => ({ fix: correct(params, shape, [], forLink), after: checks });
   const first2 = correct(params, shape, checks, forLink, "compact");
@@ -25041,6 +25285,12 @@ function withResolvedPrices(input, knownPrices, amountSource = "merchant.price")
     warnings: [{ code: "price_amount_unverified", message: `line_items use ${ids[0]}, which Checkbox could not read (no connected Stripe account has it), so the amount in the checks and in the corrected custom_text comes from ${amountSource} and is not verified against the Price. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price.`, param: "params.line_items" }]
   };
 }
+function pricePairingConflict(input, resolved) {
+  if (!resolved.warnings.some((w) => w.code === "price_amount_unverified")) return void 0;
+  const conflict = priceIntervalConflict(lineItemPriceIds(input.params), input.merchant);
+  if (!conflict) return void 0;
+  return { code: "price_plan_conflict", message: `${conflict}. Checkbox offers no corrected params for this pairing: they would state the other plan's price. Check which plan this checkout sells and pass that plan's terms (in checkbox.json: the entry's "plan"), or connect Stripe so Checkbox reads the Price.`, param: "params.line_items" };
+}
 async function checkStripeCheckoutSession(input0, opts = {}) {
   const { jurisdictions, asOf, now } = common(input0, opts.now);
   const resolvedPrices = withResolvedPrices(input0, opts.knownPrices, opts.amountSource);
@@ -25056,7 +25306,8 @@ async function checkStripeCheckoutSession(input0, opts = {}) {
   const shape = readParams(params, input.merchant, "session", asOf);
   const url = "https://checkout.stripe.com/c/pay/cs_test_preflight";
   const checks = await judge2(shape, url, jurisdictions, asOf, now, "preflight-stripe-before");
-  const { fix, after } = await bestCorrection(
+  const pairing = pricePairingConflict(input0, resolvedPrices);
+  const { fix, after } = pairing ? { fix: correct(params, shape, [], false), after: checks } : await bestCorrection(
     params,
     shape,
     checks,
@@ -25071,12 +25322,12 @@ async function checkStripeCheckoutSession(input0, opts = {}) {
     verification: { checks: d.checks, passes: d.passes, remaining_checks: d.remaining, note: HOSTED_STYLING_NOTE },
     placeholders
   };
-  const warnings = [...resolvedPrices.warnings, ...shape.warnings];
+  const warnings = [...resolvedPrices.warnings, ...pairing ? [pairing] : [], ...shape.warnings];
   if (fix.needConsent) warnings.push({ code: "stripe_tos_url_required", message: 'consent_collection.terms_of_service = "required" needs a Terms of Service URL in Stripe Dashboard \u2192 Settings \u2192 Public details, or session creation fails.' });
   const channel2 = noticeChannelField(params);
   if (channel2) warnings.push(channel2);
   return {
-    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, nextAction("session", checks, correction), void 0, { cancelUrl: shape.plan?.cancelUrl }),
+    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, pairing ? PAIRING_ACTION(pairing) : nextAction("session", checks, correction), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_checkout_session",
     correction
   };
@@ -25094,7 +25345,8 @@ async function checkStripePaymentLink(input0, opts = {}) {
   const id = typeof params.id === "string" ? params.id : void 0;
   const url = typeof params.url === "string" && /^https:\/\/buy\.stripe\.com\//.test(params.url) ? params.url : "https://buy.stripe.com/test_preflight";
   const checks = await judge2(shape, url, jurisdictions, asOf, now, "preflight-link-before");
-  const { fix, after } = await bestCorrection(
+  const pairing = pricePairingConflict(input0, resolvedPrices);
+  const { fix, after } = pairing ? { fix: correct(params, shape, [], true), after: checks } : await bestCorrection(
     params,
     shape,
     checks,
@@ -25133,11 +25385,11 @@ async function checkStripePaymentLink(input0, opts = {}) {
     ...update_params ? { update_params } : {},
     needs_new_link_for_consent: needsNew
   };
-  const warnings = [...resolvedPrices.warnings, ...shape.warnings];
+  const warnings = [...resolvedPrices.warnings, ...pairing ? [pairing] : [], ...shape.warnings];
   if (fix.needConsent) warnings.push({ code: "stripe_tos_url_required", message: 'consent_collection.terms_of_service = "required" needs a Terms of Service URL in Stripe Dashboard \u2192 Settings \u2192 Public details.' });
   const extra = needsNew && !id ? " Stripe cannot add the consent checkbox to an existing link (stripe.paymentLinks.update refuses consent_collection): create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link." : needsNew ? ` Stripe cannot add the consent checkbox to an existing link: send correction.update_params with stripe.paymentLinks.update("${id}", \u2026) for the text now, then create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link.` : id && update_params ? ` For the existing link use stripe.paymentLinks.update("${id}", correction.update_params) (same URL).` : "";
   return {
-    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, nextAction("link", checks, correction, extra), void 0, { cancelUrl: shape.plan?.cancelUrl }),
+    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, pairing ? PAIRING_ACTION(pairing) : nextAction("link", checks, correction, extra), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_payment_link",
     correction
   };
@@ -25216,7 +25468,7 @@ function noticeChannelField(params) {
     param: `params.custom_fields[${i}]`
   };
 }
-var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, CUSTOM_TEXT_FIELDS, STRIPE_GREY, DAY_MS3, open, STRIPE_HOSTED_STYLING_NOTE;
+var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, CUSTOM_TEXT_FIELDS, STRIPE_GREY, DAY_MS3, open, PAIRING_ACTION, STRIPE_HOSTED_STYLING_NOTE;
 var init_stripe2 = __esm({
   "../rules/src/preflight/stripe.ts"() {
     "use strict";
@@ -25229,6 +25481,7 @@ var init_stripe2 = __esm({
     init_common();
     init_disclosure();
     init_model();
+    init_price_hint();
     TEXT_CHECKS = [
       "signup.disclosure.autorenew_language",
       "signup.disclosure.price",
@@ -25247,10 +25500,31 @@ var init_stripe2 = __esm({
     STRIPE_GREY = { fontSizePx: 13, fontWeight: 400, color: "rgba(26, 26, 26, 0.7)", backgroundColor: "rgb(255, 255, 255)" };
     DAY_MS3 = 864e5;
     open = (c) => !!c && (c.status === "fail" || c.status === "needs_review");
+    PAIRING_ACTION = (w) => ({ type: "human_review", message: `${w.message}` });
     STRIPE_HOSTED_STYLING_NOTE = HOSTED_STYLING_NOTE;
   }
 });
 
+// ../rules/src/preflight/stripe-verdict.ts
+function stripeParamsVerdict(r) {
+  if (r.verdict === "not_applicable") return { verdict: "not_applicable", open: [] };
+  const open2 = r.checks.filter((c) => c.status === "fail" || c.status === "needs_review" && !(c.compliance_status && SATISFIED_COMPLIANCE.has(c.compliance_status))).map((c) => ({ check_id: c.check_id, status: c.status, title: c.title ?? c.check_id, detail: c.explanation ?? "" })).sort((a, b) => (a.status === "fail" ? 0 : 1) - (b.status === "fail" ? 0 : 1));
+  if (r.verdict === "fail" || r.compliance_status === "needs_fix" || open2.some((c) => c.status === "fail")) return { verdict: "fail", open: open2 };
+  const pairing = (r.warnings ?? []).find((w) => w.code === "price_plan_conflict");
+  if (pairing) return { verdict: "needs_review", open: open2, reason: pairing.message };
+  const coupon = (r.warnings ?? []).find((w) => w.code === "coupon_unverified");
+  if (open2.length) return { verdict: "needs_review", open: open2, ...coupon ? { reason: coupon.message } : {} };
+  if (coupon) return { verdict: "needs_review", open: [], reason: coupon.message };
+  return { verdict: "pass", open: [] };
+}
+var SATISFIED_COMPLIANCE;
+var init_stripe_verdict = __esm({
+  "../rules/src/preflight/stripe-verdict.ts"() {
+    "use strict";
+    SATISFIED_COMPLIANCE = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+  }
+});
+
 // ../rules/src/preflight/email.ts
 function linkify(escaped) {
   return escaped.replace(/https?:\/\/[^\s<]+/g, (raw) => {
@@ -25434,6 +25708,10 @@ function contextFor(kind, occ, plan2, jurisdictions, asOf, email) {
 function longDate2(d) {
   return d.toLocaleDateString("en-US", { month: "long", day: "numeric", year: "numeric", timeZone: "UTC" });
 }
+function supportContactLine(contact, opts = {}) {
+  if (contact || opts.required) return `Questions? Reply to this email or contact us at ${contact || SUPPORT_CONTACT_PLACEHOLDER}.`;
+  return "Questions? Reply to this email.";
+}
 function emailTemplate(kind, plan2, opts = {}) {
   const brand = plan2.merchantName ?? "";
   const sub = `${brand ? `${brand} ` : ""}subscription`;
@@ -25441,7 +25719,7 @@ function emailTemplate(kind, plan2, opts = {}) {
   const every = intervalPhrase(plan2.interval, plan2.intervalCount);
   const cancel = plan2.cancelUrl ?? CANCEL_URL_PLACEHOLDER;
   const effect = plan2.cancelTiming === "immediately" ? "cancellation takes effect immediately" : "cancellation takes effect at the end of your current billing period";
-  const contact = opts.supportContact ? `Questions? Contact us at ${opts.supportContact}.` : "Questions? Reply to this email.";
+  const contact = supportContactLine(opts.supportContact);
   const lines = (...l) => l.filter(Boolean).join("\n\n");
   const intro = plan2.introAmount !== void 0 && plan2.introAmount < plan2.amount ? `${formatMoney(plan2.introAmount, plan2.currency)} for ${plan2.introPeriods && plan2.introPeriods > 1 ? `your first ${plan2.introPeriods} billing periods` : `your first ${every}`}` : "";
   const introLine = intro ? `Introductory price: ${intro}, then ${money3} every ${every}.` : "";
@@ -25449,11 +25727,13 @@ function emailTemplate(kind, plan2, opts = {}) {
     case "acknowledgment":
       return {
         subject: `Your ${sub} is confirmed`,
+        // Round 31 (pilot 30 item 22): the same sentences, in the same order, as the "You send" acknowledgment template
+        // (apps/api notices/merchant-templates.ts), so the plan, checkEmail and the due notice give one email.
         text: lines(
-          `Thanks for subscribing${brand ? ` to ${brand}` : ""}! This email confirms your subscription terms.`,
-          introLine,
+          `Thanks for subscribing${brand ? ` to ${brand}` : ""}. This email confirms your subscription terms.`,
           plan2.trialDays ? `Your free trial lasts ${plan2.trialDays} days and ends on {{trial_end_date}}. To avoid being charged, cancel before your trial ends at ${cancel} \u2014 it takes less than a minute. If you do nothing, your subscription starts automatically on {{trial_end_date}} and you will be charged ${money3} every ${every}.` : "",
-          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your next charge is on {{next_charge_date}}.`,
+          `Your ${sub} automatically renews every ${every} at ${money3} until you cancel. Your ${plan2.trialDays ? "first" : "next"} charge is on {{next_charge_date}}.`,
+          introLine,
           `How to cancel: go to ${cancel} \u2014 you can cancel anytime online; ${effect}.`,
           contact
         ),
@@ -25509,7 +25789,7 @@ function emailTemplate(kind, plan2, opts = {}) {
           `To stop future charges, cancel online anytime at ${cancel}.`,
           // Pilot round 11 (invariant test): Georgia's charge notice must give the business's contact information;
           // "reply to this email" is not one, so without a support contact the template asks for it.
-          opts.supportContact ? contact : `Questions? Contact us at ${SUPPORT_CONTACT_PLACEHOLDER}.`
+          supportContactLine(opts.supportContact, { required: true })
         ),
         // Round 12: the template used {{support_contact}} without listing it as a merge tag to fill.
         tags: ["{{charge_date}}", "{{next_charge_date}}", ...opts.supportContact ? [] : [SUPPORT_CONTACT_PLACEHOLDER]]
@@ -25632,7 +25912,8 @@ ${html ?? ""}`, kind);
     text: t.text,
     html: htmlOf(t.text),
     merge_tags: t.tags,
-    placeholders: [...plan2.cancelUrl ? [] : [CANCEL_URL_PLACEHOLDER], ...t.text.includes(SUPPORT_CONTACT_PLACEHOLDER) ? [SUPPORT_CONTACT_PLACEHOLDER] : []],
+    // Round 32: only the placeholders the template really contains (a cancellation confirmation has no {{cancel_url}}).
+    placeholders: [CANCEL_URL_PLACEHOLDER, SUPPORT_CONTACT_PLACEHOLDER].filter((p) => t.text.includes(p) || t.subject.includes(p)),
     verified: remaining.length === 0,
     remaining_checks: remaining
   };
@@ -26050,6 +26331,7 @@ __export(preflight_exports, {
   PREFLIGHT_DISCLAIMER: () => PREFLIGHT_DISCLAIMER,
   PREFLIGHT_DOCS_URL: () => PREFLIGHT_DOCS_URL,
   PreflightInputError: () => PreflightInputError,
+  SATISFIED_COMPLIANCE: () => SATISFIED_COMPLIANCE,
   STRIPE_HOSTED_STYLING_NOTE: () => STRIPE_HOSTED_STYLING_NOTE,
   checkDisclosure: () => checkDisclosure,
   checkEmail: () => checkEmail,
@@ -26059,6 +26341,7 @@ __export(preflight_exports, {
   checkoutSessionsOf: () => checkoutSessionsOf,
   emailTemplate: () => emailTemplate,
   extractStaticPage: () => extractStaticPage,
+  intervalHintOf: () => intervalHintOf,
   lineItemPriceIds: () => lineItemPriceIds,
   modelCheckoutConfig: () => modelCheckoutConfig,
   modelContext: () => modelContext,
@@ -26066,12 +26349,17 @@ __export(preflight_exports, {
   parseHtml: () => parseHtml,
   parseJurisdictionList: () => parseJurisdictionList,
   paymentLinksOf: () => paymentLinksOf,
+  priceIntervalConflict: () => priceIntervalConflict,
   resolvePlan: () => resolvePlan,
   resolvePriceIds: () => resolvePriceIds,
   runChecks: () => runChecks,
   shapeChecks: () => shapeChecks,
   signupStripeObjects: () => signupStripeObjects,
-  withIntroOffers: () => withIntroOffers
+  stripeParamsVerdict: () => stripeParamsVerdict,
+  supportContactLine: () => supportContactLine,
+  testRunSessionIds: () => testRunSessionIds,
+  withIntroOffers: () => withIntroOffers,
+  withTestRunSessions: () => withTestRunSessions
 });
 var init_preflight = __esm({
   "../rules/src/preflight/index.ts"() {
@@ -26079,6 +26367,8 @@ var init_preflight = __esm({
     init_common();
     init_disclosure();
     init_stripe2();
+    init_price_hint();
+    init_stripe_verdict();
     init_email();
     init_html_page();
     init_page();
@@ -26263,7 +26553,8 @@ var init_check = __esm({
           }
           const hf = str(f, "html-file");
           if (hf) html = await readInput(ctx, hf);
-          if (!subject) throw new UsageError('--subject is required (or a "Subject: \u2026" first line in --file)');
+          if (!subject && html) subject = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html)?.[1]?.replace(/\s+/g, " ").trim() || void 0;
+          if (!subject) throw new UsageError('--subject is required (or a "Subject: \u2026" first line in --file, or an HTML <title>)');
           if (!text && !html) throw new UsageError("Give the email body with --text, --file or --html-file");
           const terms2 = planFrom(f);
           const pp = str(f, "previous-price");
@@ -26425,7 +26716,7 @@ function loadConfig(path) {
 function validateConfig(value) {
   const is = new Issues();
   if (!isObj2(value)) return ["must be a JSON object (see https://checkbox.site/docs/guides/ci#config)"];
-  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "notices", "checks", "coverage"]);
+  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "notices", "merge_tags", "checks", "coverage"]);
   const cov = value.coverage;
   if (cov !== void 0 && cov !== false) {
     if (!isObj2(cov)) is.add("coverage", `must be false or an object like { "ignore": ["scripts/**"] } (got ${show(cov)})`);
@@ -26493,6 +26784,15 @@ function validateConfig(value) {
       }
     }
   }
+  const mergeTags = (at, m2) => {
+    if (m2 === void 0) return;
+    if (!isObj2(m2) || !Object.keys(m2).length) return is.add(at, `must be an object mapping each merge tag to its value, like { "price": "plan.price", "interval": "plan.interval", "first_name": "Sam" } (got ${show(m2)})`);
+    for (const [k, v] of Object.entries(m2)) {
+      if (!/^[A-Za-z_][\w.-]{0,60}$/.test(k)) is.add(`${at}.${k}`, "is not a merge tag name (letters, digits, _ . -; the name inside {{ }})");
+      else if (typeof v !== "string" || v.length > 500) is.add(`${at}.${k}`, `must be a string: a sample value, or one of ${MERGE_TAG_FIELDS.join(", ")} (got ${show(v)})`);
+    }
+  };
+  mergeTags("merge_tags", value.merge_tags);
   const checks = value.checks;
   if (!isObj2(checks)) {
     is.add("checks", checks === void 0 ? "is required (an object with stripe_checkout, disclosures, pages, emails and/or notice_schedule)" : `must be an object (got ${show(checks)})`);
@@ -26577,7 +26877,8 @@ function validateConfig(value) {
   entries(
     "emails",
     (at, e) => {
-      is.keys(at, e, ["name", "plan", "kind", "subject", "file", "text", "html", "module", "args", "previous_price"]);
+      is.keys(at, e, ["name", "plan", "kind", "subject", "file", "text", "html", "module", "args", "previous_price", "merge_tags"]);
+      mergeTags(`${at}.merge_tags`, e.merge_tags);
       is.oneOf(`${at}.kind`, e.kind, EMAIL_KINDS2, true);
       is.exactlyOne(at, e, ["file", "text", "html", "module"], [["text", "html"]]);
       if (e.file !== void 0) {
@@ -26610,7 +26911,7 @@ function entryLine(raw, name) {
   const i = lines.findIndex((l) => needle.test(l));
   return i >= 0 ? i + 1 : 1;
 }
-var CONFIG_FILES, SCHEMA_URL, INTERVALS4, EMAIL_KINDS2, PAGE_KINDS2, ConfigError, isObj2, show, TODO, Issues, PLAN_KEYS;
+var CONFIG_FILES, SCHEMA_URL, INTERVALS4, EMAIL_KINDS2, PAGE_KINDS2, MERGE_TAG_FIELDS, ConfigError, isObj2, show, TODO, Issues, PLAN_KEYS;
 var init_config3 = __esm({
   "src/ci/config.ts"() {
     "use strict";
@@ -26619,6 +26920,7 @@ var init_config3 = __esm({
     INTERVALS4 = ["day", "week", "month", "year"];
     EMAIL_KINDS2 = ["acknowledgment", "trial_reminder", "renewal_reminder", "price_change", "annual_terms", "charge_notice", "cancellation_confirmation"];
     PAGE_KINDS2 = ["checkout", "pricing"];
+    MERGE_TAG_FIELDS = ["plan.price", "plan.amount", "plan.interval", "plan.name", "plan.trial_days", "plan.currency", "merchant.name", "merchant.cancel_url", "merchant.support_contact"];
     ConfigError = class extends Error {
       constructor(file, issues) {
         super(`${file}: ${issues.length === 1 ? issues[0] : `${issues.length} problems:
@@ -26699,8 +27001,8 @@ var init_config3 = __esm({
 });
 
 // src/commands/init/literal.ts
-function parseObjectLiteral(source, env2 = {}) {
-  const p = new Parser(source, env2);
+function parseObjectLiteral(source, env2 = {}, consts = {}) {
+  const p = new Parser(source, env2, consts);
   if (p.peek() !== "{") return { value: null, unresolved: ["<not an object literal>"] };
   const v = p.object("");
   return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {} };
@@ -26710,10 +27012,11 @@ var init_literal = __esm({
   "src/commands/init/literal.ts"() {
     "use strict";
     UNKNOWN = Symbol("unknown");
-    Parser = class {
-      constructor(s2, env2) {
+    Parser = class _Parser {
+      constructor(s2, env2, consts = {}) {
         this.s = s2;
         this.env = env2;
+        this.consts = consts;
       }
       i = 0;
       unresolved = [];
@@ -26803,6 +27106,12 @@ var init_literal = __esm({
           if (name === "false") return false;
           if (name === "null") return null;
           if (name === "undefined") return void 0;
+          if (Object.prototype.hasOwnProperty.call(this.consts, name)) {
+            const sub = new _Parser(this.consts[name], this.env);
+            const v = sub.value("");
+            if (v !== UNKNOWN && v !== void 0 && path) this.fromEnv[path] = name;
+            return v;
+          }
           const env2 = /^(?:process\.env|import\.meta\.env)\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(name);
           if (env2) {
             if (this.env[env2[1]] !== void 0 && path) this.fromEnv[path] = name;
@@ -26965,6 +27274,12 @@ function detectBrand(root, layoutFile, pkgName) {
   }
   return void 0;
 }
+function detectMailer(deps, framework, hasPackageJson) {
+  const found = MAILER_PACKAGES.find((m) => m in deps);
+  if (found) return found;
+  if (!hasPackageJson && framework === "html") return "none";
+  return null;
+}
 function readJson(path) {
   try {
     return JSON.parse(readFileSync5(path, "utf8"));
@@ -27024,12 +27339,49 @@ function walk2(root, visit) {
     }
   }
 }
+function hasAppRouteFile(dir, depth = 0) {
+  if (depth > 3) return false;
+  let names = [];
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return false;
+  }
+  if (names.some((n) => /^(?:page|route|layout)\.(?:tsx|jsx|ts|js|mdx)$/.test(n))) return true;
+  return names.some((n) => !n.startsWith(".") && n !== "node_modules" && (() => {
+    try {
+      return statSync(join4(dir, n)).isDirectory();
+    } catch {
+      return false;
+    }
+  })() && hasAppRouteFile(join4(dir, n), depth + 1));
+}
+function hasTsFiles(dir, depth = 0) {
+  if (depth > 3) return false;
+  let names = [];
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return false;
+  }
+  if (names.some((n) => /\.tsx?$/.test(n))) return true;
+  return names.some((n) => !n.startsWith(".") && (() => {
+    try {
+      return statSync(join4(dir, n)).isDirectory();
+    } catch {
+      return false;
+    }
+  })() && hasTsFiles(join4(dir, n), depth + 1));
+}
 function detectFramework(root, deps) {
   const has2 = (d) => d in deps;
   if (existsSync4(join4(root, "layout", "theme.liquid")) && existsSync4(join4(root, "config", "settings_schema.json"))) return { framework: "shopify-theme", layoutFile: "layout/theme.liquid" };
   if (has2("next")) {
     const app = first(root, ["app/layout.tsx", "app/layout.jsx", "app/layout.js", "app/layout.ts", "src/app/layout.tsx", "src/app/layout.jsx", "src/app/layout.js"]);
     if (app) return { framework: "nextjs-app", layoutFile: app };
+    const appDir = ["src/app", "app"].find((d) => existsSync4(join4(root, d)) && hasAppRouteFile(join4(root, d)));
+    const pagesExists = existsSync4(join4(root, "pages")) || existsSync4(join4(root, "src", "pages"));
+    if (appDir && !pagesExists) return { framework: "nextjs-app", layoutFile: `${appDir}/layout.${existsSync4(join4(root, "tsconfig.json")) || hasTsFiles(join4(root, appDir)) ? "tsx" : "js"}` };
     const doc = first(root, ["pages/_document.tsx", "pages/_document.jsx", "pages/_document.js", "src/pages/_document.tsx", "src/pages/_document.jsx", "src/pages/_document.js"]);
     const pagesDir = existsSync4(join4(root, "src", "pages")) ? "src/pages" : "pages";
     return { framework: "nextjs-pages", layoutFile: doc ?? `${pagesDir}/_document.${existsSync4(join4(root, "tsconfig.json")) ? "tsx" : "js"}` };
@@ -27116,11 +27468,11 @@ function routeOf(rel2) {
   }
   return null;
 }
-function findStripeKey(env2, processEnv) {
+function findStripeKey(env2, processEnv, envFile = {}) {
   const sources = [];
   for (const k of ["CHECKBOX_STRIPE_TEST_KEY", "STRIPE_RESTRICTED_KEY", "STRIPE_TEST_RESTRICTED_KEY", "STRIPE_SECRET_KEY", "STRIPE_TEST_SECRET_KEY", "STRIPE_API_KEY", "STRIPE_SK"]) {
     sources.push([`${k} (environment)`, processEnv[k]]);
-    sources.push([`${k} (.env)`, env2[k]]);
+    sources.push([`${k} (${envFile[k] ?? ".env"})`, env2[k]]);
   }
   const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/.test(s2[1].trim())).map(([src, v]) => [src, v.trim()]);
   const hint = (key) => `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
@@ -27147,7 +27499,13 @@ function sessionLiteral(text, index) {
       else if (ch === quote2) quote2 = null;
       continue;
     }
-    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    if (ch === "/" && text[i + 1] === "/") {
+      const nl = text.indexOf("\n", i);
+      i = nl === -1 ? text.length : nl;
+    } else if (ch === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      i = end === -1 ? text.length : end + 1;
+    } else if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
     else if (ch === "{") depth++;
     else if (ch === "}") {
       depth--;
@@ -27156,17 +27514,73 @@ function sessionLiteral(text, index) {
   }
   return null;
 }
+function declaredExpr(text, from) {
+  let depth = 0;
+  let quote2 = null;
+  for (let i = from; i < text.length && i - from < 2e3; i++) {
+    const ch = text[i];
+    if (quote2) {
+      if (ch === "\\") i++;
+      else if (ch === quote2) quote2 = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") quote2 = ch;
+    else if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") depth--;
+    else if ((ch === ";" || ch === "\n") && depth <= 0) return text.slice(from, i).trim();
+  }
+  return text.slice(from, from + 2e3).trim();
+}
+function constDeclarations(text, exportedOnly) {
+  const out = {};
+  const re = exportedOnly ? /(?:^|\n)[ \t]*export\s+const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g : /(?:^|\n)[ \t]*(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g;
+  for (const m of text.matchAll(re)) if (!(m[1] in out)) out[m[1]] = declaredExpr(text, m.index + m[0].length);
+  return out;
+}
+function resolveImport(root, fromFile, spec) {
+  const dir = fromFile.includes("/") ? fromFile.slice(0, fromFile.lastIndexOf("/")) : "";
+  const bases = spec.startsWith(".") ? [join4(dir, spec)] : /^[@~]\//.test(spec) ? [spec.slice(2), join4("src", spec.slice(2))] : [];
+  for (const b of bases) {
+    const base = b.split("\\").join("/").replace(/\.(?:[cm]?js|jsx)$/, "");
+    for (const f of [b, ...[".ts", ".tsx", ".js", ".mjs", ".jsx", "/index.ts", "/index.js"].map((e) => `${base}${e}`)]) {
+      if (/\.[cm]?[jt]sx?$/.test(f) && existsSync4(join4(root, f))) return f.split("\\").join("/");
+    }
+  }
+  return void 0;
+}
+function constantsFor(root, relFile, text) {
+  const out = {};
+  for (const m of text.matchAll(/import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g)) {
+    const target = resolveImport(root, relFile, m[2]);
+    if (!target) continue;
+    let exported;
+    try {
+      exported = constDeclarations(readFileSync5(join4(root, target), "utf8"), true);
+    } catch {
+      continue;
+    }
+    for (const part of m[1].split(",")) {
+      const [name, alias] = part.trim().split(/\s+as\s+/).map((x) => x.trim());
+      if (name && exported[name] !== void 0) out[alias || name] = exported[name];
+    }
+  }
+  return { ...out, ...constDeclarations(text, false) };
+}
 function detectProject(root, processEnv = {}) {
   const pkg = readJson(join4(root, "package.json"));
   const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
   const { framework, layoutFile } = detectFramework(root, deps);
   const packageManager = existsSync4(join4(root, "pnpm-lock.yaml")) ? "pnpm" : existsSync4(join4(root, "yarn.lock")) ? "yarn" : existsSync4(join4(root, "bun.lockb")) || existsSync4(join4(root, "bun.lock")) ? "bun" : pkg ? "npm" : null;
   const env2 = {};
+  const envFile = {};
   for (const f of [".env", ".env.production", ".env.local", ".env.development", ".env.development.local"]) {
     const t = readText(join4(root, f));
-    if (t) Object.assign(env2, parseDotenv(t));
+    if (!t) continue;
+    const vars = parseDotenv(t);
+    Object.assign(env2, vars);
+    for (const k of Object.keys(vars)) envFile[k] = f;
   }
-  const billingPlatform = "stripe" in deps || "@stripe/stripe-js" in deps || "@stripe/react-stripe-js" in deps ? "stripe" : framework === "shopify-theme" || "@shopify/hydrogen" in deps || "@shopify/shopify-api" in deps ? "shopify" : "@rechargeapps/storefront-client" in deps ? "recharge" : "@paddle/paddle-js" in deps ? "paddle" : "chargebee" in deps ? "chargebee" : "custom";
+  let billingPlatform = "stripe" in deps || "@stripe/stripe-js" in deps || "@stripe/react-stripe-js" in deps ? "stripe" : framework === "shopify-theme" || "@shopify/hydrogen" in deps || "@shopify/shopify-api" in deps ? "shopify" : "@rechargeapps/storefront-client" in deps ? "recharge" : "@paddle/paddle-js" in deps ? "paddle" : "chargebee" in deps ? "chargebee" : "custom";
   const checkoutCode = [];
   const payButtons = [];
   const checkoutSessions = [];
@@ -27192,12 +27606,13 @@ function detectProject(root, processEnv = {}) {
         checkoutSessions.push({ file: rel2, line: line2, unresolved: ["<params are not an object literal>"] });
         continue;
       }
-      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) });
+      const parsed = parseObjectLiteral(lit, { ...env2, ...Object.fromEntries(Object.entries(processEnv).filter((e) => typeof e[1] === "string" && /^(STRIPE_|NEXT_PUBLIC_STRIPE_|PRICE_)/.test(e[0]))) }, constantsFor(root, rel2, text));
       checkoutSessions.push({ file: rel2, line: line2, ...parsed.value ? { params: redactSecretsDeep(parsed.value) } : {}, unresolved: parsed.unresolved });
     }
   });
+  if (billingPlatform === "custom" && checkoutCode.some((c) => c.kind.startsWith("stripe_"))) billingPlatform = "stripe";
   const site = detectSiteUrl(root, env2, pkg);
-  const stripeKey = findStripeKey(env2, processEnv);
+  const stripeKey = findStripeKey(env2, processEnv, envFile);
   const brand = detectBrand(root, layoutFile, typeof pkg?.name === "string" ? pkg.name : void 0);
   return {
     root,
@@ -27218,16 +27633,18 @@ function detectProject(root, processEnv = {}) {
     ...stripeKey.refused ? { stripeKeyRefused: stripeKey.refused } : {},
     ...brand ? { brand } : {},
     plans: plansFromSessions(checkoutSessions),
-    env: env2
+    env: env2,
+    mailer: detectMailer(deps, framework, !!pkg)
   };
 }
-var GENERIC_NAMES, IGNORE_DIRS, CODE_EXT, MAX_FILES, MAX_FILE_BYTES, first, SITE_URL_KEYS, POLICY_ROUTES, CHECKOUT_PATTERNS, PAY_BUTTON;
+var GENERIC_NAMES, MAILER_PACKAGES, IGNORE_DIRS, CODE_EXT, MAX_FILES, MAX_FILE_BYTES, first, SITE_URL_KEYS, POLICY_ROUTES, CHECKOUT_PATTERNS, PAY_BUTTON;
 var init_detect = __esm({
   "src/commands/init/detect.ts"() {
     "use strict";
     init_src2();
     init_literal();
     GENERIC_NAMES = /^(?:web|app|site|website|frontend|client|my-app|my-site|demo|example|store|shop|starter|template|project|monorepo|root)$/i;
+    MAILER_PACKAGES = ["nodemailer", "resend", "@sendgrid/mail", "postmark", "mailgun.js", "mailgun-js", "@aws-sdk/client-ses", "@aws-sdk/client-sesv2", "@react-email/components", "react-email", "@mailchimp/mailchimp_transactional", "mailersend", "@sparkpost/node", "sparkpost", "emailjs", "@emailjs/browser", "loops", "plunk", "@plunk/node", "brevo", "@getbrevo/brevo", "sib-api-v3-sdk", "nodemailer-mailgun-transport", "@vercel/email"];
     IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "dist", "build", "out", "coverage", ".astro", "vendor", ".venv", "__pycache__"]);
     CODE_EXT = /\.(?:[cm]?[jt]sx?|vue|svelte|astro|liquid|html|ejs|hbs|erb)$/i;
     MAX_FILES = 4e3;
@@ -27243,6 +27660,7 @@ var init_detect = __esm({
     CHECKOUT_PATTERNS = [
       { kind: "stripe_checkout_session", re: /checkout\.sessions\.create\s*\(/ },
       { kind: "stripe_payment_link", re: /paymentLinks\.create\s*\(|https:\/\/buy\.stripe\.com\// },
+      { kind: "stripe_checkout_link", re: /https:\/\/checkout\.stripe\.com\// },
       { kind: "stripe_pricing_table", re: /<stripe-pricing-table\b/ },
       { kind: "stripe_subscription_api", re: /subscriptions\.create\s*\(/ },
       { kind: "stripe_elements", re: /<(PaymentElement|CardElement|ExpressCheckoutElement)\b|elements\.create\(\s*['"]payment['"]/ },
@@ -27257,6 +27675,47 @@ var init_detect = __esm({
 // src/ci/scaffold.ts
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
 import { basename, dirname as dirname4, join as join5, relative as relative2 } from "node:path";
+function countTodoValues(v) {
+  if (typeof v === "string") return /^TODO\b/.test(v) ? 1 : 0;
+  if (Array.isArray(v)) return v.reduce((n, x) => n + countTodoValues(x), 0);
+  if (v && typeof v === "object") return Object.values(v).reduce((n, x) => n + countTodoValues(x), 0);
+  return 0;
+}
+function mergeTagsIn(text) {
+  const out = [];
+  for (const m of text.matchAll(/\{\{\{?\s*([A-Za-z_][\w.-]*)\s*\}?\}\}|\*\|([A-Za-z_][\w.-]*)\|\*/g)) {
+    const t = m[1] ?? m[2];
+    if (!out.includes(t)) out.push(t);
+  }
+  return out;
+}
+function mergeTagField(tag) {
+  const t = tag.toLowerCase().replace(/[.-]/g, "_").replace(/^(?:subscription|sub)_/, "");
+  if (/^(?:plan_)?(?:price|amount|cost|recurring_price|price_formatted|formatted_price|renewal_price|renewal_amount)$/.test(t)) return "plan.price";
+  if (/^(?:plan_)?(?:interval|billing_interval|period|billing_period|frequency|billing_cycle|cycle|interval_name)$/.test(t)) return "plan.interval";
+  if (/^(?:plan|plan_name|product|product_name|plan_title|tier)$/.test(t)) return "plan.name";
+  if (/^(?:plan_)?(?:trial_days|trial_length|trial_period_days)$/.test(t)) return "plan.trial_days";
+  if (/^(?:cancel_url|cancellation_url|manage_url|billing_url|account_url|cancel_link)$/.test(t)) return "merchant.cancel_url";
+  if (/^(?:company|company_name|merchant|merchant_name|brand|brand_name|business_name|app_name)$/.test(t)) return "merchant.name";
+  if (/^(?:support_email|support_contact|support|help_email|contact_email)$/.test(t)) return "merchant.support_contact";
+  return void 0;
+}
+function pageSources(root) {
+  const out = [];
+  walk3(root, (rel2) => {
+    if (out.length >= 4) return;
+    let m = /^(?:src\/)?app\/((?:\([^/]+\)\/)*)([^/()]+)\/page\.(?:tsx|jsx|ts|js|mdx)$/.exec(rel2);
+    if (m && PAGE_ROUTE.test(m[2])) {
+      out.push({ source: rel2, file: `.next/server/app/${m[2]}.html`, route: m[2] });
+      return;
+    }
+    m = /^(?:src\/)?pages\/([^/]+?)(?:\/index)?\.(tsx|jsx|ts|js|astro)$/.exec(rel2);
+    if (m && PAGE_ROUTE.test(m[1])) {
+      out.push({ source: rel2, file: m[2] === "astro" ? `dist/${m[1]}/index.html` : `.next/server/pages/${m[1]}.html`, route: m[1] });
+    }
+  });
+  return out;
+}
 function walk3(root, visit) {
   let n = 0;
   const go = (dir, depth) => {
@@ -27306,7 +27765,8 @@ function plansFromLiterals(text, file) {
     const trial = /\btrial(?:_period)?_?days\s*:\s*(\d+)/i.exec(body)?.[1];
     if (out.some((p) => p.name === name)) continue;
     const key = m[1]?.trim() && /^[A-Za-z_$][\w$]*$/.test(m[1].trim()) ? m[1].trim() : void 0;
-    out.push({ name, ...key ? { key } : {}, price: major, currency, interval, ...count && Number(count) > 1 ? { interval_count: Number(count) } : {}, ...trial && Number(trial) > 0 ? { trial_days: Number(trial) } : {}, source: file });
+    const ids = [...new Set([...body.matchAll(/['"`](price_[A-Za-z0-9_]+)['"`]/g)].map((x) => x[1]))];
+    out.push({ name, ...key ? { key } : {}, price: major, currency, interval, ...count && Number(count) > 1 ? { interval_count: Number(count) } : {}, ...trial && Number(trial) > 0 ? { trial_days: Number(trial) } : {}, ...ids.length ? { price_ids: ids } : {}, source: file });
   }
   return out;
 }
@@ -27330,10 +27790,111 @@ function paramsBuilder(root, file, line2) {
   } else if (new RegExp(`export\\s+(?:async\\s+)?function\\s+${fn}\\b|export\\s+const\\s+${fn}\\b`).test(text)) target = file;
   return target ? { module: `${target}#${fn}`, takesArgs } : void 0;
 }
+function plansSoldBy(params, plans) {
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const out = [];
+  for (const li of items) {
+    const pd = li?.price_data;
+    if (!pd || typeof pd.unit_amount !== "number") continue;
+    const match = plans.find((p) => (typeof p.amount === "number" ? p.amount : typeof p.price === "number" ? Math.round(p.price * 100) : NaN) === pd.unit_amount && p.interval === pd.recurring?.interval);
+    if (match && !out.includes(match)) out.push(match);
+  }
+  return out;
+}
+function cancelUrlInCode(sessions) {
+  const urls = /* @__PURE__ */ new Set();
+  for (const s2 of sessions) {
+    const text = JSON.stringify(s2.params?.custom_text ?? "");
+    for (const m of text.matchAll(/cancel[^"]{0,80}?(https:\/\/[^\s"'<>)]+?)(?=[.,;:!?]?(?:[\s"'<>)]|$))/gi)) urls.add(m[1]);
+  }
+  return urls.size === 1 ? [...urls][0] : void 0;
+}
+function pageSource(root, built) {
+  const route = /(?:^|\/)(?:public|dist|out|build|static|_site|www)\/(?:(.*)\/)?([^/]+?)(?:\/index)?\.html?$/i.exec(built);
+  if (!route) return void 0;
+  const path = [route[1], route[2]].filter(Boolean).join("/");
+  const bases = [`app/${path}/page`, `src/app/${path}/page`, `app/(marketing)/${path}/page`, `pages/${path}`, `src/pages/${path}`, `src/routes/${path}/+page`, `pages/${path}/index`, `src/pages/${path}/index`];
+  const hits = bases.flatMap((b) => [".tsx", ".jsx", ".ts", ".js", ".svelte", ".vue", ".astro", ".mdx"].map((e) => `${b}${e}`)).filter((f) => existsSync5(join5(root, f)));
+  return hits.length === 1 ? hits[0] : void 0;
+}
+function priceExpressions(root, file, line2) {
+  let text;
+  try {
+    text = readFileSync6(join5(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const from = text.split("\n").slice(line2 - 1).join("\n");
+  const at = from.search(/checkout\.sessions\.create|paymentLinks\.create/);
+  const open2 = at < 0 ? -1 : from.indexOf("(", at);
+  if (open2 < 0) return [];
+  let depth = 0;
+  let end = from.length;
+  for (let i = open2; i < from.length; i++) {
+    const c = from[i];
+    if (c === "(" || c === "{" || c === "[") depth++;
+    else if (c === ")" || c === "}" || c === "]") {
+      depth--;
+      if (depth === 0) {
+        end = i;
+        break;
+      }
+    }
+  }
+  const call = from.slice(open2, end);
+  const li = call.indexOf("line_items");
+  if (li < 0) return [];
+  const items = call.slice(li);
+  const out = [];
+  for (const m of items.matchAll(/\bprice\s*:\s*/g)) {
+    let d = 0;
+    let j = m.index + m[0].length;
+    const start = j;
+    for (; j < items.length; j++) {
+      const c = items[j];
+      if (c === "(" || c === "{" || c === "[") d++;
+      else if (c === ")" || c === "}" || c === "]") {
+        if (d === 0) break;
+        d--;
+      } else if ((c === "," || c === "\n") && d === 0) break;
+    }
+    const expr = items.slice(start, j).trim();
+    if (expr) out.push(expr);
+    if (out.length >= 5) break;
+  }
+  return out;
+}
+function pairCall(root, s2, plans, priceIds, calls) {
+  if (plans.length === 1) return { plan: String(plans[0].name) };
+  if (!plans.length || plans.some((p) => String(p.name).startsWith("TODO"))) return {};
+  const sold = s2.params ? plansSoldBy(s2.params, plans) : [];
+  if (sold.length === 1) return { plan: String(sold[0].name) };
+  const items = Array.isArray(s2.params?.line_items) ? s2.params.line_items : [];
+  const literalIds = items.map((li) => li && typeof li.price === "string" ? li.price : void 0).filter((x) => !!x);
+  const exprs = priceExpressions(root, s2.file, s2.line).filter((e) => !/^['"`][^'"`]*['"`]$/.test(e));
+  for (const id of literalIds) {
+    const owner = plans.filter((p) => priceIds.get(String(p.name))?.includes(id));
+    if (owner.length === 1) return { plan: String(owner[0].name), why: `${id} is the Price id of that plan in the plans module` };
+  }
+  const runtime = exprs.find((e) => /\?|\|\||&&|\[[^\]'"`]*\]|\(/.test(e));
+  if (runtime && !literalIds.length) return calls === 1 ? { several: true } : { ref: runtime };
+  for (const ref of [...literalIds, ...exprs]) {
+    const hint = intervalHintOf(ref);
+    if (!hint) continue;
+    const match = plans.filter((p) => {
+      const count = Number(p.interval_count ?? 1) || 1;
+      const unit2 = p.interval === "month" && count === 12 ? "year" : count === 1 ? p.interval : void 0;
+      return unit2 === hint;
+    });
+    if (match.length === 1) return { plan: String(match[0].name), why: `its Price ${ref} is named for a ${hint === "day" ? "dai" : hint}ly price; check this is the plan it sells` };
+  }
+  return { ref: literalIds[0] ?? exprs[0] };
+}
 function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
   const found = [];
+  const notes2 = [];
   const names = /* @__PURE__ */ new Set();
   const merchant = {};
   const fact = (k) => typeof facts[k] === "string" && facts[k].trim() ? facts[k].trim() : void 0;
@@ -27348,13 +27909,34 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     merchant.cancel_url = cancelFact;
     found.push(`cancel URL ${cancelFact} (from checkbox init)`);
   } else if (siteUrl && cancelPath) merchant.cancel_url = `${originOf(siteUrl)}${cancelPath}`;
-  else {
+  else if (cancelUrlInCode(det.checkoutSessions)) {
+    merchant.cancel_url = cancelUrlInCode(det.checkoutSessions);
+    found.push(`cancel URL ${String(merchant.cancel_url)} (from the Checkout custom_text)`);
+  } else {
     merchant.cancel_url = "TODO: https://\u2026 page where subscribers cancel online";
     todos.push("merchant.cancel_url: the page where subscribers cancel online");
   }
   if (fact("support_email")) merchant.support_contact = fact("support_email");
+  const initPlans = Array.isArray(facts.plans) ? facts.plans : [];
+  const initName = (p) => {
+    const m = initPlans.find((x) => typeof x.name === "string" && x.amount === p.amount && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (p.interval_count ?? 1));
+    return m ? String(m.name) : void 0;
+  };
+  const literals = [];
+  walk3(root, (rel2) => {
+    if (!PLAN_FILE.test(rel2) || literals.length >= 8) return;
+    let text = "";
+    try {
+      text = readFileSync6(join5(root, rel2), "utf8");
+    } catch {
+      return;
+    }
+    for (const p of plansFromLiterals(text, rel2)) if (!literals.some((x) => x.name === p.name)) literals.push(p);
+  });
+  const minorOf = (p) => typeof p.amount === "number" ? p.amount : typeof p.price === "number" ? Math.round(p.price * 100) : NaN;
+  const literalFor = (p) => literals.find((x) => Math.round(x.price * 100) === minorOf(p) && x.interval === p.interval && (x.interval_count ?? 1) === (Number(p.interval_count ?? 1) || 1));
   const plans = det.plans.map((p, i) => ({
-    name: p.name ?? `Plan ${i + 1}`,
+    name: p.name ?? initName(p) ?? literalFor(p)?.name ?? `Plan ${i + 1}`,
     amount: p.amount,
     currency: p.currency,
     interval: p.interval,
@@ -27362,39 +27944,41 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     ...p.trial_days ? { trial_days: p.trial_days } : {}
   }));
   for (const p of det.plans) found.push(`plan ${p.name ?? ""} ${p.amount / 100} ${p.currency}/${p.interval} (${p.source})`.replace(/\s+/g, " "));
-  const planKeys = /* @__PURE__ */ new Map();
   if (!plans.length && Array.isArray(facts.plans)) {
     for (const [i, p] of facts.plans.entries()) {
       if (typeof p.amount !== "number" || typeof p.interval !== "string") continue;
-      plans.push({ name: typeof p.name === "string" ? p.name : `Plan ${i + 1}`, amount: p.amount, currency: typeof p.currency === "string" ? p.currency : "usd", interval: p.interval, ...typeof p.interval_count === "number" ? { interval_count: p.interval_count } : {}, ...typeof p.trial_days === "number" ? { trial_days: p.trial_days } : {} });
+      plans.push({ name: typeof p.name === "string" && p.name.trim() ? p.name : literalFor(p)?.name ?? `Plan ${i + 1}`, amount: p.amount, currency: typeof p.currency === "string" ? p.currency : "usd", interval: p.interval, ...typeof p.interval_count === "number" ? { interval_count: p.interval_count } : {}, ...typeof p.trial_days === "number" ? { trial_days: p.trial_days } : {} });
       found.push(`plan ${String(plans[plans.length - 1].name)} (from checkbox init --plan)`);
     }
   }
   if (!plans.length) {
-    walk3(root, (rel2) => {
-      if (!PLAN_FILE.test(rel2) || plans.length >= 8) return;
-      let text = "";
-      try {
-        text = readFileSync6(join5(root, rel2), "utf8");
-      } catch {
-        return;
-      }
-      for (const p of plansFromLiterals(text, rel2)) {
-        if (plans.some((x) => x.name === p.name)) continue;
-        const { source, key, ...plan2 } = p;
-        plans.push(plan2);
-        if (key) planKeys.set(p.name, key);
-        found.push(`plan ${p.name} ${p.price} ${p.currency}/${p.interval} (${source})`);
-      }
-    });
+    for (const p of literals) {
+      const { source, key: _key, price_ids: _ids, ...plan2 } = p;
+      plans.push(plan2);
+      found.push(`plan ${p.name} ${p.price} ${p.currency}/${p.interval} (${source})`);
+    }
+  }
+  const planKeys = /* @__PURE__ */ new Map();
+  const planPriceIds = /* @__PURE__ */ new Map();
+  for (const p of plans) {
+    const lit = literals.find((x) => x.name === p.name) ?? literalFor(p);
+    if (lit?.key) planKeys.set(String(p.name), lit.key);
+    if (lit?.price_ids?.length) planPriceIds.set(String(p.name), lit.price_ids);
+    const known = initPlans.find((x) => Array.isArray(x.stripe_price_ids) && minorOf(x) === minorOf(p) && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (Number(p.interval_count ?? 1) || 1));
+    if (known) planPriceIds.set(String(p.name), [...planPriceIds.get(String(p.name)) ?? [], ...known.stripe_price_ids]);
   }
   if (!plans.length) {
     plans.push({ name: "TODO: plan name", price: "TODO: e.g. 19.99", currency: "usd", interval: "month" });
     todos.push("plans: the price, interval and trial of each plan (the checkout uses Price ids, which cannot be read from code)");
   }
   const planNames = plans.map((p) => String(p.name));
-  const planFor = () => plans.length > 1 ? { plan: `TODO: one of ${planNames.map((n) => JSON.stringify(n)).join(", ")}` } : {};
-  if (plans.length > 1) todos.push("plan: pick the plan of each disclosure, page and email entry");
+  const oneOf = planNames.map((n) => JSON.stringify(n)).join(", ");
+  let planTodo = false;
+  const planFor = (kind = "entry") => {
+    if (plans.length <= 1) return {};
+    planTodo = true;
+    return { plan: kind === "page" ? `TODO: "all" (the page shows every plan) or one of ${oneOf}` : `TODO: one of ${oneOf}` };
+  };
   const stripe = [];
   const perFile = /* @__PURE__ */ new Map();
   for (const s2 of det.checkoutSessions) {
@@ -27425,7 +28009,21 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
     else found.push(`${s2.file}:${s2.line}: Checkout Session`);
     entry.strict = true;
-    stripe.push(entry);
+    const pair = pairCall(root, s2, plans, planPriceIds, det.checkoutSessions.length);
+    if (pair.plan) {
+      if (plans.length > 1) {
+        names.delete(String(entry.name));
+        entry.name = unique(names, `${String(entry.name).replace(/\)$/, "")}: ${pair.plan})`);
+      }
+      stripe.push({ ...entry, plan: pair.plan });
+      if (pair.why) found.push(`${s2.file}:${s2.line}: sells plan "${pair.plan}" (${pair.why})`);
+    } else if (pair.several) {
+      for (const p of plans) stripe.push({ ...entry, name: unique(names, `${String(entry.name).replace(/\)$/, "")}: ${String(p.name)})`), plan: String(p.name) });
+      names.delete(String(entry.name));
+    } else if (plans.length > 1 && !plans.some((p) => String(p.name).startsWith("TODO"))) {
+      stripe.push({ ...entry, plan: `TODO: which plan does this call sell? one of ${oneOf}` });
+      todos.push(`${s2.file}:${s2.line}: which plan this Checkout call sells ("plan"); Checkbox could not tell from its Price id${pair.ref ? ` (${pair.ref})` : ""}`);
+    } else stripe.push(entry);
   }
   const emails = [];
   const pages = [];
@@ -27434,18 +28032,29 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     if (IN_EMAIL_DIR.test(rel2)) {
       const kind = emailKindOf(rel2);
       if (/\.(?:html?|txt|md)$/i.test(rel2) && kind) {
-        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...planFor() });
-        found.push(`${rel2}: ${kind} email`);
+        let text = "";
+        try {
+          text = readFileSync6(join5(root, rel2), "utf8");
+        } catch {
+        }
+        const tags = Object.fromEntries(mergeTagsIn(text).flatMap((t) => mergeTagField(t) ? [[t, mergeTagField(t)]] : []));
+        const planTagged = Object.values(tags).some((v) => v.startsWith("plan."));
+        const hint = intervalHintOf(basename(rel2).replace(/\.[^.]+$/, ""));
+        const byName = hint && plans.length > 1 ? plans.filter((p) => p.interval === hint && (Number(p.interval_count ?? 1) || 1) === 1) : [];
+        const plan2 = plans.length > 1 && planTagged ? { plan: "all" } : byName.length === 1 ? { plan: String(byName[0].name) } : planFor();
+        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...plan2, ...Object.keys(tags).length ? { merge_tags: tags } : {} });
+        found.push(`${rel2}: ${kind} email${Object.keys(tags).length ? ` (its merge tags ${Object.keys(tags).map((t) => `{{${t}}}`).join(", ")} are filled from checkbox.json: see "merge_tags")` : ""}`);
         return;
       }
       if (/\.[jt]sx$|\.mjml$/i.test(rel2) && kind) {
-        todos.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
+        notes2.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
         return;
       }
     }
     if (PAGE_FILE.test(rel2)) {
       const kind = /checkout|subscribe/i.test(rel2) ? "checkout" : "pricing";
-      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor() });
+      const src = pageSource(root, rel2);
+      pages.push({ name: unique(names, `Page: ${rel2}`), file: rel2, kind, ...planFor("page"), ...src ? { source: src } : {} });
       found.push(`${rel2}: ${kind} page`);
       return;
     }
@@ -27462,9 +28071,24 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
       }
     }
   });
-  if (!disclosures.length && det.payButtons.length) {
-    todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
+  for (const ps of pageSources(root)) {
+    if (pages.some((p) => p.source === ps.source || p.file === ps.file)) continue;
+    let text = "";
+    try {
+      text = readFileSync6(join5(root, ps.source), "utf8");
+    } catch {
+    }
+    const kind = /checkout|subscribe/i.test(ps.route) ? "checkout" : "pricing";
+    const shows = (p) => text.includes(String(p.name)) || typeof p.price === "number" && text.includes(`$${p.price}`) || typeof p.amount === "number" && text.includes(`$${p.amount / 100}`);
+    const showsAll = plans.length > 1 && plans.every(shows);
+    pages.push({ name: unique(names, `Page: ${ps.route}`), file: ps.file, source: ps.source, kind, ...showsAll ? { plan: "all" } : planFor("page") });
+    found.push(`${ps.source}: ${kind} page (checked as the built ${ps.file}; the workflow builds it first)`);
+  }
+  const inPages = (f) => pages.some((p) => p.source === f);
+  if (!disclosures.length && det.payButtons.length && !det.payButtons.some((b) => inPages(b.file))) {
+    notes2.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
   }
+  if (planTodo) todos.push('plan: pick the plan of each disclosure, page and email entry marked TODO ("all" for a page that shows every plan)');
   const checks = {};
   if (stripe.length) checks.stripe_checkout = stripe;
   if (disclosures.length) checks.disclosures = disclosures;
@@ -27472,20 +28096,24 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
   if (emails.length) checks.emails = emails;
   checks.notice_schedule = true;
   if (!stripe.length && !disclosures.length && !pages.length && !emails.length) {
-    todos.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
+    notes2.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
   }
   return {
     config: { $schema: SCHEMA_URL, merchant, jurisdictions: "all", plans, checks },
     todos,
-    found
+    found,
+    notes: notes2,
+    todoValues: countTodoValues({ merchant, plans, checks })
   };
 }
-var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
+var PAGE_ROUTE, IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
 var init_scaffold = __esm({
   "src/ci/scaffold.ts"() {
     "use strict";
     init_detect();
+    init_preflight();
     init_config3();
+    PAGE_ROUTE = /^(pricing|checkout|subscribe|plans)$/i;
     IGNORE = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "coverage", ".astro", "vendor", ".venv", "__pycache__", ".github"]);
     MAX_FILES2 = 5e3;
     EMAIL_NAMES = [
@@ -27737,7 +28365,7 @@ function moduleErrorMessage(stderr, dir, flags = []) {
   const first2 = lines.find((l) => /^(?:[A-Z]\w*)?Error\b.*:/.test(l)) ?? lines.find((l) => /error/i.test(l)) ?? lines[lines.length - 1] ?? "";
   return first2.replace(/file:\/\/\S+/g, (u) => rel2(u)).replace(/\s+/g, " ").slice(0, 400);
 }
-function paramsFromSource(text, file, call = 1, env2 = {}) {
+function paramsFromSource(text, file, call = 1, env2 = {}, consts = {}) {
   const calls = [...text.matchAll(/checkout\.sessions\.create\s*\(/g)];
   if (!calls.length) throw new InputError(`${file} has no stripe.checkout.sessions.create( call`);
   const m = calls[call - 1];
@@ -27745,7 +28373,7 @@ function paramsFromSource(text, file, call = 1, env2 = {}) {
   const line2 = text.slice(0, m.index).split("\n").length;
   const lit = sessionLiteral(text, m.index + m[0].length);
   if (!lit) throw new InputError(`${file}:${line2}: the params are not an object literal; use "module" (a function returning the params) or "file" instead`);
-  const parsed = parseObjectLiteral(lit, env2);
+  const parsed = parseObjectLiteral(lit, env2, consts);
   if (!parsed.value) throw new InputError(`${file}:${line2}: could not read the params object`);
   return { params: parsed.value, line: line2, unresolved: parsed.unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
 }
@@ -27849,7 +28477,8 @@ async function stripeJob(loaded, e, o, root) {
     } else {
       const src = e.source;
       job.inputs.push(src);
-      const r = paramsFromSource(readRel(dir, src), src, e.call ?? 1, projectEnv(dir));
+      const srcText = readRel(dir, src);
+      const r = paramsFromSource(srcText, src, e.call ?? 1, projectEnv(dir), constantsFor(dir, src, srcText));
       job.target = { file: rel(loaded, root, src), line: r.line };
       job.fromSource = true;
       params = r.params;
@@ -27861,9 +28490,16 @@ async function stripeJob(loaded, e, o, root) {
       }
     }
     if (!params || typeof params !== "object" || Array.isArray(params)) throw new InputError("the Checkout Session params must be a JSON object");
+    const items0 = Array.isArray(params.line_items) ? params.line_items : [];
+    if (!e.plan && (config.plans?.length ?? 0) > 1 && !items0.some((li) => li && typeof li === "object" && li.price_data)) {
+      throw new InputError(`"${e.name}" does not say which plan it sells, and its price is a Price id or an expression Checkbox cannot read: add "plan": one of ${(config.plans ?? []).map((p) => JSON.stringify(p.name)).join(", ")} to this entry (one entry per plan when one call serves several plans).`);
+    }
     const merchant = planTerms(config, pickPlan(config, e.plan));
     const drift = planDrift(params, pickPlan(config, e.plan));
     if (drift) job.warnings.push(drift);
+    const soldPlan = pickPlan(config, e.plan);
+    const overrides = soldPlan ? planAsSold(params, soldPlan) : void 0;
+    if (soldPlan && overrides) job.sold = { plan: soldPlan.name, overrides };
     const items = Array.isArray(params.line_items) ? params.line_items : [];
     if (items.length && items.every((li) => li && typeof li === "object" && li.price_data)) for (const k of ["price", "amount", "currency", "interval", "interval_count"]) delete merchant[k];
     job.body = { params, ...Object.keys(merchant).length ? { merchant } : {}, ...jurisdictionsOf(config) };
@@ -27872,6 +28508,29 @@ async function stripeJob(loaded, e, o, root) {
   }
   return job;
 }
+function planAsSold(params, plan2) {
+  const sd = params.subscription_data ?? {};
+  const trial = typeof sd.trial_period_days === "number" ? sd.trial_period_days : void 0;
+  const out = {};
+  if (trial !== void 0 && trial !== (plan2.trial_days ?? 0)) out.trial_days = trial;
+  if (trial === void 0 && plan2.trial_days && plan2.trial_days > 0 && sd.trial_end === void 0) out.trial_days = 0;
+  const items = Array.isArray(params.line_items) ? params.line_items : [];
+  const pd = items.map((li) => li && typeof li === "object" ? li.price_data : void 0).find((x) => x && typeof x === "object");
+  const rec = pd && typeof pd.recurring === "object" ? pd.recurring : void 0;
+  if (rec && typeof rec.interval === "string" && rec.interval !== plan2.interval && ["day", "week", "month", "year"].includes(rec.interval)) out.interval = rec.interval;
+  const price3 = typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
+    out.price = pd.unit_amount / 100;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+function describeSold(o) {
+  const parts = [];
+  if (o.trial_days !== void 0) parts.push(o.trial_days ? `a ${o.trial_days}-day trial` : "no trial");
+  const charge = [o.price !== void 0 ? Number(o.price).toFixed(2) : "", o.interval ? `every ${o.interval}` : ""].filter(Boolean).join(" ");
+  if (charge) parts.push(charge);
+  return parts.join(", ");
+}
 function planDrift(params, plan2) {
   if (!plan2) return void 0;
   const sd = params.subscription_data ?? {};
@@ -27887,7 +28546,7 @@ function planDrift(params, plan2) {
   if (pd && typeof pd.unit_amount === "number" && price3 !== void 0 && /^(?:usd|eur|gbp|cad|aud|nzd)$/i.test(String(pd.currency ?? plan2.currency ?? "usd")) && (!pd.currency || pd.currency === (plan2.currency ?? "usd")) && Math.abs(pd.unit_amount - Math.round(price3 * 100)) >= 1) {
     out.push(`the params charge ${(pd.unit_amount / 100).toFixed(2)}, plan "${plan2.name}" ${price3.toFixed(2)}`);
   }
-  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The checks use the params; update "plans" in checkbox.json so the required emails and pages are checked for the plan you really sell.` : void 0;
+  return out.length ? `The params and checkbox.json disagree: ${out.join("; ")}. The Checkout check uses the params, and the emails, pages and disclosures of plan "${plan2.name}" are checked against both until they agree: update "plans" in checkbox.json to the plan you really sell.` : void 0;
 }
 function disclosureJob(loaded, e, root) {
   const { config, dir } = loaded;
@@ -27960,6 +28619,53 @@ function pageJob(loaded, e, o, root) {
   }
   return job;
 }
+function planMoney(plan2) {
+  if (!plan2) return void 0;
+  const cur = (plan2.currency ?? "usd").toUpperCase();
+  const major = typeof plan2.amount === "number" ? plan2.amount / 100 : typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (major === void 0) return void 0;
+  try {
+    return new Intl.NumberFormat("en-US", { style: "currency", currency: cur }).format(major);
+  } catch {
+    return `${major.toFixed(2)} ${cur}`;
+  }
+}
+function fillMergeTags(msg2, tags, config, plan2) {
+  const field = (v) => {
+    if (!MERGE_TAG_FIELDS.includes(v)) return v;
+    switch (v) {
+      case "plan.price":
+      case "plan.amount":
+        return planMoney(plan2);
+      case "plan.interval":
+        return plan2 ? (plan2.interval_count ?? 1) > 1 ? `${plan2.interval_count} ${plan2.interval}s` : plan2.interval : void 0;
+      case "plan.name":
+        return plan2?.name;
+      case "plan.trial_days":
+        return plan2?.trial_days !== void 0 ? String(plan2.trial_days) : void 0;
+      case "plan.currency":
+        return (plan2?.currency ?? "usd").toUpperCase();
+      case "merchant.name":
+        return config.merchant?.name;
+      case "merchant.cancel_url":
+        return config.merchant?.cancel_url;
+      case "merchant.support_contact":
+        return config.merchant?.support_contact;
+    }
+    return void 0;
+  };
+  const values = /* @__PURE__ */ new Map();
+  for (const [k, v] of Object.entries(tags)) {
+    const val = field(v);
+    if (val !== void 0) values.set(k.toLowerCase(), val);
+  }
+  const esc3 = (t) => t.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  const fill2 = (t, html) => t?.replace(/\{\{\{\s*([\w.-]+)\s*\}\}\}|\{\{\s*([\w.-]+)\s*\}\}|\*\|([\w.-]+)\|\*/g, (m, a, b, c) => {
+    const v = values.get(String(a ?? b ?? c).toLowerCase());
+    return v === void 0 ? m : html ? esc3(v) : v;
+  });
+  return { ...msg2.subject !== void 0 ? { subject: fill2(msg2.subject, false) } : {}, ...msg2.text !== void 0 ? { text: fill2(msg2.text, false) } : {}, ...msg2.html !== void 0 ? { html: fill2(msg2.html, true) } : {} };
+}
 async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
   const { config, dir } = loaded;
   const job = { name, type: "email", ...planName ? { plan: planName } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
@@ -27980,6 +28686,8 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
         msg2 = { ...typeof r.subject === "string" ? { subject: r.subject } : e.subject ? { subject: e.subject } : {}, ...typeof r.text === "string" ? { text: r.text } : {}, ...typeof r.html === "string" ? { html: r.html } : {} };
       } else throw new InputError(`${e.module} must return { subject, text | html } or a string`);
     } else msg2 = { subject: e.subject, ...e.text ? { text: e.text } : {}, ...e.html ? { html: e.html } : {} };
+    const tags = { ...config.merge_tags ?? {}, ...e.merge_tags ?? {} };
+    if (Object.keys(tags).length) msg2 = fillMergeTags(msg2, tags, config, pickPlan(config, planName));
     if (!msg2.subject) throw new InputError(`no subject: add "subject" to the entry, a first line "Subject: \u2026" to the file, or an HTML <title>`);
     if (!msg2.text && !msg2.html) throw new InputError("the email body is empty");
     const terms2 = { ...planTerms(config, pickPlan(config, planName)) };
@@ -27993,9 +28701,35 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
 }
 async function resolveJobs(loaded, o) {
   const root = o.root ?? loaded.dir;
+  const jobs = [];
+  for (const e of loaded.config.checks.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
+  const dependent = await planJobs(loaded, o, root);
+  jobs.push(...dependent);
+  const seen = /* @__PURE__ */ new Set();
+  for (const sj of jobs.filter((j) => j.type === "stripe_checkout" && j.sold)) {
+    const key = JSON.stringify(sj.sold);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const { plan: planName, overrides } = sj.sold;
+    const config = { ...loaded.config, plans: (loaded.config.plans ?? []).map((p) => p.name === planName ? { ...p, ...overrides } : p) };
+    const variant = await planJobs({ ...loaded, config }, o, root);
+    const sold = describeSold(overrides);
+    variant.forEach((v, i) => {
+      const orig = dependent[i];
+      if (orig.error || orig.skip || !v.body || JSON.stringify(v.body) === JSON.stringify(orig.body)) return;
+      jobs.push({
+        ...v,
+        name: `${orig.name} (as "${sj.name}" sells it: ${sold})`,
+        inputs: [.../* @__PURE__ */ new Set([...v.inputs, ...sj.inputs])],
+        warnings: [`The params and checkbox.json disagree: "${sj.name}" sells plan "${planName}" with ${sold}, which checkbox.json does not say. This check judges ${orig.name} against what the params sell; the same check against checkbox.json runs too, and both must pass. Update "plans" in checkbox.json (or the params) so they agree.`, ...v.warnings]
+      });
+    });
+  }
+  return jobs;
+}
+async function planJobs(loaded, o, root) {
   const c = loaded.config.checks;
   const jobs = [];
-  for (const e of c.stripe_checkout ?? []) jobs.push(await stripeJob(loaded, e, o, root));
   for (const e of c.disclosures ?? []) jobs.push(disclosureJob(loaded, e, root));
   for (const e of c.pages ?? []) jobs.push(pageJob(loaded, e, o, root));
   for (const e of c.emails ?? []) {
@@ -28379,6 +29113,7 @@ var init_timing = __esm({
 var notice_schedule_exports = {};
 __export(notice_schedule_exports, {
   computeNoticeSchedule: () => computeNoticeSchedule,
+  noticesKindsNote: () => noticesKindsNote,
   singleDayNote: () => singleDayNote
 });
 function singleDayNote(requirementIds, days) {
@@ -28487,7 +29222,12 @@ function computeNoticeSchedule(input, now = /* @__PURE__ */ new Date()) {
     if (t.governed) push("annual_terms", termMonths2 >= 12 ? "Yearly terms reminder (first anniversary; the renewal reminder can carry it)" : "Yearly terms reminder (first anniversary)", anniversary, t);
     else notRequired.push({ kind: "annual_terms", reason: "No applicable requirement demands a yearly terms reminder under these jurisdictions." });
   }
-  if (!input.price_change) {
+  if (!input.price_change && plan2.introAmount !== void 0 && plan2.introAmount < plan2.amount) {
+    const stepUp = addInterval(firstCharge, plan2.interval, plan2.intervalCount * Math.max(1, plan2.introPeriods ?? 1));
+    const t = timing("price_change", stepUp);
+    if (t.governed) push("price_change", `Intro price ends: the regular price is first charged`, stepUp, t);
+    else notRequired.push({ kind: "price_change", reason: "The intro price ends, but no applicable requirement demands a price-change notice for it under these jurisdictions." });
+  } else if (!input.price_change) {
     notRequired.push({ kind: "price_change", reason: "No price change planned. Pass price_change (effective_date, new_price) to schedule its advance notice." });
   } else {
     const eff = parseDate(input.price_change.effective_date, "price_change.effective_date", start);
@@ -28514,6 +29254,24 @@ function computeNoticeSchedule(input, now = /* @__PURE__ */ new Date()) {
     }
   };
 }
+function noticesKindsNote(kinds, settings) {
+  const scheduled = [...new Set(kinds)];
+  if (!scheduled.length) return null;
+  if (!settings || settings.mode !== "checkbox") {
+    return {
+      code: "notices_you_send",
+      message: `This site's notices are in "You send" mode: your code sends ${scheduled.join(", ")} at these dates (Checkbox tracks them and can call your webhook when each is due). To have Checkbox send them: updateNoticeSettings { "mode": "checkbox", "add_kinds": ${JSON.stringify(scheduled)} }.`,
+      param: "site"
+    };
+  }
+  const off = scheduled.filter((k) => !settings.enabledKinds.includes(k));
+  if (!off.length) return null;
+  return {
+    code: "notices_kinds_off",
+    message: `Checkbox Notices does not send ${off.join(", ")} for this site yet: updateNoticeSettings { "add_kinds": ${JSON.stringify(off)} } turns them on (or your code sends them at these dates).`,
+    param: "site"
+  };
+}
 var CITATION, BY_ID2, day, unix;
 var init_notice_schedule = __esm({
   "../../apps/api/src/v1/checks/notice-schedule.ts"() {
@@ -28554,8 +29312,15 @@ function operationFor2(kind) {
 function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
+function resultOf(status, exit, strict) {
+  if (exit === 0) return status === "needs_review" ? "passed with items to review (they do not fail this run)" : "passed";
+  if (status === "needs_review") return `failed: items need review and ${strict ? "--strict is on" : 'a "strict" entry or a blocking check makes them fail the run'} (exit ${exit})`;
+  if (status === "skipped") return `failed: nothing was checked (exit ${exit})`;
+  if (status === "fail") return `failed: fixes needed (exit ${exit})`;
+  return `failed: could not run every check (exit ${exit})`;
+}
 function ciVocabulary(text) {
-  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/comes from merchant\.price and is not verified against the Price\. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price\./g, "comes from the plan's price in checkbox.json and is not verified against the Price. Connect Stripe on the site in Checkbox, then run checkbox ci --online (CHECKBOX_SECRET_KEY) so Checkbox reads the Price.").replace(/comes from merchant\.price\b/g, "comes from the plan's price in checkbox.json").replace(/\bmerchant\.price says\b/g, "The plan's price in checkbox.json says").replace(/\(or pass merchant\.cancel_url\)/g, "(or set merchant.cancel_url in checkbox.json)").replace(/to confirm, check the email again with sample values in their place \(keep the merge tags in your code\)\./g, `give each tag its value under "merge_tags" in checkbox.json (on this entry, or top level for every email), e.g. "merge_tags": { "price": "plan.price", "interval": "plan.interval" }: Checkbox fills them from the entry's plan before checking, and your template keeps its tags.`).replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
 }
 function pricingPageFixes(fixes) {
   const reworded = fixes.map(
@@ -28565,10 +29330,18 @@ function pricingPageFixes(fixes) {
   const renewalLineFor = /* @__PURE__ */ new Set();
   for (const f of reworded) {
     const card = /^(Plan card [^:]+): /.exec(f)?.[1] ?? "";
-    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price)/.test(f);
+    const isRenewalLine = /\b(?:Add one line under the price|Put the renewal line under the price|Move the renewal line under the price|Add your own renewal line next to the (?:pay|plan's) button)/.test(f);
     if (isRenewalLine) {
-      if (renewalLineFor.has(card)) continue;
-      renewalLineFor.add(card);
+      const cards = [...card.matchAll(/“([^”]+)”/g)].map((m) => m[1]);
+      const fresh = cards.filter((c) => !renewalLineFor.has(c));
+      if (cards.length ? !fresh.length : renewalLineFor.has(card)) continue;
+      if (!cards.length) renewalLineFor.add(card);
+      for (const c of fresh) renewalLineFor.add(c);
+      if (cards.length && fresh.length < cards.length) {
+        const g = `Plan card ${fresh.map((c) => `\u201C${c}\u201D`).join(", ")}: ${f.slice(card.length + 2)}`;
+        if (!out.includes(g)) out.push(g);
+        continue;
+      }
     }
     if (!out.includes(f)) out.push(f);
   }
@@ -28594,12 +29367,23 @@ function fixesOf(r, onlyNeedsFix = false) {
   failing.sort((a, b) => (a.compliance_status === "needs_fix" ? 0 : 1) - (b.compliance_status === "needs_fix" ? 0 : 1) || (RANK2[a.status] ?? 2) - (RANK2[b.status] ?? 2));
   for (const c of failing) {
     const base = c.compliance?.fix || c.fix || c.compliance?.question?.text || c.explanation || c.title || c.check_id;
-    const cards = failingCards(c.explanation);
+    let cards = failingCards(c.explanation);
+    const plain = cards.length > 1 ? cardClauses(c.explanation).filter((x) => /look like the surrounding text/.test(x.clause)).map((x) => x.card) : [];
+    if (plain.length && plain.length < cards.length && /renewal line/i.test(base)) {
+      cards = cards.filter((x) => !plain.includes(x));
+      const standOut = `Plan card ${plain.map((x) => `\u201C${x}\u201D`).join(", ")}: ${STAND_OUT_DECISION}`;
+      if (!onlyNeedsFix && !out.includes(standOut)) out.push(standOut);
+    }
     const text = cards.length && base ? `Plan card ${cards.map((x) => `\u201C${x}\u201D`).join(", ")}: ${base}` : base;
     if (text && !out.includes(text)) out.push(text);
   }
   return out;
 }
+function cardClauses(explanation) {
+  if (!explanation) return [];
+  const ms = [...explanation.matchAll(/plan button “([^”]{1,80})”(?: in the card “([^”]{1,80})”)?/g)];
+  return ms.map((m, i) => ({ card: m[2] ?? m[1], clause: explanation.slice(m.index + m[0].length, ms[i + 1]?.index ?? explanation.length) }));
+}
 function failingCards(explanation) {
   if (!explanation) return [];
   if (/\(\d+ checkout page views? checked\) — e\.g\./.test(explanation)) return [];
@@ -28616,7 +29400,7 @@ function withPlaceholders(params, placeholders) {
   }
   return copy;
 }
-function correctedOf(type, r, partial = false, placeholders) {
+function correctedOf(type, r, partial = false, placeholders, pricingPage = false) {
   if (type === "stripe_checkout" && r.correction?.patch?.length && partial) {
     return { format: "json", title: `Changes to make to the params (JSON Patch; keep your other values)${r.correction.verification?.passes ? ", verified by the rules engine" : ""}`, body: JSON.stringify(r.correction.patch, null, 2) };
   }
@@ -28629,8 +29413,10 @@ function correctedOf(type, r, partial = false, placeholders) {
     return {
       format: "text",
       title: `Suggested replacement per plan, each directly above its own plan's button${all ? " (each passes the checks, verified by the rules engine)" : ""}`,
+      // Round 32 (pilot 31, ci-pr-agent): a pricing page links to the checkout, where consent is asked (Stripe Checkout
+      // shows its own checkbox), so no consent checkbox label is suggested for it.
       body: perPlan.map((p) => `${p.plan}:
-${p.disclosure_text}${p.consent_label ? `
+${p.disclosure_text}${p.consent_label && !pricingPage ? `
 Consent checkbox label: ${p.consent_label}` : ""}`).join("\n\n")
     };
   }
@@ -28647,7 +29433,8 @@ Consent checkbox label: ${r.replacement.consent_label}` : ""}`
     };
   }
   if (type === "email" && r.template && ciStatusOf(r) !== "pass" && r.verdict !== "not_applicable") {
-    return { format: "text", title: `Suggested template${r.template.verified ? " (passes the checks, verified by the rules engine)" : ""}`, body: `Subject: ${r.template.subject}
+    const toFill = r.template.placeholders ?? [];
+    return { format: "text", title: `Suggested template${r.template.verified ? toFill.length ? ` (passes the checks once you replace ${toFill.join(", ")} with your real value${toFill.length === 1 ? "" : "s"}${toFill.includes("{{support_contact}}") ? ", or set merchant.support_contact in checkbox.json" : ""})` : " (passes the checks, verified by the rules engine)" : ""}`, body: `Subject: ${r.template.subject}
 
 ${r.template.text}` };
   }
@@ -28691,13 +29478,20 @@ function noticeCoverage(config, planName, schedule, opts = {}) {
   const required = /* @__PURE__ */ new Map();
   for (const n of schedule.notices ?? []) {
     const k = NOTICE_TO_EMAIL[n.kind];
-    if (k && !required.has(k)) required.set(k, { occasion: n.occasion, days: n.days_before });
-  }
+    if (k && !required.has(k)) required.set(k, { occasion: n.occasion, days: n.days_before, citations: n.citations ?? [], jurisdictions: n.jurisdictions ?? [] });
+  }
+  const law = (w) => {
+    if (!w.citations.length) return "";
+    const where2 = w.jurisdictions.map((j) => j.replace(/^US-/, "")).filter((j) => j !== "FED");
+    const fed = w.jurisdictions.includes("US-FED");
+    const places = [...fed ? ["federal"] : [], ...where2];
+    return ` Required by ${w.citations.slice(0, 2).join("; ")}${w.citations.length > 2 ? ` and ${w.citations.length - 2} more` : ""}${places.length ? ` (${places.length > 4 ? `${places.slice(0, 4).join(", ")} and ${places.length - 4} more` : places.join(", ")})` : ""}.`;
+  };
   const missing = [...required].filter(([k]) => !have.has(k));
   if (!required.size) return { status: "not_applicable", label: "No reminder emails required", fixes: [] };
   const sent2 = [...required.keys()].filter((k) => byCheckbox.has(k)).length;
   if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered${sent2 ? ` (${sent2} sent by Checkbox Notices, ${real ? "as the site's Notice settings confirm" : "as checkbox.json declares; --online confirms it against the site"})` : ""}`, fixes: [] };
-  const fixes = missing.map(([k, w]) => `Add ${/^[aeiou]/i.test(EMAIL_LABEL[k]) ? "an" : "a"} ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it${declared.includes(k) ? " (checkbox.json says it does, but the site's Notice settings do not send it)" : ""}.`);
+  const fixes = missing.map(([k, w]) => `Add ${/^[aeiou]/i.test(EMAIL_LABEL[k]) ? "an" : "a"} ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it${declared.includes(k) ? " (checkbox.json says it does, but the site's Notice settings do not send it)" : ` ("notices": { "sent_by_checkbox": true } in checkbox.json once Notices is on for the site)`}.${law(w)}`);
   return { status: "needs_review", label: `${missing.length} required email${missing.length === 1 ? "" : "s"} not in checkbox.json`, fix: fixes[0], fixes };
 }
 function unverifiedOffer(r) {
@@ -28724,6 +29518,11 @@ async function runJob(job, engine, config, opts = {}) {
     return { ...base, status: "error", label: "Could not run", message: `${ciVocabulary(e.message)}${e.param && !failure && /^merchant\./.test(e.param) ? "" : e.param ? ` (${e.param})` : ""}`, fixes: [], ...failure ? { failure } : {} };
   }
   if (job.type === "notice_schedule") return { ...base, ...noticeCoverage(config, job.plan, report, opts), report };
+  const pairing = (report.warnings ?? []).find((w) => w.code === "price_plan_conflict");
+  if (pairing) {
+    const names = (config.plans ?? []).map((p) => JSON.stringify(p.name)).join(", ");
+    return { ...base, status: "error", label: "Could not run \xB7 plan pairing", message: `${pairing.message.replace(/\. Checkbox offers no corrected params[\s\S]*$/, "")}. Set "plan" on "${job.name}" to the plan this call really sells (one of ${names}); Checkbox shows no fix until the pairing agrees, because a fix would write the other plan's price into this checkout.`, fixes: [], report };
+  }
   const alerts = job.warnings.filter((w) => /^The params and checkbox\.json disagree/.test(w));
   for (const w of report.warnings ?? []) {
     const text = ciVocabulary(w.message);
@@ -28734,6 +29533,12 @@ async function runJob(job, engine, config, opts = {}) {
   const status = ciStatusOf(report);
   const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
   let fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  const tagsLeft = job.type === "email" && status !== "pass" ? (report.warnings ?? []).find((w) => w.code === "unresolved_placeholders") : void 0;
+  if (tagsLeft) {
+    const tags = [...new Set(tagsLeft.message.match(/\{\{\{?\s*[\w.-]+\s*\}?\}\}|\*\|[\w.-]+\|\*/g) ?? [])];
+    const sample = tags.slice(0, 3).map((t) => t.replace(/[{}*|\s]/g, "")).map((t) => `"${t}": "${/price|amount|cost/i.test(t) ? "plan.price" : /interval|period|frequency|cycle/i.test(t) ? "plan.interval" : /trial/i.test(t) ? "plan.trial_days" : /plan/i.test(t) ? "plan.name" : /cancel/i.test(t) ? "merchant.cancel_url" : "a sample value"}"`);
+    fixes.unshift(`Checkbox cannot read the terms behind ${tags.join(", ")}. Add "merge_tags": { ${sample.join(", ")} } to this entry in checkbox.json (plan.price, plan.interval, \u2026 take the entry's plan), then run checkbox ci again; no render module is needed.`);
+  }
   const pricingPage = job.type === "page" && job.body?.page_kind === "pricing";
   if (pricingPage) fixes = pricingPageFixes(fixes);
   const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b/.test(p));
@@ -28768,18 +29573,29 @@ async function runJob(job, engine, config, opts = {}) {
       engine.mode === "offline" ? `The intro price is declared in checkbox.json, not verified: offline, Checkbox cannot read ${what} from Stripe. Run with --online (CHECKBOX_SECRET_KEY, and the site's Stripe key connected) so Checkbox reads it and compares its percent / amount off and duration with the declared intro.` : `The intro price is declared in checkbox.json, not verified: Checkbox could not read ${what} through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?). Until it is read, its percent / amount off and duration are not compared with the declared intro.`
     );
   }
-  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon ? "needs_review" : status;
-  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
+  const sharedReview = !unread && !declaredCoupon && status === "pass" && job.type === "stripe_checkout" ? stripeParamsVerdict(report) : void 0;
+  const unreadCoupon = sharedReview?.verdict === "needs_review" && sharedReview.reason ? sharedReview.reason : void 0;
+  if (unreadCoupon) {
+    const id = /discounts use (coupon|promotion code) (\S+?),/.exec(unreadCoupon);
+    const what = id ? `${id[1]} ${id[2]}` : "the coupon";
+    fixes.unshift(
+      engine.mode === "offline" ? `The params apply ${what}, which Checkbox cannot read offline, so its discount and duration (what the shopper is charged first) are not checked. Declare the intro on the plan in checkbox.json (intro_percent_off, intro_amount_off or intro_price, with intro_periods) and state it in custom_text.submit, or run with --online so Checkbox reads the coupon.` : `The params apply ${what}, which Checkbox could not read through the site's connected Stripe key (is the site known, via --site or CHECKBOX_SITE, and does the key have Coupons: Read?), so its discount and duration are not checked. Declare the intro on the plan in checkbox.json and state it in custom_text.submit, or let Checkbox read the coupon.`
+    );
+  }
+  const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon || unreadCoupon ? "needs_review" : status;
+  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders, pricingPage);
   if (corrected?.format === "json" && job.placeholders) {
     const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
     if (unset.length) Object.assign(base, { alerts: [...unset, ...base.alerts ?? []] });
   }
-  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || status === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
+  const blocking = unread || status === "needs_review" && (job.type === "page" || job.type === "disclosure") && (report.compliance_status === "incomplete" || report.compliance_status === "not_checked") || // Round 31 (pilot 30 item 2, headless-agent-pr false pass: a "strict" entry with a declared-but-unverified coupon exited
+  // 0): the entry's strictness applies to the status the check reports (finalStatus), not the engine's raw verdict.
+  finalStatus === "needs_review" && job.type === "stripe_checkout" && (!!job.strict || !!offer);
   return {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : unreadCoupon ? "Needs review \xB7 coupon not read" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
@@ -28847,10 +29663,11 @@ async function runCi(jobs, engine, opts) {
     checks,
     ...versioned?.rules_version ? { rules_version: versioned.rules_version } : {},
     ...versioned?.catalog_version ? { catalog_version: versioned.catalog_version } : {},
-    disclaimer: CI_DISCLAIMER
+    disclaimer: CI_DISCLAIMER,
+    result: resultOf(status, exit, opts.strict)
   };
 }
-var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
+var ENGINE_KIND, STRIPE_OBJECTS_OFFLINE_NOTICE, CI_DISCLAIMER, RANK2, OK_STATUSES, STAND_OUT_DECISION, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -28858,6 +29675,7 @@ var init_runner = __esm({
     init_http();
     init_src();
     init_types2();
+    init_stripe_verdict();
     init_config3();
     ENGINE_KIND = {
       stripe_checkout: "stripe_checkout_session",
@@ -28866,9 +29684,11 @@ var init_runner = __esm({
       email: "email",
       notice_schedule: "notice_schedule"
     };
+    STRIPE_OBJECTS_OFFLINE_NOTICE = "Stripe objects (Payment Links, and the trial or price set on a Stripe Price) are not checked offline: this change touches a trial, price or interval, so run checkbox ci --online (CHECKBOX_SECRET_KEY, with Stripe connected on the site) to check that Stripe sells the same terms.";
     CI_DISCLAIMER = "Automated check against Checkbox's catalog of automatic-renewal laws; not legal advice.";
     RANK2 = { fail: 0, needs_review: 1 };
     OK_STATUSES = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
+    STAND_OUT_DECISION = "Decision for you (not a fix): its renewal line is there and legible but looks like the text around it. California asks for renewal terms that stand out, so consider larger type, bold (weight 600 or more), a contrasting colour, or a border.";
     NOTICE_TO_EMAIL = {
       acknowledgment: "acknowledgment",
       trial_ending: "trial_reminder",
@@ -28913,21 +29733,28 @@ function renderHuman(run2, c, opts = {}) {
   const lines = [];
   const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
   lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
+  const unreadPrices = [];
   const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
   for (const x of run2.checks) {
     const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
     lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
     if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
     if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
-    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
+    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(/^Plan card [^:]+: Decision for you\b/.test(f) ? `      decision: ${wrap(f.replace(/Decision for you \(not a fix\): /, ""), 110, "                ")}` : `      fix: ${wrap(f, 110, "           ")}`);
     const alerts = x.alerts ?? [];
     for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
-    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    for (const w of x.warnings.filter((w2) => !alerts.includes(w2) && !PRICE_UNREAD.test(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    for (const w of x.warnings) {
+      const id = PRICE_UNREAD.exec(w)?.[1];
+      if (id && !unreadPrices.includes(id)) unreadPrices.push(id);
+    }
     if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
   }
+  if (unreadPrices.length) lines.push("", c.dim(wrap(`note: ${unreadPrices.length === 1 ? `Price ${unreadPrices[0]} was` : `Prices ${unreadPrices.join(", ")} were`} not read (no connected Stripe account has ${unreadPrices.length === 1 ? "it" : "them"}), so the amounts checked come from "plans" in checkbox.json. To check them against Stripe, connect Stripe on the site in Checkbox and run checkbox ci --online.`, 110, "      ")));
   const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
   if (run2.status === "skipped") lines.push("", c.red(wrap(nothingCheckedMessage(run2), 110, "")));
-  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
+  if (run2.offline_notice) lines.push("", c.yellow(wrap(`Not checked offline: ${run2.offline_notice}`, 110, "      ")));
+  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}${run2.result ? ` (${run2.result.replace(/ \(exit \d+\)$/, "")})` : ""}`);
   if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
   lines.push(c.dim(run2.disclaimer));
   return lines;
@@ -28952,6 +29779,8 @@ function stepSummary(run2) {
   const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
   lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
   if (run2.status === "skipped") lines.push(`\u274C ${nothingCheckedMessage(run2)}`, "");
+  if (run2.result) lines.push(`Result: ${run2.result}.`, "");
+  if (run2.offline_notice) lines.push(`\u26A0\uFE0F ${run2.offline_notice}`, "");
   lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
   for (const x of run2.checks) {
     const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
@@ -28974,7 +29803,7 @@ function stepSummary(run2) {
 function escapeHtml(s2) {
   return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
+var TYPE_LABEL, where, PRICE_UNREAD, escData, escProp, cell, STATUS_MD;
 var init_report = __esm({
   "src/ci/report.ts"() {
     "use strict";
@@ -28988,6 +29817,7 @@ var init_report = __esm({
       notice_schedule: "Notice schedule"
     };
     where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
+    PRICE_UNREAD = /^line_items use (\S+), which Checkbox could not read\b/;
     escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
     escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
     cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
@@ -29170,6 +30000,8 @@ __export(ci_exports, {
   attachSiteForCoupons: () => attachSiteForCoupons,
   couponIdsIn: () => couponIdsIn,
   default: () => ci_default,
+  siteFactsFor: () => siteFactsFor,
+  termsChanged: () => termsChanged,
   touchesConfig: () => touchesConfig,
   undiffableInputs: () => undiffableInputs
 });
@@ -29177,6 +30009,16 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
 import { dirname as dirname7, join as join9, relative as relative5, resolve as resolve7 } from "node:path";
+function termsChanged(cwd, base, jobs) {
+  if (jobs.some((j) => j.type === "stripe_checkout" && (j.sold || j.warnings.some((w) => /^The params and checkbox\.json disagree/.test(w))))) return true;
+  try {
+    const args = ["diff", "-U0", "--no-color", ...base ? [`${base}...HEAD`] : ["HEAD"], "--", ".", ":(exclude)*.md", ":(exclude)**/*.test.*", ":(exclude)**/*.lock", ":(exclude)package-lock.json", ":(exclude)pnpm-lock.yaml"];
+    const out = execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 20 * 1024 * 1024 });
+    return out.split("\n").some((l) => /^[+-](?![+-])/.test(l) && /\b(?:trial(?:_period)?_?days|trialDays|trial_end|unit_amount|interval(?:_count)?|price|amount)\b/i.test(l));
+  } catch {
+    return false;
+  }
+}
 function gitChanged(cwd, base) {
   try {
     const root = execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -29246,6 +30088,36 @@ async function confirm(question) {
     rl.close();
   }
 }
+async function siteFactsFor(ctx, setupSession) {
+  if (!setupSession) return {};
+  try {
+    if (!ctx.credentials()) return {};
+    const client = ctx.client();
+    const sess = await Promise.race([client.sdk.setupSessions.retrieve(setupSession), new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 8e3))]);
+    const out = {};
+    const b = sess?.business ?? {};
+    if (b.merchant_name) out.merchant_name = b.merchant_name;
+    if (b.site_url) out.site_url = b.site_url;
+    const cancel = b.cancellation_url ?? b.account_url;
+    if (cancel) out.account_url = cancel;
+    const plans = (sess?.site_plans ?? []).filter((p) => typeof p.amount === "number" && p.amount > 0 && typeof p.interval === "string");
+    if (plans.length) {
+      out.plans = plans.map((p) => ({
+        // A name that is only the price ("$29.00 / month") is left out: the plans module names the plan better.
+        ...p.name && !/^\W?\s*[\d.,]+/.test(p.name) ? { name: p.name } : {},
+        amount: p.amount,
+        currency: p.currency ?? "usd",
+        interval: p.interval,
+        ...p.interval_count && p.interval_count > 1 ? { interval_count: p.interval_count } : {},
+        ...p.trial_days ? { trial_days: p.trial_days } : {},
+        ...p.stripe_price_ids?.length ? { stripe_price_ids: p.stripe_price_ids } : {}
+      }));
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
 async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
@@ -29256,13 +30128,24 @@ async function runInit(ctx, argv) {
   const withWorkflow = bool(p.flags, "workflow") !== false;
   const projects = ctx.config.load().init?.projects ?? {};
   let facts = {};
+  let setupSession;
   for (let dir = resolve7(ctx.cwd); ; dir = dirname7(dir)) {
-    if (projects[dir]?.facts) {
-      facts = projects[dir].facts;
+    const proj = projects[dir];
+    if (proj?.facts || proj?.setup_session) {
+      facts = proj.facts ?? {};
+      setupSession = proj.setup_session;
       break;
     }
     if (dirname7(dir) === dir) break;
   }
+  const fromSite = await siteFactsFor(ctx, setupSession);
+  facts = { ...fromSite, ...facts, ...fromSite.plans && !facts.plans ? { plans: fromSite.plans } : {} };
+  if (Array.isArray(facts.plans) && Array.isArray(fromSite.plans)) {
+    facts.plans = facts.plans.map((p2) => {
+      const m = fromSite.plans.find((x) => x.amount === p2.amount && x.interval === p2.interval);
+      return m && !p2.stripe_price_ids ? { ...p2, stripe_price_ids: m.stripe_price_ids } : p2;
+    });
+  }
   const s2 = scaffoldConfig(ctx.cwd, ctx.env, facts);
   const actionFor = (f) => existsSync8(f) ? force ? "overwrite" : "keep" : "create";
   const files = [{ path: configPath, content: `${JSON.stringify(s2.config, null, 2)}
@@ -29294,8 +30177,13 @@ async function runInit(ctx, argv) {
     found: s2.found,
     ...withWorkflow ? { workflow_steps: workflowSteps } : {},
     todos: s2.todos,
+    // Round 32 (pilot 31, ci-pr-agent: "Fill in the 2 TODO item(s)" with 1 TODO in the file): suggestions are notes;
+    // the count is the number of "TODO" values in the file.
+    todo_values: s2.todoValues,
+    notes: s2.notes,
+    ...Object.keys(fromSite).length ? { from_site: Object.keys(fromSite) } : {},
     config: s2.config,
-    next_action: s2.todos.length ? { type: "edit_config", message: `Fill in the ${s2.todos.length} TODO item(s) in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
+    next_action: s2.todoValues ? { type: "edit_config", message: `Fill in the ${s2.todoValues} "TODO" value${s2.todoValues === 1 ? "" : "s"} in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
   };
   ctx.out.result(result, () => {
     const lines = [];
@@ -29305,6 +30193,7 @@ async function runInit(ctx, argv) {
     if (withWorkflow && workflowSteps.length) lines.push("", `The workflow runs ${workflowSteps.map((c) => `\`${c}\``).join(" and ")} before the checks, so they work on a fresh clone.`);
     if (needs.urlPages) lines.push("", 'Note: "url" pages are fetched by the API (checkbox ci --online), which needs a LIVE key (ck_live_\u2026) on an activated account. Without one, list the built page as "file".');
     if (s2.todos.length) lines.push("", "To do:", ...s2.todos.map((t) => `  - ${t}`));
+    if (s2.notes.length) lines.push("", "Also:", ...s2.notes.map((t) => `  - ${t}`));
     lines.push("", `${ctx.out.c.cyan("Next:")} ${result.next_action.message}`);
     if (!write) lines.push("", ctx.out.c.dim(`${relName(configPath)}:`), ...JSON.stringify(s2.config, null, 2).split("\n").map((l) => ctx.out.c.dim(`  ${l}`)));
     return lines;
@@ -29469,13 +30358,17 @@ ${message}
         const engine = client ? onlineEngine(client) : offlineEngine();
         const notices = client && declaredByCheckbox(loaded.config).length ? await readNotices(ctx, client, str(p.flags, "site")) : void 0;
         const noticesLine = Math.max(1, loaded.raw.split("\n").findIndex((l) => l.includes('"sent_by_checkbox"')) + 1);
-        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
+        const run0 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
+        const baseRef = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
+        const run2 = !client && termsChanged(ctx.cwd, baseRef, jobs) ? { ...run0, offline_notice: STRIPE_OBJECTS_OFFLINE_NOTICE } : run0;
         ctx.out.result(run2, () => renderHuman(run2, ctx.out.c, { verbose: bool(p.flags, "verbose") === true }));
         if (gha) {
           for (const a of annotations(run2)) emit(a);
           writeGithubFile(ctx.env.GITHUB_STEP_SUMMARY, stepSummary(run2));
+          if (run2.offline_notice) emit(`::notice title=Checkbox%3A Stripe not checked offline::${run2.offline_notice}`);
           writeGithubFile(ctx.env.GITHUB_OUTPUT, `status=${run2.status}
 exit_code=${run2.exit_code}
+result=${run2.result}
 `);
         }
         return run2.exit_code;
@@ -29535,6 +30428,14 @@ function findAnchor(src, target) {
       }
     }
   }
+  if (!text && !id && tag) {
+    const all = [...src.matchAll(tagRe)];
+    if (all.length === 1) return openAt(all[0].index + 1, `the only <${tag}> in this file`);
+    if (tag === "button" || tag === "input") {
+      const submit = all.filter((m) => /^[^>]*\btype\s*=\s*(?:"submit"|'submit'|\{\s*["']submit["']\s*\})/i.test(src.slice(m.index, src.indexOf(">", m.index) + 1)));
+      if (submit.length === 1) return openAt(submit[0].index + 1, `the only <${tag} type="submit"> in this file`);
+    }
+  }
   return null;
 }
 function lineStart(src, idx) {
@@ -29884,6 +30785,16 @@ var init_device = __esm({
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname8, join as join10 } from "node:path";
+function pinnedRelease(body) {
+  const b = body;
+  if (!b || typeof b.version !== "string" || !/^\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(b.version)) return void 0;
+  if (typeof b.integrity !== "string" || !/^sha384-[A-Za-z0-9+/]{64}$/.test(b.integrity)) return void 0;
+  return { version: b.version, integrity: b.integrity };
+}
+function snippetScriptTag(s2, jsx = false, attrs = "") {
+  const pin = s2.pinned ? ` integrity="${s2.pinned.integrity}" ${jsx ? "crossOrigin" : "crossorigin"}="anonymous"` : "";
+  return `<script${attrs} async src="${srcOf(s2)}"${pin} data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`;
+}
 function read(root, rel2) {
   try {
     return readFileSync11(join10(root, rel2), "utf8");
@@ -29892,19 +30803,20 @@ function read(root, rel2) {
   }
 }
 function srcOf(s2) {
-  return `${s2.apiBase.replace(/\/+$/, "")}/s.js`;
+  const api = s2.apiBase.replace(/\/+$/, "");
+  return s2.pinned ? `${api}/s/${s2.pinned.version}.js` : `${api}/s.js`;
 }
 function jsxBlock(s2, indent) {
   return [
     `${indent}{/* ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) */}`,
-    `${indent}<script async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, true)}`,
     `${indent}{/* ${MARK_END} */}`
   ];
 }
 function htmlBlock(s2, indent, attrs = "") {
   return [
     `${indent}<!-- ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet) -->`,
-    `${indent}<script${attrs} async src="${srcOf(s2)}" data-key="${s2.snippetKey}" data-api="${s2.apiBase.replace(/\/+$/, "")}"></script>`,
+    `${indent}${snippetScriptTag(s2, false, attrs)}`,
     `${indent}<!-- ${MARK_END} -->`
   ];
 }
@@ -29963,7 +30875,7 @@ function planSnippet(d, s2) {
   const root = d.root;
   const file = d.layoutFile;
   const manual = `Add this tag inside <head> on every page (your root layout / template):
-  ${s2.scriptTag}`;
+  ${s2.pinned ? snippetScriptTag(s2) : s2.scriptTag}`;
   if (!file) return { change: null, manual };
   const existing = read(root, file);
   const jsx = (f) => f === "nextjs-app" || f === "nextjs-pages" || f === "remix" || f === "react-router";
@@ -29973,21 +30885,25 @@ function planSnippet(d, s2) {
     return { change: { file, action: existing === null ? "create" : "modify", summary: "Nuxt client plugin that adds the snippet to every page", contents, added: contents.trim().split("\n") } };
   }
   if (existing === null) {
+    if (d.framework === "nextjs-app") {
+      const contents = NEXT_APP_LAYOUT(s2, /\.tsx$/.test(file));
+      return { change: { file, action: "create", summary: "Root layout with the snippet in <head>", contents, added: contents.trim().split("\n") } };
+    }
     if (d.framework === "nextjs-pages") {
       const contents = NEXT_DOCUMENT(s2);
       return { change: { file, action: "create", summary: "Custom _document with the snippet in <Head>", contents, added: contents.trim().split("\n") } };
     }
     return { change: null, manual };
   }
-  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START)) {
-    return { change: { file, action: "unchanged", summary: "Snippet already installed", added: [] } };
+  if (existing.includes(`data-key="${s2.snippetKey}"`) && existing.includes(MARK_START) && existing.includes(`src="${srcOf(s2)}"`) && (!s2.pinned || existing.includes(s2.pinned.integrity))) {
+    return { change: { file, action: "unchanged", summary: s2.pinned ? `Snippet already installed (pinned release ${s2.pinned.version} with SRI)` : "Snippet already installed", added: [] } };
   }
   const isJsx = jsx(d.framework);
   const indentRe = isJsx ? d.framework === "nextjs-pages" ? /<Head\b[^>]*>/ : /<head\b[^>]*>/ : /<\/head>/i;
   const indent = isJsx ? indentOf2(existing, indentRe) : indentOf2(existing, /<\/head>/i, "  ");
   const block = isJsx ? jsxBlock(s2, indent) : htmlBlock(s2, indent, d.framework === "astro" ? " is:inline" : "");
   const replaced = replaceMarked(existing, block);
-  if (replaced !== null) return { change: { file, action: "modify", summary: "Snippet tag updated (new site key)", contents: replaced, added: block } };
+  if (replaced !== null) return { change: { file, action: "modify", summary: existing.includes(`data-key="${s2.snippetKey}"`) ? s2.pinned ? `Snippet tag pinned to release ${s2.pinned.version} with SRI` : "Snippet tag updated" : "Snippet tag updated (new site key)", contents: replaced, added: block } };
   let next = null;
   switch (d.framework) {
     case "nextjs-app": {
@@ -30018,7 +30934,7 @@ ${indentOf2(existing, /<Head\s*\/>/, "")}</Head>`) : null);
   }
   if (!next) return { change: null, manual: `Could not find <head> in ${file}. ${manual}` };
   if (!snippetPlacedSafely(next, isJsx)) return { change: null, manual: `Could not place the snippet safely in ${file} (its <head> is not where Checkbox can patch it without breaking the file), so ${file} was NOT changed. ${manual}` };
-  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}`, contents: next, added: block } };
+  return { change: { file, action: "modify", summary: `Snippet added to <head> in ${file}${s2.pinned ? ` (pinned release ${s2.pinned.version} with SRI)` : ""}`, contents: next, added: block } };
 }
 function envVarNames(d) {
   return {
@@ -30101,7 +31017,7 @@ function applyChange(root, c) {
   mkdirSync3(dirname8(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
-var MARK_START, MARK_END, NEXT_DOCUMENT, NUXT_PLUGIN;
+var MARK_START, MARK_END, NEXT_DOCUMENT, NEXT_APP_LAYOUT, NUXT_PLUGIN;
 var init_patch2 = __esm({
   "src/commands/init/patch.ts"() {
     "use strict";
@@ -30122,11 +31038,22 @@ ${jsxBlock(s2, "        ").join("\n")}
     </Html>
   );
 }
+`;
+    NEXT_APP_LAYOUT = (s2, ts) => `${ts ? "import type { ReactNode } from 'react';\n\n" : ""}export default function RootLayout({ children }${ts ? ": { children: ReactNode }" : ""}) {
+  return (
+    <html lang="en">
+      <head>
+${jsxBlock(s2, "        ").join("\n")}
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}
 `;
     NUXT_PLUGIN = (s2) => `// ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet)
 export default defineNuxtPlugin(() => {
   useHead({
-    script: [{ src: '${srcOf(s2)}', async: true, 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
+    script: [{ src: '${srcOf(s2)}', async: true,${s2.pinned ? ` integrity: '${s2.pinned.integrity}', crossorigin: 'anonymous',` : ""} 'data-key': '${s2.snippetKey}', 'data-api': '${s2.apiBase.replace(/\/+$/, "")}' }],
   });
 });
 // ${MARK_END}
@@ -30142,8 +31069,11 @@ __export(init_exports, {
   configLines: () => configLines,
   configNameOf: () => configNameOf,
   default: () => init_default,
+  liveKeyNextAction: () => liveKeyNextAction,
   parsePlanFlag: () => parsePlanFlag,
-  syncCheckoutConfigs: () => syncCheckoutConfigs
+  snippetWords: () => snippetWords,
+  syncCheckoutConfigs: () => syncCheckoutConfigs,
+  withEvaluatedAt: () => withEvaluatedAt
 });
 import { existsSync as existsSync11 } from "node:fs";
 import { join as join11 } from "node:path";
@@ -30163,6 +31093,10 @@ function saveState(ctx, root, patch) {
   }
   ctx.config.save({ init: { ...cfg, projects } });
 }
+function withEvaluatedAt(c) {
+  const t = c.evaluated;
+  return typeof t === "number" && t > 0 ? { evaluated_at: new Date(t * 1e3).toISOString(), ...c } : c;
+}
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
   try {
@@ -30190,6 +31124,7 @@ function projectFacts(d) {
     ...d.layoutFile ? { layout_file: d.layoutFile } : {},
     env_file: d.envFile,
     ...d.publicDir ? { public_dir: d.publicDir } : {},
+    ...d.mailer ? { mailer: d.mailer } : {},
     checkout_code: d.checkoutCode.slice(0, 100).map((c) => ({ file: c.file.slice(0, 500), line: c.line, kind: c.kind, snippet: c.snippet.slice(0, 500) })),
     pay_buttons: d.payButtons.slice(0, 100).map((c) => ({ file: c.file.slice(0, 500), line: c.line, kind: c.kind, snippet: c.snippet.slice(0, 500) }))
   };
@@ -30227,7 +31162,7 @@ async function syncCheckoutConfigs(client, site, sessions, root) {
     const call = (perFile.get(s2.file) ?? 0) + 1;
     perFile.set(s2.file, call);
     if (!registrable(s2.params, s2.unresolved)) {
-      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")}` : "not a subscription-mode Checkout Session" });
+      out.push({ file: s2.file, line: s2.line, skipped: s2.unresolved.length ? `values not readable statically: ${s2.unresolved.slice(0, 5).join(", ")} (a variable, call or template string). Next: register the exact params your server sends with createStripeCheckoutConfig (POST /v1/sites/{site}/stripe_checkout_configs), or, once Stripe is connected, create one Checkout Session in Stripe test mode so Checkbox reads it` : "not a subscription-mode Checkout Session" });
       continue;
     }
     try {
@@ -30265,11 +31200,32 @@ function configLines(configs, now = Date.now()) {
   };
   return ["Checkout params registered:", ...configs.map((c) => c.id ? `  ${c.file}:${c.line} \u2192 ${c.id}${age(c.registered_at)}${c.replaced?.length ? ` (replaced ${c.replaced.length} older config${c.replaced.length === 1 ? "" : "s"})` : ""}` : `  ${c.file}${c.line ? `:${c.line}` : ""}: ${c.skipped}`)];
 }
+async function snippetRelease(client) {
+  try {
+    return pinnedRelease(await client.get("/s/latest.json"));
+  } catch {
+    return void 0;
+  }
+}
 function registrable(params, unresolved) {
   if (!params) return false;
   if (unresolved.some((u) => /^(mode|line_items|subscription_data|custom_text|consent_collection)\b/.test(u))) return false;
   return params.mode === "subscription" && Array.isArray(params.line_items) && params.line_items.length > 0;
 }
+function snippetWords(homepage, live) {
+  if (homepage) return "detected";
+  if (live) return "live (seen through the page captures it sends; not in the homepage HTML Checkbox loaded)";
+  return "NOT detected yet (deploy, then verify again)";
+}
+function liveKeyNextAction(dashboard) {
+  const url = `${dashboard.replace(/\/+$/, "")}/settings/developers?mode=live&create=key`;
+  return {
+    type: "ask_human_for_live_key",
+    message: `Ask the human for live mode (an agent never creates live keys): either they approve again with \`checkbox init --live --relogin --yes --json\` and tick \u201CAlso create live-mode keys\u201D on the approval page, or they create a live key in the Checkbox dashboard (Live mode, Agent & API: ${url}) and put it in the project env as CHECKBOX_LIVE_SECRET_KEY (never in the chat). Then run \`checkbox init --live --yes --json\`: it links the live site and writes the domain-verification file. Live checks start once the domain is verified.`,
+    command: "checkbox init --live --relogin --yes --json",
+    url
+  };
+}
 function detectionSummary(d, siteUrl) {
   return {
     framework: d.framework,
@@ -30292,9 +31248,14 @@ function detectionSummary(d, siteUrl) {
 function fileOut(c) {
   return { file: c.file, action: c.action, summary: c.summary, added: c.added };
 }
-function resultOf(status, d, session, changes, extra, apiBase) {
+function resultOf2(status, d, session, changes, extra, apiBase) {
   const names = envVarNames(d);
-  const next = session.next_action.type === "done" ? { type: "done", message: "Checkbox is set up. After each change to checkout, emails or cancellation, run `checkbox plan --json` and apply what it returns.", command: "checkbox plan --json" } : session.next_action;
+  const next = session.next_action.type === "done" ? {
+    type: "done",
+    // Round 32 (pilot 31 item 1): a test-mode setup says so, with the go-live steps left (go_live), never a bare "set up".
+    message: session.go_live?.steps.length ? `Checkbox is set up in Stripe test mode. ${session.go_live.summary} After each change to checkout, emails or cancellation, run \`checkbox plan --json\` and apply what it returns.` : "Checkbox is set up. After each change to checkout, emails or cancellation, run `checkbox plan --json` and apply what it returns.",
+    command: "checkbox plan --json"
+  } : session.next_action;
   return {
     object: "checkbox_init",
     status,
@@ -30309,7 +31270,10 @@ function resultOf(status, d, session, changes, extra, apiBase) {
     install: session.install,
     stripe: { ...session.stripe, ...extra.stripe ?? {} },
     ...extra.live && Object.keys(extra.live).length ? { live: extra.live } : {},
-    compliance: session.compliance,
+    // Round 32 (pilot 31, discovery-agent: "compliance.evaluated" read like a count but is a Unix timestamp): the CLI says
+    // when, as evaluated_at (ISO 8601), next to the API's field.
+    compliance: session.compliance ? withEvaluatedAt(session.compliance) : session.compliance,
+    ...session.go_live ? { go_live: session.go_live } : {},
     steps: session.steps.map((s2) => ({ key: s2.key, status: s2.status, summary: s2.summary })),
     warnings: extra.warnings ?? [],
     owner_notified: session.owner_notified,
@@ -30332,6 +31296,10 @@ function renderSession(ctx, s2) {
     for (const t of todo.slice(0, 5)) lines.push(`  ${t.status === "needs_fix" || t.status === "not_set_up" ? c.red("\u2717") : c.yellow("?")} ${t.title} ${c.dim(`(${t.label})`)}`);
     if (todo.length > 5) lines.push(c.dim(`  \u2026 ${todo.length - 5} more: checkbox plan`));
   }
+  if (s2.go_live?.steps.length) {
+    lines.push("", c.bold(`Before real customers (Stripe test mode so far): ${s2.go_live.steps.length} step${s2.go_live.steps.length === 1 ? "" : "s"}`));
+    s2.go_live.steps.forEach((st, i) => lines.push(`  ${i + 1}. ${c.dim(st.who === "person" ? "[owner]" : "[agent]")} ${st.text}`));
+  }
   lines.push("", `${c.cyan("next")}  ${s2.next_action.message}${s2.next_action.command ? `
       ${s2.next_action.command}` : ""}`, `${c.dim("review")} ${s2.review_url}`);
   return lines;
@@ -30357,6 +31325,7 @@ var init_init = __esm({
     "use strict";
     init_args();
     init_config();
+    init_src2();
     init_http();
     init_types2();
     init_detect();
@@ -30364,7 +31333,7 @@ var init_init = __esm({
     init_patch2();
     VERSION_FLAGS = {
       string: ["site-url", "checkout-url", "account-url", "terms-url", "privacy-url", "refund-url", "cancellation-url", "wait-seconds", "agent", "support-email", "merchant-name", "plan"],
-      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "relogin"],
+      boolean: ["yes", "dry-run", "open", "wait", "verify", "complete", "live", "stripe", "snippet", "pin", "relogin"],
       alias: { y: "yes" }
     };
     interactive = (ctx) => !ctx.flags.json && !!process.stdin.isTTY && !!process.stderr.isTTY;
@@ -30376,8 +31345,11 @@ var init_init = __esm({
         "Run it in the project root. What it does (idempotent; re-run any time):",
         "  1. detects the framework, billing platform, checkout code and pay buttons",
         '  2. signs you in: prints ONE link ("Open \u2026 and click Approve") and opens the browser; new accounts are free',
-        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it)",
-        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments)",
+        "  3. writes CHECKBOX_SECRET_KEY and the publishable key to .env.local / .env (and git-ignores it); when that file is",
+        "     tracked by git, or the folder is deployed as it is, the key is not written to it and stays only in the CLI config",
+        "     (~/.config/checkbox/config.json), which the output says",
+        "  4. installs the Checkbox snippet in the root layout (marked with checkbox:snippet comments): the pinned release",
+        "     (/s/<version>.js with integrity= and crossorigin=, Subresource Integrity); --no-pin uses the unpinned /s.js",
         "  5. registers the site, Terms / refund / cancellation policy URLs (fetched and checked by Checkbox)",
         "  6. with your permission, uses the project's Stripe restricted TEST key (rk_test_\u2026; sk_test_ and live keys are refused) for a synthetic test subscription",
         "  7. runs the first checks and prints the next step (`checkbox plan --json`); the human gets the summary email",
@@ -30453,7 +31425,7 @@ var init_init = __esm({
           if (bool(flags, "verify")) {
             const v = await client2.sdk.setupSessions.verify(state.setup_session);
             session2 = v.setup_session;
-            out.info(v.homepage.ok ? `Site loaded; snippet ${v.homepage.snippet_detected ? "detected" : "NOT detected yet (deploy, then verify again)"}` : `Could not load the site: ${v.homepage.error}`);
+            out.info(v.homepage.ok ? `Site loaded; snippet ${snippetWords(v.homepage.snippet_detected, session2.install?.detected_on_site ?? null)}` : `Could not load the site: ${v.homepage.error}`);
           } else {
             session2 = await client2.sdk.setupSessions.retrieve(state.setup_session);
           }
@@ -30463,7 +31435,7 @@ var init_init = __esm({
             const configs = await syncCheckoutConfigs(client2, session2.site, d.checkoutSessions, root).catch((err) => [{ file: "", line: 0, skipped: err instanceof Error ? err.message : String(err) }]);
             if (configs.length) stripeOut.checkout_configs = configs;
           }
-          out.result(resultOf("verified", d, session2, [], Object.keys(stripeOut).length ? { stripe: stripeOut } : {}, apiBase), () => [...renderSession(ctx, session2), ...configLines(stripeOut.checkout_configs)]);
+          out.result(resultOf2("verified", d, session2, [], Object.keys(stripeOut).length ? { stripe: stripeOut } : {}, apiBase), () => [...renderSession(ctx, session2), ...configLines(stripeOut.checkout_configs)]);
           return EXIT.ok;
         }
         if (dryRun && (!state.setup_session || !creds)) {
@@ -30492,10 +31464,11 @@ var init_init = __esm({
         let token = null;
         let apiKey = creds?.apiKey;
         let sessionId = state.setup_session;
-        const reuse = !!(state.setup_session && creds && bool(flags, "relogin") !== true);
+        const pendingLogin = state.pending && Date.parse(state.pending.expires_at) > Date.now() + 1e4 && state.pending.api_base === apiBase ? state.pending : void 0;
+        const reuse = !!(state.setup_session && creds && bool(flags, "relogin") !== true && !pendingLogin);
         if (!reuse) {
           const anon = ctx.client({ apiKey: "device-login", apiBase });
-          let pending = state.pending && Date.parse(state.pending.expires_at) > Date.now() + 1e4 && state.pending.api_base === apiBase ? state.pending : void 0;
+          let pending = pendingLogin;
           if (!pending) {
             const agent2 = detectAgent(ctx.env, agentName);
             const wantStripe = bool(flags, "stripe") !== false && d.billingPlatform === "stripe" && !!d.stripeTestKey;
@@ -30508,7 +31481,8 @@ var init_init = __esm({
               ...merchantName ? { merchant_name: merchantName.slice(0, 100) } : {},
               framework: d.framework,
               ...d.packageManager ? { package_manager: d.packageManager } : {},
-              billing_platform: d.billingPlatform,
+              // "custom" means nothing was detected: never sent as a declared platform (the API then looks for Stripe itself).
+              ...d.billingPlatform !== "custom" ? { billing_platform: d.billingPlatform } : {},
               ...bool(flags, "live") ? { live: true } : {},
               ...wantStripe ? { stripe_test_key_hint: d.stripeTestKey.hint } : {}
             });
@@ -30539,7 +31513,7 @@ var init_init = __esm({
                 expires_at: pending.expires_at,
                 next_action: {
                   type: "ask_human_to_approve",
-                  message: `Ask the human to open ${pending.verification_uri_complete} and click Approve, then run \`checkbox init --yes --json\` again (it continues where it stopped and remembers ${Object.keys(factsToRemember).length ? Object.keys(factsToRemember).join(", ") : "the flags given now"}).`,
+                  message: `Ask the human to open ${pending.verification_uri_complete} and click Approve.${d.billingPlatform === "stripe" && bool(flags, "stripe") !== false ? ` ${approvalKeyAsk({ stripe: true, keyFound: !!d.stripeTestKey })}` : ""} Then run \`checkbox init --yes --json\` again (it continues where it stopped and remembers ${Object.keys(factsToRemember).length ? Object.keys(factsToRemember).join(", ") : "the flags given now"}).`,
                   command: "checkbox init --yes --json",
                   url: pending.verification_uri_complete
                 }
@@ -30623,7 +31597,9 @@ var init_init = __esm({
         if (session.install.script_tag && session.install.snippet_key) {
           if (bool(flags, "snippet") === false) manualSnippet = session.install.script_tag;
           else {
-            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase });
+            const pinned = bool(flags, "pin") === false ? void 0 : await snippetRelease(client);
+            if (!pinned && bool(flags, "pin") !== false) warnings.push("The pinned snippet release (/s/latest.json) could not be read, so the unpinned /s.js tag was used. Run `checkbox init` again to pin it with Subresource Integrity.");
+            const plan2 = planSnippet(d, { scriptTag: session.install.script_tag, snippetKey: session.install.snippet_key, apiBase, ...pinned ? { pinned } : {} });
             if (plan2.change) changes.push(plan2.change);
             if (plan2.manual) manualSnippet = plan2.manual;
           }
@@ -30680,9 +31656,12 @@ var init_init = __esm({
         }
         const live = {};
         if (!dryRun && bool(flags, "live") && siteUrl) {
-          const liveKey = token?.live_secret_key ?? void 0;
-          if (!liveKey) {
-            warnings.push("No live key (approve live keys on the approval page, or create one in the dashboard) \u2014 live mode skipped.");
+          const liveKey = token?.live_secret_key ?? ctx.env.CHECKBOX_LIVE_SECRET_KEY ?? d.env.CHECKBOX_LIVE_SECRET_KEY ?? void 0;
+          if (!liveKey || !/^ck_live_/.test(liveKey)) {
+            const ask3 = liveKeyNextAction(session.review_url.replace(/\/setup\/[^/]*$/, ""));
+            live.skipped = "no_live_key";
+            live.next_action = ask3;
+            warnings.push(`Live mode not set up yet: it needs a live Checkbox key (ck_live_\u2026), and only a person creates one. ${ask3.message}`);
           } else {
             try {
               const lc = ctx.client({ apiKey: liveKey, apiBase });
@@ -30696,7 +31675,7 @@ var init_init = __esm({
                   changes.push(wk);
                 }
               }
-              session = await client.sdk.setupSessions.update(sessionId, { live_site: liveSite.id });
+              session = await lc.sdk.setupSessions.update(sessionId, { live_site: liveSite.id });
               saveState(ctx, root, { live_site: liveSite.id });
               live.site = liveSite.id;
               live.domain_verification = { status: dv.status, file: dv.file?.url ?? null, dns_txt: dv.dns_record ? `${dv.dns_record.name} = ${dv.dns_record.value}` : null };
@@ -30709,7 +31688,8 @@ var init_init = __esm({
           out.info("Running the first checks\u2026");
           session = (await client.sdk.setupSessions.verify(sessionId)).setup_session;
         }
-        const doc = resultOf(dryRun ? "dry_run" : "configured", d, session, changes, { stripe, live, warnings, manualSnippet, token, envNotWritten: envTracked && !!token }, apiBase);
+        const doc = resultOf2(dryRun ? "dry_run" : "configured", d, session, changes, { stripe, live, warnings, manualSnippet, token, envNotWritten: envTracked && !!token }, apiBase);
+        if (live.next_action && (session.next_action.type === "done" || session.next_action.type === "complete_setup")) doc.next_action = live.next_action;
         out.result(doc, () => [...renderFiles(ctx, changes, dryRun), ...manualSnippet ? [`Add the snippet yourself: ${manualSnippet}`] : [], ...warnings.map((w) => `${out.c.yellow("!")} ${w}`), ...configLines(stripe.checkout_configs), ...renderSession(ctx, session)]);
         return EXIT.ok;
       }