@checkbox-site/cli 0.4.6 → 0.4.8

package/dist/checkbox.js

@@ -3295,7 +3295,7 @@ var init_operations = __esm({
       /**
        * Store a billing test-mode key.
        *
-       * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked "Let your agent store a Stripe test-mode key" on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
+       * Stores the site's Stripe TEST-mode restricted key (rk_test_…), after checking it with Stripe the way the dashboard's Connect Stripe does. An agent may call this itself once the owner approved the setup; every store is logged on the site's setup timeline and Billing connection line, and the human can revoke it in one click. Live keys are refused (test_key_not_test_mode: a human adds live keys in the dashboard); the owner must have ticked the box “Let your agent store a Stripe test-mode restricted key for this project” (agent sign-in) or “Let this app store a Stripe test-mode restricted key for your sites” (app connection) (checkbox id consent-stripe-test-key) on the approval page of the agent's sign-in or connection (else test_key_declined); a key whose Stripe account looks like another site's is refused with billing_account_mismatch (with confirm_account_mismatch: true the key is connected on hold until a person confirms the account in the dashboard; only a person can confirm it); secret keys (sk_test_…) are refused (test_key_not_restricted). On a test-mode site without a Stripe connection the key also becomes the site's Stripe connection: one key for checks, fixes (only after the human approves each) and test runs. The key's checklist: Customers: Write, Products: Read, Prices: Read, Coupons: Read, Subscriptions: Write, Test clocks: Write, Customer portal: Write, Checkout Sessions: Write, Payment Links: Write, Webhook Endpoints: Write. Replaces an existing key. Next: createTestRun.
        *
        * @param site Unique identifier of the site (site_…).
        * @see POST /v1/sites/{site}/test_credentials (operation `createTestCredential`, scope `test_runs:write`)
@@ -3617,7 +3617,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.4";
+    SDK_VERSION = "0.2.6";
   }
 });
 
@@ -4484,7 +4484,23 @@ function exitCodeFor(report, strict) {
   if (report.verdict === "needs_review" && strict) return EXIT.needs_review;
   return EXIT.ok;
 }
+function renderSchedule(report, out, opts) {
+  const c = out.c;
+  const notices = report.notices ?? [];
+  const where2 = report.jurisdictions === "all" || !report.jurisdictions ? "all jurisdictions" : report.jurisdictions.join(", ");
+  const lines = [`${c.bold("NOTICE SCHEDULE")}  ${notices.length} notice${notices.length === 1 ? "" : "s"} to send \xB7 ${where2} \xB7 rules ${report.rules_version ?? "?"} \xB7 catalog ${report.catalog_version ?? "?"}`];
+  for (const n of notices.slice(0, opts.verbose ? 200 : 12)) {
+    lines.push(`  ${n.send_date ?? "?"}  ${n.kind ?? "notice"}${n.occasion ? c.dim(` \xB7 ${n.occasion}`) : ""}${n.days_before ? c.dim(` (${n.days_before} days before)`) : ""}${n.citations?.length ? c.dim(` \xB7 ${n.citations.slice(0, 2).join("; ")}${n.citations.length > 2 ? " \u2026" : ""}`) : ""}`);
+  }
+  if (!opts.verbose && notices.length > 12) lines.push(c.dim(`  \u2026 ${notices.length - 12} more (--verbose or --json)`));
+  const notRequired = report.not_required ?? [];
+  if (notRequired.length && opts.verbose) for (const n of notRequired) lines.push(c.dim(`  not required: ${n.kind ?? ""}${n.reason ? ` \u2014 ${n.reason}` : ""}`));
+  if (report.next_action?.message) lines.push("", `${c.cyan("Next:")} ${wrap(report.next_action.message, 110, "      ")}`);
+  if (report.disclaimer) lines.push(c.dim(report.disclaimer));
+  return lines;
+}
 function renderReport(report, out, opts) {
+  if (!report.verdict && Array.isArray(report.notices)) return renderSchedule(report, out, opts);
   const c = out.c;
   const icon2 = (s2) => s2 === "pass" ? c.green("\u2713") : s2 === "fail" ? c.red("\u2717") : s2 === "needs_review" ? c.yellow("?") : c.dim("\u2013");
   const verdict = report.verdict ?? "unknown";
@@ -4518,7 +4534,9 @@ function renderReport(report, out, opts) {
     lines.push(...JSON.stringify(report.correction.patch, null, 2).split("\n").map((l) => `  ${l}`));
   }
   if (report.template && verdict !== "pass" && verdict !== "not_applicable") {
-    lines.push("", report.template.verified ? `${c.bold("Suggested template (passes the checks)")} ${c.green("(verified)")}` : c.bold("Suggested template"), `  Subject: ${report.template.subject}`, ...report.template.text.split("\n").map((l) => `  ${l}`));
+    const toFill = report.template.placeholders ?? [];
+    const label = !report.template.verified ? c.bold("Suggested template") : toFill.length ? `${c.bold(`Suggested template (passes the checks once you replace ${toFill.join(", ")} with your real value${toFill.length === 1 ? "" : "s"})`)}` : `${c.bold("Suggested template (passes the checks)")} ${c.green("(verified)")}`;
+    lines.push("", label, `  Subject: ${report.template.subject}`, ...report.template.text.split("\n").map((l) => `  ${l}`));
   }
   if (report.next_action?.message) lines.push("", `${c.cyan("Next:")} ${wrap(report.next_action.message, 110, "      ")}`);
   if (report.disclaimer) lines.push(c.dim(report.disclaimer));
@@ -4736,16 +4754,71 @@ var init_stripe_ids = __esm({
 });
 
 // ../core/src/stripe-key.ts
+function stripeKeyPermissionLine(filter) {
+  return STRIPE_KEY_PERMISSIONS.filter(filter ?? (() => true)).map((p) => `${p.resource}: ${p.access}`).join(", ");
+}
+function testKeyBoxName(via = "either") {
+  const label = via === "device" ? `\u201C${DEVICE_TEST_KEY_LABEL}\u201D` : via === "oauth" ? `\u201C${OAUTH_TEST_KEY_LABEL}\u201D` : `\u201C${DEVICE_TEST_KEY_LABEL}\u201D (agent sign-in) or \u201C${OAUTH_TEST_KEY_LABEL}\u201D (app connection)`;
+  return `the box ${label} (checkbox id ${TEST_KEY_CHECKBOX_ID})`;
+}
+function approvalKeyAsk(opts = {}) {
+  if (opts.stripe === false) return "";
+  const create = `create a restricted key in Stripe Test mode (${STRIPE_TEST_API_KEYS_URL} \u2192 Create restricted key) ticking ${stripeKeyPermissionLine()}, and put it in the project's env file (never in the chat)`;
+  return `${opts.stripe ? "In the same message" : "If the site sells through Stripe, in the same message"}, ask them to tick ${testKeyBoxName("device")} on that page${opts.keyFound ? "" : ` and, if the project has no rk_test_ key yet, to ${create}`}: one approval then covers the key and the test subscription.`;
+}
+var STRIPE_KEY_PERMISSIONS, STRIPE_TEST_API_KEYS_URL, DEVICE_TEST_KEY_LABEL, OAUTH_TEST_KEY_LABEL, TEST_KEY_CHECKBOX_ID;
 var init_stripe_key = __esm({
   "../core/src/stripe-key.ts"() {
     "use strict";
+    STRIPE_KEY_PERMISSIONS = [
+      { resource: "Customers", access: "Write", why: "Hosted cancellation page: finds the subscriber by email (Read). Test runs: create a test customer (Write, test mode only).", uses: ["fixes", "test_runs"], optional: true, writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Products", access: "Read", why: "Plan names next to your prices.", uses: ["checks", "test_runs"] },
+      { resource: "Prices", access: "Read", why: "Amounts, billing intervals and trial lengths, compared with what your pages say.", uses: ["checks", "test_runs"] },
+      { resource: "Coupons", access: "Read", why: "Only when your hosted cancellation page offers a coupon as the save offer.", uses: ["fixes"], optional: true },
+      { resource: "Subscriptions", access: "Write", why: "Read: which trials subscribers actually get. Write: cancels when a subscriber asks on your hosted cancellation page, and test runs create test subscriptions.", uses: ["checks", "fixes", "test_runs"], writeWhen: "Used only after you turn on the hosted cancellation page (you approve it in one click), or in test mode." },
+      { resource: "Test clocks", access: "Write", why: "Test runs fast-forward through trial end and renewal (test-mode keys only; nothing is charged).", uses: ["test_runs"], optional: true, writeWhen: "Used only in test mode." },
+      { resource: "Customer portal", access: "Write", why: "Read: whether subscribers can cancel online and your portal link. Write: test runs open the portal to cancel the test subscription.", uses: ["checks", "test_runs"], writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Checkout Sessions", access: "Write", why: "Read: your checkout text and terms-consent setting. Write: test runs start a test checkout.", uses: ["checks", "test_runs"], writeWhen: "Used only in test mode (test runs)." },
+      { resource: "Payment Links", access: "Write", why: "Read: consent and renewal text on your Payment Links. Write: the Payment Link fix, only when you click Approve.", uses: ["checks", "fixes"], writeWhen: "Used only after you click Approve on the Payment Link fix, or in test mode." },
+      { resource: "Webhook Endpoints", access: "Write", why: "Registers Checkbox\u2019s webhook endpoint, so renewals and cancellations are seen as they happen.", uses: ["checks"], writeWhen: "Used once, when you connect the key, to add Checkbox\u2019s own webhook endpoint (and to remove it when you disconnect); nothing else." }
+    ];
+    STRIPE_TEST_API_KEYS_URL = "https://dashboard.stripe.com/test/apikeys";
+    DEVICE_TEST_KEY_LABEL = "Let your agent store a Stripe test-mode restricted key for this project";
+    OAUTH_TEST_KEY_LABEL = "Let this app store a Stripe test-mode restricted key for your sites";
+    TEST_KEY_CHECKBOX_ID = "consent-stripe-test-key";
   }
 });
 
 // ../core/src/go-live.ts
+function goLiveSteps(input = {}) {
+  const out = [];
+  if (!input.domainVerified) out.push({ key: "verify_domain", who: "person", text: "Verify your domain (a DNS record or a file on your site). Live checks start only on a verified public domain." });
+  if (input.termsOfServiceRequired && !input.termsOfServiceUrlSet) out.push({ key: "stripe_terms_url", who: "person", text: input.termsOfServiceConditional ? GO_LIVE_TERMS_URL_STEP_CONDITIONAL : GO_LIVE_TERMS_URL_STEP, url: STRIPE_PUBLIC_DETAILS });
+  if (!input.liveKeyConnected)
+    out.push({
+      key: "live_stripe_key",
+      who: "person",
+      text: "Switch the dashboard to Live mode and connect your live Stripe key (rk_live_\u2026) with the same permissions as your test key (the checklist next to the key field: Read for the checks; Write only for fixes you approve and to add Checkbox\u2019s webhook endpoint). Only a person adds live keys; an agent never does."
+    });
+  if (input.checkoutKind === "payment_link")
+    out.push({ key: "live_checkout", who: "person", text: "Create the live Payment Link in Stripe live mode with the same settings as the test link Checkbox checked (renewal terms, consent checkbox, cancellation link); then your agent puts the live link on your site in place of the test link." });
+  else if (input.checkoutKind === "stripe_checkout")
+    out.push({ key: "live_checkout", who: "agent", text: "Ship the same Checkout Session params Checkbox checked with your live Price ids (the live Stripe secret key in your production settings is set by a person)." });
+  out.push({
+    key: "promote_site",
+    who: "person",
+    text: `Promote the site to live: Checkbox copies your Checkbox Notices settings, confirmed cancellation policy, support email and New York answers.${input.checkboxSends === false ? "" : " If Checkbox sends your emails, preview them and confirm once that it may email your real subscribers."}`
+  });
+  return out;
+}
+var STRIPE_PUBLIC_DETAILS, GO_LIVE_TERMS_URL_STEP, GO_LIVE_TERMS_URL_STEP_CONDITIONAL, GO_LIVE_STEPS;
 var init_go_live = __esm({
   "../core/src/go-live.ts"() {
     "use strict";
+    STRIPE_PUBLIC_DETAILS = "https://dashboard.stripe.com/settings/public";
+    GO_LIVE_TERMS_URL_STEP = 'Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details). Your checkout asks shoppers to accept your terms (consent_collection.terms_of_service = "required"), and Stripe refuses those Checkout Sessions until that URL is set.';
+    GO_LIVE_TERMS_URL_STEP_CONDITIONAL = 'Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details) before your checkout asks shoppers to accept your terms (consent_collection.terms_of_service = "required", which the checkout fix adds): Stripe refuses those Checkout Sessions until that URL is set.';
+    GO_LIVE_STEPS = goLiveSteps().map((s2) => s2.text);
   }
 });
 
@@ -4788,6 +4861,13 @@ var init_secrets = __esm({
   }
 });
 
+// ../core/src/site-unreachable.ts
+var init_site_unreachable = __esm({
+  "../core/src/site-unreachable.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/index.ts
 var init_src2 = __esm({
   "../core/src/index.ts"() {
@@ -4799,6 +4879,7 @@ var init_src2 = __esm({
     init_stripe_key();
     init_go_live();
     init_secrets();
+    init_site_unreachable();
   }
 });
 
@@ -4988,7 +5069,7 @@ var init_california = __esm({
         notes: notes(
           AB2863_APPLICABILITY,
           "Misrepresentation is only partly machine-detectable; the auto-renewal language check catches the most common case (offers that hide or deny the renewal).",
-          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock, $35M), a hidden early-termination fee (Adobe: Justice Department complaint filed June 2024).',
+          'Severity raised from medium to critical (catalog 2026.11.01.1, docs/legal/LITIGATION_PRIORITIES.md): misrepresentation is the theory behind the largest recent outcomes \u2014 "cancel at any time" without a prorated refund (Sanderson v. Whoop, sent to a jury in 2026), "no commitment" packs that renewed (FTC v. Shutterstock: proposed $35M order filed May 2026), a hidden early-termination fee (Adobe: Justice Department complaint filed June 2024).',
           'CHECK GAP: no check yet flags "cancel anytime" / "no commitment" copy contradicted by the refund or term policy, or a one-time purchase that enrolls the buyer in a subscription (product opportunity: a rollover and misrepresentation check). terms.refund_policy_consistent covers advertised refund promises.'
         )
       }),
@@ -5837,7 +5918,7 @@ var init_new_york = __esm({
     NYC_EFFECTIVE = "2026-10-01";
     NYC = "6 RCNY \xA7 5-110.1";
     NYC_RULE_VERIFIED = "2026-10-31";
-    NYC_NOTE = "NYC DCWP rule (adopted July 10, 2026; effective Oct. 1, 2026), verified against the adopted text on 2026-10-31. Applies to New York City consumers; evaluated wherever US-NY applies (territorial reach: open question 9). Exempt (\xA7 5-110.3): municipal franchise holders, DFS-regulated entities, licensed alarm operators, banks and licensed financial institutions, and service-contract sellers.";
+    NYC_NOTE = "NYC DCWP rule (adopted July 10, 2026; effective Oct. 1, 2026), verified against the adopted text on 2026-10-31. Applies to New York City consumers; evaluated wherever US-NY applies (how far the rule reaches outside the city is not settled yet). Exempt (\xA7 5-110.3): municipal franchise holders, DFS-regulated entities, licensed alarm operators, banks and licensed financial institutions, and service-contract sellers.";
     PART_W_NOTE = "Current text from L. 2025, ch. 58, Part W, effective Nov. 5, 2025.";
     PRE_PART_W = "Prior version: L. 2020, ch. 267 text in force Feb. 9, 2021 - Nov. 4, 2025 (sunset when Part W took effect); kept so evaluations as of earlier dates apply the law then in force.";
     NEW_YORK_REQUIREMENTS = [
@@ -6286,12 +6367,12 @@ var init_new_york = __esm({
         sourceUrl: NYC_RULE_URL,
         effectiveDate: NYC_EFFECTIVE,
         lastVerified: NYC_RULE_VERIFIED,
-        summary: "City rule mirroring GBL \xA7 527-a: material terms (including the deadline to act) before consent or billing information; cancellation as easy as consent, in the same medium and every consent medium, with an online option (website or email) for in-person sign-ups; no obstruction or unreasonable save offers; 15-45 day renewal notice (initial term of one year or more renewing for six months or more) and 3-21 day trial notice (trials over a month) in the consumer-selected channel; material-change notice at least 5 business days and no more than 30 days before the change (Checkbox schedules it 7-30 calendar days ahead). Violators refund every amount charged after the first cancellation attempt (\xA7 5-110.2); DCWP penalties $525 / $1,050 / $3,500. Checked together with New York State's rules.",
+        summary: "City rule mirroring GBL \xA7 527-a: material terms (including the deadline to act) before consent or billing information; cancellation as easy as consent, in the same medium and every consent medium, with an online option (website or email) for in-person sign-ups; no obstruction or unreasonable save offers; 15-45 day renewal notice (initial term of one year or more renewing for six months or more) and 3-21 day trial notice (trials over a month) in the consumer-selected channel; material-change notice at least 5 business days and no more than 30 days before the change (Checkbox Notices counts the business days, skipping weekends and public holidays). Violators refund every amount charged after the first cancellation attempt (\xA7 5-110.2); DCWP penalties $525 / $1,050 / $3,500. Checked together with New York State's rules.",
         status: "in_force",
         confidence: "medium",
         verification: "primary",
         requirementIdPrefixes: ["US-NY.NYC."],
-        scope: "New York City consumers. Exempt (\xA7 5-110.3): municipal franchise holders (e.g. cable), DFS-regulated entities, licensed alarm operators, banks and licensed financial institutions, and service-contract sellers. Territorial reach and interaction with state AG enforcement are open question 9 (hence medium confidence).",
+        scope: "New York City consumers. Exempt (\xA7 5-110.3): municipal franchise holders (e.g. cable), DFS-regulated entities, licensed alarm operators, banks and licensed financial institutions, and service-contract sellers. How far the rule reaches outside the city, and how it works alongside the Attorney General's enforcement of the state law, are not settled yet (hence medium confidence).",
         amendments: [
           { citation: "DCWP Notice of Adoption (proposed Apr. 8, 2026; hearing May 8, 2026; adopted July 10, 2026)", effectiveDate: NYC_EFFECTIVE, summary: 'Adds 6 RCNY Part 8 "Click to Cancel" (\xA7\xA7 5-110 to 5-110.3).' }
         ]
@@ -10157,11 +10238,11 @@ function findRecurringPrices(text, amounts, freqs) {
     let best = null;
     for (const f of freqs) {
       const after = f.index >= money3.index;
-      const gap = after ? f.index - (money3.index + money3.text.length) : money3.index - (f.index + f.text.length);
-      if (gap < -1) continue;
-      if (gap > (after ? 45 : 60)) continue;
+      const gap2 = after ? f.index - (money3.index + money3.text.length) : money3.index - (f.index + f.text.length);
+      if (gap2 < -1) continue;
+      if (gap2 > (after ? 45 : 60)) continue;
       if (SENTENCE_BREAK_RE.test(between(text, money3, f))) continue;
-      if (!best || gap < best.gap) best = { f, gap };
+      if (!best || gap2 < best.gap) best = { f, gap: gap2 };
     }
     if (best) {
       const start = Math.min(money3.index, best.f.index);
@@ -11440,10 +11521,10 @@ function withIntroOffers(declared, billing, offers) {
 }
 function shortPlanTerms(p) {
   const digits = currencyDigitsOf(p.currency);
-  const major = p.amount / 10 ** digits;
+  const major2 = p.amount / 10 ** digits;
   const cur = (p.currency || "usd").toLowerCase();
   const sym = { usd: "$", eur: "\u20AC", gbp: "\xA3", jpy: "\xA5" }[cur];
-  const num3 = Number.isInteger(major) ? String(major) : major.toFixed(digits);
+  const num3 = Number.isInteger(major2) ? String(major2) : major2.toFixed(digits);
   const money3 = sym ? `${sym}${num3}` : `${num3} ${cur.toUpperCase()}`;
   const every = (p.intervalCount || 1) > 1 ? ` every ${p.intervalCount} ${p.interval}s` : `/${p.interval}`;
   const trial = (p.trialDays ?? 0) > 0 ? ` with a ${p.trialDays}-day free trial` : "";
@@ -11713,11 +11794,11 @@ function formatMoney(amount, currency) {
   } catch {
     digits = 2;
   }
-  const major = amount / 10 ** digits;
+  const major2 = amount / 10 ** digits;
   try {
-    return new Intl.NumberFormat("en-US", { style: "currency", currency: code2, minimumFractionDigits: digits }).format(major);
+    return new Intl.NumberFormat("en-US", { style: "currency", currency: code2, minimumFractionDigits: digits }).format(major2);
   } catch {
-    return `${major.toFixed(digits)} ${code2}`;
+    return `${major2.toFixed(digits)} ${code2}`;
   }
 }
 function intervalPhrase(interval, count = 1) {
@@ -12106,6 +12187,13 @@ function checkoutSessionsOf(config) {
   if (!Array.isArray(raw)) return [];
   return raw.filter((s2) => !!s2 && typeof s2 === "object" && typeof s2.id === "string" && Array.isArray(s2.lineItems));
 }
+function withTestRunSessions(sessions, runSessionIds) {
+  if (!runSessionIds.size) return [...sessions];
+  return sessions.map((s2) => !s2.checkboxTestRun && runSessionIds.has(s2.id) ? { ...s2, checkboxTestRun: true } : s2);
+}
+function testRunSessionIds(runs) {
+  return new Set(runs.map((r) => r.state?.sessionId).filter((x) => typeof x === "string" && x.startsWith("cs_")));
+}
 function newestFirst(sessions) {
   return sessions.map((s2, i) => ({ s: s2, i })).sort((a, b) => (typeof b.s.created === "number" ? b.s.created : -Infinity) - (typeof a.s.created === "number" ? a.s.created : -Infinity) || a.i - b.i).map((x) => x.s);
 }
@@ -13333,7 +13421,7 @@ function checkoutConfigViews(ctx) {
   return (ctx.checkoutConfigs ?? []).filter((c) => c && c.capture).map((c) => ({
     ...buildSignupView(c.capture),
     label: `${c.kind === "payment_link" ? "Stripe Payment Link" : "Stripe Checkout config"} \u201C${c.name ?? c.id}\u201D`,
-    checkoutConfig: { id: c.id, ...c.name ? { name: c.name } : {}, consentRequired: c.consentRequired, ...c.kind ? { kind: c.kind } : {}, ...c.url ? { url: c.url } : {} },
+    checkoutConfig: { id: c.id, ...c.name ? { name: c.name } : {}, consentRequired: c.consentRequired, ...c.kind ? { kind: c.kind } : {}, ...c.url ? { url: c.url } : {}, ...typeof c.trialDays === "number" ? { trialDays: c.trialDays } : {} },
     // A Payment Link is read from Stripe on every billing read: it shows the link as of that read.
     ...c.kind === "payment_link" && readAt ? { observedAt: readAt } : {}
   }));
@@ -13801,7 +13889,7 @@ function platformKey(platform) {
 }
 function portalUnlinkedFix(portalUrl) {
   const login = portalUrl && /^https:\/\/billing\.stripe\.com\/p\/login\//.test(portalUrl) ? portalUrl : "billing.stripe.com/p/login/\u2026";
-  return `Add a \u201CManage subscription\u201D link to your account page that opens your Stripe customer portal (${login}), then run a scan so Checkbox sees it.`;
+  return `Add a \u201CManage subscription\u201D link that opens your Stripe customer portal (${login}) to your account page, or to your home page or footer if your site has no account page, then run a scan so Checkbox sees it.`;
 }
 function paymentLinkCancelRemediation(portalUrl, loginPageOn) {
   const link = portalUrl && /^https:\/\/billing\.stripe\.com\//.test(portalUrl) ? portalUrl : void 0;
@@ -14907,6 +14995,18 @@ var init_help_pages = __esm({
 });
 
 // ../rules/src/checks/cancel-paths.ts
+function mayOpenPortal(el, pageUrl2) {
+  const href = el.href;
+  if (!href) return true;
+  try {
+    const target = new URL(href, pageUrl2);
+    const page = new URL(pageUrl2);
+    if (target.host !== page.host) return true;
+    return /(?:^|\/)(?:api|portal|billing|billing-portal|create-portal-session|customer-portal)(?:\/|$|[-_?])/i.test(target.pathname);
+  } catch {
+    return true;
+  }
+}
 function inAppPath(input) {
   const flow = input.ctx.cancellation?.via === "stripe_portal" ? void 0 : input.ctx.cancellation;
   if (flow) {
@@ -14942,7 +15042,7 @@ function inAppPath(input) {
         return true;
       }
     });
-    if (leadsOnline.length) return { kind: "in_app", state: "offered", detail: `your own page offers a cancel option (${p.url})`, url: p.url };
+    if (leadsOnline.length) return { kind: "in_app", state: "offered", detail: `your own page offers a cancel option (${p.url})`, url: p.url, ...leadsOnline.every((el) => mayOpenPortal(el, p.url)) ? { mayOpenPortal: true } : {} };
   }
   if (input.ctx.facts?.cancelsInApp === true) return { kind: "in_app", state: "unconfirmed", detail: "subscribers cancel in your own app, but Checkbox has not seen a cancellation complete there yet" };
   return void 0;
@@ -15620,6 +15720,16 @@ var init_cancellation = __esm({
               { unverified: true, source: "snippet" }
             );
           }
+          if (controls.length && cfg?.selfServeOnline === false && controls.every((el) => mayOpenPortal(el, page.url))) {
+            return makeResult(
+              id,
+              "needs_review",
+              `A cancel page with an online cancel option (\u201C${quote(controls[0].text)}\u201D) was found at ${page.url}, but cancellation is off in your billing platform's customer portal: if this option opens the portal, subscribers cannot cancel there. Not yet verified by a cancellation test: run a test run, or turn cancellation on in the portal`,
+              [...captureRefs(page), ...configRefs],
+              0.5,
+              { inAppOffered: true, url: page.url, selfServeOnline: false, portalCancelOff: true }
+            );
+          }
           if (controls.length) {
             return makeResult(
               id,
@@ -16043,6 +16153,16 @@ var init_config2 = __esm({
         }
         if (c.selfServeOnline === false) {
           const flow = input.ctx.cancellation;
+          if (inApp?.state === "offered" && inApp.mayOpenPortal && model.hosted?.state !== "offered" && !(model.offline && !model.offline.soft)) {
+            return makeResult(
+              id,
+              "needs_review",
+              `Self-serve cancellation is off in ${name}'s portal. Your own page offers a cancel option (${inApp.url}), but Checkbox has not followed it to a finished cancellation yet: if it opens the ${name} customer portal, subscribers cannot cancel there. Run a test run (it cancels through your page), or turn cancellation on in the portal`,
+              refs(input),
+              0.6,
+              { ...data, ownCancelPage: true, inAppOfferedUntested: true, inAppUnobserved: true }
+            );
+          }
           if (model.otherOnlineWorks) {
             const via = inApp?.state === "works" && flow ? "subscribers cancel online through your own page (a test cancellation completed; see \u201Ccancel online\u201D)" : model.hosted?.state === "offered" ? `subscribers cancel through the Checkbox hosted cancellation page (${model.hosted.url}); see \u201Ccancel online\u201D` : `your own page offers a cancel option (${inApp?.url}); online cancellation is judged on that page (see \u201Ccancel online\u201D), so the portal setting is not required`;
             return makeResult(
@@ -16248,8 +16368,8 @@ function introEmailFinding(rawText, plans, opts) {
   const usable = plans.filter((p2) => p2.amount > 0 && p2.interval);
   if (!usable.length) return void 0;
   const text = normalizeText(rawText);
-  const major = (p2, minor) => minor / 10 ** currencyDigitsOf(p2.currency);
-  const regular = [...usable.map((p2) => major(p2, p2.amount)), ...opts.extraAmounts ?? []];
+  const major2 = (p2, minor) => minor / 10 ** currencyDigitsOf(p2.currency);
+  const regular = [...usable.map((p2) => major2(p2, p2.amount)), ...opts.extraAmounts ?? []];
   const isRegular = (n) => regular.some((r) => Math.abs(r - n) < 5e-3);
   const offRegular = (sentence) => findAmounts(sentence).filter((m) => {
     if (typeof m.amount !== "number" || !(m.amount > 0) || isRegular(m.amount)) return false;
@@ -16296,7 +16416,7 @@ function introEmailFinding(rawText, plans, opts) {
     };
   }
   const fits = (p2) => {
-    const intro = major(p2, p2.introAmount);
+    const intro = major2(p2, p2.introAmount);
     const pct = (1 - p2.introAmount / p2.amount) * 100;
     return statedAmounts.every((m) => Math.abs(m.amount - intro) < 5e-3) && percents.every((x) => Math.abs(x.value - pct) <= 0.5);
   };
@@ -16325,6 +16445,7 @@ function introEmailFinding(rawText, plans, opts) {
       fix: `State how long the promo really lasts: ${introTermsPhrase(p2)}.`
     };
   }
+  if (statesIntroEndDate(text)) return void 0;
   const p = fitting[0];
   return {
     status: "needs_review",
@@ -16334,29 +16455,32 @@ function introEmailFinding(rawText, plans, opts) {
     fix: `State how long the promo lasts and the price after it: ${introTermsPhrase(p)}.`
   };
 }
+function statesIntroEndDate(text) {
+  return INTRO_END_DATE_RES.some((re) => re.test(text));
+}
 function introFirstChargeFinding(rawText, plans) {
   const usable = plans.filter((p2) => p2.amount > 0 && p2.interval);
   if (!usable.length) return void 0;
   const text = normalizeText(rawText);
   const stated = findAmounts(text).filter((m) => typeof m.amount === "number" && m.amount > 0);
-  const major = (p2, minor) => minor / 10 ** currencyDigitsOf(p2.currency);
+  const major2 = (p2, minor) => minor / 10 ** currencyDigitsOf(p2.currency);
   const states = (n) => stated.some((m) => Math.abs(m.amount - n) < 5e-3);
-  const named = usable.filter((p2) => states(major(p2, p2.amount)));
+  const named = usable.filter((p2) => states(major2(p2, p2.amount)));
   if (!named.length || !named.every(hasIntro)) return void 0;
-  if (named.some((p2) => states(major(p2, p2.introAmount)))) return void 0;
+  if (named.some((p2) => states(major2(p2, p2.introAmount)))) return void 0;
   if (new RegExp(PERCENT_OFF_RE.source, "i").test(text)) return void 0;
   const p = named[0];
   const regular = money(p.amount, p.currency);
   const nameOf = p.label?.trim() || (p.name?.trim() ? `plan \u201C${p.name.trim()}\u201D` : `the ${regular} ${planEvery(p)} plan`);
   return {
     status: "fail",
-    quote: stated.find((m) => Math.abs(m.amount - major(p, p.amount)) < 5e-3)?.text ?? regular,
+    quote: stated.find((m) => Math.abs(m.amount - major2(p, p.amount)) < 5e-3)?.text ?? regular,
     reason: "intro_first_charge",
     detail: `states ${regular} as the charge after the trial, but ${nameOf} has an introductory price: the first charge after the trial is ${money(p.introAmount, p.currency)} (${introTermsPhrase(p)}) \u2014 state the intro price for that charge, then the regular price`,
     fix: `State the first charge after the trial and the price after it: ${introTermsPhrase(p)}.`
   };
 }
-var PERCENT_OFF_RE, DURATION_NUM, DURATION_UNIT, FIRST_DURATION_RE, FOR_DURATION_RE, VAGUE_DURATION_RE, TRIAL_DURATION_AROUND_RE, BILLED_LONGER_RE, INTRO_CUE_RE, NOT_A_PRICE_AROUND_RE, TRIAL_ENDING_RE;
+var PERCENT_OFF_RE, DURATION_NUM, DURATION_UNIT, FIRST_DURATION_RE, FOR_DURATION_RE, VAGUE_DURATION_RE, TRIAL_DURATION_AROUND_RE, BILLED_LONGER_RE, INTRO_CUE_RE, NOT_A_PRICE_AROUND_RE, DATE_RE_SRC, INTRO_WORD, REGULAR_PRICE, gap, INTRO_END_DATE_RES, TRIAL_ENDING_RE;
 var init_intro_terms = __esm({
   "../rules/src/checks/intro-terms.ts"() {
     "use strict";
@@ -16372,10 +16496,86 @@ var init_intro_terms = __esm({
     BILLED_LONGER_RE = /\bbilled\s+(?:annually|yearly|every\s+(?:\d{1,2}|twelve|two|three|six)\s+(?:months|years))\b|\bsingle\s+upfront\s+charge\b/i;
     INTRO_CUE_RE = /\bintro(?:ductory)?\b|\bpromo(?:tional)?\b|\bdiscount(?:ed)?\b|\bspecial\s+(?:price|offer|rate)\b|\bfirst\s+\w+|\bthen\b|\bafter\s+(?:that|which)\b/i;
     NOT_A_PRICE_AROUND_RE = /\b(?:tax(?:es)?|vat|fees?|shipping|delivery\s+fee|credit|refund(?:ed)?|balance|deposit|tip)\b/i;
+    DATE_RE_SRC = "(?:(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|june?|july?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)\\.?\\s+\\d{1,2}(?:st|nd|rd|th)?(?:,?\\s+\\d{4})?|\\d{1,2}\\s+(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]*\\.?(?:\\s+\\d{4})?|\\d{4}-\\d{2}-\\d{2}|\\d{1,2}/\\d{1,2}/\\d{2,4})";
+    INTRO_WORD = "(?:discount|coupon|promo(?:tion|tional)?(?:\\s+(?:price|rate|code))?|intro(?:ductory)?(?:\\s+(?:price|rate|offer|period))?|special\\s+(?:price|offer|rate)|offer)";
+    REGULAR_PRICE = "(?:regular|full|standard|normal|usual)\\s+(?:price|rate)";
+    gap = (n) => `(?:[^.\\n]|\\.(?=\\d)){0,${n}}?`;
+    INTRO_END_DATE_RES = [
+      new RegExp(`\\b${INTRO_WORD}\\b${gap(80)}\\b(?:ends?|ending|expires?|runs?\\s+out|lasts?\\s+(?:until|through)|is\\s+valid\\s+(?:until|through)|until|through)\\b${gap(100)}${DATE_RE_SRC}`, "i"),
+      new RegExp(`\\b${REGULAR_PRICE}\\b${gap(100)}\\b(?:from|on|starting(?:\\s+on)?|beginning(?:\\s+on)?|as\\s+of|after)\\s+${DATE_RE_SRC}`, "i"),
+      new RegExp(`\\b(?:starting|from|beginning|on|as\\s+of)\\s+${DATE_RE_SRC}${gap(100)}\\b${REGULAR_PRICE}\\b`, "i")
+    ];
     TRIAL_ENDING_RE = /\btrial\b[^.\n]{0,60}?\b(?:ends?|ending|expires?|is\s+over|runs?\s+out)\b|\b(?:after|when|once)\s+(?:your|the)\s+(?:free\s+)?trial\b/i;
   }
 });
 
+// ../rules/src/checks/charge-claims.ts
+function sentenceSpan(text, index) {
+  const dot = text.lastIndexOf(". ", index);
+  const start = Math.max(dot >= 0 ? dot + 2 : 0, text.lastIndexOf("\n", index) + 1);
+  const ends = [text.indexOf(". ", index), text.indexOf("\n", index)].filter((n) => n >= 0);
+  return { start: Math.min(start, index), end: ends.length ? Math.min(...ends) + 1 : text.length };
+}
+function misstatedRecurringCharge(text, prices, plans, others = []) {
+  const usable = plans.filter((p) => p.amount > 0 && p.interval);
+  if (!usable.length) return void 0;
+  const known = [...usable.map((p) => p.amount), ...others].filter((n) => n > 0);
+  const same = (a, b) => Math.abs(a - b) < 5e-3;
+  const statesPlanPrice = prices.some((r) => r.money.amount !== null && known.some((k) => same(k, r.money.amount)));
+  if (!statesPlanPrice) return void 0;
+  return prices.find((r) => {
+    const amount = r.money.amount;
+    const unit2 = r.frequency.unit;
+    if (amount === null || !(amount > 0) || !unit2) return false;
+    if (known.some((k) => same(k, amount))) return false;
+    const cur = (r.money.currency || "").toLowerCase();
+    const plansHere = usable.filter((p) => !cur || !p.currency || p.currency.toLowerCase() === cur);
+    if (!plansHere.some((p) => frequencyMatchesPlan(unit2, r.frequency.count, p))) return false;
+    if (plansHere.some((p) => {
+      const k = amount / p.amount;
+      return k >= 2 && Math.abs(k - Math.round(k)) < 1e-3;
+    })) return false;
+    if (isPerPeriodEquivalent(r, plansHere)) return false;
+    const at = r.money.index;
+    if (!(at >= 0) || text.slice(at, at + r.money.text.length) !== r.money.text) return false;
+    {
+      const { start, end } = sentenceSpan(text, at);
+      const sentence = text.slice(start, end);
+      const around = text.slice(Math.max(start, at - 24), Math.min(end, at + r.money.text.length + 40));
+      if (NOT_THE_CHARGE_AROUND_RE.test(around) || NOT_A_PRICE_AROUND_RE.test(around)) return false;
+      if (INTRO_CUE_RE.test(sentence) || INTRO_SENTENCE_RE.test(sentence)) return false;
+      const before = text.slice(Math.max(start, at - 32), at);
+      const adjacent = prices.some((o) => {
+        if (o === r || o.money.amount === null || o.money.index < 0 || !known.some((k) => same(k, o.money.amount))) return false;
+        const [a, b] = o.money.index < at ? [o.money, r.money] : [r.money, o.money];
+        return /^[\s()[\]/,:–—-]*$/.test(text.slice(a.index + a.text.length, b.index));
+      });
+      if (!adjacent && !CHARGE_CUE_BEFORE_RE.test(before)) return false;
+    }
+    return true;
+  });
+}
+function isPerPeriodEquivalent(r, plans) {
+  const amount = r.money.amount;
+  const unit2 = r.frequency.unit;
+  if (amount === null || !(amount > 0) || !unit2) return false;
+  const cur = (r.money.currency || "").toLowerCase();
+  return plans.some(
+    (p) => p.amount > 0 && (!cur || !p.currency || p.currency.toLowerCase() === cur) && !frequencyMatchesPlan(unit2, r.frequency.count, p) && Math.abs(amount * periodDays(p.interval, p.intervalCount) / periodDays(unit2, r.frequency.count) - p.amount) <= Math.max(0.02 * p.amount, 0.05)
+  );
+}
+var NOT_THE_CHARGE_AROUND_RE, INTRO_SENTENCE_RE, CHARGE_CUE_BEFORE_RE;
+var init_charge_claims = __esm({
+  "../rules/src/checks/charge-claims.ts"() {
+    "use strict";
+    init_plan_terms();
+    init_intro_terms();
+    NOT_THE_CHARGE_AROUND_RE = /\b(?:off|save[sd]?|saving|savings|value[sd]?|worth|reward|bonus|max(?:imum)?|up\s+to|prorat\w*|earlier|previous(?:ly)?|used\s+to|last\s+(?:year|month|week|period|time)|from|was|were|previously|formerly|regular(?:ly)?|normally|usually|instead\s+of|compared|vs\.?|versus|old|reg\.|retail|list\s+price|add-?ons?|extra|additional|per\s+(?:seat|user|member|license|licence|unit))\b/i;
+    INTRO_SENTENCE_RE = /\btrial\b|\bfree\b|\buntil\b[^.]*\bthen\b|\bfor\s+(?:the\s+|your\s+)?first\b|\bafter\s+(?:the\s+)?(?:first|trial|intro)/i;
+    CHARGE_CUE_BEFORE_RE = /\b(?:charg\w*|bill(?:s|ed|ing)?|pay(?:s|ing|ment)?|renew(?:s|al|ing)?|costs?|total|due|amount|price)\b[^$€£\d]*$/i;
+  }
+});
+
 // ../rules/src/checks/notice-content.ts
 function offlineOnlyCancelIn(text, cancelMethods) {
   const offline = contactOnlySentence(text);
@@ -16414,11 +16614,21 @@ function noticeContent(e, opts = {}) {
   ];
   const amount = a.recurringPrices[0]?.money ?? positiveAmounts(a)[0];
   const stated = positiveAmounts(a).filter((m) => m.amount !== null);
+  const toMajor = (p, minor) => minor / 10 ** currencyDigitsOf(p.currency);
+  const chargePlans = plans.map((p) => ({ amount: toMajor(p, p.amount), currency: p.currency, interval: p.interval, intervalCount: p.intervalCount }));
+  const misstated = plans.length ? misstatedRecurringCharge(
+    a.text,
+    a.recurringPrices,
+    chargePlans,
+    [...expected, ...plans.flatMap((p) => typeof p.introAmount === "number" && p.introAmount > 0 ? [toMajor(p, p.introAmount)] : [])]
+  ) : void 0;
   if (amount && expected.length && stated.length && !stated.some((m) => expected.some((x) => Math.abs(x - m.amount) < 5e-3))) wrong.amount = quote(amount);
+  else if (misstated) wrong.amount = quote(misstated.money);
   else if (amount) quotes.amount = quote(amount);
   const freq = a.recurringPrices[0]?.frequency ?? a.frequencies[0];
   const freqs = [...a.recurringPrices.map((r) => r.frequency), ...a.frequencies].filter((f) => f.unit);
-  const charged = a.recurringPrices.map((r) => r.frequency).filter((f) => !!f?.unit);
+  const planPriceStated = stated.some((m) => chargePlans.some((p) => Math.abs(p.amount - m.amount) < 5e-3));
+  const charged = a.recurringPrices.filter((r) => !!r.frequency?.unit && !(planPriceStated && isPerPeriodEquivalent(r, chargePlans))).map((r) => r.frequency);
   const misses = (f) => !plans.some((p) => frequencyMatchesPlan(f.unit, f.count, p));
   const wrongCharged = plans.length ? charged.find(misses) : void 0;
   if (wrongCharged) wrong.frequency = quote(wrongCharged);
@@ -16485,6 +16695,7 @@ var init_notice_content = __esm({
     init_context();
     init_intro_terms();
     init_result();
+    init_charge_claims();
     ELEMENT_LABELS = {
       amount: "the amount charged",
       frequency: "how often the subscription is charged",
@@ -16770,7 +16981,7 @@ function withoutRevisedDrafts(emails) {
   const draft2 = (e) => !e.subscriptionRef && !e.relatedSignupAt && !e.testRun && !isCheckboxSentEmail(e);
   const trial = (e) => /\b(?:free\s+)?trial\b/i.test(`${e.subject ?? ""} ${emailBody(e)}`);
   const at = (e) => toDate(e.receivedAt)?.getTime() ?? 0;
-  return emails.filter((e) => !(draft2(e) && sender(e) && emails.some((o) => o !== e && draft2(o) && sender(o) === sender(e) && trial(o) === trial(e) && at(o) > at(e))));
+  return emails.filter((e) => !(draft2(e) && sender(e) && emails.some((o) => o !== e && sender(o) === sender(e) && trial(o) === trial(e) && at(o) > at(e))));
 }
 function latestPerTemplateAndPlan(emails, input) {
   const offers = contextOffers(input.ctx);
@@ -17683,29 +17894,29 @@ function contentGap(required, emails, opts = {}) {
   }
   return null;
 }
-function contentFail(spec, required, gap, timing, refs2, data) {
-  const intro = gap.intro;
-  const sentWhat = isPreflightEmail(gap.email) ? "is a draft that" : `${timing}, but it`;
+function contentFail(spec, required, gap2, timing, refs2, data) {
+  const intro = gap2.intro;
+  const sentWhat = isPreflightEmail(gap2.email) ? "is a draft that" : `${timing}, but it`;
   const introData = intro ? { contentIntro: { status: intro.status, reason: intro.reason, quote: intro.quote, fix: intro.fix } } : {};
-  if (!gap.missing.length && intro) {
+  if (!gap2.missing.length && intro) {
     return makeResult(
       spec.checkId,
       intro.status,
-      `The ${spec.noun} (${emailLabel(gap.email)}) ${sentWhat} ${intro.detail}`,
-      [...emailRefs(gap.email), ...refs2],
+      `The ${spec.noun} (${emailLabel(gap2.email)}) ${sentWhat} ${intro.detail}`,
+      [...emailRefs(gap2.email), ...refs2],
       intro.status === "fail" ? 0.8 : 0.5,
-      { ...data, contentMissing: [], contentEmailId: gap.email.id, ...isCheckboxSentEmail(gap.email) ? { contentByCheckbox: true } : {}, ...introData }
+      { ...data, contentMissing: [], contentEmailId: gap2.email.id, ...isCheckboxSentEmail(gap2.email) ? { contentByCheckbox: true } : {}, ...introData }
     );
   }
   return makeResult(
     spec.checkId,
     "fail",
-    `The ${spec.noun} (${emailLabel(gap.email)}) ${isPreflightEmail(gap.email) ? "is a draft that" : `${timing}, but it`} does not state ${describeMissing(gap.missing)}${// Round 20 (pilot 19 item 16, change-guard: "contradicts the plan or is not an online way to cancel"): each wrong
+    `The ${spec.noun} (${emailLabel(gap2.email)}) ${isPreflightEmail(gap2.email) ? "is a draft that" : `${timing}, but it`} does not state ${describeMissing(gap2.missing)}${// Round 20 (pilot 19 item 16, change-guard: "contradicts the plan or is not an online way to cancel"): each wrong
     // element says its own reason.
-    gap.wrong ? ` correctly (it says ${Object.entries(gap.wrong).map(([k, v]) => `\u201C${v}\u201D for ${ELEMENT_LABELS[k]}, ${k === "cancellation" ? "which is not an online way to cancel" : "which contradicts the plan"}`).join("; ")})` : ""} \u2014 the notice must tell the subscriber ${describeMissing(required)}${intro ? `; it also ${intro.detail}` : ""}`,
-    [...emailRefs(gap.email), ...refs2],
+    gap2.wrong ? ` correctly (it says ${Object.entries(gap2.wrong).map(([k, v]) => `\u201C${v}\u201D for ${ELEMENT_LABELS[k]}, ${k === "cancellation" ? "which is not an online way to cancel" : "which contradicts the plan"}`).join("; ")})` : ""} \u2014 the notice must tell the subscriber ${describeMissing(required)}${intro ? `; it also ${intro.detail}` : ""}`,
+    [...emailRefs(gap2.email), ...refs2],
     0.8,
-    { ...data, contentMissing: gap.missing, contentEmailId: gap.email.id, ...isCheckboxSentEmail(gap.email) ? { contentByCheckbox: true } : {}, ...gap.wrong ? { contentWrong: gap.wrong } : {}, ...introData }
+    { ...data, contentMissing: gap2.missing, contentEmailId: gap2.email.id, ...isCheckboxSentEmail(gap2.email) ? { contentByCheckbox: true } : {}, ...gap2.wrong ? { contentWrong: gap2.wrong } : {}, ...introData }
   );
 }
 async function runReminder(spec, input) {
@@ -17805,8 +18016,8 @@ async function runReminder(spec, input) {
   const w = conflicting ? "within each state\u2019s window" : why(window);
   if (counted.length) {
     if (!outside.length && !missing.length && !partial.length) {
-      const gap = contentGap(required, matched.flatMap((j) => j.email ? [j.email] : []), contentOpts);
-      if (gap) return contentFail(spec, required, gap, "was sent on time", refs2(matched), data);
+      const gap2 = contentGap(required, matched.flatMap((j) => j.email ? [j.email] : []), contentOpts);
+      if (gap2) return contentFail(spec, required, gap2, "was sent on time", refs2(matched), data);
       return makeResult(
         id,
         "pass",
@@ -17897,8 +18108,8 @@ async function runReminder(spec, input) {
       return contentFail(spec, required, newestGap, t ? `was sent about ${t.days} days ahead (required: ${conflicting ? w : why(t.w)})` : "was captured (its timing could not be verified)", configRefs, data);
     }
     if (inWindow.length) {
-      const gap = contentGap(required, inWindow.map((t) => t.e), contentOpts);
-      if (gap) return contentFail(spec, required, gap, `was sent about ${inWindow[0].days} days ahead (required: ${conflicting ? w : why(inWindow[0].w)})`, configRefs, data);
+      const gap2 = contentGap(required, inWindow.map((t) => t.e), contentOpts);
+      if (gap2) return contentFail(spec, required, gap2, `was sent about ${inWindow[0].days} days ahead (required: ${conflicting ? w : why(inWindow[0].w)})`, configRefs, data);
       return makeResult(
         id,
         "pass",
@@ -17910,8 +18121,8 @@ async function runReminder(spec, input) {
     }
     if (nearWindow.length) {
       const n = nearWindow[0];
-      const gap = contentGap(required, nearWindow.map((t) => t.e), contentOpts);
-      if (gap) return contentFail(spec, required, gap, `was sent about ${n.days} days ahead (required: ${conflicting ? w : why(n.w)})`, configRefs, data);
+      const gap2 = contentGap(required, nearWindow.map((t) => t.e), contentOpts);
+      if (gap2) return contentFail(spec, required, gap2, `was sent about ${n.days} days ahead (required: ${conflicting ? w : why(n.w)})`, configRefs, data);
       data.timingNearWindow = { days: n.days, required: conflicting ? w : why(n.w), roundingRule: DAYS_ROUNDING_RULE, ...n.range ? { range: n.range } : {} };
       data.timingOutsideWindow = { days: n.days, required: conflicting ? w : why(n.w) };
       return makeResult(
@@ -19207,8 +19418,8 @@ function gatedByOwnBox(renewalBoxes, path) {
   return renewalBoxes.some((b) => b.required === true && !b.checkedByDefault && consentGate(b, path) === "gated");
 }
 function boxNearCta(box, cta) {
-  const gap = box.y >= cta.y + cta.height ? box.y - (cta.y + cta.height) : cta.y >= box.y + box.height ? cta.y - (box.y + box.height) : 0;
-  return gap <= 200;
+  const gap2 = box.y >= cta.y + cta.height ? box.y - (cta.y + cta.height) : cta.y >= box.y + box.height ? cta.y - (box.y + box.height) : 0;
+  return gap2 <= 200;
 }
 var NO_CHECKOUT_CAPTURE_MESSAGE, NO_PURCHASE_BUTTON, OTHER_PLAN_CARD_NOTE, heuristicCache, PROCESSOR_LINE_NOTE, RENEWAL_CONTEXT_RE, autorenewLanguage, autorenewOverViews, FOOTNOTE_RE, NON_CHARGE_AMOUNT_RE, INTRO_PRICE_RE, RENEWAL_PRICE_RE, PRODUCT_TITLE_RE, CHARGED_NOW_RE, LATER_CHARGE_RE, price, frequency, CANCEL_LINK_RE, cancellationPolicy, TRIAL_DAYS_SLACK, trialTerms2, termLength, PLACEMENT_RANK, proximity, conspicuous, RENEWAL_CONSENT_RE, CONSENT_CHECKBOX_RE, TOS_RE, SUBSCRIPTION_CTA_RE, MARKETING_RE, RENEWAL_TERMS_RE, NOTIFICATION_OPT_IN_RE, AGREEMENT_RE, SEPARATE_CONSENT_JURISDICTIONS, EXPRESS_CONSENT_COUNSEL_QUESTION, CA_SEPARATE_CONSENT, consentAffirmative, consentOverViews, notPrechecked, SIGNUP_CHECKS;
 var init_signup = __esm({
@@ -19223,6 +19434,7 @@ var init_signup = __esm({
     init_offer_view();
     init_plan_terms();
     init_cancellation();
+    init_charge_claims();
     init_intro_terms();
     init_intro_terms();
     init_result();
@@ -19388,6 +19600,29 @@ var init_signup = __esm({
                 const pl = view.plan?.plan;
                 return !!pl && hasIntro(pl) && r.money.amount !== null && Math.abs(r.money.amount - pl.introAmount / 10 ** currencyDigits(pl.currency || "usd")) < 5e-3;
               };
+              if (!tied && plans.length) {
+                const sitePrices = withAccountPrices(referencePlans(input.ctx), input.ctx).map((p) => p.amount / 10 ** currencyDigits((p.currency || "usd").toLowerCase()));
+                const intros = [...plans.map((p) => p.plan), ...view.plan ? [view.plan.plan] : []].flatMap(
+                  (pl) => hasIntro(pl) ? [pl.introAmount / 10 ** currencyDigits((pl.currency || "usd").toLowerCase())] : []
+                );
+                const misstated = misstatedRecurringCharge(
+                  near2.text,
+                  parsed,
+                  plans.map((p) => ({ amount: p.amount, currency: p.currency, interval: p.plan.interval, intervalCount: p.plan.intervalCount })),
+                  [...sitePrices, ...intros]
+                );
+                if (misstated && !NON_CHARGE_AMOUNT_RE.test(quote(misstated) ?? "") && !INTRO_PRICE_RE.test(quote(misstated) ?? "")) {
+                  const said = misstated.money.text;
+                  const own = quote(parsed.find(recurringMatches) ?? rp) ?? "";
+                  const firm = decisive && input.ctx.facts?.partialPlans !== true && !otherPlanCard(view, input);
+                  return unit(
+                    firm ? "fail" : "needs_review",
+                    `the terms state \u201C${own}\u201D but also \u201C${said}\u201D for the same billing period, and ${plans.length === 1 ? "the plan charges" : "the plans charge"} ${plans.slice(0, 4).map((p) => p.label).join(", ")} \u2014 state only the recurring charge subscribers will actually pay`,
+                    firm ? 0.85 : 0.6,
+                    { quote: said, meta: { ...meta(misstated.money.amount, misstated.money.currency), priceMismatch: true, secondCharge: true } }
+                  );
+                }
+              }
               const foreign = tied && plans.length ? parsed.find((r) => r.frequency.unit && !recurringMatches(r) && !equivalentOfPlan(r) && !ownIntro(r) && !INTRO_PRICE_RE.test(quote(r) ?? "")) : void 0;
               if (foreign) {
                 const own = parsed.find(recurringMatches) ?? rp;
@@ -19689,8 +19924,18 @@ var init_signup = __esm({
           const offers = contextOffers(input.ctx);
           const loose = !view.plan || view.plan.how === "only_plan";
           const cardOffer = loose && (view.offer || view.checkoutConfig) && offers.length > 1 ? offerForView(view, offers) : void 0;
-          const planTrial = cardOffer ? cardOffer.trialDays : view.plan ? offerTrialDays(offers, view.plan.plan, input.ctx.facts) : void 0;
+          const paramsTrial = view.checkoutConfig?.trialDays;
+          const planTrial = typeof paramsTrial === "number" ? paramsTrial : cardOffer ? cardOffer.trialDays : view.plan ? offerTrialDays(offers, view.plan.plan, input.ctx.facts) : void 0;
           const planName = cardOffer ? offerName(cardOffer) : view.plan?.label;
+          if (mentioned && paramsTrial === 0) {
+            const said = [...a.trialLengths, ...p.trialLengths][0] ?? [...a.trialMentions, ...p.trialMentions][0];
+            return unit(
+              "fail",
+              `the text promises a free trial${said ? ` (\u201C${quote(said)}\u201D)` : ""}, but the ${view.checkoutConfig?.kind === "payment_link" ? "Payment Link" : "Checkout params"} run none (no subscription_data.trial_period_days), so Stripe charges the full price today \u2014 add the trial to subscription_data, or remove the promise from the text`,
+              0.85,
+              { ...said ? { quote: quote(said) } : {}, meta: { planTrialDays: 0, paramsTrialDays: 0, trialMismatch: true } }
+            );
+          }
           if (!mentioned) {
             if (planTrial === 0 && offers.some((o) => o.trialDays > 0)) {
               const withTrial = offers.filter((o) => o.trialDays > 0).map(offerName);
@@ -19715,7 +19960,7 @@ var init_signup = __esm({
           const meta = {};
           if (length && "days" in length && length.days !== null) meta.disclosedTrialDays = length.days;
           if (input.facts.trialDays) meta.configuredTrialDays = input.facts.trialDays;
-          const ownPlanOnly = (!!view.plan || !!cardOffer) && (!!view.checkoutConfig || !!view.offer) && planTrial !== void 0;
+          const ownPlanOnly = (typeof paramsTrial === "number" || !!view.plan || !!cardOffer) && (!!view.checkoutConfig || !!view.offer) && planTrial !== void 0;
           const trialPlans = [
             ...(input.ctx.config?.plans ?? []).map((pl) => ({ trialDays: pl.trialDays, source: configPlanSource(input.ctx) })),
             ...(input.ctx.referencePlans ?? []).map((pl) => ({ trialDays: pl.trialDays, source: pl.source }))
@@ -22025,6 +22270,24 @@ var init_brand_scope = __esm({
   }
 });
 
+// ../rules/src/set-off-fix.ts
+function setOffFix(text) {
+  const own = /legible \((\d+(?:\.\d+)?)px, weight (\d+)/.exec(text);
+  const ref = /look like the surrounding text \(about (\d+(?:\.\d+)?)px, weight (\d+)/.exec(text);
+  if (!ref) return 'Set the renewal line apart from the text around it in a way Checkbox can measure: larger type (about 15% larger), semibold (weight 600+) where the text around it is not bold, a contrasting colour, or a border (e.g. style="border:1px solid currentColor;padding:8px 12px"). Any one of these is enough.';
+  const refPx = Number(ref[1]);
+  const refWeight = Number(ref[2]);
+  const larger = Math.ceil(refPx * 1.15);
+  const measured = own ? `It is ${own[1]}px, weight ${own[2]}; the text around it is about ${refPx}px, weight ${refWeight}${refWeight >= 600 ? " (already bold, so a bolder weight cannot set it apart)" : ""}.` : `The text around it is about ${refPx}px, weight ${refWeight}.`;
+  const ways = [`${larger}px or larger`, ...refWeight < 600 ? ["semibold (font-weight 600 or more)"] : [], "a contrasting colour (not grey)", 'a border around it (e.g. style="border:1px solid currentColor;padding:8px 12px")'];
+  return `Set the renewal line apart in a way Checkbox can measure. ${measured} Any one of these is enough: ${ways.join("; ")}.`;
+}
+var init_set_off_fix = __esm({
+  "../rules/src/set-off-fix.ts"() {
+    "use strict";
+  }
+});
+
 // ../rules/src/status.ts
 function tierOf(checkId) {
   return CHECK_TIERS[checkId] ?? "required";
@@ -22121,10 +22384,18 @@ function cancelTestProblem(raw) {
 }
 function policyUnreadableFix(text) {
   const n = /\((\d+) characters/.exec(text)?.[1];
-  if (n !== void 0 || /almost no text/.test(text)) {
-    return `Your Terms page has only ${n !== void 0 ? `${n} characters` : "a few words"} of text, so there is nothing for Checkbox to check yet: add sections on how the subscription renews, how to cancel and your refund policy (or, if the page is built with JavaScript, serve that text in the HTML). Checkbox reads it again on the next check.`;
+  const doc = /\b(terms of service|cancellation policy|refund policy|privacy policy)\s*\((https?:\/\/[^\s),]+)/i.exec(text);
+  const kind = doc?.[1]?.toLowerCase();
+  const url = doc?.[2];
+  const page = !kind || kind === "terms of service" ? "Terms page" : `${kind} page`;
+  const named = url ? `Your ${page} (${url})` : `Your ${page}`;
+  if (url && /\/p\/login\//i.test(url)) {
+    return `${url} is a Stripe customer portal sign-in page, not a policy page, so there is no ${kind === "terms of service" || !kind ? "Terms" : kind} text to check there. Keep it as your cancel link (account page, emails); remove it as the ${kind === "terms of service" || !kind ? "Terms" : kind} URL (updateSetupSession ${kind === "refund policy" ? "refund_url" : kind === "cancellation policy" ? "cancellation_url" : "terms_url"}: null) or replace it with the page that states the policy. Checkbox reads it again on the next check.`;
   }
-  return "Checkbox could not read your Terms page: register a public URL that serves the policy text without a login (Site settings, or updateSite terms_url). Checkbox reads it again on the next check.";
+  if (n !== void 0 || /almost no text/i.test(text)) {
+    return `${named} has only ${n !== void 0 ? `${n} characters` : "a few words"} of text, so there is nothing for Checkbox to check yet: add sections on how the subscription renews, how to cancel and your refund policy (or, if the page is built with JavaScript, serve that text in the HTML). Checkbox reads it again on the next check.`;
+  }
+  return `Checkbox could not read ${url ? `your ${page} (${url})` : `your ${page}`}: register a public URL that serves the policy text without a login (Site settings, or updateSite terms_url). Checkbox reads it again on the next check.`;
 }
 function finish(base, reason, checkId, tier = tierOf(checkId)) {
   if (reason === "ny_owner_decision") return { ...base, label: NY_EMAIL_ONLY_LABEL, reason, tier };
@@ -22359,6 +22630,7 @@ var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_L
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
+    init_set_off_fix();
     init_notice_content();
     init_notices_on();
     init_plan_terms();
@@ -22647,17 +22919,30 @@ var init_status = __esm({
       { code: "far_from_button", category: "content", when: has(/far from the purchase button|only far from/), build: () => ({ status: "needs_fix", fix: "Move the renewal line directly above (or right below) the pay button." }) },
       { code: "below_button_small", category: "content", when: has(/directly below the purchase button/), build: () => ({ status: "needs_fix", fix: "Move the renewal line under the price, before the card and email fields and the pay button, at body size." }) },
       // Normal round 2 (nextjs, django): "looks like the surrounding text" is a measurement Checkbox cannot finish (borders,
-      // symbols and italics are not captured), so it is a question to confirm by eye, not "Needs a fix". Never compliant.
+      // symbols and italics are not captured), so it was a question to confirm by eye. Round 33 (pilot 32 item 18,
+      // core-api-only / core-ci-pr / core-discovery: the owner was asked for "a decision" an agent could make in code, and the
+      // recommended "make it semibold" could never pass next to an already bold price line): a fix with the measured values
+      // and the ways Checkbox can measure (larger type, semibold where the text around is not bold, a contrasting colour, a
+      // border). Never compliant.
+      // A disclosure text check (kind "disclosure") only knows the styling the caller describes (placement.bold / boxed):
+      // there it stays the question it was, with the same measurable options.
       {
         code: "not_set_off",
+        category: "content",
+        when: (c) => c.kind !== "disclosure" && /look like the surrounding text/.test(c.text),
+        build: (c) => ({ status: "needs_fix", fix: setOffFix(c.text) })
+      },
+      {
+        code: "not_set_off_described",
         category: "legal_choice",
-        when: has(/look like the surrounding text/),
-        build: () => ({
+        when: (c) => c.kind === "disclosure" && /look like the surrounding text/.test(c.text),
+        build: (c) => ({
           status: "your_call",
+          fix: setOffFix(c.text),
           question: ask(
-            "Confirm by eye: does the renewal line stand out from the text around it (semibold, a brand colour, or a border)?",
-            "Yes if it is semibold or in a colour next to the button; if not, make it semibold (same size, no box or banner needed).",
-            "Checkbox measured the same size, weight and colour as the nearby body text, but cannot see borders or symbols."
+            "Confirm by eye: does the renewal line stand out from the text around it (semibold where the text around it is not bold, larger type, a contrasting colour, or a border)?",
+            "If it does, check again with placement.bold (or placement.boxed) set; if not, apply one of the ways in the fix.",
+            "This check only knows the styling you describe; it cannot see your page."
           )
         })
       },
@@ -23005,7 +23290,7 @@ var init_status = __esm({
       { code: "stripe_checkout_unchecked", category: "missing_evidence", when: has(/checkout session whose parameters checkbox has not checked|register the checkout session parameters/), build: (c) => ({ status: "pending_live_check", pending: pendingFor("", `${c.text} createstripecheckoutconfig`, c.data) }) }
     ];
     STATUS_RULES = RULES.map((r) => ({ code: r.code, category: r.category }));
-    NY_EMAIL_ONLY_LABEL = "Your decision: email only";
+    NY_EMAIL_ONLY_LABEL = "Your decision: email only (not verified)";
     NY_EMAIL_ONLY_NOTE = 'You recorded your decision to send renewal and reminder notices by email only. New York asks for notices "in the manner the consumer selected"; whether email that nobody picked meets that is not settled, and Checkbox does not decide it. You can add an Email choice at sign-up at any time.';
     STRIPE_HOSTED_UNITS = /* @__PURE__ */ new Set(["checkout_config", "payment_link", "stripe_hosted"]);
     PLATFORM_NAMES2 = { paddle: "Paddle", shopify: "Shopify", recharge: "Recharge", chargebee: "Chargebee", recurly: "Recurly" };
@@ -23807,12 +24092,12 @@ function disclosureParts(text) {
 function disclosureHtml(text) {
   return disclosureParts(text).map((p) => "url" in p ? `<a href="${esc(p.url)}">${esc(p.label)}</a>` : esc(p.text)).join("");
 }
-function htmlDisclosureComponent(texts, sha2562) {
+function htmlDisclosureComponent(texts, sha2562, opts = {}) {
   return `<!-- Checkbox renewal terms (generated from your plan's price, interval and cancellation URL; regenerate instead of editing the text).
      Paste INSIDE your sign-up <form>, directly ABOVE the subscribe / purchase button.
-     One line in your page's own font, size and colours: semibold sets it apart from normal-weight text (clear and conspicuous).
-     If the text around it is already bold (a bold price line), put it in a bordered or shaded box instead. Keep it at body size and readable contrast; do not make it smaller or lighter than the text around it. -->
-<div class="checkbox-renewal-terms" data-checkbox-terms="${esc(sha2562)}" style="margin:12px 0;line-height:1.5;">
+${opts.boxed ? BOXED_NOTE : `     One line in your page's own font, size and colours: semibold sets it apart from normal-weight text (clear and conspicuous).
+     If the text around it is already bold (a bold price line), put it in a bordered or shaded box instead.`} Keep it at body size and readable contrast; do not make it smaller or lighter than the text around it. -->
+<div class="checkbox-renewal-terms" data-checkbox-terms="${esc(sha2562)}" style="margin:12px 0;line-height:1.5;${opts.boxed ? BOXED_STYLE : ""}">
   <p style="margin:0 0 6px;font-weight:600;">${disclosureHtml(texts.disclosure)}</p>
   <label style="display:flex;gap:8px;align-items:flex-start;">
     <!-- Never add "checked": consent must be an affirmative act. -->
@@ -23822,23 +24107,26 @@ function htmlDisclosureComponent(texts, sha2562) {
 </div>
 <button type="submit">${esc(texts.cta)}</button>`;
 }
-function htmlTermsOnly(disclosure, sha2562, onStripe) {
+function htmlTermsOnly(disclosure, sha2562, onStripe, opts = {}) {
   const where2 = onStripe === "payment_link" ? "Payment Link" : "Stripe Checkout";
   return `<!-- Checkbox renewal terms (generated from your plan's price, interval and cancellation URL; regenerate instead of editing the text).
      Paste directly ABOVE your own subscribe / Join link or button. Keep that link or button as it is.
      No consent checkbox here: the ${where2} collects consent (consent_collection.terms_of_service = "required").
-     One line in your page's own font, size and colours: semibold sets it apart from normal-weight text (clear and conspicuous).
-     If the text around it is already bold (a bold price line), put it in a bordered or shaded box instead. -->
-<div class="checkbox-renewal-terms" data-checkbox-terms="${esc(sha2562)}" style="margin:12px 0;line-height:1.5;">
+${opts.boxed ? BOXED_NOTE : `     One line in your page's own font, size and colours: semibold sets it apart from normal-weight text (clear and conspicuous).
+     If the text around it is already bold (a bold price line), put it in a bordered or shaded box instead.`} -->
+<div class="checkbox-renewal-terms" data-checkbox-terms="${esc(sha2562)}" style="margin:12px 0;line-height:1.5;${opts.boxed ? BOXED_STYLE : ""}">
   <p style="margin:0;font-weight:600;">${disclosureHtml(disclosure)}</p>
 </div>`;
 }
-var esc, URL_RE2;
+var esc, URL_RE2, BOXED_STYLE, BOXED_NOTE;
 var init_html = __esm({
   "../rules/src/fixes/html.ts"() {
     "use strict";
     esc = (s2) => s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
     URL_RE2 = /https?:\/\/[^\s<>"']+[^\s<>"'.,;:!?)]/g;
+    BOXED_STYLE = "border:1px solid currentColor;border-radius:6px;padding:8px 12px;";
+    BOXED_NOTE = `     The text next to your button is already bold, so a semibold line cannot stand out: this version is set off by a border
+     (${BOXED_STYLE.replace(/;$/, "")}), which Checkbox measures. Keep the border, or use 15% larger type instead.`;
   }
 });
 
@@ -23865,6 +24153,10 @@ function fixTextsFor(t, style2) {
   if (style2 === "full") return fixTexts(t);
   return { disclosure: compactDisclosureText(t), consentLabel: COMPACT_CONSENT_LABEL, cta: compactCtaLabel(t) };
 }
+function stripeCompactConsent(t) {
+  const trial = t.trialDays && t.trialDays > 0 ? ` after the ${t.trialDays}-day free trial` : "";
+  return `I agree that my subscription renews automatically at ${formatMoney(t.amount, t.currency)} every ${intervalPhrase(t.interval, t.intervalCount)}${trial} until I cancel.`;
+}
 var COMPACT_CONSENT_LABEL;
 var init_compact = __esm({
   "../rules/src/fixes/compact.ts"() {
@@ -23881,9 +24173,10 @@ function shortDisclosureText(t) {
   const trial = !!t.trialDays && t.trialDays > 0;
   const intro = introPhrase(t);
   const cancel = `Cancel anytime online at ${t.cancelUrl}`;
-  if (trial) return `${t.trialDays} days free, then ${intro ?? `${price3} every ${every}`}. Renews automatically until you cancel. ${cancel} before the trial ends to avoid being charged.`;
-  if (intro) return `${intro[0].toUpperCase()}${intro.slice(1)}. Renews automatically until you cancel. ${cancel}.`;
-  return `Renews automatically every ${every} at ${price3} until you cancel. ${cancel}.`;
+  const tax = " (plus applicable taxes)";
+  if (trial) return `${t.trialDays} days free, then ${intro ?? `${price3} every ${every}`}${tax}. Renews automatically until you cancel. ${cancel} before the trial ends to avoid being charged.`;
+  if (intro) return `${intro[0].toUpperCase()}${intro.slice(1)}${tax}. Renews automatically until you cancel. ${cancel}.`;
+  return `Renews automatically every ${every} at ${price3}${tax} until you cancel. ${cancel}.`;
 }
 var init_short = __esm({
   "../rules/src/fixes/short.ts"() {
@@ -23916,7 +24209,7 @@ function modelAfterCapture(before, target, texts, opts) {
   const ctaY = cta ? cta.rect.y : 700;
   const ctaH = cta ? cta.rect.height : 48;
   const stripe = target === "stripe_checkout" || target === "stripe_payment_link";
-  const style2 = stripe ? STRIPE_CUSTOM_TEXT_STYLE : COMPONENT_STYLE;
+  const style2 = stripe ? STRIPE_CUSTOM_TEXT_STYLE : opts.boxed ? { ...COMPONENT_STYLE, boxed: true } : COMPONENT_STYLE;
   const disclosureH = textHeight(texts.disclosure, width, style2.fontSizePx);
   const labelH = textHeight(texts.consentLabel, width - 28, style2.fontSizePx);
   const disclosure = {
@@ -24048,7 +24341,7 @@ async function verifyFix(input) {
   const rest = captures.filter((c) => !allCheckout(c));
   const unchangedCheckout = latestPages(captures.filter((c) => allCheckout(c) && !matching.some((m) => m.id === c.id))).filter((c) => (c.ctas?.length ?? 0) > 0);
   const otherCheckoutPages = new Set(unchangedCheckout.map((c) => c.url.split(/[?#]/)[0])).size;
-  const after = base.map((c) => modelAfterCapture(c, input.target, input.texts, { consentCheckbox: consent }));
+  const after = base.map((c) => modelAfterCapture(c, input.target, input.texts, { consentCheckbox: consent, ...input.boxed ? { boxed: true } : {} }));
   const changedIds = new Set(objects.map((o) => o.id));
   const afterConfigs = input.ctx.checkoutConfigs?.map(
     (c) => changedIds.has(c.id) ? { ...c, capture: modelAfterCapture(c.capture, input.target, input.texts, { consentCheckbox: consent }), consentRequired: consent || c.consentRequired } : c
@@ -24313,13 +24606,18 @@ async function buildReplacement(plan2, jurisdictions, asOf, now, opts = {}) {
   const verifyTexts = lockedTexts(verifyTerms);
   const page = opts.onStripe && opts.page && (opts.page.ctas?.length ?? 0) > 0 ? [{ ...opts.page, pageKind: "checkout", source: "scanner" }] : [];
   const ctx = modelContext(jurisdictions, asOf, planFacts(plan2), { config: planConfig(plan2, asOf), ...page.length ? { captures: page } : {}, ...plan2.merchantName ? { merchantNames: [plan2.merchantName] } : {} });
-  const v = await verifyFix({ ctx, target: "html", texts: verifyTexts, terms: verifyTerms, now, ...opts.onStripe ? { consentCheckbox: false } : {} });
+  const v0 = await verifyFix({ ctx, target: "html", texts: verifyTexts, terms: verifyTerms, now, ...opts.boxed ? { boxed: true } : {}, ...opts.onStripe ? { consentCheckbox: false } : {} });
+  const tryBoxed = !opts.boxed && page.length > 0 && !v0.passes && v0.remaining.includes("signup.disclosure.conspicuous");
+  const vb = tryBoxed ? await verifyFix({ ctx, target: "html", texts: verifyTexts, terms: verifyTerms, now, boxed: true, ...opts.onStripe ? { consentCheckbox: false } : {} }) : void 0;
+  const boxedOnPage = !!vb && !vb.remaining.includes("signup.disclosure.conspicuous") && vb.remaining.length < v0.remaining.length;
+  const boxed = opts.boxed === true || boxedOnPage;
+  const v = boxedOnPage ? vb : v0;
   const sha = textsSha256(shown);
   const placeholders = plan2.cancelUrl ? [] : [CANCEL_URL_PLACEHOLDER];
   let short;
   if (plan2.cancelUrl) {
     const shortText = shortDisclosureText(verifyTerms);
-    const sv = await verifyFix({ ctx, target: "html", texts: { ...verifyTexts, disclosure: shortText }, terms: verifyTerms, now, ...opts.onStripe ? { consentCheckbox: false } : {} });
+    const sv = await verifyFix({ ctx, target: "html", texts: { ...verifyTexts, disclosure: shortText }, terms: verifyTerms, now, ...boxed ? { boxed: true } : {}, ...opts.onStripe ? { consentCheckbox: false } : {} });
     if (sv.passes && v.passes && shortText !== shown.disclosure) short = shortText;
   }
   if (opts.onStripe) {
@@ -24330,9 +24628,9 @@ async function buildReplacement(plan2, jurisdictions, asOf, now, opts = {}) {
       ...short ? { short_disclosure_text: short } : {},
       consent_label: shown.consentLabel,
       button_text: shown.cta,
-      html: htmlTermsOnly(shown.disclosure, sha, opts.onStripe),
+      html: htmlTermsOnly(shown.disclosure, sha, opts.onStripe, boxed ? { boxed: true } : {}),
       consent_on: opts.onStripe,
-      note: `html is the renewal terms only (no checkbox, no button): paste it directly above your own purchase link and keep that link. Consent is collected on ${where2}: it needs consent_collection.terms_of_service = "required" and the renewal terms in custom_text (check it with ${check2}). consent_label and button_text are for a page that collects consent itself.`,
+      note: `html is the renewal terms only (no checkbox, no button): paste it directly above your own purchase link and keep that link. Consent is collected on ${where2}: it needs consent_collection.terms_of_service = "required" and the renewal terms in custom_text (check it with ${check2}). consent_label and button_text are for a page that collects consent itself.${boxed ? " The text next to your button is already bold, so a semibold renewal line cannot stand out: this html sets it off with a border, which Checkbox measures (or use type 15% larger than the text around it)." : ""}`,
       placeholders,
       verified: v.passes,
       remaining_checks: [.../* @__PURE__ */ new Set([...v.remaining, "signup.consent.affirmative"])],
@@ -24344,7 +24642,7 @@ async function buildReplacement(plan2, jurisdictions, asOf, now, opts = {}) {
     ...short ? { short_disclosure_text: short } : {},
     consent_label: shown.consentLabel,
     button_text: shown.cta,
-    html: htmlDisclosureComponent(shown, sha),
+    html: htmlDisclosureComponent(shown, sha, boxed ? { boxed: true } : {}),
     placeholders,
     verified: v.passes,
     remaining_checks: v.remaining,
@@ -24595,7 +24893,57 @@ var init_stripe = __esm({
   }
 });
 
+// ../rules/src/preflight/price-hint.ts
+function intervalHintOf(ref) {
+  if (typeof ref !== "string" || !ref.trim() || ref.length > 200) return void 0;
+  const s2 = ref.trim();
+  if (GENERATED.test(s2)) return void 0;
+  const tokens = s2.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  const hits = /* @__PURE__ */ new Set();
+  for (const t of tokens) for (const [k, re] of WORDS2) if (re.test(t)) hits.add(k);
+  return hits.size === 1 ? [...hits][0] : void 0;
+}
+function priceIntervalConflict(ids, plan2) {
+  const interval = plan2?.interval;
+  if (!interval || !ids.length) return void 0;
+  const count = Number(plan2?.interval_count ?? 1) || 1;
+  for (const id of ids) {
+    const hint = intervalHintOf(id);
+    if (!hint) continue;
+    const planUnit = interval === "month" && count === 12 ? "year" : interval;
+    if (hint !== planUnit) {
+      const name = plan2?.plan_name ?? plan2?.name;
+      return `line_items use ${id}, whose name says it bills every ${hint}, but the plan terms given${name ? ` (plan "${name}")` : ""} bill every ${count > 1 ? `${count} ${interval}s` : interval}`;
+    }
+  }
+  return void 0;
+}
+var WORDS2, GENERATED;
+var init_price_hint = __esm({
+  "../rules/src/preflight/price-hint.ts"() {
+    "use strict";
+    WORDS2 = [
+      ["year", /^(?:annual|annually|yearly|year|years|yr|yrly|12mo|12m|1y|1yr)$/],
+      ["month", /^(?:monthly|month|months|mo|mth|1m|1mo)$/],
+      ["week", /^(?:weekly|week|weeks|wk)$/],
+      ["day", /^(?:daily|day|days)$/]
+    ];
+    GENERATED = /^(?:price|plan|prod)_1[A-Za-z0-9]{12,}$/;
+  }
+});
+
 // ../rules/src/preflight/stripe.ts
+function trialPromise(texts) {
+  for (const [field, text] of texts) {
+    if (!text) continue;
+    const a = analyzeTerms(text);
+    if (!a.trialMentions.length && !a.trialLengths.length) continue;
+    const days = a.trialLengths.map((t) => "days" in t ? t.days : null).filter((d) => typeof d === "number" && d > 0);
+    const span = a.trialLengths[0] ?? a.trialMentions[0];
+    return { field, quote: span.text.trim(), days };
+  }
+  return void 0;
+}
 function clone(v) {
   return JSON.parse(JSON.stringify(v));
 }
@@ -24687,6 +25035,25 @@ function readParams(params, merchant, kind, asOf) {
   if (trial !== void 0 && trial > 0 && custom && /[$€£]\s?\d|\b(?:charged?|billed)\b/i.test(custom) && !/\b(?:trial|free|days?)\b/i.test(custom)) {
     caveats.push({ checks: ["signup.disclosure.trial_terms"], status: "fail", reason: `there is a ${trial}-day free trial, but your custom_text.submit states the charge without mentioning it, so a shopper reads it as charged today (Stripe's summary alone shows the trial) \u2014 state the ${trial}-day free trial and what is charged when it ends`, param: "params.custom_text.submit" });
   }
+  const promisedTrial = trialPromise([["custom_text.submit", msg(ctAll.submit)], ["custom_text.terms_of_service_acceptance", isObj(params.consent_collection) && params.consent_collection.terms_of_service === "required" ? msg(ctAll.terms_of_service_acceptance) : void 0], ["product description", description]]);
+  if (promisedTrial && !(trial !== void 0 && trial > 0)) {
+    caveats.push({
+      checks: ["signup.disclosure.trial_terms"],
+      status: "fail",
+      reason: `the ${promisedTrial.field} promises a free trial (\u201C${promisedTrial.quote}\u201D), but the params run none (no subscription_data.trial_period_days or trial_end), so Stripe charges the full price today \u2014 add the trial to subscription_data, or remove the promise from the text`,
+      param: promisedTrial.field === "product description" ? "params.line_items" : `params.${promisedTrial.field}.message`
+    });
+  } else if (promisedTrial && trial !== void 0 && trial > 0) {
+    const wrongDays = promisedTrial.days.find((d) => Math.abs(d - trial) > TRIAL_DAYS_SLACK);
+    if (wrongDays !== void 0) {
+      caveats.push({
+        checks: ["signup.disclosure.trial_terms"],
+        status: "fail",
+        reason: `the ${promisedTrial.field} promises a ${wrongDays}-day free trial (\u201C${promisedTrial.quote}\u201D), but the params run a ${trial}-day trial \u2014 state the ${trial}-day free trial subscribers get, or change subscription_data.trial_period_days`,
+        param: promisedTrial.field === "product description" ? "params.line_items" : `params.${promisedTrial.field}.message`
+      });
+    }
+  }
   const uiMode = typeof params.ui_mode === "string" ? params.ui_mode : void 0;
   if (uiMode === "custom" || uiMode === "elements") {
     caveats.push({
@@ -24964,6 +25331,7 @@ function correct(params, shape, checks, forLink, style2 = "full") {
       out.custom_text = set;
     } else {
       for (const [k, v] of Object.entries(set)) {
+        if (JSON.stringify(ct[k]) === JSON.stringify(v)) continue;
         patch.push({ op: k in ct && ct[k] !== null ? "replace" : "add", path: `/custom_text/${k}`, value: v });
         ct[k] = v;
       }
@@ -24987,10 +25355,6 @@ function correct(params, shape, checks, forLink, style2 = "full") {
   }
   return { patch, corrected: out, texts, needText, needConsent };
 }
-function stripeCompactConsent(t) {
-  const trial = t.trialDays && t.trialDays > 0 ? ` after the ${t.trialDays}-day free trial` : "";
-  return `I agree that my subscription renews automatically at ${formatMoney(t.amount, t.currency)} every ${intervalPhrase(t.interval, t.intervalCount)}${trial} until I cancel.`;
-}
 async function bestCorrection(params, shape, checks, forLink, judgeAfter) {
   const none = () => ({ fix: correct(params, shape, [], forLink), after: checks });
   const first2 = correct(params, shape, checks, forLink, "compact");
@@ -25071,6 +25435,12 @@ function withResolvedPrices(input, knownPrices, amountSource = "merchant.price")
     warnings: [{ code: "price_amount_unverified", message: `line_items use ${ids[0]}, which Checkbox could not read (no connected Stripe account has it), so the amount in the checks and in the corrected custom_text comes from ${amountSource} and is not verified against the Price. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price.`, param: "params.line_items" }]
   };
 }
+function pricePairingConflict(input, resolved) {
+  if (!resolved.warnings.some((w) => w.code === "price_amount_unverified")) return void 0;
+  const conflict = priceIntervalConflict(lineItemPriceIds(input.params), input.merchant);
+  if (!conflict) return void 0;
+  return { code: "price_plan_conflict", message: `${conflict}. Checkbox offers no corrected params for this pairing: they would state the other plan's price. Check which plan this checkout sells and pass that plan's terms (in checkbox.json: the entry's "plan"), or connect Stripe so Checkbox reads the Price.`, param: "params.line_items" };
+}
 async function checkStripeCheckoutSession(input0, opts = {}) {
   const { jurisdictions, asOf, now } = common(input0, opts.now);
   const resolvedPrices = withResolvedPrices(input0, opts.knownPrices, opts.amountSource);
@@ -25086,7 +25456,8 @@ async function checkStripeCheckoutSession(input0, opts = {}) {
   const shape = readParams(params, input.merchant, "session", asOf);
   const url = "https://checkout.stripe.com/c/pay/cs_test_preflight";
   const checks = await judge2(shape, url, jurisdictions, asOf, now, "preflight-stripe-before");
-  const { fix, after } = await bestCorrection(
+  const pairing = pricePairingConflict(input0, resolvedPrices);
+  const { fix, after } = pairing ? { fix: correct(params, shape, [], false), after: checks } : await bestCorrection(
     params,
     shape,
     checks,
@@ -25101,12 +25472,12 @@ async function checkStripeCheckoutSession(input0, opts = {}) {
     verification: { checks: d.checks, passes: d.passes, remaining_checks: d.remaining, note: HOSTED_STYLING_NOTE },
     placeholders
   };
-  const warnings = [...resolvedPrices.warnings, ...shape.warnings];
+  const warnings = [...resolvedPrices.warnings, ...pairing ? [pairing] : [], ...shape.warnings];
   if (fix.needConsent) warnings.push({ code: "stripe_tos_url_required", message: 'consent_collection.terms_of_service = "required" needs a Terms of Service URL in Stripe Dashboard \u2192 Settings \u2192 Public details, or session creation fails.' });
   const channel2 = noticeChannelField(params);
   if (channel2) warnings.push(channel2);
   return {
-    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, nextAction("session", checks, correction), void 0, { cancelUrl: shape.plan?.cancelUrl }),
+    ...baseReport("stripe_checkout_session", checks, jurisdictions, asOf, warnings, pairing ? PAIRING_ACTION(pairing) : nextAction("session", checks, correction), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_checkout_session",
     correction
   };
@@ -25124,7 +25495,8 @@ async function checkStripePaymentLink(input0, opts = {}) {
   const id = typeof params.id === "string" ? params.id : void 0;
   const url = typeof params.url === "string" && /^https:\/\/buy\.stripe\.com\//.test(params.url) ? params.url : "https://buy.stripe.com/test_preflight";
   const checks = await judge2(shape, url, jurisdictions, asOf, now, "preflight-link-before");
-  const { fix, after } = await bestCorrection(
+  const pairing = pricePairingConflict(input0, resolvedPrices);
+  const { fix, after } = pairing ? { fix: correct(params, shape, [], true), after: checks } : await bestCorrection(
     params,
     shape,
     checks,
@@ -25163,11 +25535,11 @@ async function checkStripePaymentLink(input0, opts = {}) {
     ...update_params ? { update_params } : {},
     needs_new_link_for_consent: needsNew
   };
-  const warnings = [...resolvedPrices.warnings, ...shape.warnings];
+  const warnings = [...resolvedPrices.warnings, ...pairing ? [pairing] : [], ...shape.warnings];
   if (fix.needConsent) warnings.push({ code: "stripe_tos_url_required", message: 'consent_collection.terms_of_service = "required" needs a Terms of Service URL in Stripe Dashboard \u2192 Settings \u2192 Public details.' });
   const extra = needsNew && !id ? " Stripe cannot add the consent checkbox to an existing link (stripe.paymentLinks.update refuses consent_collection): create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link." : needsNew ? ` Stripe cannot add the consent checkbox to an existing link: send correction.update_params with stripe.paymentLinks.update("${id}", \u2026) for the text now, then create a new link with correction.corrected_params, replace the old URL everywhere, then deactivate the old link.` : id && update_params ? ` For the existing link use stripe.paymentLinks.update("${id}", correction.update_params) (same URL).` : "";
   return {
-    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, nextAction("link", checks, correction, extra), void 0, { cancelUrl: shape.plan?.cancelUrl }),
+    ...baseReport("stripe_payment_link", checks, jurisdictions, asOf, warnings, pairing ? PAIRING_ACTION(pairing) : nextAction("link", checks, correction, extra), void 0, { cancelUrl: shape.plan?.cancelUrl }),
     kind: "stripe_payment_link",
     correction
   };
@@ -25227,7 +25599,10 @@ function modelCheckoutConfig(params, opts) {
       // travels with its plan, so the site's checks and copy know the promo without a separate declaration.
       ...plan2.introAmount !== void 0 && plan2.introAmount >= 0 && plan2.introAmount < plan2.amount ? { introAmount: plan2.introAmount, ...plan2.introPeriods && plan2.introPeriods > 1 ? { introPeriods: plan2.introPeriods } : {} } : {}
     },
-    consentRequired: shape.consentRequired
+    consentRequired: shape.consentRequired,
+    // Round 33: the trial the params themselves run (subscription_data), 0 when none; a trial taken only from a Price
+    // or merchant terms is not one Stripe runs for these params.
+    trialDays: plan2.trialDays ?? 0
   };
 }
 function noticeChannelField(params) {
@@ -25246,7 +25621,7 @@ function noticeChannelField(params) {
     param: `params.custom_fields[${i}]`
   };
 }
-var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, CUSTOM_TEXT_FIELDS, STRIPE_GREY, DAY_MS3, open, STRIPE_HOSTED_STYLING_NOTE;
+var TEXT_CHECKS, CONSENT_CHECKS2, HOSTED_STYLING_NOTE, INTRO_PROMISE_RE, isObj, msg, CUSTOM_TEXT_FIELDS, STRIPE_GREY, DAY_MS3, open, PAIRING_ACTION, STRIPE_HOSTED_STYLING_NOTE;
 var init_stripe2 = __esm({
   "../rules/src/preflight/stripe.ts"() {
     "use strict";
@@ -25254,11 +25629,13 @@ var init_stripe2 = __esm({
     init_compact();
     init_plan_terms();
     init_text();
+    init_signup();
     init_verify();
     init_stripe();
     init_common();
     init_disclosure();
     init_model();
+    init_price_hint();
     TEXT_CHECKS = [
       "signup.disclosure.autorenew_language",
       "signup.disclosure.price",
@@ -25277,6 +25654,7 @@ var init_stripe2 = __esm({
     STRIPE_GREY = { fontSizePx: 13, fontWeight: 400, color: "rgba(26, 26, 26, 0.7)", backgroundColor: "rgb(255, 255, 255)" };
     DAY_MS3 = 864e5;
     open = (c) => !!c && (c.status === "fail" || c.status === "needs_review");
+    PAIRING_ACTION = (w) => ({ type: "human_review", message: `${w.message}` });
     STRIPE_HOSTED_STYLING_NOTE = HOSTED_STYLING_NOTE;
   }
 });
@@ -25286,6 +25664,8 @@ function stripeParamsVerdict(r) {
   if (r.verdict === "not_applicable") return { verdict: "not_applicable", open: [] };
   const open2 = r.checks.filter((c) => c.status === "fail" || c.status === "needs_review" && !(c.compliance_status && SATISFIED_COMPLIANCE.has(c.compliance_status))).map((c) => ({ check_id: c.check_id, status: c.status, title: c.title ?? c.check_id, detail: c.explanation ?? "" })).sort((a, b) => (a.status === "fail" ? 0 : 1) - (b.status === "fail" ? 0 : 1));
   if (r.verdict === "fail" || r.compliance_status === "needs_fix" || open2.some((c) => c.status === "fail")) return { verdict: "fail", open: open2 };
+  const pairing = (r.warnings ?? []).find((w) => w.code === "price_plan_conflict");
+  if (pairing) return { verdict: "needs_review", open: open2, reason: pairing.message };
   const coupon = (r.warnings ?? []).find((w) => w.code === "coupon_unverified");
   if (open2.length) return { verdict: "needs_review", open: open2, ...coupon ? { reason: coupon.message } : {} };
   if (coupon) return { verdict: "needs_review", open: [], reason: coupon.message };
@@ -25686,7 +26066,8 @@ ${html ?? ""}`, kind);
     text: t.text,
     html: htmlOf(t.text),
     merge_tags: t.tags,
-    placeholders: [...plan2.cancelUrl ? [] : [CANCEL_URL_PLACEHOLDER], ...t.text.includes(SUPPORT_CONTACT_PLACEHOLDER) ? [SUPPORT_CONTACT_PLACEHOLDER] : []],
+    // Round 32: only the placeholders the template really contains (a cancellation confirmation has no {{cancel_url}}).
+    placeholders: [CANCEL_URL_PLACEHOLDER, SUPPORT_CONTACT_PLACEHOLDER].filter((p) => t.text.includes(p) || t.subject.includes(p)),
     verified: remaining.length === 0,
     remaining_checks: remaining
   };
@@ -25956,7 +26337,8 @@ async function checkPageHtml(input, opts = {}) {
     });
   }
   const consentOnStripe = onStripe ?? (checkoutType === "payment_link" || checkoutType === "stripe_checkout" ? checkoutType : checkoutType ? void 0 : stripeButtonsKind(capture));
-  const repOpts = consentOnStripe ? { onStripe: consentOnStripe } : {};
+  const boldAround = checks.some((c) => c.check_id === "signup.disclosure.conspicuous" && /already bold, so a bolder weight cannot set them apart/.test(c.explanation ?? ""));
+  const repOpts = { ...consentOnStripe ? { onStripe: consentOnStripe } : {}, ...boldAround ? { boxed: true } : {} };
   const built = plan2 ? await buildReplacement(plan2, jurisdictions, asOf, now, { ...repOpts, page: capture }) : void 0;
   const differs = plan2 && !multi ? pagePriceDiffers(run2.findings) : [];
   if (plan2 && differs.length) {
@@ -26039,7 +26421,8 @@ function signupStripeObjects(input) {
         capture: { ...m.capture, siteId: input.siteId },
         consentRequired: m.consentRequired,
         kind: "checkout_config",
-        ...m.plan ? { planId: m.plan.id } : {}
+        ...m.plan ? { planId: m.plan.id } : {},
+        ...typeof m.trialDays === "number" ? { trialDays: m.trialDays } : {}
       });
     }
     if (m.plan) referencePlans2.push({ ...m.plan, source: "checkout_config", ...row.name ? { label: row.name } : {} });
@@ -26072,7 +26455,8 @@ function signupStripeObjects(input) {
         consentRequired: m.consentRequired,
         kind: "payment_link",
         ...link.url ? { url: link.url } : {},
-        ...m.plan ? { planId: m.plan.id } : {}
+        ...m.plan ? { planId: m.plan.id } : {},
+        ...typeof m.trialDays === "number" ? { trialDays: m.trialDays } : {}
       });
     }
     if (m.plan) referencePlans2.push({ ...m.plan, source: "checkout_config", label: `Payment Link \u201C${name}\u201D` });
@@ -26114,6 +26498,7 @@ __export(preflight_exports, {
   checkoutSessionsOf: () => checkoutSessionsOf,
   emailTemplate: () => emailTemplate,
   extractStaticPage: () => extractStaticPage,
+  intervalHintOf: () => intervalHintOf,
   lineItemPriceIds: () => lineItemPriceIds,
   modelCheckoutConfig: () => modelCheckoutConfig,
   modelContext: () => modelContext,
@@ -26121,6 +26506,7 @@ __export(preflight_exports, {
   parseHtml: () => parseHtml,
   parseJurisdictionList: () => parseJurisdictionList,
   paymentLinksOf: () => paymentLinksOf,
+  priceIntervalConflict: () => priceIntervalConflict,
   resolvePlan: () => resolvePlan,
   resolvePriceIds: () => resolvePriceIds,
   runChecks: () => runChecks,
@@ -26128,7 +26514,10 @@ __export(preflight_exports, {
   signupStripeObjects: () => signupStripeObjects,
   stripeParamsVerdict: () => stripeParamsVerdict,
   supportContactLine: () => supportContactLine,
-  withIntroOffers: () => withIntroOffers
+  testRunSessionIds: () => testRunSessionIds,
+  trialPromise: () => trialPromise,
+  withIntroOffers: () => withIntroOffers,
+  withTestRunSessions: () => withTestRunSessions
 });
 var init_preflight = __esm({
   "../rules/src/preflight/index.ts"() {
@@ -26136,6 +26525,7 @@ var init_preflight = __esm({
     init_common();
     init_disclosure();
     init_stripe2();
+    init_price_hint();
     init_stripe_verdict();
     init_email();
     init_html_page();
@@ -26321,7 +26711,8 @@ var init_check = __esm({
           }
           const hf = str(f, "html-file");
           if (hf) html = await readInput(ctx, hf);
-          if (!subject) throw new UsageError('--subject is required (or a "Subject: \u2026" first line in --file)');
+          if (!subject && html) subject = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html)?.[1]?.replace(/\s+/g, " ").trim() || void 0;
+          if (!subject) throw new UsageError('--subject is required (or a "Subject: \u2026" first line in --file, or an HTML <title>)');
           if (!text && !html) throw new UsageError("Give the email body with --text, --file or --html-file");
           const terms2 = planFrom(f);
           const pp = str(f, "previous-price");
@@ -26483,7 +26874,7 @@ function loadConfig(path) {
 function validateConfig(value) {
   const is = new Issues();
   if (!isObj2(value)) return ["must be a JSON object (see https://checkbox.site/docs/guides/ci#config)"];
-  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "notices", "checks", "coverage"]);
+  is.keys("", value, ["$schema", "merchant", "jurisdictions", "plans", "notices", "merge_tags", "checks", "coverage"]);
   const cov = value.coverage;
   if (cov !== void 0 && cov !== false) {
     if (!isObj2(cov)) is.add("coverage", `must be false or an object like { "ignore": ["scripts/**"] } (got ${show(cov)})`);
@@ -26551,6 +26942,15 @@ function validateConfig(value) {
       }
     }
   }
+  const mergeTags = (at, m2) => {
+    if (m2 === void 0) return;
+    if (!isObj2(m2) || !Object.keys(m2).length) return is.add(at, `must be an object mapping each merge tag to its value, like { "price": "plan.price", "interval": "plan.interval", "first_name": "Sam" } (got ${show(m2)})`);
+    for (const [k, v] of Object.entries(m2)) {
+      if (!/^[A-Za-z_][\w.-]{0,60}$/.test(k)) is.add(`${at}.${k}`, "is not a merge tag name (letters, digits, _ . -; the name inside {{ }})");
+      else if (typeof v !== "string" || v.length > 500) is.add(`${at}.${k}`, `must be a string: a sample value, or one of ${MERGE_TAG_FIELDS.join(", ")} (got ${show(v)})`);
+    }
+  };
+  mergeTags("merge_tags", value.merge_tags);
   const checks = value.checks;
   if (!isObj2(checks)) {
     is.add("checks", checks === void 0 ? "is required (an object with stripe_checkout, disclosures, pages, emails and/or notice_schedule)" : `must be an object (got ${show(checks)})`);
@@ -26635,7 +27035,8 @@ function validateConfig(value) {
   entries(
     "emails",
     (at, e) => {
-      is.keys(at, e, ["name", "plan", "kind", "subject", "file", "text", "html", "module", "args", "previous_price"]);
+      is.keys(at, e, ["name", "plan", "kind", "subject", "file", "text", "html", "module", "args", "previous_price", "merge_tags"]);
+      mergeTags(`${at}.merge_tags`, e.merge_tags);
       is.oneOf(`${at}.kind`, e.kind, EMAIL_KINDS2, true);
       is.exactlyOne(at, e, ["file", "text", "html", "module"], [["text", "html"]]);
       if (e.file !== void 0) {
@@ -26668,7 +27069,7 @@ function entryLine(raw, name) {
   const i = lines.findIndex((l) => needle.test(l));
   return i >= 0 ? i + 1 : 1;
 }
-var CONFIG_FILES, SCHEMA_URL, INTERVALS4, EMAIL_KINDS2, PAGE_KINDS2, ConfigError, isObj2, show, TODO, Issues, PLAN_KEYS;
+var CONFIG_FILES, SCHEMA_URL, INTERVALS4, EMAIL_KINDS2, PAGE_KINDS2, MERGE_TAG_FIELDS, ConfigError, isObj2, show, TODO, Issues, PLAN_KEYS;
 var init_config3 = __esm({
   "src/ci/config.ts"() {
     "use strict";
@@ -26677,6 +27078,7 @@ var init_config3 = __esm({
     INTERVALS4 = ["day", "week", "month", "year"];
     EMAIL_KINDS2 = ["acknowledgment", "trial_reminder", "renewal_reminder", "price_change", "annual_terms", "charge_notice", "cancellation_confirmation"];
     PAGE_KINDS2 = ["checkout", "pricing"];
+    MERGE_TAG_FIELDS = ["plan.price", "plan.amount", "plan.interval", "plan.name", "plan.trial_days", "plan.currency", "merchant.name", "merchant.cancel_url", "merchant.support_contact"];
     ConfigError = class extends Error {
       constructor(file, issues) {
         super(`${file}: ${issues.length === 1 ? issues[0] : `${issues.length} problems:
@@ -26761,7 +27163,7 @@ function parseObjectLiteral(source, env2 = {}, consts = {}) {
   const p = new Parser(source, env2, consts);
   if (p.peek() !== "{") return { value: null, unresolved: ["<not an object literal>"] };
   const v = p.object("");
-  return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {} };
+  return { value: v === UNKNOWN ? null : v, unresolved: [...new Set(p.unresolved)], ...Object.keys(p.fromEnv).length ? { fromEnv: p.fromEnv } : {}, ...p.spreads.length ? { spreads: p.spreads } : {} };
 }
 var UNKNOWN, Parser;
 var init_literal = __esm({
@@ -26777,6 +27179,7 @@ var init_literal = __esm({
       i = 0;
       unresolved = [];
       fromEnv = {};
+      spreads = [];
       ws() {
         for (; ; ) {
           while (this.i < this.s.length && /\s/.test(this.s[this.i])) this.i++;
@@ -26913,7 +27316,9 @@ var init_literal = __esm({
           if (!ch) return UNKNOWN;
           if (this.s.startsWith("...", this.i)) {
             this.i += 3;
+            const from = this.i;
             this.skipExpr();
+            if (!path) this.spreads.push(this.s.slice(from, this.i).trim());
             this.unresolved.push(`${path ? `${path}.` : ""}...`);
           } else {
             let key = null;
@@ -27030,6 +27435,12 @@ function detectBrand(root, layoutFile, pkgName) {
   }
   return void 0;
 }
+function detectMailer(deps, framework, hasPackageJson) {
+  const found = MAILER_PACKAGES.find((m) => m in deps);
+  if (found) return found;
+  if (!hasPackageJson && framework === "html") return "none";
+  return null;
+}
 function readJson(path) {
   try {
     return JSON.parse(readFileSync5(path, "utf8"));
@@ -27089,12 +27500,49 @@ function walk2(root, visit) {
     }
   }
 }
+function hasAppRouteFile(dir, depth = 0) {
+  if (depth > 3) return false;
+  let names = [];
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return false;
+  }
+  if (names.some((n) => /^(?:page|route|layout)\.(?:tsx|jsx|ts|js|mdx)$/.test(n))) return true;
+  return names.some((n) => !n.startsWith(".") && n !== "node_modules" && (() => {
+    try {
+      return statSync(join4(dir, n)).isDirectory();
+    } catch {
+      return false;
+    }
+  })() && hasAppRouteFile(join4(dir, n), depth + 1));
+}
+function hasTsFiles(dir, depth = 0) {
+  if (depth > 3) return false;
+  let names = [];
+  try {
+    names = readdirSync2(dir);
+  } catch {
+    return false;
+  }
+  if (names.some((n) => /\.tsx?$/.test(n))) return true;
+  return names.some((n) => !n.startsWith(".") && (() => {
+    try {
+      return statSync(join4(dir, n)).isDirectory();
+    } catch {
+      return false;
+    }
+  })() && hasTsFiles(join4(dir, n), depth + 1));
+}
 function detectFramework(root, deps) {
   const has2 = (d) => d in deps;
   if (existsSync4(join4(root, "layout", "theme.liquid")) && existsSync4(join4(root, "config", "settings_schema.json"))) return { framework: "shopify-theme", layoutFile: "layout/theme.liquid" };
   if (has2("next")) {
     const app = first(root, ["app/layout.tsx", "app/layout.jsx", "app/layout.js", "app/layout.ts", "src/app/layout.tsx", "src/app/layout.jsx", "src/app/layout.js"]);
     if (app) return { framework: "nextjs-app", layoutFile: app };
+    const appDir = ["src/app", "app"].find((d) => existsSync4(join4(root, d)) && hasAppRouteFile(join4(root, d)));
+    const pagesExists = existsSync4(join4(root, "pages")) || existsSync4(join4(root, "src", "pages"));
+    if (appDir && !pagesExists) return { framework: "nextjs-app", layoutFile: `${appDir}/layout.${existsSync4(join4(root, "tsconfig.json")) || hasTsFiles(join4(root, appDir)) ? "tsx" : "js"}` };
     const doc = first(root, ["pages/_document.tsx", "pages/_document.jsx", "pages/_document.js", "src/pages/_document.tsx", "src/pages/_document.jsx", "src/pages/_document.js"]);
     const pagesDir = existsSync4(join4(root, "src", "pages")) ? "src/pages" : "pages";
     return { framework: "nextjs-pages", layoutFile: doc ?? `${pagesDir}/_document.${existsSync4(join4(root, "tsconfig.json")) ? "tsx" : "js"}` };
@@ -27181,11 +27629,11 @@ function routeOf(rel2) {
   }
   return null;
 }
-function findStripeKey(env2, processEnv) {
+function findStripeKey(env2, processEnv, envFile = {}) {
   const sources = [];
   for (const k of ["CHECKBOX_STRIPE_TEST_KEY", "STRIPE_RESTRICTED_KEY", "STRIPE_TEST_RESTRICTED_KEY", "STRIPE_SECRET_KEY", "STRIPE_TEST_SECRET_KEY", "STRIPE_API_KEY", "STRIPE_SK"]) {
     sources.push([`${k} (environment)`, processEnv[k]]);
-    sources.push([`${k} (.env)`, env2[k]]);
+    sources.push([`${k} (${envFile[k] ?? ".env"})`, env2[k]]);
   }
   const found = sources.filter((s2) => typeof s2[1] === "string" && /^(sk|rk)_(test|live)_[A-Za-z0-9]{10,}$/.test(s2[1].trim())).map(([src, v]) => [src, v.trim()]);
   const hint = (key) => `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
@@ -27285,11 +27733,15 @@ function detectProject(root, processEnv = {}) {
   const { framework, layoutFile } = detectFramework(root, deps);
   const packageManager = existsSync4(join4(root, "pnpm-lock.yaml")) ? "pnpm" : existsSync4(join4(root, "yarn.lock")) ? "yarn" : existsSync4(join4(root, "bun.lockb")) || existsSync4(join4(root, "bun.lock")) ? "bun" : pkg ? "npm" : null;
   const env2 = {};
+  const envFile = {};
   for (const f of [".env", ".env.production", ".env.local", ".env.development", ".env.development.local"]) {
     const t = readText(join4(root, f));
-    if (t) Object.assign(env2, parseDotenv(t));
+    if (!t) continue;
+    const vars = parseDotenv(t);
+    Object.assign(env2, vars);
+    for (const k of Object.keys(vars)) envFile[k] = f;
   }
-  const billingPlatform = "stripe" in deps || "@stripe/stripe-js" in deps || "@stripe/react-stripe-js" in deps ? "stripe" : framework === "shopify-theme" || "@shopify/hydrogen" in deps || "@shopify/shopify-api" in deps ? "shopify" : "@rechargeapps/storefront-client" in deps ? "recharge" : "@paddle/paddle-js" in deps ? "paddle" : "chargebee" in deps ? "chargebee" : "custom";
+  let billingPlatform = "stripe" in deps || "@stripe/stripe-js" in deps || "@stripe/react-stripe-js" in deps ? "stripe" : framework === "shopify-theme" || "@shopify/hydrogen" in deps || "@shopify/shopify-api" in deps ? "shopify" : "@rechargeapps/storefront-client" in deps ? "recharge" : "@paddle/paddle-js" in deps ? "paddle" : "chargebee" in deps ? "chargebee" : "custom";
   const checkoutCode = [];
   const payButtons = [];
   const checkoutSessions = [];
@@ -27319,8 +27771,9 @@ function detectProject(root, processEnv = {}) {
       checkoutSessions.push({ file: rel2, line: line2, ...parsed.value ? { params: redactSecretsDeep(parsed.value) } : {}, unresolved: parsed.unresolved });
     }
   });
+  if (billingPlatform === "custom" && checkoutCode.some((c) => c.kind.startsWith("stripe_"))) billingPlatform = "stripe";
   const site = detectSiteUrl(root, env2, pkg);
-  const stripeKey = findStripeKey(env2, processEnv);
+  const stripeKey = findStripeKey(env2, processEnv, envFile);
   const brand = detectBrand(root, layoutFile, typeof pkg?.name === "string" ? pkg.name : void 0);
   return {
     root,
@@ -27341,16 +27794,18 @@ function detectProject(root, processEnv = {}) {
     ...stripeKey.refused ? { stripeKeyRefused: stripeKey.refused } : {},
     ...brand ? { brand } : {},
     plans: plansFromSessions(checkoutSessions),
-    env: env2
+    env: env2,
+    mailer: detectMailer(deps, framework, !!pkg)
   };
 }
-var GENERIC_NAMES, IGNORE_DIRS, CODE_EXT, MAX_FILES, MAX_FILE_BYTES, first, SITE_URL_KEYS, POLICY_ROUTES, CHECKOUT_PATTERNS, PAY_BUTTON;
+var GENERIC_NAMES, MAILER_PACKAGES, IGNORE_DIRS, CODE_EXT, MAX_FILES, MAX_FILE_BYTES, first, SITE_URL_KEYS, POLICY_ROUTES, CHECKOUT_PATTERNS, PAY_BUTTON;
 var init_detect = __esm({
   "src/commands/init/detect.ts"() {
     "use strict";
     init_src2();
     init_literal();
     GENERIC_NAMES = /^(?:web|app|site|website|frontend|client|my-app|my-site|demo|example|store|shop|starter|template|project|monorepo|root)$/i;
+    MAILER_PACKAGES = ["nodemailer", "resend", "@sendgrid/mail", "postmark", "mailgun.js", "mailgun-js", "@aws-sdk/client-ses", "@aws-sdk/client-sesv2", "@react-email/components", "react-email", "@mailchimp/mailchimp_transactional", "mailersend", "@sparkpost/node", "sparkpost", "emailjs", "@emailjs/browser", "loops", "plunk", "@plunk/node", "brevo", "@getbrevo/brevo", "sib-api-v3-sdk", "nodemailer-mailgun-transport", "@vercel/email"];
     IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "dist", "build", "out", "coverage", ".astro", "vendor", ".venv", "__pycache__"]);
     CODE_EXT = /\.(?:[cm]?[jt]sx?|vue|svelte|astro|liquid|html|ejs|hbs|erb)$/i;
     MAX_FILES = 4e3;
@@ -27366,6 +27821,7 @@ var init_detect = __esm({
     CHECKOUT_PATTERNS = [
       { kind: "stripe_checkout_session", re: /checkout\.sessions\.create\s*\(/ },
       { kind: "stripe_payment_link", re: /paymentLinks\.create\s*\(|https:\/\/buy\.stripe\.com\// },
+      { kind: "stripe_checkout_link", re: /https:\/\/checkout\.stripe\.com\// },
       { kind: "stripe_pricing_table", re: /<stripe-pricing-table\b/ },
       { kind: "stripe_subscription_api", re: /subscriptions\.create\s*\(/ },
       { kind: "stripe_elements", re: /<(PaymentElement|CardElement|ExpressCheckoutElement)\b|elements\.create\(\s*['"]payment['"]/ },
@@ -27380,6 +27836,47 @@ var init_detect = __esm({
 // src/ci/scaffold.ts
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync2 } from "node:fs";
 import { basename, dirname as dirname4, join as join5, relative as relative2 } from "node:path";
+function countTodoValues(v) {
+  if (typeof v === "string") return /^TODO\b/.test(v) ? 1 : 0;
+  if (Array.isArray(v)) return v.reduce((n, x) => n + countTodoValues(x), 0);
+  if (v && typeof v === "object") return Object.values(v).reduce((n, x) => n + countTodoValues(x), 0);
+  return 0;
+}
+function mergeTagsIn(text) {
+  const out = [];
+  for (const m of text.matchAll(/\{\{\{?\s*([A-Za-z_][\w.-]*)\s*\}?\}\}|\*\|([A-Za-z_][\w.-]*)\|\*/g)) {
+    const t = m[1] ?? m[2];
+    if (!out.includes(t)) out.push(t);
+  }
+  return out;
+}
+function mergeTagField(tag) {
+  const t = tag.toLowerCase().replace(/[.-]/g, "_").replace(/^(?:subscription|sub)_/, "");
+  if (/^(?:plan_)?(?:price|amount|cost|recurring_price|price_formatted|formatted_price|renewal_price|renewal_amount)$/.test(t)) return "plan.price";
+  if (/^(?:plan_)?(?:interval|billing_interval|period|billing_period|frequency|billing_cycle|cycle|interval_name)$/.test(t)) return "plan.interval";
+  if (/^(?:plan|plan_name|product|product_name|plan_title|tier)$/.test(t)) return "plan.name";
+  if (/^(?:plan_)?(?:trial_days|trial_length|trial_period_days)$/.test(t)) return "plan.trial_days";
+  if (/^(?:cancel_url|cancellation_url|manage_url|billing_url|account_url|cancel_link)$/.test(t)) return "merchant.cancel_url";
+  if (/^(?:company|company_name|merchant|merchant_name|brand|brand_name|business_name|app_name)$/.test(t)) return "merchant.name";
+  if (/^(?:support_email|support_contact|support|help_email|contact_email)$/.test(t)) return "merchant.support_contact";
+  return void 0;
+}
+function pageSources(root) {
+  const out = [];
+  walk3(root, (rel2) => {
+    if (out.length >= 4) return;
+    let m = /^(?:src\/)?app\/((?:\([^/]+\)\/)*)([^/()]+)\/page\.(?:tsx|jsx|ts|js|mdx)$/.exec(rel2);
+    if (m && PAGE_ROUTE.test(m[2])) {
+      out.push({ source: rel2, file: `.next/server/app/${m[2]}.html`, route: m[2] });
+      return;
+    }
+    m = /^(?:src\/)?pages\/([^/]+?)(?:\/index)?\.(tsx|jsx|ts|js|astro)$/.exec(rel2);
+    if (m && PAGE_ROUTE.test(m[1])) {
+      out.push({ source: rel2, file: m[2] === "astro" ? `dist/${m[1]}/index.html` : `.next/server/pages/${m[1]}.html`, route: m[1] });
+    }
+  });
+  return out;
+}
 function walk3(root, visit) {
   let n = 0;
   const go = (dir, depth) => {
@@ -27420,8 +27917,8 @@ function plansFromLiterals(text, file) {
     if (!interval) continue;
     const price3 = /\bprice\s*:\s*(\d+(?:\.\d{1,2})?)\b/.exec(body)?.[1];
     const minor = /\b(?:amount|unit_amount|price_cents|cents)\s*:\s*(\d+)\b/.exec(body)?.[1];
-    const major = price3 !== void 0 ? Number(price3) : minor !== void 0 ? Number(minor) / 100 : void 0;
-    if (major === void 0 || !(major > 0)) continue;
+    const major2 = price3 !== void 0 ? Number(price3) : minor !== void 0 ? Number(minor) / 100 : void 0;
+    if (major2 === void 0 || !(major2 > 0)) continue;
     const name = /\b(?:name|title|label)\s*:\s*['"]([^'"]{1,80})['"]/.exec(body)?.[1] ?? m[1]?.trim();
     if (!name) continue;
     const currency = /\bcurrency\s*:\s*['"]([a-z]{3})['"]/i.exec(body)?.[1]?.toLowerCase() ?? "usd";
@@ -27429,7 +27926,8 @@ function plansFromLiterals(text, file) {
     const trial = /\btrial(?:_period)?_?days\s*:\s*(\d+)/i.exec(body)?.[1];
     if (out.some((p) => p.name === name)) continue;
     const key = m[1]?.trim() && /^[A-Za-z_$][\w$]*$/.test(m[1].trim()) ? m[1].trim() : void 0;
-    out.push({ name, ...key ? { key } : {}, price: major, currency, interval, ...count && Number(count) > 1 ? { interval_count: Number(count) } : {}, ...trial && Number(trial) > 0 ? { trial_days: Number(trial) } : {}, source: file });
+    const ids = [...new Set([...body.matchAll(/['"`](price_[A-Za-z0-9_]+)['"`]/g)].map((x) => x[1]))];
+    out.push({ name, ...key ? { key } : {}, price: major2, currency, interval, ...count && Number(count) > 1 ? { interval_count: Number(count) } : {}, ...trial && Number(trial) > 0 ? { trial_days: Number(trial) } : {}, ...ids.length ? { price_ids: ids } : {}, source: file });
   }
   return out;
 }
@@ -27480,10 +27978,84 @@ function pageSource(root, built) {
   const hits = bases.flatMap((b) => [".tsx", ".jsx", ".ts", ".js", ".svelte", ".vue", ".astro", ".mdx"].map((e) => `${b}${e}`)).filter((f) => existsSync5(join5(root, f)));
   return hits.length === 1 ? hits[0] : void 0;
 }
+function priceExpressions(root, file, line2) {
+  let text;
+  try {
+    text = readFileSync6(join5(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const from = text.split("\n").slice(line2 - 1).join("\n");
+  const at = from.search(/checkout\.sessions\.create|paymentLinks\.create/);
+  const open2 = at < 0 ? -1 : from.indexOf("(", at);
+  if (open2 < 0) return [];
+  let depth = 0;
+  let end = from.length;
+  for (let i = open2; i < from.length; i++) {
+    const c = from[i];
+    if (c === "(" || c === "{" || c === "[") depth++;
+    else if (c === ")" || c === "}" || c === "]") {
+      depth--;
+      if (depth === 0) {
+        end = i;
+        break;
+      }
+    }
+  }
+  const call = from.slice(open2, end);
+  const li = call.indexOf("line_items");
+  if (li < 0) return [];
+  const items = call.slice(li);
+  const out = [];
+  for (const m of items.matchAll(/\bprice\s*:\s*/g)) {
+    let d = 0;
+    let j = m.index + m[0].length;
+    const start = j;
+    for (; j < items.length; j++) {
+      const c = items[j];
+      if (c === "(" || c === "{" || c === "[") d++;
+      else if (c === ")" || c === "}" || c === "]") {
+        if (d === 0) break;
+        d--;
+      } else if ((c === "," || c === "\n") && d === 0) break;
+    }
+    const expr = items.slice(start, j).trim();
+    if (expr) out.push(expr);
+    if (out.length >= 5) break;
+  }
+  return out;
+}
+function pairCall(root, s2, plans, priceIds, calls) {
+  if (plans.length === 1) return { plan: String(plans[0].name) };
+  if (!plans.length || plans.some((p) => String(p.name).startsWith("TODO"))) return {};
+  const sold = s2.params ? plansSoldBy(s2.params, plans) : [];
+  if (sold.length === 1) return { plan: String(sold[0].name) };
+  const items = Array.isArray(s2.params?.line_items) ? s2.params.line_items : [];
+  const literalIds = items.map((li) => li && typeof li.price === "string" ? li.price : void 0).filter((x) => !!x);
+  const exprs = priceExpressions(root, s2.file, s2.line).filter((e) => !/^['"`][^'"`]*['"`]$/.test(e));
+  for (const id of literalIds) {
+    const owner = plans.filter((p) => priceIds.get(String(p.name))?.includes(id));
+    if (owner.length === 1) return { plan: String(owner[0].name), why: `${id} is the Price id of that plan in the plans module` };
+  }
+  const runtime = exprs.find((e) => /\?|\|\||&&|\[[^\]'"`]*\]|\(/.test(e));
+  if (runtime && !literalIds.length) return calls === 1 ? { several: true } : { ref: runtime };
+  for (const ref of [...literalIds, ...exprs]) {
+    const hint = intervalHintOf(ref);
+    if (!hint) continue;
+    const match = plans.filter((p) => {
+      const count = Number(p.interval_count ?? 1) || 1;
+      const unit2 = p.interval === "month" && count === 12 ? "year" : count === 1 ? p.interval : void 0;
+      return unit2 === hint;
+    });
+    if (match.length === 1) return { plan: String(match[0].name), why: `its Price ${ref} is named for a ${hint === "day" ? "dai" : hint}ly price; check this is the plan it sells` };
+  }
+  return { ref: literalIds[0] ?? exprs[0] };
+}
 function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
   const found = [];
+  const notes2 = [];
   const names = /* @__PURE__ */ new Set();
   const merchant = {};
   const fact = (k) => typeof facts[k] === "string" && facts[k].trim() ? facts[k].trim() : void 0;
@@ -27511,8 +28083,21 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     const m = initPlans.find((x) => typeof x.name === "string" && x.amount === p.amount && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (p.interval_count ?? 1));
     return m ? String(m.name) : void 0;
   };
+  const literals = [];
+  walk3(root, (rel2) => {
+    if (!PLAN_FILE.test(rel2) || literals.length >= 8) return;
+    let text = "";
+    try {
+      text = readFileSync6(join5(root, rel2), "utf8");
+    } catch {
+      return;
+    }
+    for (const p of plansFromLiterals(text, rel2)) if (!literals.some((x) => x.name === p.name)) literals.push(p);
+  });
+  const minorOf = (p) => typeof p.amount === "number" ? p.amount : typeof p.price === "number" ? Math.round(p.price * 100) : NaN;
+  const literalFor = (p) => literals.find((x) => Math.round(x.price * 100) === minorOf(p) && x.interval === p.interval && (x.interval_count ?? 1) === (Number(p.interval_count ?? 1) || 1));
   const plans = det.plans.map((p, i) => ({
-    name: p.name ?? initName(p) ?? `Plan ${i + 1}`,
+    name: p.name ?? initName(p) ?? literalFor(p)?.name ?? `Plan ${i + 1}`,
     amount: p.amount,
     currency: p.currency,
     interval: p.interval,
@@ -27520,31 +28105,28 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     ...p.trial_days ? { trial_days: p.trial_days } : {}
   }));
   for (const p of det.plans) found.push(`plan ${p.name ?? ""} ${p.amount / 100} ${p.currency}/${p.interval} (${p.source})`.replace(/\s+/g, " "));
-  const planKeys = /* @__PURE__ */ new Map();
   if (!plans.length && Array.isArray(facts.plans)) {
     for (const [i, p] of facts.plans.entries()) {
       if (typeof p.amount !== "number" || typeof p.interval !== "string") continue;
-      plans.push({ name: typeof p.name === "string" ? p.name : `Plan ${i + 1}`, amount: p.amount, currency: typeof p.currency === "string" ? p.currency : "usd", interval: p.interval, ...typeof p.interval_count === "number" ? { interval_count: p.interval_count } : {}, ...typeof p.trial_days === "number" ? { trial_days: p.trial_days } : {} });
+      plans.push({ name: typeof p.name === "string" && p.name.trim() ? p.name : literalFor(p)?.name ?? `Plan ${i + 1}`, amount: p.amount, currency: typeof p.currency === "string" ? p.currency : "usd", interval: p.interval, ...typeof p.interval_count === "number" ? { interval_count: p.interval_count } : {}, ...typeof p.trial_days === "number" ? { trial_days: p.trial_days } : {} });
       found.push(`plan ${String(plans[plans.length - 1].name)} (from checkbox init --plan)`);
     }
   }
   if (!plans.length) {
-    walk3(root, (rel2) => {
-      if (!PLAN_FILE.test(rel2) || plans.length >= 8) return;
-      let text = "";
-      try {
-        text = readFileSync6(join5(root, rel2), "utf8");
-      } catch {
-        return;
-      }
-      for (const p of plansFromLiterals(text, rel2)) {
-        if (plans.some((x) => x.name === p.name)) continue;
-        const { source, key, ...plan2 } = p;
-        plans.push(plan2);
-        if (key) planKeys.set(p.name, key);
-        found.push(`plan ${p.name} ${p.price} ${p.currency}/${p.interval} (${source})`);
-      }
-    });
+    for (const p of literals) {
+      const { source, key: _key, price_ids: _ids, ...plan2 } = p;
+      plans.push(plan2);
+      found.push(`plan ${p.name} ${p.price} ${p.currency}/${p.interval} (${source})`);
+    }
+  }
+  const planKeys = /* @__PURE__ */ new Map();
+  const planPriceIds = /* @__PURE__ */ new Map();
+  for (const p of plans) {
+    const lit = literals.find((x) => x.name === p.name) ?? literalFor(p);
+    if (lit?.key) planKeys.set(String(p.name), lit.key);
+    if (lit?.price_ids?.length) planPriceIds.set(String(p.name), lit.price_ids);
+    const known = initPlans.find((x) => Array.isArray(x.stripe_price_ids) && minorOf(x) === minorOf(p) && x.interval === p.interval && (Number(x.interval_count ?? 1) || 1) === (Number(p.interval_count ?? 1) || 1));
+    if (known) planPriceIds.set(String(p.name), [...planPriceIds.get(String(p.name)) ?? [], ...known.stripe_price_ids]);
   }
   if (!plans.length) {
     plans.push({ name: "TODO: plan name", price: "TODO: e.g. 19.99", currency: "usd", interval: "month" });
@@ -27588,11 +28170,20 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     } else if (s2.unresolved.length) found.push(`${s2.file}:${s2.line}: Checkout Session (${s2.unresolved.length} value(s) are expressions, read as-is)`);
     else found.push(`${s2.file}:${s2.line}: Checkout Session`);
     entry.strict = true;
-    const sold = s2.params ? plansSoldBy(s2.params, plans) : [];
-    if (plans.length === 1 || sold.length === 1) stripe.push({ ...entry, plan: String((sold[0] ?? plans[0]).name) });
-    else if (s2.params && plans.length > 1 && !plans.some((p) => String(p.name).startsWith("TODO"))) {
+    const pair = pairCall(root, s2, plans, planPriceIds, det.checkoutSessions.length);
+    if (pair.plan) {
+      if (plans.length > 1) {
+        names.delete(String(entry.name));
+        entry.name = unique(names, `${String(entry.name).replace(/\)$/, "")}: ${pair.plan})`);
+      }
+      stripe.push({ ...entry, plan: pair.plan });
+      if (pair.why) found.push(`${s2.file}:${s2.line}: sells plan "${pair.plan}" (${pair.why})`);
+    } else if (pair.several) {
       for (const p of plans) stripe.push({ ...entry, name: unique(names, `${String(entry.name).replace(/\)$/, "")}: ${String(p.name)})`), plan: String(p.name) });
       names.delete(String(entry.name));
+    } else if (plans.length > 1 && !plans.some((p) => String(p.name).startsWith("TODO"))) {
+      stripe.push({ ...entry, plan: `TODO: which plan does this call sell? one of ${oneOf}` });
+      todos.push(`${s2.file}:${s2.line}: which plan this Checkout call sells ("plan"); Checkbox could not tell from its Price id${pair.ref ? ` (${pair.ref})` : ""}`);
     } else stripe.push(entry);
   }
   const emails = [];
@@ -27602,12 +28193,22 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     if (IN_EMAIL_DIR.test(rel2)) {
       const kind = emailKindOf(rel2);
       if (/\.(?:html?|txt|md)$/i.test(rel2) && kind) {
-        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...planFor() });
-        found.push(`${rel2}: ${kind} email`);
+        let text = "";
+        try {
+          text = readFileSync6(join5(root, rel2), "utf8");
+        } catch {
+        }
+        const tags = Object.fromEntries(mergeTagsIn(text).flatMap((t) => mergeTagField(t) ? [[t, mergeTagField(t)]] : []));
+        const planTagged = Object.values(tags).some((v) => v.startsWith("plan."));
+        const hint = intervalHintOf(basename(rel2).replace(/\.[^.]+$/, ""));
+        const byName = hint && plans.length > 1 ? plans.filter((p) => p.interval === hint && (Number(p.interval_count ?? 1) || 1) === 1) : [];
+        const plan2 = plans.length > 1 && planTagged ? { plan: "all" } : byName.length === 1 ? { plan: String(byName[0].name) } : planFor();
+        emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...plan2, ...Object.keys(tags).length ? { merge_tags: tags } : {} });
+        found.push(`${rel2}: ${kind} email${Object.keys(tags).length ? ` (its merge tags ${Object.keys(tags).map((t) => `{{${t}}}`).join(", ")} are filled from checkbox.json: see "merge_tags")` : ""}`);
         return;
       }
       if (/\.[jt]sx$|\.mjml$/i.test(rel2) && kind) {
-        todos.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
+        notes2.push(`${rel2}: a ${kind} email component; add it with "module": "<file>#<export>" returning the rendered { subject, html } (React Email: render() with sample props)`);
         return;
       }
     }
@@ -27631,8 +28232,22 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
       }
     }
   });
-  if (!disclosures.length && det.payButtons.length) {
-    todos.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
+  for (const ps of pageSources(root)) {
+    if (pages.some((p) => p.source === ps.source || p.file === ps.file)) continue;
+    let text = "";
+    try {
+      text = readFileSync6(join5(root, ps.source), "utf8");
+    } catch {
+    }
+    const kind = /checkout|subscribe/i.test(ps.route) ? "checkout" : "pricing";
+    const shows = (p) => text.includes(String(p.name)) || typeof p.price === "number" && text.includes(`$${p.price}`) || typeof p.amount === "number" && text.includes(`$${p.amount / 100}`);
+    const showsAll = plans.length > 1 && plans.every(shows);
+    pages.push({ name: unique(names, `Page: ${ps.route}`), file: ps.file, source: ps.source, kind, ...showsAll ? { plan: "all" } : planFor("page") });
+    found.push(`${ps.source}: ${kind} page (checked as the built ${ps.file}; the workflow builds it first)`);
+  }
+  const inPages = (f) => pages.some((p) => p.source === f);
+  if (!disclosures.length && det.payButtons.length && !det.payButtons.some((b) => inPages(b.file))) {
+    notes2.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
   }
   if (planTodo) todos.push('plan: pick the plan of each disclosure, page and email entry marked TODO ("all" for a page that shows every plan)');
   const checks = {};
@@ -27642,20 +28257,24 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
   if (emails.length) checks.emails = emails;
   checks.notice_schedule = true;
   if (!stripe.length && !disclosures.length && !pages.length && !emails.length) {
-    todos.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
+    notes2.push('No checkout code, email templates or pages were found: add entries under "checks" (https://checkbox.site/docs/guides/ci#config)');
   }
   return {
     config: { $schema: SCHEMA_URL, merchant, jurisdictions: "all", plans, checks },
     todos,
-    found
+    found,
+    notes: notes2,
+    todoValues: countTodoValues({ merchant, plans, checks })
   };
 }
-var IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
+var PAGE_ROUTE, IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
 var init_scaffold = __esm({
   "src/ci/scaffold.ts"() {
     "use strict";
     init_detect();
+    init_preflight();
     init_config3();
+    PAGE_ROUTE = /^(pricing|checkout|subscribe|plans)$/i;
     IGNORE = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".nuxt", ".svelte-kit", ".output", ".vercel", ".netlify", ".turbo", ".cache", "coverage", ".astro", "vendor", ".venv", "__pycache__", ".github"]);
     MAX_FILES2 = 5e3;
     EMAIL_NAMES = [
@@ -27846,8 +28465,8 @@ function loaderFlags(file, dir, nodeVersion = process.versions.node, features =
   if (hasTsx(dir)) return ["--import", "tsx"];
   if (/\.[jt]sx$/.test(file)) return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: JSX modules need tsx (npm install -D tsx), or export the rendered { subject, html } from a .js / .ts file`;
   if (features.typescript) return [];
-  const [major, minor] = nodeVersion.split(".").map(Number);
-  if (major > 22 || major === 22 && minor >= 6) return ["--experimental-strip-types"];
+  const [major2, minor] = nodeVersion.split(".").map(Number);
+  if (major2 > 22 || major2 === 22 && minor >= 6) return ["--experimental-strip-types"];
   return declaresTsx(dir) ? `${file}: ${NOT_INSTALLED}` : `${file}: TypeScript modules need Node 22.6+ (type stripping) or tsx in the project (npm install -D tsx); or point "file" at a JSON export`;
 }
 function runModule(dir, ref, args = [], env2 = process.env, timeoutMs = 3e4) {
@@ -27917,7 +28536,23 @@ function paramsFromSource(text, file, call = 1, env2 = {}, consts = {}) {
   if (!lit) throw new InputError(`${file}:${line2}: the params are not an object literal; use "module" (a function returning the params) or "file" instead`);
   const parsed = parseObjectLiteral(lit, env2, consts);
   if (!parsed.value) throw new InputError(`${file}:${line2}: could not read the params object`);
-  return { params: parsed.value, line: line2, unresolved: parsed.unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
+  const unresolved = [...parsed.unresolved, ...spreadUnread(parsed.value, parsed.spreads ?? [], consts)];
+  return { params: parsed.value, line: line2, unresolved, ...parsed.fromEnv ? { fromEnv: parsed.fromEnv } : {} };
+}
+function spreadUnread(params, spreads, consts = {}) {
+  const out = [];
+  for (const expr of spreads) {
+    const name = expr.replace(/\s+/g, "").replace(/\?\./g, ".");
+    const seen = Object.prototype.hasOwnProperty.call(consts, name) ? consts[name] : expr;
+    const visible = /[{]/.test(seen);
+    for (const k of SPREAD_VERDICT_KEYS) {
+      if (params[k] !== void 0) continue;
+      if (visible && !new RegExp(`\\b${k}\\b`).test(seen)) continue;
+      const entry = `${k} (may come from ...${expr.length > 40 ? `${expr.slice(0, 37)}\u2026` : expr})`;
+      if (!out.includes(entry)) out.push(entry);
+    }
+  }
+  return out;
 }
 function lineOfAny(text, needles) {
   const lower2 = text.toLowerCase();
@@ -28028,7 +28663,8 @@ async function stripeJob(loaded, e, o, root) {
       if (r.unresolved.length) {
         job.partial = true;
         job.unresolved = r.unresolved;
-        job.warnings.push(`Read statically; ${r.unresolved.length} value(s) are expressions Checkbox cannot evaluate (${r.unresolved.slice(0, 4).join(", ")}${r.unresolved.length > 4 ? ", \u2026" : ""}). Give the price in "plans" (and "plan" here), or use "module" to return the exact params.`);
+        const listed = r.unresolved.some((p) => / \(may come from \.\.\./.test(p)) ? r.unresolved.filter((p) => p !== "...") : r.unresolved;
+        job.warnings.push(`Read statically; ${listed.length} value(s) are expressions Checkbox cannot evaluate (${listed.slice(0, 4).join(", ")}${listed.length > 4 ? ", \u2026" : ""}). Give the price in "plans" (and "plan" here), or use "module" to return the exact params.`);
       }
     }
     if (!params || typeof params !== "object" || Array.isArray(params)) throw new InputError("the Checkout Session params must be a JSON object");
@@ -28161,6 +28797,53 @@ function pageJob(loaded, e, o, root) {
   }
   return job;
 }
+function planMoney(plan2) {
+  if (!plan2) return void 0;
+  const cur = (plan2.currency ?? "usd").toUpperCase();
+  const major2 = typeof plan2.amount === "number" ? plan2.amount / 100 : typeof plan2.price === "number" ? plan2.price : typeof plan2.price === "string" && /^[\d.]+$/.test(plan2.price) ? Number(plan2.price) : void 0;
+  if (major2 === void 0) return void 0;
+  try {
+    return new Intl.NumberFormat("en-US", { style: "currency", currency: cur }).format(major2);
+  } catch {
+    return `${major2.toFixed(2)} ${cur}`;
+  }
+}
+function fillMergeTags(msg2, tags, config, plan2) {
+  const field = (v) => {
+    if (!MERGE_TAG_FIELDS.includes(v)) return v;
+    switch (v) {
+      case "plan.price":
+      case "plan.amount":
+        return planMoney(plan2);
+      case "plan.interval":
+        return plan2 ? (plan2.interval_count ?? 1) > 1 ? `${plan2.interval_count} ${plan2.interval}s` : plan2.interval : void 0;
+      case "plan.name":
+        return plan2?.name;
+      case "plan.trial_days":
+        return plan2?.trial_days !== void 0 ? String(plan2.trial_days) : void 0;
+      case "plan.currency":
+        return (plan2?.currency ?? "usd").toUpperCase();
+      case "merchant.name":
+        return config.merchant?.name;
+      case "merchant.cancel_url":
+        return config.merchant?.cancel_url;
+      case "merchant.support_contact":
+        return config.merchant?.support_contact;
+    }
+    return void 0;
+  };
+  const values = /* @__PURE__ */ new Map();
+  for (const [k, v] of Object.entries(tags)) {
+    const val = field(v);
+    if (val !== void 0) values.set(k.toLowerCase(), val);
+  }
+  const esc3 = (t) => t.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  const fill2 = (t, html) => t?.replace(/\{\{\{\s*([\w.-]+)\s*\}\}\}|\{\{\s*([\w.-]+)\s*\}\}|\*\|([\w.-]+)\|\*/g, (m, a, b, c) => {
+    const v = values.get(String(a ?? b ?? c).toLowerCase());
+    return v === void 0 ? m : html ? esc3(v) : v;
+  });
+  return { ...msg2.subject !== void 0 ? { subject: fill2(msg2.subject, false) } : {}, ...msg2.text !== void 0 ? { text: fill2(msg2.text, false) } : {}, ...msg2.html !== void 0 ? { html: fill2(msg2.html, true) } : {} };
+}
 async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
   const { config, dir } = loaded;
   const job = { name, type: "email", ...planName ? { plan: planName } : {}, target: { file: rel(loaded, root, loaded.path), line: entryLine(loaded.raw, e.name) }, inputs: [], warnings: [] };
@@ -28181,6 +28864,8 @@ async function emailJob(loaded, e, o, root, planName = e.plan, name = e.name) {
         msg2 = { ...typeof r.subject === "string" ? { subject: r.subject } : e.subject ? { subject: e.subject } : {}, ...typeof r.text === "string" ? { text: r.text } : {}, ...typeof r.html === "string" ? { html: r.html } : {} };
       } else throw new InputError(`${e.module} must return { subject, text | html } or a string`);
     } else msg2 = { subject: e.subject, ...e.text ? { text: e.text } : {}, ...e.html ? { html: e.html } : {} };
+    const tags = { ...config.merge_tags ?? {}, ...e.merge_tags ?? {} };
+    if (Object.keys(tags).length) msg2 = fillMergeTags(msg2, tags, config, pickPlan(config, planName));
     if (!msg2.subject) throw new InputError(`no subject: add "subject" to the entry, a first line "Subject: \u2026" to the file, or an HTML <title>`);
     if (!msg2.text && !msg2.html) throw new InputError("the email body is empty");
     const terms2 = { ...planTerms(config, pickPlan(config, planName)) };
@@ -28246,7 +28931,7 @@ async function planJobs(loaded, o, root) {
   }
   return jobs;
 }
-var InputError, NOT_INSTALLED, CHILD, jurisdictionsOf;
+var InputError, NOT_INSTALLED, CHILD, SPREAD_VERDICT_KEYS, jurisdictionsOf;
 var init_inputs = __esm({
   "src/ci/inputs.ts"() {
     "use strict";
@@ -28274,6 +28959,7 @@ if (typeof v === 'function') v = await v(...JSON.parse(argsJson));
 process.stdout.write('\\n__CHECKBOX_JSON__' + JSON.stringify(v === undefined ? null : v) + '\\n');
 process.exit(0);
 `;
+    SPREAD_VERDICT_KEYS = ["mode", "consent_collection", "custom_text", "subscription_data", "discounts"];
     jurisdictionsOf = (config) => config.jurisdictions ? { jurisdictions: config.jurisdictions } : {};
   }
 });
@@ -28606,6 +29292,7 @@ var init_timing = __esm({
 var notice_schedule_exports = {};
 __export(notice_schedule_exports, {
   computeNoticeSchedule: () => computeNoticeSchedule,
+  noticesKindsNote: () => noticesKindsNote,
   singleDayNote: () => singleDayNote
 });
 function singleDayNote(requirementIds, days) {
@@ -28714,7 +29401,12 @@ function computeNoticeSchedule(input, now = /* @__PURE__ */ new Date()) {
     if (t.governed) push("annual_terms", termMonths2 >= 12 ? "Yearly terms reminder (first anniversary; the renewal reminder can carry it)" : "Yearly terms reminder (first anniversary)", anniversary, t);
     else notRequired.push({ kind: "annual_terms", reason: "No applicable requirement demands a yearly terms reminder under these jurisdictions." });
   }
-  if (!input.price_change) {
+  if (!input.price_change && plan2.introAmount !== void 0 && plan2.introAmount < plan2.amount) {
+    const stepUp = addInterval(firstCharge, plan2.interval, plan2.intervalCount * Math.max(1, plan2.introPeriods ?? 1));
+    const t = timing("price_change", stepUp);
+    if (t.governed) push("price_change", `Intro price ends: the regular price is first charged`, stepUp, t);
+    else notRequired.push({ kind: "price_change", reason: "The intro price ends, but no applicable requirement demands a price-change notice for it under these jurisdictions." });
+  } else if (!input.price_change) {
     notRequired.push({ kind: "price_change", reason: "No price change planned. Pass price_change (effective_date, new_price) to schedule its advance notice." });
   } else {
     const eff = parseDate(input.price_change.effective_date, "price_change.effective_date", start);
@@ -28741,6 +29433,24 @@ function computeNoticeSchedule(input, now = /* @__PURE__ */ new Date()) {
     }
   };
 }
+function noticesKindsNote(kinds, settings) {
+  const scheduled = [...new Set(kinds)];
+  if (!scheduled.length) return null;
+  if (!settings || settings.mode !== "checkbox") {
+    return {
+      code: "notices_you_send",
+      message: `This site's notices are in "You send" mode: your code sends ${scheduled.join(", ")} at these dates (Checkbox tracks them and can call your webhook when each is due). To have Checkbox send them: updateNoticeSettings { "mode": "checkbox", "add_kinds": ${JSON.stringify(scheduled)} }.`,
+      param: "site"
+    };
+  }
+  const off = scheduled.filter((k) => !settings.enabledKinds.includes(k));
+  if (!off.length) return null;
+  return {
+    code: "notices_kinds_off",
+    message: `Checkbox Notices does not send ${off.join(", ")} for this site yet: updateNoticeSettings { "add_kinds": ${JSON.stringify(off)} } turns them on (or your code sends them at these dates).`,
+    param: "site"
+  };
+}
 var CITATION, BY_ID2, day, unix;
 var init_notice_schedule = __esm({
   "../../apps/api/src/v1/checks/notice-schedule.ts"() {
@@ -28781,10 +29491,41 @@ function operationFor2(kind) {
 function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
+function resultOf(status, exit, strict) {
+  if (exit === 0) return status === "needs_review" ? "passed with items to review (they do not fail this run)" : "passed";
+  if (status === "needs_review") return `failed: items need review and ${strict ? "--strict is on" : 'a "strict" entry or a blocking check makes them fail the run'} (exit ${exit})`;
+  if (status === "skipped") return `failed: nothing was checked (exit ${exit})`;
+  if (status === "fail") return `failed: fixes needed (exit ${exit})`;
+  return `failed: could not run every check (exit ${exit})`;
+}
 function ciVocabulary(text) {
-  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/comes from merchant\.price and is not verified against the Price\. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price\./g, "comes from the plan's price in checkbox.json and is not verified against the Price. Connect Stripe on the site in Checkbox, then run checkbox ci --online (CHECKBOX_SECRET_KEY) so Checkbox reads the Price.").replace(/comes from merchant\.price\b/g, "comes from the plan's price in checkbox.json").replace(/\bmerchant\.price says\b/g, "The plan's price in checkbox.json says").replace(/\(or pass merchant\.cancel_url\)/g, "(or set merchant.cancel_url in checkbox.json)").replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+  return text.replace(/Pass every plan the page sells \(plans: \[\.\.\.\]\)/g, 'Set "plan": "all" on this page entry in checkbox.json (every plan the page sells)').replace(/Pass plans with every plan the page sells/g, 'Set "plan": "all" on this page entry in checkbox.json').replace(/\(page_kind "checkout"\)/g, '(a pages entry with "kind": "checkout")').replace(/page_kind "checkout"/g, '"kind": "checkout"').replace(/check the renewal (text|text itself) with check_disclosure/g, 'check the renewal $1 with a "disclosures" entry').replace(/\bcheck_disclosure\b/g, 'a "disclosures" entry').replace(/pass merchant\.price \(e\.g\. 19\.99\), merchant\.currency and merchant\.interval/g, 'add the plan to "plans" in checkbox.json (price, currency, interval) and name it in "plan" on this entry').replace(/merchant\.price \+ merchant\.interval/g, 'a plan in "plans" of checkbox.json (and "plan" on this entry)').replace(/pass merchant\.price and merchant\.interval/gi, 'add the plan to "plans" in checkbox.json and name it in "plan" on this entry').replace(/merchant\.intro_percent_off \(or intro_amount_off\) and merchant\.intro_periods/g, "intro_percent_off (or intro_amount_off) and intro_periods on the plan in checkbox.json").replace(/merchant\.intro_\*/g, "the plan's intro_* in checkbox.json").replace(/merchant\.trial_days \((\d+)\)/g, "trial_days ($1) of the plan in checkbox.json").replace(/merchant\.price was ignored/g, "the plan's price in checkbox.json was ignored").replace(/comes from merchant\.price and is not verified against the Price\. Connect Stripe on the site, or register the params with createStripeCheckoutConfig on a site whose Stripe account has this Price\./g, "comes from the plan's price in checkbox.json and is not verified against the Price. Connect Stripe on the site in Checkbox, then run checkbox ci --online (CHECKBOX_SECRET_KEY) so Checkbox reads the Price.").replace(/comes from merchant\.price\b/g, "comes from the plan's price in checkbox.json").replace(/\bmerchant\.price says\b/g, "The plan's price in checkbox.json says").replace(/\(or pass merchant\.cancel_url\)/g, "(or set merchant.cancel_url in checkbox.json)").replace(/to confirm, check the email again with sample values in their place \(keep the merge tags in your code\)\./g, `give each tag its value under "merge_tags" in checkbox.json (on this entry, or top level for every email), e.g. "merge_tags": { "price": "plan.price", "interval": "plan.interval" }: Checkbox fills them from the entry's plan before checking, and your template keeps its tags.`).replace(/In test mode, pass the page source as html\./g, 'With a test key, list the built page under "file" in checkbox.json instead of "url" (or run --online with a live key, ck_live_\u2026).');
+}
+function pricingPageFixes(fixes, replacements = []) {
+  return concreteCardFixes(pricingPageFixesRaw(fixes), replacements);
 }
-function pricingPageFixes(fixes) {
+function concreteCardFixes(fixes, replacements) {
+  if (!replacements.length) return fixes;
+  const lineFor = (card) => {
+    const name = card.split(", ")[0].trim().toLowerCase();
+    const r = replacements.find((x) => x.plan.replace(/\s*\([^)]*\)\s*$/, "").trim().toLowerCase() === name);
+    return r?.short_disclosure_text || r?.disclosure_text || void 0;
+  };
+  const covered = /* @__PURE__ */ new Set();
+  const out = fixes.map((f) => {
+    const m = /^Plan card “([^”]+)”: /.exec(f);
+    if (!m || !/"<price> every <interval>[^"]*"/.test(f)) return f;
+    const line2 = lineFor(m[1]);
+    if (!line2) return f;
+    if (/cancel anytime online/i.test(line2)) covered.add(m[1]);
+    return f.replace(/"<price> every <interval>[^"]*"/, `"${line2}"`);
+  });
+  return out.filter((f) => {
+    const m = /^Plan card “([^”]+)”: Add "Cancel anytime online" to the renewal line/.exec(f);
+    return !(m && covered.has(m[1]));
+  });
+}
+function pricingPageFixesRaw(fixes) {
   const reworded = fixes.map(
     (f) => f.replace(/,? before the card and email fields and the (?:pay|purchase) button/g, ", next to the plan's button").replace(/,? before the card and email fields/g, ", next to the plan's button")
   );
@@ -28833,8 +29574,10 @@ function fixesOf(r, onlyNeedsFix = false) {
     const plain = cards.length > 1 ? cardClauses(c.explanation).filter((x) => /look like the surrounding text/.test(x.clause)).map((x) => x.card) : [];
     if (plain.length && plain.length < cards.length && /renewal line/i.test(base)) {
       cards = cards.filter((x) => !plain.includes(x));
-      const standOut = `Plan card ${plain.map((x) => `\u201C${x}\u201D`).join(", ")}: ${STAND_OUT_FIX}`;
-      if (!out.includes(standOut)) out.push(standOut);
+      for (const x of cardClauses(c.explanation).filter((y) => plain.includes(y.card))) {
+        const standOut = `Plan card \u201C${x.card}\u201D: ${setOffFix(x.clause)}`;
+        if (!out.includes(standOut)) out.push(standOut);
+      }
     }
     const text = cards.length && base ? `Plan card ${cards.map((x) => `\u201C${x}\u201D`).join(", ")}: ${base}` : base;
     if (text && !out.includes(text)) out.push(text);
@@ -28862,22 +29605,29 @@ function withPlaceholders(params, placeholders) {
   }
   return copy;
 }
-function correctedOf(type, r, partial = false, placeholders) {
+function correctedOf(type, r, partial = false, placeholders, pricingPage = false) {
   if (type === "stripe_checkout" && r.correction?.patch?.length && partial) {
     return { format: "json", title: `Changes to make to the params (JSON Patch; keep your other values)${r.correction.verification?.passes ? ", verified by the rules engine" : ""}`, body: JSON.stringify(r.correction.patch, null, 2) };
   }
   if (type === "stripe_checkout" && r.correction?.patch?.length) {
     return { format: "json", title: `Corrected params${r.correction.verification?.passes ? " (verified by the rules engine)" : ""}${placeholders ? "; keep your own values where it says {{\u2026}}" : ""}`, body: JSON.stringify(withPlaceholders(r.correction.corrected_params, placeholders), null, 2) };
   }
-  const perPlan = (r.plan_replacements ?? []).filter((p) => p.disclosure_text);
-  if (type === "page" && perPlan.length >= 2 && ciStatusOf(r) !== "pass") {
+  const allPlans = (r.plan_replacements ?? []).filter((p) => p.disclosure_text);
+  if (type === "page" && allPlans.length >= 2 && ciStatusOf(r) !== "pass") {
+    const named = (r.checks ?? []).filter((c) => (c.status === "fail" || c.status === "needs_review") && !(c.compliance_status && OK_STATUSES.has(c.compliance_status))).flatMap((c) => failingCards(c.explanation)).map((x) => x.split(", ")[0].trim().toLowerCase());
+    const failing = allPlans.filter((p) => named.includes(p.plan.replace(/\s*\([^)]*\)\s*$/, "").trim().toLowerCase()));
+    const perPlan = failing.length ? failing : allPlans;
     const all = perPlan.every((p) => p.verified);
     return {
       format: "text",
-      title: `Suggested replacement per plan, each directly above its own plan's button${all ? " (each passes the checks, verified by the rules engine)" : ""}`,
-      body: perPlan.map((p) => `${p.plan}:
-${p.disclosure_text}${p.consent_label ? `
-Consent checkbox label: ${p.consent_label}` : ""}`).join("\n\n")
+      title: perPlan.length === 1 ? `Suggested replacement for ${perPlan[0].plan.replace(/\s*\([^)]*\)\s*$/, "")}, directly above its button${all ? " (passes the checks, verified by the rules engine)" : ""}` : `Suggested replacement per plan, each directly above its own plan's button${all ? " (each passes the checks, verified by the rules engine)" : ""}`,
+      // Round 32 (pilot 31, ci-pr-agent): a pricing page links to the checkout, where consent is asked (Stripe Checkout
+      // shows its own checkbox), so no consent checkbox label is suggested for it.
+      body: `${perPlan.map((p) => `${p.plan}:
+${p.disclosure_text}${p.consent_label && !pricingPage ? `
+Consent checkbox label: ${p.consent_label}` : ""}`).join("\n\n")}${perPlan.some((p) => p.html && BOXED_HTML.test(p.html)) ? `
+
+${BOXED_LINE}` : ""}`
     };
   }
   if ((type === "disclosure" || type === "page") && r.replacement?.disclosure_text && ciStatusOf(r) !== "pass") {
@@ -28889,11 +29639,14 @@ Consent checkbox label: ${p.consent_label}` : ""}`).join("\n\n")
 
 Fuller version: ${r.replacement.disclosure_text}` : r.replacement.disclosure_text}${r.replacement.consent_label ? `
 
-Consent checkbox label: ${r.replacement.consent_label}` : ""}`
+Consent checkbox label: ${r.replacement.consent_label}` : ""}${r.replacement.html && BOXED_HTML.test(r.replacement.html) ? `
+
+${BOXED_LINE}` : ""}`
     };
   }
   if (type === "email" && r.template && ciStatusOf(r) !== "pass" && r.verdict !== "not_applicable") {
-    return { format: "text", title: `Suggested template${r.template.verified ? " (passes the checks, verified by the rules engine)" : ""}`, body: `Subject: ${r.template.subject}
+    const toFill = r.template.placeholders ?? [];
+    return { format: "text", title: `Suggested template${r.template.verified ? toFill.length ? ` (passes the checks once you replace ${toFill.join(", ")} with your real value${toFill.length === 1 ? "" : "s"}${toFill.includes("{{support_contact}}") ? ", or set merchant.support_contact in checkbox.json" : ""})` : " (passes the checks, verified by the rules engine)" : ""}`, body: `Subject: ${r.template.subject}
 
 ${r.template.text}` };
   }
@@ -28937,13 +29690,20 @@ function noticeCoverage(config, planName, schedule, opts = {}) {
   const required = /* @__PURE__ */ new Map();
   for (const n of schedule.notices ?? []) {
     const k = NOTICE_TO_EMAIL[n.kind];
-    if (k && !required.has(k)) required.set(k, { occasion: n.occasion, days: n.days_before });
-  }
+    if (k && !required.has(k)) required.set(k, { occasion: n.occasion, days: n.days_before, citations: n.citations ?? [], jurisdictions: n.jurisdictions ?? [] });
+  }
+  const law = (w) => {
+    if (!w.citations.length) return "";
+    const where2 = w.jurisdictions.map((j) => j.replace(/^US-/, "")).filter((j) => j !== "FED");
+    const fed = w.jurisdictions.includes("US-FED");
+    const places = [...fed ? ["federal"] : [], ...where2];
+    return ` Required by ${w.citations.slice(0, 2).join("; ")}${w.citations.length > 2 ? ` and ${w.citations.length - 2} more` : ""}${places.length ? ` (${places.length > 4 ? `${places.slice(0, 4).join(", ")} and ${places.length - 4} more` : places.join(", ")})` : ""}.`;
+  };
   const missing = [...required].filter(([k]) => !have.has(k));
   if (!required.size) return { status: "not_applicable", label: "No reminder emails required", fixes: [] };
   const sent2 = [...required.keys()].filter((k) => byCheckbox.has(k)).length;
   if (!missing.length) return { status: "pass", label: `Checks pass \xB7 ${required.size} required email${required.size === 1 ? "" : "s"} covered${sent2 ? ` (${sent2} sent by Checkbox Notices, ${real ? "as the site's Notice settings confirm" : "as checkbox.json declares; --online confirms it against the site"})` : ""}`, fixes: [] };
-  const fixes = missing.map(([k, w]) => `Add ${/^[aeiou]/i.test(EMAIL_LABEL[k]) ? "an" : "a"} ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it${declared.includes(k) ? " (checkbox.json says it does, but the site's Notice settings do not send it)" : ""}.`);
+  const fixes = missing.map(([k, w]) => `Add ${/^[aeiou]/i.test(EMAIL_LABEL[k]) ? "an" : "a"} ${EMAIL_LABEL[k]} to checks.emails (kind "${k}"; ${w.days > 0 ? `${w.days} days before: ${w.occasion}` : w.occasion}), or have Checkbox Notices send it${declared.includes(k) ? " (checkbox.json says it does, but the site's Notice settings do not send it)" : ` ("notices": { "sent_by_checkbox": true } in checkbox.json once Notices is on for the site)`}.${law(w)}`);
   return { status: "needs_review", label: `${missing.length} required email${missing.length === 1 ? "" : "s"} not in checkbox.json`, fix: fixes[0], fixes };
 }
 function unverifiedOffer(r) {
@@ -28957,6 +29717,11 @@ function unverifiedOffer(r) {
   if (coupon && open2.length) return coupon.message;
   return void 0;
 }
+function sitePlansDifferInCi(message) {
+  const m = /\(you sent (.+?); (site_\w+) has (.+?)\), then check again/.exec(message);
+  if (!m) return message;
+  return `The site's plans in Checkbox (${m[3]}) are older than checkbox.json (${m[1]}). This run checks against checkbox.json, what this code sells. Once this change is deployed, update the site's plans (updateSetupSession plans[], or \`checkbox init --plan \u2026\`) so the site's own checks and its compliance plan use them; until then the plan's tasks may quote the old terms.`;
+}
 async function runJob(job, engine, config, opts = {}) {
   const base = { name: job.name, type: job.type, ...job.plan ? { plan: job.plan } : {}, target: { ...job.target }, ...job.fromSource ? { fromSource: true } : {}, warnings: [...job.warnings] };
   if (job.error) return { ...base, status: "error", label: "Could not run", message: job.error, fixes: [] };
@@ -28970,22 +29735,41 @@ async function runJob(job, engine, config, opts = {}) {
     return { ...base, status: "error", label: "Could not run", message: `${ciVocabulary(e.message)}${e.param && !failure && /^merchant\./.test(e.param) ? "" : e.param ? ` (${e.param})` : ""}`, fixes: [], ...failure ? { failure } : {} };
   }
   if (job.type === "notice_schedule") return { ...base, ...noticeCoverage(config, job.plan, report, opts), report };
+  const pairing = (report.warnings ?? []).find((w) => w.code === "price_plan_conflict");
+  if (pairing) {
+    const names = (config.plans ?? []).map((p) => JSON.stringify(p.name)).join(", ");
+    return { ...base, status: "error", label: "Could not run \xB7 plan pairing", message: `${pairing.message.replace(/\. Checkbox offers no corrected params[\s\S]*$/, "")}. Set "plan" on "${job.name}" to the plan this call really sells (one of ${names}); Checkbox shows no fix until the pairing agrees, because a fix would write the other plan's price into this checkout.`, fixes: [], report };
+  }
   const alerts = job.warnings.filter((w) => /^The params and checkbox\.json disagree/.test(w));
   for (const w of report.warnings ?? []) {
-    const text = ciVocabulary(w.message);
+    const text = w.code === "site_plans_differ" ? sitePlansDifferInCi(w.message) : ciVocabulary(w.message);
     base.warnings.push(text);
     if (ALERT_CODES.has(w.code)) alerts.push(text);
   }
   if (alerts.length) Object.assign(base, { alerts });
+  const onlyPlansDiffer = (report.warnings ?? []).some((w) => w.code === "site_plans_differ") && report.verdict !== "fail" && report.compliance_status !== "needs_fix" && (report.checks ?? []).length > 0 && (report.checks ?? []).every((c) => c.status === "pass" || c.status === "not_applicable" || !!c.compliance_status && OK_STATUSES.has(c.compliance_status));
+  if (onlyPlansDiffer) {
+    const pending = Number(report.compliance?.counts?.pending_live_check) || 0;
+    report = { ...report, verdict: "pass", compliance_status: pending ? "pending_live_check" : "compliant", compliance: { ...report.compliance ?? {}, label: pending ? `Checks pass \xB7 ${pending} live check${pending === 1 ? "" : "s"} pending` : "Checks pass" } };
+  }
   const status = ciStatusOf(report);
   const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
   let fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
+  const tagsLeft = job.type === "email" && status !== "pass" ? (report.warnings ?? []).find((w) => w.code === "unresolved_placeholders") : void 0;
+  if (tagsLeft) {
+    const tags = [...new Set(tagsLeft.message.match(/\{\{\{?\s*[\w.-]+\s*\}?\}\}|\*\|[\w.-]+\|\*/g) ?? [])];
+    const sample = tags.slice(0, 3).map((t) => t.replace(/[{}*|\s]/g, "")).map((t) => `"${t}": "${/price|amount|cost/i.test(t) ? "plan.price" : /interval|period|frequency|cycle/i.test(t) ? "plan.interval" : /trial/i.test(t) ? "plan.trial_days" : /plan/i.test(t) ? "plan.name" : /cancel/i.test(t) ? "merchant.cancel_url" : "a sample value"}"`);
+    fixes.unshift(`Checkbox cannot read the terms behind ${tags.join(", ")}. Add "merge_tags": { ${sample.join(", ")} } to this entry in checkbox.json (plan.price, plan.interval, \u2026 take the entry's plan), then run checkbox ci again; no render module is needed.`);
+  }
   const pricingPage = job.type === "page" && job.body?.page_kind === "pricing";
-  if (pricingPage) fixes = pricingPageFixes(fixes);
-  const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b/.test(p));
-  const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review" || status === "pass" && unreadText.some((p) => /^(?:custom_text|consent_collection|discounts|subscription_data\.trial)/.test(p)));
+  const cardLines = (report.plan_replacements ?? []).filter((p) => p.disclosure_text);
+  if (pricingPage) fixes = pricingPageFixes(fixes, cardLines);
+  const unreadText = (job.unresolved ?? []).filter((p) => /^(?:custom_text|consent_collection|discounts|subscription_data|allow_promotion_codes|payment_method_collection)\b|^mode\b/.test(p));
+  const unread = job.type === "stripe_checkout" && unreadText.length > 0 && (status === "fail" || status === "needs_review" || status === "not_applicable" && unreadText.some((p) => /^mode\b/.test(p)) || status === "pass" && unreadText.some((p) => /^(?:custom_text|consent_collection|discounts|subscription_data(?:\.trial| \(may come from))/.test(p)));
+  const spreadOnly = unreadText.length > 0 && unreadText.every((p) => / \(may come from \.\.\./.test(p));
   if (unread) {
-    fixes.splice(0, fixes.length, `${unreadText.slice(0, 3).join(", ")} ${unreadText.length === 1 ? "is an expression" : "are expressions"} Checkbox cannot read statically (e.g. a ternary or PLANS.monthly.*), so the checks that depend on ${unreadText.length === 1 ? "it were" : "them were"} not checked (no fix is given for a value Checkbox did not read). Use "module" (a function returning the exact params for each plan) or "file" instead of "source".`);
+    const what = spreadOnly ? `${unreadText.slice(0, 3).map((p) => p.replace(/ \((may come from [^)]*)\)$/, " $1")).join(", ")}: Checkbox does not follow a spread statically` : `${unreadText.slice(0, 3).join(", ")} ${unreadText.length === 1 ? "is an expression" : "are expressions"} Checkbox cannot read statically (e.g. a ternary or PLANS.monthly.*)`;
+    fixes.splice(0, fixes.length, `${what}, so the checks that depend on ${unreadText.length === 1 ? "it were" : "them were"} not checked (no fix is given for a value Checkbox did not read). Use "module" (a function returning the exact params for each plan) or "file" instead of "source"${spreadOnly ? ", or write these keys in the params literal" : ""}.`);
   }
   const literal = [];
   if (unread) {
@@ -29024,7 +29808,7 @@ async function runJob(job, engine, config, opts = {}) {
     );
   }
   const finalStatus = unread ? literal.length ? "fail" : "needs_review" : declaredCoupon || unreadCoupon ? "needs_review" : status;
-  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders);
+  const corrected = unread ? void 0 : correctedOf(job.type, report, job.partial, job.placeholders, pricingPage);
   if (corrected?.format === "json" && job.placeholders) {
     const unset = job.warnings.filter((w) => /(?:was|were) not set when Checkbox ran/.test(w));
     if (unset.length) Object.assign(base, { alerts: [...unset, ...base.alerts ?? []] });
@@ -29036,7 +29820,7 @@ async function runJob(job, engine, config, opts = {}) {
     ...base,
     status: finalStatus,
     ...blocking ? { blocking: true } : {},
-    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${unreadText[0]} is an expression` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : unreadCoupon ? "Needs review \xB7 coupon not read" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary)) : void 0),
+    label: unread ? `${literal.length ? `${literal.length} fix${literal.length === 1 ? "" : "es"} needed \xB7 ` : ""}Not checked: ${spreadOnly ? unreadText[0].replace(/ \((may come from [^)]*)\)$/, " $1") : `${unreadText[0]} is an expression`}` : declaredCoupon ? "Needs review \xB7 coupon declared, not verified" : unreadCoupon ? "Needs review \xB7 coupon not read" : countedLabel(report.compliance?.label || DEFAULT_LABEL[status], report, pricingPage ? (f) => pricingPageFixes(f.map(ciVocabulary), cardLines) : void 0),
     ...fixes[0] ? { fix: fixes[0] } : {},
     fixes,
     ...corrected ? { corrected } : {},
@@ -29104,10 +29888,11 @@ async function runCi(jobs, engine, opts) {
     checks,
     ...versioned?.rules_version ? { rules_version: versioned.rules_version } : {},
     ...versioned?.catalog_version ? { catalog_version: versioned.catalog_version } : {},
-    disclaimer: CI_DISCLAIMER
+    disclaimer: CI_DISCLAIMER,
+    result: resultOf(status, exit, opts.strict)
   };
 }
-var ENGINE_KIND, CI_DISCLAIMER, RANK2, OK_STATUSES, STAND_OUT_FIX, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
+var ENGINE_KIND, STRIPE_OBJECTS_OFFLINE_NOTICE, CI_DISCLAIMER, RANK2, OK_STATUSES, BOXED_HTML, BOXED_LINE, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -29116,6 +29901,7 @@ var init_runner = __esm({
     init_src();
     init_types2();
     init_stripe_verdict();
+    init_set_off_fix();
     init_config3();
     ENGINE_KIND = {
       stripe_checkout: "stripe_checkout_session",
@@ -29124,10 +29910,12 @@ var init_runner = __esm({
       email: "email",
       notice_schedule: "notice_schedule"
     };
+    STRIPE_OBJECTS_OFFLINE_NOTICE = "Stripe objects (Payment Links, and the trial or price set on a Stripe Price) are not checked offline: this change touches a trial, price or interval, so run checkbox ci --online (CHECKBOX_SECRET_KEY, with Stripe connected on the site) to check that Stripe sells the same terms.";
     CI_DISCLAIMER = "Automated check against Checkbox's catalog of automatic-renewal laws; not legal advice.";
     RANK2 = { fail: 0, needs_review: 1 };
     OK_STATUSES = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
-    STAND_OUT_FIX = "Make its renewal line stand out from the text around it: larger type, bold (weight 600 or more), a contrasting colour, or a border.";
+    BOXED_HTML = /border:1px solid currentColor/;
+    BOXED_LINE = 'Style: the text next to the buttons is already bold, so a semibold line cannot stand out. Put each line in a border (style="border:1px solid currentColor;border-radius:6px;padding:8px 12px"), or make it 15% larger than the text around it: Checkbox measures both.';
     NOTICE_TO_EMAIL = {
       acknowledgment: "acknowledgment",
       trial_ending: "trial_reminder",
@@ -29172,21 +29960,29 @@ function renderHuman(run2, c, opts = {}) {
   const lines = [];
   const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
   lines.push(`${c.bold("Checkbox CI")}  ${run2.config} \xB7 ${run2.mode}${versions} \xB7 ${run2.checks.length} check${run2.checks.length === 1 ? "" : "s"}`);
+  const unreadPrices = [];
   const width = Math.min(40, Math.max(...run2.checks.map((x) => x.name.length), 10));
   for (const x of run2.checks) {
     const label = x.status === "fail" || x.status === "error" ? c.red(x.label) : x.status === "needs_review" ? c.yellow(x.label) : x.status === "pass" ? c.green(x.label) : c.dim(x.label);
     lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
     if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
     if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
-    if (opts.verbose) for (const f of x.fixes.slice(1)) lines.push(`      fix: ${wrap(f, 110, "           ")}`);
+    for (const f of x.fixes.slice(1, opts.verbose ? void 0 : 4)) lines.push(/^Plan card [^:]+: Decision for you\b/.test(f) ? `      decision: ${wrap(f.replace(/Decision for you \(not a fix\): /, ""), 110, "                ")}` : `      fix: ${wrap(f, 110, "           ")}`);
+    if (!opts.verbose && x.fixes.length > 4) lines.push(c.dim(`      (+${x.fixes.length - 4} more with --verbose)`));
     const alerts = x.alerts ?? [];
     for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
-    for (const w of x.warnings.filter((w2) => !alerts.includes(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    for (const w of x.warnings.filter((w2) => !alerts.includes(w2) && !PRICE_UNREAD.test(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
+    for (const w of x.warnings) {
+      const id = PRICE_UNREAD.exec(w)?.[1];
+      if (id && !unreadPrices.includes(id)) unreadPrices.push(id);
+    }
     if (x.corrected && opts.verbose) lines.push(c.dim(`      ${x.corrected.title}:`), ...x.corrected.body.split("\n").map((l) => c.dim(`        ${l}`)));
   }
+  if (unreadPrices.length) lines.push("", c.dim(wrap(`note: ${unreadPrices.length === 1 ? `Price ${unreadPrices[0]} was` : `Prices ${unreadPrices.join(", ")} were`} not read (no connected Stripe account has ${unreadPrices.length === 1 ? "it" : "them"}), so the amounts checked come from "plans" in checkbox.json. To check them against Stripe, connect Stripe on the site in Checkbox and run checkbox ci --online.`, 110, "      ")));
   const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
   if (run2.status === "skipped") lines.push("", c.red(wrap(nothingCheckedMessage(run2), 110, "")));
-  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}`);
+  if (run2.offline_notice) lines.push("", c.yellow(wrap(`Not checked offline: ${run2.offline_notice}`, 110, "      ")));
+  lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}${run2.result ? ` (${run2.result.replace(/ \(exit \d+\)$/, "")})` : ""}`);
   if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
   lines.push(c.dim(run2.disclaimer));
   return lines;
@@ -29198,8 +29994,9 @@ function annotations(run2) {
     const level = x.status === "fail" || x.status === "error" ? "error" : x.status === "needs_review" ? run2.strict || x.blocking ? "error" : "warning" : alerts.length ? "warning" : void 0;
     if (!level) continue;
     const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
+    const removed = x.anchored?.removed?.length ? `This change removed ${x.anchored.removed.length === 1 ? "a line" : `${x.anchored.removed.length} lines`} here: ${x.anchored.removed.slice(0, 2).map((l) => `"${l.trim().slice(0, 120)}"`).join(", ")}${x.anchored.removed.length > 2 ? ", \u2026" : ""}` : "";
     const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
-${x.fix}` : `Could not run: ${x.message ?? ""}` : [x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [removed, x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
     out.push(`::${level} ${props.join(",")}::${escData(body)}`);
   }
   if (run2.status === "skipped") out.push(`::error file=${escProp(run2.config)},title=${escProp("Checkbox: nothing was checked")}::${escData(nothingCheckedMessage(run2))}`);
@@ -29211,6 +30008,8 @@ function stepSummary(run2) {
   const versions = run2.rules_version ? ` \xB7 rules ${run2.rules_version} \xB7 catalog ${run2.catalog_version}` : "";
   lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
   if (run2.status === "skipped") lines.push(`\u274C ${nothingCheckedMessage(run2)}`, "");
+  if (run2.result) lines.push(`Result: ${run2.result}.`, "");
+  if (run2.offline_notice) lines.push(`\u26A0\uFE0F ${run2.offline_notice}`, "");
   lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
   for (const x of run2.checks) {
     const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
@@ -29219,7 +30018,7 @@ function stepSummary(run2) {
   }
   const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
   for (const x of detailed) {
-    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.toLowerCase() : `${x.fixes.length} fixes`)}</summary>`, "");
+    lines.push("", `<details><summary><b>${escapeHtml(x.name)}</b>: ${escapeHtml(x.corrected ? x.corrected.title.charAt(0).toLowerCase() + x.corrected.title.slice(1) : `${x.fixes.length} fixes`)}</summary>`, "");
     if (x.fixes.length) lines.push(...x.fixes.map((f) => `- ${f}`), "");
     if (x.corrected) {
       const fence = x.corrected.body.includes("```") ? "````" : "```";
@@ -29233,7 +30032,7 @@ function stepSummary(run2) {
 function escapeHtml(s2) {
   return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-var TYPE_LABEL, where, escData, escProp, cell, STATUS_MD;
+var TYPE_LABEL, where, PRICE_UNREAD, escData, escProp, cell, STATUS_MD;
 var init_report = __esm({
   "src/ci/report.ts"() {
     "use strict";
@@ -29247,6 +30046,7 @@ var init_report = __esm({
       notice_schedule: "Notice schedule"
     };
     where = (c) => `${c.target.file}${c.target.line && c.target.line > 1 ? `:${c.target.line}` : ""}`;
+    PRICE_UNREAD = /^line_items use (\S+), which Checkbox could not read\b/;
     escData = (s2) => s2.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
     escProp = (s2) => escData(s2).replace(/:/g, "%3A").replace(/,/g, "%2C");
     cell = (s2) => s2.replace(/\|/g, "\\|").replace(/\r?\n/g, "<br>");
@@ -29291,6 +30091,7 @@ function renderPlan(p, c, opts = {}) {
     else if (t.status === "manual" && t.question) lines.push(`        ${c.yellow("ask the human:")} ${t.question.text}  ${c.dim(`\u2192 checkbox answer ${t.id} <${t.question.options?.join("|") ?? "yes|no"}>`)}`);
     else if ((t.status === "done" || t.status === "wont_fix") && t.closed_reason) lines.push(c.dim(`        closed: ${t.closed_reason.replace(/_/g, " ")}`));
     else if (t.blocked_by.length) lines.push(c.dim(`        after ${t.blocked_by.join(", ")}`));
+    else if ((t.status === "open" || t.status === "in_progress") && opts.stale?.(t)) lines.push(`        ${c.yellow("stale, re-verify after the site's plans are updated:")} ${opts.stale(t)}`);
     else if (t.status === "open" || t.status === "in_progress") lines.push(c.dim(`        ${t.where.file_hint ?? t.where.url ?? t.where.stripe_object ?? t.where.kind} \xB7 ${t.change.type} \xB7 checkbox fix ${t.id}`));
   }
   const hidden = p.tasks.length - tasks.length;
@@ -29302,7 +30103,7 @@ function statusColor(s2, c) {
   return s2 === "compliant" ? c.green("all observed checks passing") : s2 === "action_required" ? c.red(s2) : c.yellow(s2);
 }
 function renderVerification(v, c) {
-  const mark = v.status === "passed" ? c.green("passed") : v.status === "failed" ? c.red("failed") : v.status === "passed_with_gaps" ? c.yellow("passed with gaps (not verified)") : v.status === "passed_with_notes" ? c.yellow("passed with notes (a check outside your control needs review)") : v.status === "not_checked" ? c.yellow("not checked yet (missing evidence, nothing to change)") : v.status === "pending_live_check" ? c.yellow("live check pending (content passes; waiting for a real send)") : c.yellow("pending");
+  const mark = v.status === "passed" ? c.green("passed") : v.status === "failed" ? c.red("failed") : v.status === "passed_with_gaps" ? c.yellow("passed with gaps (not verified)") : v.status === "passed_with_notes" ? c.yellow("passed with notes (a check outside your control needs review)") : v.status === "not_checked" ? c.yellow("not checked yet (missing evidence, nothing to change)") : v.status === "pending_live_check" ? c.yellow("live check pending (content passes; waiting for a real send)") : v.status === "needs_review" ? c.yellow("needs review (nothing failed; a check is still undecided: see next step)") : v.status === "superseded" ? c.yellow("superseded (newer evidence settled the task)") : c.yellow("pending");
   const firstCheck = !v.task && v.next_action?.type === "first_check_complete";
   const lines = [`${c.bold(`Verification ${v.id}`)}${v.task ? ` for ${v.task}` : ""}: ${firstCheck ? c.cyan("first check complete") : mark} (${v.method})`];
   if (v.precheck) lines.push(`  pre-check (${v.precheck.source}): ${v.precheck.verdict} \u2014 ${v.precheck.note}`);
@@ -29330,7 +30131,7 @@ function workflowYaml(needs = {}) {
   const node = !!(needs.install || needs.build);
   const steps = ["      - uses: actions/checkout@v4"];
   if (node) {
-    steps.push("      - uses: actions/setup-node@v4", "        with:", "          node-version: 20");
+    steps.push("      - uses: actions/setup-node@v4", "        with:", "          node-version: 22");
     if (needs.install) steps.push(`      # ${needs.why?.install ?? 'checkbox.json "module" entries import your code and its dependencies.'}`, `      - run: ${needs.install}`);
     if (needs.build) steps.push(`      # ${needs.why?.build ?? 'checkbox.json "pages" read built HTML, which a fresh clone does not have.'}`, `      - run: ${needs.build}`);
   } else {
@@ -29426,9 +30227,13 @@ var init_workflow = __esm({
 // src/commands/ci/index.ts
 var ci_exports = {};
 __export(ci_exports, {
+  anchorToChanges: () => anchorToChanges,
   attachSiteForCoupons: () => attachSiteForCoupons,
   couponIdsIn: () => couponIdsIn,
   default: () => ci_default,
+  diffHunks: () => diffHunks,
+  siteFactsFor: () => siteFactsFor,
+  termsChanged: () => termsChanged,
   touchesConfig: () => touchesConfig,
   undiffableInputs: () => undiffableInputs
 });
@@ -29436,6 +30241,48 @@ import { execFileSync as execFileSync2 } from "node:child_process";
 import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { createInterface } from "node:readline";
 import { dirname as dirname7, join as join9, relative as relative5, resolve as resolve7 } from "node:path";
+function termsChanged(cwd, base, jobs) {
+  if (jobs.some((j) => j.type === "stripe_checkout" && (j.sold || j.warnings.some((w) => /^The params and checkbox\.json disagree/.test(w))))) return true;
+  try {
+    const args = ["diff", "-U0", "--no-color", ...base ? [`${base}...HEAD`] : ["HEAD"], "--", ".", ":(exclude)*.md", ":(exclude)**/*.test.*", ":(exclude)**/*.lock", ":(exclude)package-lock.json", ":(exclude)pnpm-lock.yaml"];
+    const out = execFileSync2("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 20 * 1024 * 1024 });
+    return out.split("\n").some((l) => /^[+-](?![+-])/.test(l) && /\b(?:trial(?:_period)?_?days|trialDays|trial_end|unit_amount|interval(?:_count)?|price|amount)\b/i.test(l));
+  } catch {
+    return false;
+  }
+}
+function diffHunks(cwd, base, file) {
+  let out;
+  try {
+    out = execFileSync2("git", ["diff", "-U0", "--no-color", "--no-ext-diff", `${base}...HEAD`, "--", file], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 20 * 1024 * 1024 });
+  } catch {
+    return [];
+  }
+  const hunks = [];
+  for (const l of out.split("\n")) {
+    const h = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(l);
+    if (h) hunks.push({ start: Number(h[1]), count: h[2] === void 0 ? 1 : Number(h[2]), removed: [] });
+    else if (hunks.length && l.startsWith("-") && !l.startsWith("---")) hunks[hunks.length - 1].removed.push(l.slice(1));
+  }
+  return hunks;
+}
+function anchorToChanges(checks, cwd, workspace, base) {
+  const cache2 = /* @__PURE__ */ new Map();
+  for (const x of checks) {
+    if (!(x.status === "fail" || x.status === "needs_review" || x.status === "error") || !x.target.line || x.failure) continue;
+    const file = resolve7(workspace, x.target.file);
+    if (!cache2.has(file)) cache2.set(file, diffHunks(cwd, base, file));
+    const hunks = cache2.get(file);
+    if (!hunks.length) continue;
+    const line2 = x.target.line;
+    if (hunks.some((h) => h.count > 0 && line2 >= h.start && line2 < h.start + h.count)) continue;
+    const dist = (h) => h.count > 0 ? Math.min(Math.abs(line2 - h.start), Math.abs(line2 - (h.start + h.count - 1))) : Math.abs(line2 - h.start);
+    const near2 = [...hunks].sort((a, b) => dist(a) - dist(b))[0];
+    if (dist(near2) > 40) continue;
+    x.anchored = { from: line2, ...near2.removed.length && near2.count === 0 ? { removed: near2.removed } : {} };
+    x.target = { ...x.target, line: Math.max(1, near2.count > 0 ? near2.start : near2.start + 1) };
+  }
+}
 function gitChanged(cwd, base) {
   try {
     const root = execFileSync2("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
@@ -29505,6 +30352,36 @@ async function confirm(question) {
     rl.close();
   }
 }
+async function siteFactsFor(ctx, setupSession) {
+  if (!setupSession) return {};
+  try {
+    if (!ctx.credentials()) return {};
+    const client = ctx.client();
+    const sess = await Promise.race([client.sdk.setupSessions.retrieve(setupSession), new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 8e3))]);
+    const out = {};
+    const b = sess?.business ?? {};
+    if (b.merchant_name) out.merchant_name = b.merchant_name;
+    if (b.site_url) out.site_url = b.site_url;
+    const cancel = b.cancellation_url ?? b.account_url;
+    if (cancel) out.account_url = cancel;
+    const plans = (sess?.site_plans ?? []).filter((p) => typeof p.amount === "number" && p.amount > 0 && typeof p.interval === "string");
+    if (plans.length) {
+      out.plans = plans.map((p) => ({
+        // A name that is only the price ("$29.00 / month") is left out: the plans module names the plan better.
+        ...p.name && !/^\W?\s*[\d.,]+/.test(p.name) ? { name: p.name } : {},
+        amount: p.amount,
+        currency: p.currency ?? "usd",
+        interval: p.interval,
+        ...p.interval_count && p.interval_count > 1 ? { interval_count: p.interval_count } : {},
+        ...p.trial_days ? { trial_days: p.trial_days } : {},
+        ...p.stripe_price_ids?.length ? { stripe_price_ids: p.stripe_price_ids } : {}
+      }));
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
 async function runInit(ctx, argv) {
   const p = parseArgs(argv, { boolean: ["yes", "force", "dry-run", "workflow"], string: ["config"], alias: { y: "yes" } });
   if (p.positionals.length) throw new UsageError(`Unexpected argument "${p.positionals[0]}"`);
@@ -29515,13 +30392,24 @@ async function runInit(ctx, argv) {
   const withWorkflow = bool(p.flags, "workflow") !== false;
   const projects = ctx.config.load().init?.projects ?? {};
   let facts = {};
+  let setupSession;
   for (let dir = resolve7(ctx.cwd); ; dir = dirname7(dir)) {
-    if (projects[dir]?.facts) {
-      facts = projects[dir].facts;
+    const proj = projects[dir];
+    if (proj?.facts || proj?.setup_session) {
+      facts = proj.facts ?? {};
+      setupSession = proj.setup_session;
       break;
     }
     if (dirname7(dir) === dir) break;
   }
+  const fromSite = await siteFactsFor(ctx, setupSession);
+  facts = { ...fromSite, ...facts, ...fromSite.plans && !facts.plans ? { plans: fromSite.plans } : {} };
+  if (Array.isArray(facts.plans) && Array.isArray(fromSite.plans)) {
+    facts.plans = facts.plans.map((p2) => {
+      const m = fromSite.plans.find((x) => x.amount === p2.amount && x.interval === p2.interval);
+      return m && !p2.stripe_price_ids ? { ...p2, stripe_price_ids: m.stripe_price_ids } : p2;
+    });
+  }
   const s2 = scaffoldConfig(ctx.cwd, ctx.env, facts);
   const actionFor = (f) => existsSync8(f) ? force ? "overwrite" : "keep" : "create";
   const files = [{ path: configPath, content: `${JSON.stringify(s2.config, null, 2)}
@@ -29553,8 +30441,13 @@ async function runInit(ctx, argv) {
     found: s2.found,
     ...withWorkflow ? { workflow_steps: workflowSteps } : {},
     todos: s2.todos,
+    // Round 32 (pilot 31, ci-pr-agent: "Fill in the 2 TODO item(s)" with 1 TODO in the file): suggestions are notes;
+    // the count is the number of "TODO" values in the file.
+    todo_values: s2.todoValues,
+    notes: s2.notes,
+    ...Object.keys(fromSite).length ? { from_site: Object.keys(fromSite) } : {},
     config: s2.config,
-    next_action: s2.todos.length ? { type: "edit_config", message: `Fill in the ${s2.todos.length} TODO item(s) in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
+    next_action: s2.todoValues ? { type: "edit_config", message: `Fill in the ${s2.todoValues} "TODO" value${s2.todoValues === 1 ? "" : "s"} in ${relName(configPath)} (checkbox ci refuses TODO values), then run \`checkbox ci\` and fix what it reports.` } : { type: "run_ci", message: "Run `checkbox ci` locally, fix what it reports, then commit checkbox.json and the workflow." }
   };
   ctx.out.result(result, () => {
     const lines = [];
@@ -29564,6 +30457,7 @@ async function runInit(ctx, argv) {
     if (withWorkflow && workflowSteps.length) lines.push("", `The workflow runs ${workflowSteps.map((c) => `\`${c}\``).join(" and ")} before the checks, so they work on a fresh clone.`);
     if (needs.urlPages) lines.push("", 'Note: "url" pages are fetched by the API (checkbox ci --online), which needs a LIVE key (ck_live_\u2026) on an activated account. Without one, list the built page as "file".');
     if (s2.todos.length) lines.push("", "To do:", ...s2.todos.map((t) => `  - ${t}`));
+    if (s2.notes.length) lines.push("", "Also:", ...s2.notes.map((t) => `  - ${t}`));
     lines.push("", `${ctx.out.c.cyan("Next:")} ${result.next_action.message}`);
     if (!write) lines.push("", ctx.out.c.dim(`${relName(configPath)}:`), ...JSON.stringify(s2.config, null, 2).split("\n").map((l) => ctx.out.c.dim(`  ${l}`)));
     return lines;
@@ -29728,13 +30622,18 @@ ${message}
         const engine = client ? onlineEngine(client) : offlineEngine();
         const notices = client && declaredByCheckbox(loaded.config).length ? await readNotices(ctx, client, str(p.flags, "site")) : void 0;
         const noticesLine = Math.max(1, loaded.raw.split("\n").findIndex((l) => l.includes('"sent_by_checkbox"')) + 1);
-        const run2 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
+        const run0 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
+        const baseRef = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
+        if (baseRef) anchorToChanges(run0.checks, ctx.cwd, workspace, baseRef);
+        const run2 = !client && termsChanged(ctx.cwd, baseRef, jobs) ? { ...run0, offline_notice: STRIPE_OBJECTS_OFFLINE_NOTICE } : run0;
         ctx.out.result(run2, () => renderHuman(run2, ctx.out.c, { verbose: bool(p.flags, "verbose") === true }));
         if (gha) {
           for (const a of annotations(run2)) emit(a);
           writeGithubFile(ctx.env.GITHUB_STEP_SUMMARY, stepSummary(run2));
+          if (run2.offline_notice) emit(`::notice title=Checkbox%3A Stripe not checked offline::${run2.offline_notice}`);
           writeGithubFile(ctx.env.GITHUB_OUTPUT, `status=${run2.status}
 exit_code=${run2.exit_code}
+result=${run2.result}
 `);
         }
         return run2.exit_code;
@@ -29794,6 +30693,14 @@ function findAnchor(src, target) {
       }
     }
   }
+  if (!text && !id && tag) {
+    const all = [...src.matchAll(tagRe)];
+    if (all.length === 1) return openAt(all[0].index + 1, `the only <${tag}> in this file`);
+    if (tag === "button" || tag === "input") {
+      const submit = all.filter((m) => /^[^>]*\btype\s*=\s*(?:"submit"|'submit'|\{\s*["']submit["']\s*\})/i.test(src.slice(m.index, src.indexOf(">", m.index) + 1)));
+      if (submit.length === 1) return openAt(submit[0].index + 1, `the only <${tag} type="submit"> in this file`);
+    }
+  }
   return null;
 }
 function lineStart(src, idx) {
@@ -29916,12 +30823,20 @@ function diffLines(a, b) {
   ops.push(...a.slice(a.length - suf).map((line2) => ({ t: " ", line: line2 })));
   return ops;
 }
+function gitLines(text) {
+  if (text === "") return [];
+  const lines = text.split("\n");
+  if (text.endsWith("\n")) lines.pop();
+  else lines[lines.length - 1] += NO_EOL;
+  return lines;
+}
 function unifiedDiff(before, after, path, context = 3) {
   if (before === after) return "";
-  const a = before.split("\n");
-  const b = after.split("\n");
+  const a = gitLines(before);
+  const b = gitLines(after);
   const ops = diffLines(a, b);
   const out = [`--- a/${path}`, `+++ b/${path}`];
+  const show2 = (o) => o.line.endsWith(NO_EOL) ? [`${o.t}${o.line.slice(0, -NO_EOL.length)}`, NO_EOL_MARKER] : [`${o.t}${o.line}`];
   let i = 0;
   while (i < ops.length) {
     if (ops[i].t === " ") {
@@ -29943,26 +30858,50 @@ function unifiedDiff(before, after, path, context = 3) {
     const bStart = ops.slice(0, start).filter((o) => o.t !== "-").length + 1;
     const aLen = slice.filter((o) => o.t !== "+").length;
     const bLen = slice.filter((o) => o.t !== "-").length;
-    out.push(`@@ -${aLen ? aStart : aStart - 1},${aLen} +${bLen ? bStart : bStart - 1},${bLen} @@`, ...slice.map((o) => `${o.t}${o.line}`));
+    out.push(`@@ -${aLen ? aStart : aStart - 1},${aLen} +${bLen ? bStart : bStart - 1},${bLen} @@`, ...slice.flatMap(show2));
     i = stop;
     start = stop;
   }
   return `${out.join("\n")}
 `;
 }
-var escapeRe2, VOID_TAGS;
+var escapeRe2, VOID_TAGS, NO_EOL, NO_EOL_MARKER;
 var init_patch = __esm({
   "src/commands/plan/patch.ts"() {
     "use strict";
     escapeRe2 = (s2) => s2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     VOID_TAGS = ["area", "base", "br", "col", "embed", "hr", "img", "input", "link", "meta", "source", "track", "wbr"];
+    NO_EOL = "\0no-eol";
+    NO_EOL_MARKER = "\";
   }
 });
 
 // src/commands/plan/fix.ts
 import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3 } from "node:fs";
 import { relative as relative6, resolve as resolve8 } from "node:path";
-function fixForTask(task, cwd, file) {
+function declaredPlans(cwd) {
+  const path = findConfig(cwd);
+  if (!path) return [];
+  try {
+    return loadConfig(path).config.plans ?? [];
+  } catch {
+    return [];
+  }
+}
+function staleAgainstDeclared(content, plans) {
+  if (!plans.length || !content) return void 0;
+  const text = content.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ");
+  const said = [];
+  for (const m of text.matchAll(/(\d{1,3})[- ]days? free,? then \$([\d,]+(?:\.\d{1,2})?) (?:every|per|a|\/) ?(month|year|week|day)/gi)) {
+    const trial = Number(m[1]);
+    const price3 = Number(m[2].replace(/,/g, ""));
+    const interval = m[3].toLowerCase();
+    const same = plans.filter((p) => p.interval === interval && major(p) !== void 0 && Math.abs(major(p) - price3) < 5e-3);
+    if (same.length && !same.some((p) => (p.trial_days ?? 0) === trial)) said.push(`it says \u201C${m[0]}\u201D, but checkbox.json declares ${same.map((p) => `"${p.name}" with ${p.trial_days ? `a ${p.trial_days}-day trial` : "no trial"}`).join(", ")}`);
+  }
+  return said.length ? said.join("; ") : void 0;
+}
+function fixForTask(task, cwd, file, plans = declaredPlans(cwd)) {
   const base = {
     object: "task_fix",
     task: task.id,
@@ -29973,6 +30912,22 @@ function fixForTask(task, cwd, file) {
     verify: task.verify
   };
   const verifyCmd = `checkbox verify ${task.id} --wait`;
+  const stale = staleAgainstDeclared(`${task.change.content}
+${task.change.edits.map((e) => e.content ?? "").join("\n")}`, plans);
+  if (stale) {
+    return {
+      ...base,
+      file: null,
+      diff: null,
+      applied: [],
+      unmatched: [],
+      next_action: {
+        type: "refresh_plan",
+        description: `Not applied: this task was built from the site's plans in Checkbox, which are older than checkbox.json (${stale}). Applying it would put the old terms back. Leave this file as it is; once this change is deployed, update the site's plans (updateSetupSession plans[], or \`checkbox init --plan \u2026\`), then run \`checkbox plan\` again for a fix built from the new plans.`,
+        command: "checkbox plan"
+      }
+    };
+  }
   const candidate = file ?? (task.where.file_hint && existsSync9(resolve8(cwd, task.where.file_hint)) ? task.where.file_hint : void 0);
   if (task.change.type === "patch" && task.change.edits.length && candidate) {
     const path = resolve8(cwd, candidate);
@@ -30010,14 +30965,16 @@ function fixForTask(task, cwd, file) {
   const type = task.change.type === "manual" ? "answer_question" : task.change.type === "needs_facts" ? "provide_facts" : "apply_change";
   return { ...base, file: null, diff: null, applied: [], unmatched: [], next_action: { type, description: how[task.change.type] ?? "Apply the change, then verify.", command: task.change.type === "manual" ? `checkbox answer ${task.id}` : task.change.type === "needs_facts" ? `checkbox fix ${task.id}` : verifyCmd } };
 }
-var TASK_RE2, fix_default;
+var TASK_RE2, major, fix_default;
 var init_fix = __esm({
   "src/commands/plan/fix.ts"() {
     "use strict";
     init_args();
     init_types2();
+    init_config3();
     init_patch();
     TASK_RE2 = /^task_[0-9a-f]{32}$/;
+    major = (p) => p.price !== void 0 ? Number(p.price) : p.amount !== void 0 ? p.amount / 100 : void 0;
     fix_default = defineCommand({
       name: "fix",
       summary: "Show the change for a plan task (exact diff of your file for code tasks)",
@@ -30243,6 +31200,10 @@ function planSnippet(d, s2) {
     return { change: { file, action: existing === null ? "create" : "modify", summary: "Nuxt client plugin that adds the snippet to every page", contents, added: contents.trim().split("\n") } };
   }
   if (existing === null) {
+    if (d.framework === "nextjs-app") {
+      const contents = NEXT_APP_LAYOUT(s2, /\.tsx$/.test(file));
+      return { change: { file, action: "create", summary: "Root layout with the snippet in <head>", contents, added: contents.trim().split("\n") } };
+    }
     if (d.framework === "nextjs-pages") {
       const contents = NEXT_DOCUMENT(s2);
       return { change: { file, action: "create", summary: "Custom _document with the snippet in <Head>", contents, added: contents.trim().split("\n") } };
@@ -30371,7 +31332,7 @@ function applyChange(root, c) {
   mkdirSync3(dirname8(abs), { recursive: true });
   writeFileSync4(abs, c.contents, c.file.startsWith(".env") ? { mode: 384 } : void 0);
 }
-var MARK_START, MARK_END, NEXT_DOCUMENT, NUXT_PLUGIN;
+var MARK_START, MARK_END, NEXT_DOCUMENT, NEXT_APP_LAYOUT, NUXT_PLUGIN;
 var init_patch2 = __esm({
   "src/commands/init/patch.ts"() {
     "use strict";
@@ -30392,6 +31353,17 @@ ${jsxBlock(s2, "        ").join("\n")}
     </Html>
   );
 }
+`;
+    NEXT_APP_LAYOUT = (s2, ts) => `${ts ? "import type { ReactNode } from 'react';\n\n" : ""}export default function RootLayout({ children }${ts ? ": { children: ReactNode }" : ""}) {
+  return (
+    <html lang="en">
+      <head>
+${jsxBlock(s2, "        ").join("\n")}
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}
 `;
     NUXT_PLUGIN = (s2) => `// ${MARK_START} \u2014 Checkbox subscription-compliance monitoring (https://checkbox.site/docs/snippet)
 export default defineNuxtPlugin(() => {
@@ -30412,8 +31384,11 @@ __export(init_exports, {
   configLines: () => configLines,
   configNameOf: () => configNameOf,
   default: () => init_default,
+  liveKeyNextAction: () => liveKeyNextAction,
   parsePlanFlag: () => parsePlanFlag,
-  syncCheckoutConfigs: () => syncCheckoutConfigs
+  snippetWords: () => snippetWords,
+  syncCheckoutConfigs: () => syncCheckoutConfigs,
+  withEvaluatedAt: () => withEvaluatedAt
 });
 import { existsSync as existsSync11 } from "node:fs";
 import { join as join11 } from "node:path";
@@ -30433,6 +31408,10 @@ function saveState(ctx, root, patch) {
   }
   ctx.config.save({ init: { ...cfg, projects } });
 }
+function withEvaluatedAt(c) {
+  const t = c.evaluated;
+  return typeof t === "number" && t > 0 ? { evaluated_at: new Date(t * 1e3).toISOString(), ...c } : c;
+}
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
   try {
@@ -30460,6 +31439,7 @@ function projectFacts(d) {
     ...d.layoutFile ? { layout_file: d.layoutFile } : {},
     env_file: d.envFile,
     ...d.publicDir ? { public_dir: d.publicDir } : {},
+    ...d.mailer ? { mailer: d.mailer } : {},
     checkout_code: d.checkoutCode.slice(0, 100).map((c) => ({ file: c.file.slice(0, 500), line: c.line, kind: c.kind, snippet: c.snippet.slice(0, 500) })),
     pay_buttons: d.payButtons.slice(0, 100).map((c) => ({ file: c.file.slice(0, 500), line: c.line, kind: c.kind, snippet: c.snippet.slice(0, 500) }))
   };
@@ -30547,6 +31527,20 @@ function registrable(params, unresolved) {
   if (unresolved.some((u) => /^(mode|line_items|subscription_data|custom_text|consent_collection)\b/.test(u))) return false;
   return params.mode === "subscription" && Array.isArray(params.line_items) && params.line_items.length > 0;
 }
+function snippetWords(homepage, live) {
+  if (homepage) return "detected";
+  if (live) return "live (seen through the page captures it sends; not in the homepage HTML Checkbox loaded)";
+  return "NOT detected yet (deploy, then verify again)";
+}
+function liveKeyNextAction(dashboard) {
+  const url = `${dashboard.replace(/\/+$/, "")}/settings/developers?mode=live&create=key`;
+  return {
+    type: "ask_human_for_live_key",
+    message: `Ask the human for live mode (an agent never creates live keys): either they approve again with \`checkbox init --live --relogin --yes --json\` and tick \u201CAlso create live-mode keys\u201D on the approval page, or they create a live key in the Checkbox dashboard (Live mode, Agent & API: ${url}) and put it in the project env as CHECKBOX_LIVE_SECRET_KEY (never in the chat). Then run \`checkbox init --live --yes --json\`: it links the live site and writes the domain-verification file. Live checks start once the domain is verified.`,
+    command: "checkbox init --live --relogin --yes --json",
+    url
+  };
+}
 function detectionSummary(d, siteUrl) {
   return {
     framework: d.framework,
@@ -30569,9 +31563,14 @@ function detectionSummary(d, siteUrl) {
 function fileOut(c) {
   return { file: c.file, action: c.action, summary: c.summary, added: c.added };
 }
-function resultOf(status, d, session, changes, extra, apiBase) {
+function resultOf2(status, d, session, changes, extra, apiBase) {
   const names = envVarNames(d);
-  const next = session.next_action.type === "done" ? { type: "done", message: "Checkbox is set up. After each change to checkout, emails or cancellation, run `checkbox plan --json` and apply what it returns.", command: "checkbox plan --json" } : session.next_action;
+  const next = session.next_action.type === "done" ? {
+    type: "done",
+    // Round 32 (pilot 31 item 1): a test-mode setup says so, with the go-live steps left (go_live), never a bare "set up".
+    message: session.go_live?.steps.length ? `Checkbox is set up in Stripe test mode. ${session.go_live.summary} After each change to checkout, emails or cancellation, run \`checkbox plan --json\` and apply what it returns.` : "Checkbox is set up. After each change to checkout, emails or cancellation, run `checkbox plan --json` and apply what it returns.",
+    command: "checkbox plan --json"
+  } : session.next_action;
   return {
     object: "checkbox_init",
     status,
@@ -30586,7 +31585,10 @@ function resultOf(status, d, session, changes, extra, apiBase) {
     install: session.install,
     stripe: { ...session.stripe, ...extra.stripe ?? {} },
     ...extra.live && Object.keys(extra.live).length ? { live: extra.live } : {},
-    compliance: session.compliance,
+    // Round 32 (pilot 31, discovery-agent: "compliance.evaluated" read like a count but is a Unix timestamp): the CLI says
+    // when, as evaluated_at (ISO 8601), next to the API's field.
+    compliance: session.compliance ? withEvaluatedAt(session.compliance) : session.compliance,
+    ...session.go_live ? { go_live: session.go_live } : {},
     steps: session.steps.map((s2) => ({ key: s2.key, status: s2.status, summary: s2.summary })),
     warnings: extra.warnings ?? [],
     owner_notified: session.owner_notified,
@@ -30609,6 +31611,10 @@ function renderSession(ctx, s2) {
     for (const t of todo.slice(0, 5)) lines.push(`  ${t.status === "needs_fix" || t.status === "not_set_up" ? c.red("\u2717") : c.yellow("?")} ${t.title} ${c.dim(`(${t.label})`)}`);
     if (todo.length > 5) lines.push(c.dim(`  \u2026 ${todo.length - 5} more: checkbox plan`));
   }
+  if (s2.go_live?.steps.length) {
+    lines.push("", c.bold(`Before real customers (Stripe test mode so far): ${s2.go_live.steps.length} step${s2.go_live.steps.length === 1 ? "" : "s"}`));
+    s2.go_live.steps.forEach((st, i) => lines.push(`  ${i + 1}. ${c.dim(st.who === "person" ? "[owner]" : "[agent]")} ${st.text}`));
+  }
   lines.push("", `${c.cyan("next")}  ${s2.next_action.message}${s2.next_action.command ? `
       ${s2.next_action.command}` : ""}`, `${c.dim("review")} ${s2.review_url}`);
   return lines;
@@ -30634,6 +31640,7 @@ var init_init = __esm({
     "use strict";
     init_args();
     init_config();
+    init_src2();
     init_http();
     init_types2();
     init_detect();
@@ -30679,7 +31686,7 @@ var init_init = __esm({
         "  --no-stripe             Do not offer the Stripe test key / test subscription",
         "  --live                  Also request live-mode keys and write the domain-verification file",
         "  --no-wait               Start the login, print the link and exit (run `checkbox init` again to continue)",
-        "  --wait-seconds <n>      How long to wait for the approval (default 900 on a terminal, 100 otherwise)",
+        "  --wait-seconds <n>      How long to wait for the approval (default 900 on a terminal, 40 with --json, 100 otherwise)",
         "  --no-open               Do not open the browser",
         "  --verify                Re-check the site now (after deploying) and print the updated checklist",
         "  --complete              Finish the setup and email the human the summary (sent automatically the first time every",
@@ -30733,7 +31740,7 @@ var init_init = __esm({
           if (bool(flags, "verify")) {
             const v = await client2.sdk.setupSessions.verify(state.setup_session);
             session2 = v.setup_session;
-            out.info(v.homepage.ok ? `Site loaded; snippet ${v.homepage.snippet_detected ? "detected" : "NOT detected yet (deploy, then verify again)"}` : `Could not load the site: ${v.homepage.error}`);
+            out.info(v.homepage.ok ? `Site loaded; snippet ${snippetWords(v.homepage.snippet_detected, session2.install?.detected_on_site ?? null)}` : `Could not load the site: ${v.homepage.error}`);
           } else {
             session2 = await client2.sdk.setupSessions.retrieve(state.setup_session);
           }
@@ -30743,7 +31750,7 @@ var init_init = __esm({
             const configs = await syncCheckoutConfigs(client2, session2.site, d.checkoutSessions, root).catch((err) => [{ file: "", line: 0, skipped: err instanceof Error ? err.message : String(err) }]);
             if (configs.length) stripeOut.checkout_configs = configs;
           }
-          out.result(resultOf("verified", d, session2, [], Object.keys(stripeOut).length ? { stripe: stripeOut } : {}, apiBase), () => [...renderSession(ctx, session2), ...configLines(stripeOut.checkout_configs)]);
+          out.result(resultOf2("verified", d, session2, [], Object.keys(stripeOut).length ? { stripe: stripeOut } : {}, apiBase), () => [...renderSession(ctx, session2), ...configLines(stripeOut.checkout_configs)]);
           return EXIT.ok;
         }
         if (dryRun && (!state.setup_session || !creds)) {
@@ -30772,10 +31779,11 @@ var init_init = __esm({
         let token = null;
         let apiKey = creds?.apiKey;
         let sessionId = state.setup_session;
-        const reuse = !!(state.setup_session && creds && bool(flags, "relogin") !== true);
+        const pendingLogin = state.pending && Date.parse(state.pending.expires_at) > Date.now() + 1e4 && state.pending.api_base === apiBase ? state.pending : void 0;
+        const reuse = !!(state.setup_session && creds && bool(flags, "relogin") !== true && !pendingLogin);
         if (!reuse) {
           const anon = ctx.client({ apiKey: "device-login", apiBase });
-          let pending = state.pending && Date.parse(state.pending.expires_at) > Date.now() + 1e4 && state.pending.api_base === apiBase ? state.pending : void 0;
+          let pending = pendingLogin;
           if (!pending) {
             const agent2 = detectAgent(ctx.env, agentName);
             const wantStripe = bool(flags, "stripe") !== false && d.billingPlatform === "stripe" && !!d.stripeTestKey;
@@ -30788,7 +31796,8 @@ var init_init = __esm({
               ...merchantName ? { merchant_name: merchantName.slice(0, 100) } : {},
               framework: d.framework,
               ...d.packageManager ? { package_manager: d.packageManager } : {},
-              billing_platform: d.billingPlatform,
+              // "custom" means nothing was detected: never sent as a declared platform (the API then looks for Stripe itself).
+              ...d.billingPlatform !== "custom" ? { billing_platform: d.billingPlatform } : {},
               ...bool(flags, "live") ? { live: true } : {},
               ...wantStripe ? { stripe_test_key_hint: d.stripeTestKey.hint } : {}
             });
@@ -30806,7 +31815,7 @@ var init_init = __esm({
           if (bool(flags, "open") !== false) openBrowser(pending.verification_uri_complete, ctx.env);
           const tty = !!process.stdin.isTTY && !!process.stderr.isTTY;
           const waitArg = str(flags, "wait-seconds");
-          const waitSeconds = bool(flags, "wait") === false ? 0 : waitArg !== void 0 ? Number(waitArg) : tty ? 900 : 100;
+          const waitSeconds = bool(flags, "wait") === false ? 0 : waitArg !== void 0 ? Number(waitArg) : tty ? 900 : out.json ? 40 : 100;
           if (!Number.isFinite(waitSeconds) || waitSeconds < 0) throw new UsageError("--wait-seconds must be a number of seconds");
           const polled = await pollDeviceLogin(anon, pending, waitSeconds * 1e3, ctx);
           if (polled.status === "timeout") {
@@ -30819,7 +31828,7 @@ var init_init = __esm({
                 expires_at: pending.expires_at,
                 next_action: {
                   type: "ask_human_to_approve",
-                  message: `Ask the human to open ${pending.verification_uri_complete} and click Approve, then run \`checkbox init --yes --json\` again (it continues where it stopped and remembers ${Object.keys(factsToRemember).length ? Object.keys(factsToRemember).join(", ") : "the flags given now"}).`,
+                  message: `Ask the human to open ${pending.verification_uri_complete} and click Approve.${d.billingPlatform === "stripe" && bool(flags, "stripe") !== false ? ` ${approvalKeyAsk({ stripe: true, keyFound: !!d.stripeTestKey })}` : ""} Then run \`checkbox init --yes --json\` again (it continues where it stopped and remembers ${Object.keys(factsToRemember).length ? Object.keys(factsToRemember).join(", ") : "the flags given now"}).`,
                   command: "checkbox init --yes --json",
                   url: pending.verification_uri_complete
                 }
@@ -30962,9 +31971,12 @@ var init_init = __esm({
         }
         const live = {};
         if (!dryRun && bool(flags, "live") && siteUrl) {
-          const liveKey = token?.live_secret_key ?? void 0;
-          if (!liveKey) {
-            warnings.push("No live key (approve live keys on the approval page, or create one in the dashboard) \u2014 live mode skipped.");
+          const liveKey = token?.live_secret_key ?? ctx.env.CHECKBOX_LIVE_SECRET_KEY ?? d.env.CHECKBOX_LIVE_SECRET_KEY ?? void 0;
+          if (!liveKey || !/^ck_live_/.test(liveKey)) {
+            const ask3 = liveKeyNextAction(session.review_url.replace(/\/setup\/[^/]*$/, ""));
+            live.skipped = "no_live_key";
+            live.next_action = ask3;
+            warnings.push(`Live mode not set up yet: it needs a live Checkbox key (ck_live_\u2026), and only a person creates one. ${ask3.message}`);
           } else {
             try {
               const lc = ctx.client({ apiKey: liveKey, apiBase });
@@ -30978,7 +31990,7 @@ var init_init = __esm({
                   changes.push(wk);
                 }
               }
-              session = await client.sdk.setupSessions.update(sessionId, { live_site: liveSite.id });
+              session = await lc.sdk.setupSessions.update(sessionId, { live_site: liveSite.id });
               saveState(ctx, root, { live_site: liveSite.id });
               live.site = liveSite.id;
               live.domain_verification = { status: dv.status, file: dv.file?.url ?? null, dns_txt: dv.dns_record ? `${dv.dns_record.name} = ${dv.dns_record.value}` : null };
@@ -30991,7 +32003,8 @@ var init_init = __esm({
           out.info("Running the first checks\u2026");
           session = (await client.sdk.setupSessions.verify(sessionId)).setup_session;
         }
-        const doc = resultOf(dryRun ? "dry_run" : "configured", d, session, changes, { stripe, live, warnings, manualSnippet, token, envNotWritten: envTracked && !!token }, apiBase);
+        const doc = resultOf2(dryRun ? "dry_run" : "configured", d, session, changes, { stripe, live, warnings, manualSnippet, token, envNotWritten: envTracked && !!token }, apiBase);
+        if (live.next_action && (session.next_action.type === "done" || session.next_action.type === "complete_setup")) doc.next_action = live.next_action;
         out.result(doc, () => [...renderFiles(ctx, changes, dryRun), ...manualSnippet ? [`Add the snippet yourself: ${manualSnippet}`] : [], ...warnings.map((w) => `${out.c.yellow("!")} ${w}`), ...configLines(stripe.checkout_configs), ...renderSession(ctx, session)]);
         return EXIT.ok;
       }
@@ -31175,6 +32188,7 @@ var init_plan = __esm({
     init_args();
     init_types2();
     init_lib();
+    init_fix();
     plan_default = defineCommand({
       name: "plan",
       summary: "Show the compliance plan: ordered tasks to apply, then verify",
@@ -31195,7 +32209,15 @@ var init_plan = __esm({
         const client = ctx.client();
         const site = await resolveSite(ctx, str(flags, "site"), client);
         const plan2 = await client.sdk.plans.retrieve(site);
-        ctx.out.result(plan2, () => renderPlan(plan2, ctx.out.c, { all: !!bool(flags, "all") }));
+        const declared = declaredPlans(ctx.cwd);
+        const staleOf = (t) => staleAgainstDeclared(`${t.change.content}
+${t.change.edits.map((e) => e.content ?? "").join("\n")}`, declared);
+        const stale = plan2.tasks.filter((t) => (t.status === "open" || t.status === "in_progress") && staleOf(t)).map((t) => t.id);
+        ctx.out.result(stale.length ? { ...plan2, stale_tasks: stale } : plan2, () => {
+          const lines = renderPlan(plan2, ctx.out.c, { all: !!bool(flags, "all"), stale: staleOf });
+          if (stale.length) lines.push("", ctx.out.c.yellow(`${stale.length} task(s) were built from the site's plans in Checkbox, which are older than checkbox.json: do not apply them. Once this change is deployed, update the site's plans (updateSetupSession plans[], or \`checkbox init --plan \u2026\`), then run \`checkbox plan\` again.`));
+          return lines;
+        });
         return bool(flags, "exit-code") && plan2.status !== "compliant" ? EXIT.fail : EXIT.ok;
       }
     });