@checkbox-site/cli 0.4.8 → 0.4.9

package/dist/checkbox.js

@@ -144,7 +144,8 @@ function findProjectKey(cwd, env2 = {}) {
       const v = readEnvValue(text, "CHECKBOX_SECRET_KEY");
       if (v && looksLikeApiKey(v)) {
         const up = depth === 0 ? "" : "../".repeat(depth);
-        return { apiKey: v, file: `${up}${f}` };
+        const base = readEnvValue(text, "CHECKBOX_API_BASE");
+        return { apiKey: v, file: `${up}${f}`, ...base && /^https?:\/\//.test(base) ? { apiBase: base } : {} };
       }
     }
     if (existsSync(join(dir, ".git")) || dir === home) break;
@@ -198,12 +199,12 @@ function createConfigStore(env2) {
   };
 }
 function resolveCredentials(env2, stored, flags, project) {
-  const apiBase = (flags.apiBase || env2.CHECKBOX_API_BASE || stored.api_base || DEFAULT_API_BASE).replace(/\/+$/, "");
-  if (flags.apiKey) return { apiKey: flags.apiKey, apiBase, source: "flag" };
-  if (env2.CHECKBOX_API_KEY) return { apiKey: env2.CHECKBOX_API_KEY, apiBase, source: "env" };
-  if (env2.CHECKBOX_SECRET_KEY) return { apiKey: env2.CHECKBOX_SECRET_KEY, apiBase, source: "env" };
-  if (project) return { apiKey: project.apiKey, apiBase, source: "project", file: project.file };
-  if (stored.api_key) return { apiKey: stored.api_key, apiBase, source: "config" };
+  const base = (own) => (flags.apiBase || env2.CHECKBOX_API_BASE || own || DEFAULT_API_BASE).replace(/\/+$/, "");
+  if (flags.apiKey) return { apiKey: flags.apiKey, apiBase: base(), source: "flag" };
+  if (env2.CHECKBOX_API_KEY) return { apiKey: env2.CHECKBOX_API_KEY, apiBase: base(), source: "env" };
+  if (env2.CHECKBOX_SECRET_KEY) return { apiKey: env2.CHECKBOX_SECRET_KEY, apiBase: base(), source: "env" };
+  if (project) return { apiKey: project.apiKey, apiBase: base(project.apiBase), source: "project", file: project.file };
+  if (stored.api_key) return { apiKey: stored.api_key, apiBase: base(stored.api_base), source: "config" };
   return void 0;
 }
 function describeKeySource(c, env2 = {}) {
@@ -3030,7 +3031,7 @@ var init_operations = __esm({
       /**
        * Check a subscription lifecycle email.
        *
-       * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the result is at most needs_review and Next is update_setup (update the site's plans first). Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
+       * Checks the content of an acknowledgment (welcome) email, trial-ending reminder, renewal reminder, price-change notice, yearly terms reminder or cancellation confirmation against the requirements for that notice (renewal terms, amount, frequency, how to cancel, trial cancellation). The email is modelled as sent on time, so the verdict is about content; get send dates from checkNoticeSchedule. Prices are judged against what Stripe charges: with `site` (or, without it and without a price in terms, the account's one site with Stripe connected) the plan fields come from the site's plans and the email is matched to the plan it names ("Annual") first; a price that contradicts it fails, and `warnings` say which site and plan were used. Without `site`, a price you send in terms is judged as sent; when it differs from every plan of that site, the verdict is still judged with the terms you sent and a `site_plans_differ` warning says to update the site's plans (update_setup) once the change is deployed. Returns `required_by` (requirements that make the email mandatory for this plan) and a `template` that passes the checks, with {{merge_tags}}, verified by the engine. Stateless and deterministic: nothing is stored, the same input on the same as_of date gives the same verdicts. Every verdict comes from the Checkbox rules engine over the legal catalog (federal ROSCA / EFTA plus the state automatic-renewal laws); the response carries rules_version, catalog_version and a disclaimer (not legal advice). Read `verdict`, then `next_action`: it tells you exactly what to change and to call the check again until verdict is pass.
        *
        * @see POST /v1/checks/email (operation `checkEmail`, scope `checks:read`)
        */
@@ -3617,7 +3618,7 @@ var SDK_VERSION;
 var init_version = __esm({
   "../sdk-node/src/version.ts"() {
     "use strict";
-    SDK_VERSION = "0.2.6";
+    SDK_VERSION = "0.2.7";
   }
 });
 
@@ -4793,16 +4794,25 @@ var init_stripe_key = __esm({
 function goLiveSteps(input = {}) {
   const out = [];
   if (!input.domainVerified) out.push({ key: "verify_domain", who: "person", text: "Verify your domain (a DNS record or a file on your site). Live checks start only on a verified public domain." });
-  if (input.termsOfServiceRequired && !input.termsOfServiceUrlSet) out.push({ key: "stripe_terms_url", who: "person", text: input.termsOfServiceConditional ? GO_LIVE_TERMS_URL_STEP_CONDITIONAL : GO_LIVE_TERMS_URL_STEP, url: STRIPE_PUBLIC_DETAILS });
+  if (input.termsOfServiceRequired && !input.termsOfServiceUrlSet)
+    out.push({ key: "stripe_terms_url", who: "person", text: input.checkoutKind === "payment_link" ? GO_LIVE_TERMS_URL_STEP_PAYMENT_LINK : input.termsOfServiceConditional ? GO_LIVE_TERMS_URL_STEP_CONDITIONAL : GO_LIVE_TERMS_URL_STEP, url: STRIPE_PUBLIC_DETAILS });
   if (!input.liveKeyConnected)
     out.push({
       key: "live_stripe_key",
       who: "person",
-      text: "Switch the dashboard to Live mode and connect your live Stripe key (rk_live_\u2026) with the same permissions as your test key (the checklist next to the key field: Read for the checks; Write only for fixes you approve and to add Checkbox\u2019s webhook endpoint). Only a person adds live keys; an agent never does."
+      text: `Switch the dashboard to Live mode and connect your live Stripe key (rk_live_\u2026) with the same permissions as your test key (the checklist next to the key field: Read for the checks; Write only for fixes you approve and to add Checkbox\u2019s webhook endpoint).${input.noAgent ? " Only a person adds live keys." : " Only a person adds live keys; an agent never does."}`
     });
-  if (input.checkoutKind === "payment_link")
-    out.push({ key: "live_checkout", who: "person", text: "Create the live Payment Link in Stripe live mode with the same settings as the test link Checkbox checked (renewal terms, consent checkbox, cancellation link); then your agent puts the live link on your site in place of the test link." });
-  else if (input.checkoutKind === "stripe_checkout")
+  if (input.portalCancel)
+    out.push({
+      key: "live_portal_cancel",
+      who: "person",
+      text: 'Turn on cancellation in the Stripe customer portal in live mode (Stripe Dashboard in Live mode \u203A Settings \u203A Billing \u203A Customer portal: "Cancel subscriptions", with the same timing as in test mode, and the customer login link). Stripe keeps these settings separately for test and live mode, so the test-mode setting does not carry over.',
+      url: STRIPE_PORTAL_SETTINGS
+    });
+  if (input.checkoutKind === "payment_link") {
+    out.push({ key: "live_checkout", who: "person", text: `Create the live Payment Link in Stripe live mode with the same settings as the test link Checkbox checked (renewal terms, consent checkbox, cancellation link); then put the live link on your site in place of the test link${input.noAgent ? "" : " (or ask your agent to)"}.` });
+    out.push({ key: "deactivate_old_live_link", who: "person", text: "If an older live Payment Link without these settings exists, deactivate it in Stripe live mode (Payment Links \u203A the old link \u203A Deactivate): anyone with its URL could still subscribe without seeing the terms." });
+  } else if (input.checkoutKind === "stripe_checkout")
     out.push({ key: "live_checkout", who: "agent", text: "Ship the same Checkout Session params Checkbox checked with your live Price ids (the live Stripe secret key in your production settings is set by a person)." });
   out.push({
     key: "promote_site",
@@ -4811,13 +4821,15 @@ function goLiveSteps(input = {}) {
   });
   return out;
 }
-var STRIPE_PUBLIC_DETAILS, GO_LIVE_TERMS_URL_STEP, GO_LIVE_TERMS_URL_STEP_CONDITIONAL, GO_LIVE_STEPS;
+var STRIPE_PORTAL_SETTINGS, STRIPE_PUBLIC_DETAILS, GO_LIVE_TERMS_URL_STEP, GO_LIVE_TERMS_URL_STEP_CONDITIONAL, GO_LIVE_TERMS_URL_STEP_PAYMENT_LINK, GO_LIVE_STEPS;
 var init_go_live = __esm({
   "../core/src/go-live.ts"() {
     "use strict";
+    STRIPE_PORTAL_SETTINGS = "https://dashboard.stripe.com/settings/billing/portal";
     STRIPE_PUBLIC_DETAILS = "https://dashboard.stripe.com/settings/public";
     GO_LIVE_TERMS_URL_STEP = 'Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details). Your checkout asks shoppers to accept your terms (consent_collection.terms_of_service = "required"), and Stripe refuses those Checkout Sessions until that URL is set.';
     GO_LIVE_TERMS_URL_STEP_CONDITIONAL = 'Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details) before your checkout asks shoppers to accept your terms (consent_collection.terms_of_service = "required", which the checkout fix adds): Stripe refuses those Checkout Sessions until that URL is set.';
+    GO_LIVE_TERMS_URL_STEP_PAYMENT_LINK = "Set your Terms of Service URL in the Stripe Dashboard (Settings > Public details). Your Payment Link asks shoppers to accept your terms (\u201CRequire customers to accept your terms of service\u201D), and Stripe only allows that once the URL is set.";
     GO_LIVE_STEPS = goLiveSteps().map((s2) => s2.text);
   }
 });
@@ -12217,18 +12229,15 @@ function checkoutSessionsForSite(sessions, captures, checkoutType) {
   const ownCardForm = captures.some((c) => OWN_CARD_FORM_RE.test(c.text ?? ""));
   if (checkoutType !== "stripe_checkout" && !linksToCheckout && ownCardForm) return [];
   if (checkoutType !== "stripe_checkout" && !linksToCheckout && stripePayLinksIn(captures).length) return [];
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const s2 of newestFirst(sessions)) {
-    if (s2.paymentLink || s2.checkboxTestRun) continue;
-    if (!(s2.lineItems ?? []).some((li) => !!li.interval || !!li.price)) continue;
+  const picked = /* @__PURE__ */ new Map();
+  newestFirst(sessions).forEach((s2, i) => {
+    if (s2.paymentLink || s2.checkboxTestRun) return;
+    if (!(s2.lineItems ?? []).some((li) => !!li.interval || !!li.price)) return;
     const key = (s2.lineItems ?? []).map((li) => li.price ?? `${li.amount}|${li.interval}|${li.intervalCount}`).sort().join(",");
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(s2);
-    if (out.length >= MAX_CHECKOUT_SESSIONS) break;
-  }
-  return out;
+    const prev = picked.get(key);
+    if (!prev || prev.s.status === "expired" && s2.status !== "expired") picked.set(key, { s: s2, i });
+  });
+  return [...picked.values()].sort((a, b) => a.i - b.i).slice(0, MAX_CHECKOUT_SESSIONS).map((x) => x.s);
 }
 function paymentLinkParams(link, opts = {}) {
   const items = (link.lineItems ?? []).filter((li) => li && (li.interval || li.price));
@@ -16655,7 +16664,14 @@ function noticeContent(e, opts = {}) {
   if (when) quotes.trial_end = quote(when);
   const afterTrial = opts.firstChargeAfterTrial === "always" || opts.firstChargeAfterTrial === "when_trial_mentioned" && TRIAL_ENDING_RE.test(body);
   const intro = wrong.amount ? void 0 : introEmailFinding(body, plans, { termsComplete: plans.length > 0 && plans.every((p) => isPreflightPlan(p)), extraAmounts: opts.extraAmounts ?? [] }) ?? (afterTrial ? introFirstChargeFinding(body, plans) : void 0);
-  return { present: Object.keys(quotes).filter((k) => quotes[k]), quotes, ...Object.keys(wrong).length ? { wrong } : {}, ...intro ? { intro } : {} };
+  const trialLength = opts.trialLength?.(a, e);
+  return {
+    present: Object.keys(quotes).filter((k) => quotes[k]),
+    quotes,
+    ...Object.keys(wrong).length ? { wrong } : {},
+    ...intro ? { intro } : {},
+    ...trialLength ? { trialLength } : {}
+  };
 }
 function missingElements(content, required) {
   return required.filter((el) => !content.present.includes(el));
@@ -16667,6 +16683,12 @@ function describeMissing(missing) {
   return missing.map((m) => ELEMENT_LABELS[m]).join(", ");
 }
 function contentFixLine(checkId, data) {
+  const tl = data?.contentTrialLength;
+  const trialFix = NOTICE_NOUN[checkId] && typeof tl?.stated === "string" && typeof tl.plan === "string" ? `The ${NOTICE_NOUN[checkId]} says ${tl.stated}, but ${tl.plan}: state the trial the subscriber really gets.` : void 0;
+  const line2 = contentFixLineBase(checkId, data);
+  return line2 && trialFix ? `${line2} ${trialFix}` : line2 ?? trialFix;
+}
+function contentFixLineBase(checkId, data) {
   if (typeof data?.contentIntro?.fix === "string" && !(Array.isArray(data?.contentMissing) && data.contentMissing.length)) return data.contentIntro.fix;
   if ((checkId === "signup.disclosure.price" || checkId === "confirmation.email.terms") && Array.isArray(data?.units)) {
     const line2 = data.units.find((x) => x && x.status !== "pass" && typeof x.introFix === "string")?.introFix;
@@ -16683,7 +16705,10 @@ function contentFixFromText(checkId, text) {
   const noun = NOTICE_NOUN[checkId];
   if (!noun) return void 0;
   const m = new RegExp(`^the ${noun} \\(.*?\\) .*? does not state (.+?)(?: correctly \\(| \u2014 )`, "i").exec(text.trim());
-  return m ? `Add ${m[1]} to the ${noun}; Checkbox's template has every required line.` : void 0;
+  const add = m ? `Add ${m[1]} to the ${noun}; Checkbox's template has every required line.` : void 0;
+  const t = /\bsays (“[^”]+”), but (.+?): state the trial the subscriber really gets/.exec(text);
+  const trial = t ? `The ${noun} says ${t[1]}, but ${t[2]}: state the trial the subscriber really gets.` : void 0;
+  return add && trial ? `${add} ${trial}` : add ?? trial;
 }
 var ELEMENT_LABELS, CHARGE_FOLLOWS_RE, DATE_TAG_RE, TRIAL_END_WHEN_RE, PRODUCT_RE, CONTACT_RE, CANCEL_URL_RE, CHARGE_AMOUNT_EVENTS, NOTICE_NOUN;
 var init_notice_content = __esm({
@@ -16770,6 +16795,19 @@ function offerLabel(o) {
   const price3 = `${(o.amount / 10 ** digits).toFixed(digits)} ${o.currency.toUpperCase()} every ${o.intervalCount > 1 ? `${o.intervalCount} ${o.interval}s` : o.interval}`;
   return o.name ? `${o.name} (${price3})` : price3;
 }
+function trialLengthFits(days, trial) {
+  return days === trial || days % 30 === 0 && Math.abs(days - trial) <= Math.max(1, days / 30) * 2;
+}
+function statedTrialMismatch(a, p, offers) {
+  const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
+  if (!stated.length) return void 0;
+  const own = p?.offer && p.offer.trialDays > 0 ? [p.offer] : p?.offer ? [] : offers.filter((o) => o.trialDays > 0);
+  if (!own.length) return void 0;
+  if (stated.some((t) => own.some((o) => trialLengthFits(t.days, o.trialDays)))) return void 0;
+  const lengths = [...new Set(own.map((o) => o.trialDays))].sort((x, y) => x - y);
+  const plan2 = p?.offer ? `${offerLabel(p.offer)} has a ${p.offer.trialDays}-day free trial` : `the plan${lengths.length > 1 ? "s give" : " gives"} a ${lengths.join("- or ")}-day free trial`;
+  return { stated: `\u201C${stated[0].text}\u201D`, plan: plan2 };
+}
 var DAYS;
 var init_email_plan = __esm({
   "../rules/src/checks/email-plan.ts"() {
@@ -16842,11 +16880,29 @@ var init_forwarded = __esm({
 
 // ../rules/src/checks/confirmation.ts
 function isPostSignupEmail(e) {
-  if (e.kind !== "other" || !e.scanId || !e.relatedSignupAt) return false;
+  if (e.kind !== "other" || !(e.scanId || testRunAckEmail(e)) || !e.relatedSignupAt) return false;
   const received = toDate(e.receivedAt);
   const signup = toDate(e.relatedSignupAt);
   return !!received && !!signup && received.getTime() >= signup.getTime() - HOUR_MS;
 }
+function testRunAckEmail(e) {
+  const run2 = e.testRun;
+  return !!run2 && typeof run2 === "object" && run2.step === "acknowledgment_email";
+}
+function acknowledgmentLike(e) {
+  if (e.kind !== "other" || isCheckboxSentEmail(e) || e.noticeSample) return false;
+  const opening = `${e.subject ?? ""}
+${emailBody(e).slice(0, 600)}`;
+  return ACK_LIKE_RE.test(opening) && !NEWSLETTER_RE.test(`${e.subject ?? ""}
+${emailBody(e).slice(0, 300)}`);
+}
+function acknowledgmentCandidate(e, explicit) {
+  if (!acknowledgmentLike(e)) return false;
+  if (isPostSignupEmail(e)) return true;
+  const key = emailTemplateKey(e);
+  const at = toDate(e.receivedAt)?.getTime() ?? 0;
+  return explicit.some((a) => emailTemplateKey(a) === key && (toDate(a.receivedAt)?.getTime() ?? Infinity) <= at);
+}
 function findAcknowledgments(emails) {
   const cached = ackCache.get(emails);
   if (cached) return cached;
@@ -16856,6 +16912,7 @@ function findAcknowledgments(emails) {
   const acknowledged = new Set(explicit.map((e) => recipientOf(e)).filter((r) => r !== ""));
   for (const e of emails) {
     if (e.kind === "acknowledgment") acks.push(e);
+    else if (acknowledgmentCandidate(e, explicit)) acks.push(e);
     else if (acknowledged.has(recipientOf(e))) continue;
     else if (explicit.length && e.kind === "receipt" && (forwardedInfo(e).forwarded || isMerchantOfRecordEmail(e) || sentStraightToCheckbox(e))) continue;
     else if (e.kind === "receipt" || isPostSignupEmail(e)) {
@@ -16891,6 +16948,18 @@ function noAckResult(checkId, input, set) {
   }
   if (set.receipts.length) {
     const r = set.receipts[set.receipts.length - 1];
+    const runOnly = set.receipts.filter(testRunAckEmail);
+    if (runOnly.length && !noticesCover) {
+      const last = runOnly[runOnly.length - 1];
+      return makeResult(
+        checkId,
+        "fail",
+        `The test run's sign-up received ${runOnly.length === 1 ? "one email" : `${runOnly.length} emails`} (e.g. ${emailLabel(last)}), and none restates the subscription terms (price, how often it renews, that it renews until canceled, and how to cancel) \u2014 send an acknowledgment with the terms right after sign-up.`,
+        runOnly.flatMap(emailRefs),
+        0.75,
+        { runSignupWithoutTerms: runOnly.map((e) => e.id) }
+      );
+    }
     return makeResult(
       checkId,
       "needs_review",
@@ -17066,18 +17135,7 @@ function cancelBeforeTrialMatch(text) {
   if (byDate && TRIAL_ENDS_DATE_RE.test(text)) return byDate[0];
   return null;
 }
-function statedTrialMismatch(a, p, offers) {
-  const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
-  if (!stated.length) return void 0;
-  const own = p?.offer && p.offer.trialDays > 0 ? [p.offer] : p?.offer ? [] : offers.filter((o) => o.trialDays > 0);
-  if (!own.length) return void 0;
-  const fits = (days, trial) => days === trial || days % 30 === 0 && Math.abs(days - trial) <= Math.max(1, days / 30) * 2;
-  if (stated.some((t) => own.some((o) => fits(t.days, o.trialDays)))) return void 0;
-  const lengths = [...new Set(own.map((o) => o.trialDays))].sort((x, y) => x - y);
-  const plan2 = p?.offer ? `${offerLabel(p.offer)} has a ${p.offer.trialDays}-day free trial` : `the plan${lengths.length > 1 ? "s give" : " gives"} a ${lengths.join("- or ")}-day free trial`;
-  return { stated: `\u201C${stated[0].text}\u201D`, plan: plan2 };
-}
-var ACK_MAX_DELAY_HOURS, NO_ACK_EMAIL_MESSAGE, ackCache, SIGNUP_LINK_TOLERANCE_MS, sent, terms, cancellationInstructions, CANCELLING_RE, CANCEL_BEFORE_TRIAL_RE, MONTH, DATE, CANCEL_BEFORE_NO_CHARGE_RE, CANCEL_BEFORE_DATE_RE, TRIAL_ENDS_DATE_RE, trialTerms, CONFIRMATION_CHECKS;
+var ACK_MAX_DELAY_HOURS, NO_ACK_EMAIL_MESSAGE, ackCache, ACK_LIKE_RE, NEWSLETTER_RE, SIGNUP_LINK_TOLERANCE_MS, sent, terms, cancellationInstructions, CANCELLING_RE, CANCEL_BEFORE_TRIAL_RE, MONTH, DATE, CANCEL_BEFORE_NO_CHARGE_RE, CANCEL_BEFORE_DATE_RE, TRIAL_ENDS_DATE_RE, trialTerms, CONFIRMATION_CHECKS;
 var init_confirmation = __esm({
   "../rules/src/checks/confirmation.ts"() {
     "use strict";
@@ -17093,6 +17151,8 @@ var init_confirmation = __esm({
     ACK_MAX_DELAY_HOURS = 24;
     NO_ACK_EMAIL_MESSAGE = "No acknowledgment email captured yet \u2014 BCC your sign-up confirmation email to your Checkbox inbound address (see Install), or add a test purchase to your scan settings so our shopper inbox receives it.";
     ackCache = /* @__PURE__ */ new WeakMap();
+    ACK_LIKE_RE = /\bwelcome\b|\bthanks?\s+(?:you\s+)?for\s+(?:subscribing|joining|signing\s+up|your\s+subscription|starting\s+your|choosing\s+our)\b|\byou(?:'re|’re|\s+are)\s+(?:now\s+)?(?:subscribed|a\s+member|officially\s+in)\b|\b(?:subscription|membership)\s+(?:is\s+)?(?:confirmed|active|activated|started)\b|\b(?:free\s+)?trial\s+(?:has\s+(?:started|begun)|starts\s+(?:today|now)|is\s+now\s+active)\b/i;
+    NEWSLETTER_RE = /\b(?:newsletter|mailing\s+list|digest|blog\s+(?:posts?|updates?))\b/i;
     SIGNUP_LINK_TOLERANCE_MS = 30 * 6e4;
     sent = {
       id: "confirmation.email.sent",
@@ -17527,6 +17587,11 @@ function wholeDaysBefore(days, tie = "up") {
 function sentInWindow(days, w) {
   return wholeDaysBefore(days, "up") <= w.maxDays && days >= w.minDays - MIN_DAYS_GRACE_DAYS;
 }
+function countsAsWholeDays(days) {
+  if (Number.isInteger(days)) return "";
+  const whole = wholeDaysBefore(days, "up");
+  return `, which counts as ${whole} day${whole === 1 ? "" : "s"} by the whole-day rule`;
+}
 function windowCloseMs(dueMs, w) {
   return dueMs - (w.minDays - MIN_DAYS_GRACE_DAYS) * DAY_MS;
 }
@@ -17890,14 +17955,29 @@ function contentGap(required, emails, opts = {}) {
     const content = noticeContent(email, opts);
     const wrongKeys = Object.keys(content.wrong ?? {});
     const missing = [.../* @__PURE__ */ new Set([...missingElements(content, required), ...wrongKeys])];
-    if (missing.length || content.intro) return { email, missing, ...content.wrong ? { wrong: content.wrong } : {}, ...content.intro ? { intro: content.intro } : {} };
+    if (missing.length || content.intro || content.trialLength)
+      return { email, missing, ...content.wrong ? { wrong: content.wrong } : {}, ...content.intro ? { intro: content.intro } : {}, ...content.trialLength ? { trialLength: content.trialLength } : {} };
   }
   return null;
 }
 function contentFail(spec, required, gap2, timing, refs2, data) {
   const intro = gap2.intro;
   const sentWhat = isPreflightEmail(gap2.email) ? "is a draft that" : `${timing}, but it`;
-  const introData = intro ? { contentIntro: { status: intro.status, reason: intro.reason, quote: intro.quote, fix: intro.fix } } : {};
+  const introData = {
+    ...intro ? { contentIntro: { status: intro.status, reason: intro.reason, quote: intro.quote, fix: intro.fix } } : {},
+    ...gap2.trialLength ? { contentTrialLength: gap2.trialLength } : {}
+  };
+  const trialLine = gap2.trialLength ? `says ${gap2.trialLength.stated}, but ${gap2.trialLength.plan}: state the trial the subscriber really gets` : "";
+  if (!gap2.missing.length && gap2.trialLength) {
+    return makeResult(
+      spec.checkId,
+      "fail",
+      `The ${spec.noun} (${emailLabel(gap2.email)}) ${sentWhat} ${trialLine}${intro ? `; it also ${intro.detail}` : ""}`,
+      [...emailRefs(gap2.email), ...refs2],
+      0.8,
+      { ...data, contentMissing: [], contentEmailId: gap2.email.id, ...isCheckboxSentEmail(gap2.email) ? { contentByCheckbox: true } : {}, ...introData }
+    );
+  }
   if (!gap2.missing.length && intro) {
     return makeResult(
       spec.checkId,
@@ -17913,12 +17993,26 @@ function contentFail(spec, required, gap2, timing, refs2, data) {
     "fail",
     `The ${spec.noun} (${emailLabel(gap2.email)}) ${isPreflightEmail(gap2.email) ? "is a draft that" : `${timing}, but it`} does not state ${describeMissing(gap2.missing)}${// Round 20 (pilot 19 item 16, change-guard: "contradicts the plan or is not an online way to cancel"): each wrong
     // element says its own reason.
-    gap2.wrong ? ` correctly (it says ${Object.entries(gap2.wrong).map(([k, v]) => `\u201C${v}\u201D for ${ELEMENT_LABELS[k]}, ${k === "cancellation" ? "which is not an online way to cancel" : "which contradicts the plan"}`).join("; ")})` : ""} \u2014 the notice must tell the subscriber ${describeMissing(required)}${intro ? `; it also ${intro.detail}` : ""}`,
+    gap2.wrong ? ` correctly (it says ${Object.entries(gap2.wrong).map(([k, v]) => `\u201C${v}\u201D for ${ELEMENT_LABELS[k]}, ${k === "cancellation" ? "which is not an online way to cancel" : "which contradicts the plan"}`).join("; ")})` : ""} \u2014 the notice must tell the subscriber ${describeMissing(required)}${intro ? `; it also ${intro.detail}` : ""}${trialLine ? `; it also ${trialLine}` : ""}`,
     [...emailRefs(gap2.email), ...refs2],
     0.8,
     { ...data, contentMissing: gap2.missing, contentEmailId: gap2.email.id, ...isCheckboxSentEmail(gap2.email) ? { contentByCheckbox: true } : {}, ...gap2.wrong ? { contentWrong: gap2.wrong } : {}, ...introData }
   );
 }
+function reminderTrialLength(input) {
+  const offers = contextOffers(input.ctx);
+  return (a, e) => {
+    if (isCheckboxSentEmail(e)) return void 0;
+    const ref = typeof e.subscriptionRef === "string" ? e.subscriptionRef.trim() : "";
+    const own = ref ? (input.ctx.events ?? []).filter((ev) => ev.subscriptionRef === ref).map((ev) => ev.trialDays ?? 0).find((d) => d > 0) : void 0;
+    if (own) {
+      const stated = a.trialLengths.filter((t) => typeof t.days === "number" && t.days > 0);
+      if (!stated.length || stated.some((t) => trialLengthFits(t.days, own))) return void 0;
+      return { stated: `\u201C${stated[0].text}\u201D`, plan: isPreflightEmail(e) ? `the plan gives a ${own}-day free trial` : `this subscriber's free trial is ${own} days` };
+    }
+    return statedTrialMismatch(a, emailPlan(e, input.ctx, offers), offers);
+  };
+}
 async function runReminder(spec, input) {
   const id = spec.checkId;
   const config = input.ctx.config;
@@ -17969,7 +18063,8 @@ async function runReminder(spec, input) {
   const contentOpts = {
     productNames: productNames2,
     ...planOpts,
-    ...spec.kind === "trial_ending" ? { firstChargeAfterTrial: "always" } : spec.kind === "annual_renewal" ? { firstChargeAfterTrial: "when_trial_mentioned" } : {}
+    ...spec.kind === "trial_ending" ? { firstChargeAfterTrial: "always" } : spec.kind === "annual_renewal" ? { firstChargeAfterTrial: "when_trial_mentioned" } : {},
+    ...spec.kind === "trial_ending" || spec.kind === "annual_renewal" ? { trialLength: reminderTrialLength(input) } : {}
   };
   const runStep = spec.kind === "trial_ending" ? "trial_reminder" : spec.kind === "annual_renewal" ? "renewal" : null;
   const runStamped = runStep ? emails.filter((e) => testRunDaysBefore(e, runStep)) : [];
@@ -18113,7 +18208,7 @@ async function runReminder(spec, input) {
       return makeResult(
         id,
         "pass",
-        `${spec.noun[0].toUpperCase()}${spec.noun.slice(1)} captured (${emailLabel(inWindow[0].e)}), sent about ${inWindow[0].days} days before the date it announces (required: ${conflicting ? w : why(inWindow[0].w)})`,
+        `${spec.noun[0].toUpperCase()}${spec.noun.slice(1)} captured (${emailLabel(inWindow[0].e)}), sent about ${inWindow[0].days} days before the date it announces${countsAsWholeDays(inWindow[0].days)} (required: ${conflicting ? w : why(inWindow[0].w)})`,
         [...emailRefs(inWindow[0].e), ...configRefs],
         0.7,
         data
@@ -18270,6 +18365,7 @@ var init_reminder = __esm({
   "../rules/src/checks/reminder.ts"() {
     "use strict";
     init_email_plan();
+    init_offer();
     init_text();
     init_business_days();
     init_context();
@@ -18976,8 +19072,21 @@ function otherPlanCard(view, input) {
   const known = referencePlans(input.ctx).map((p) => p.amount / 10 ** currencyDigits(p.currency));
   return !amounts.some((n) => known.some((k) => Math.abs(k - n) < 5e-3));
 }
+function boughtPlanViews(views, input) {
+  if (input.ctx.facts?.boughtPlanOnly !== true) return [...views];
+  const known = referencePlans(input.ctx).map((p) => p.amount / 10 ** currencyDigits(p.currency));
+  if (!known.length) return [...views];
+  const amountsOf = (v) => findAmounts(v.nearCtaText || v.termsText || "").map((m) => m.amount).filter((n) => typeof n === "number" && n > 0);
+  const other = (v) => {
+    if (v.offer === void 0) return false;
+    const amounts = amountsOf(v);
+    return amounts.length > 0 && !amounts.some((n) => known.some((k) => Math.abs(k - n) < 5e-3));
+  };
+  const kept = views.filter((v) => !other(v));
+  return kept.length ? kept : [...views];
+}
 async function overViews(checkId, input, headlines, evaluateView) {
-  const views = input.data.signupViews;
+  const views = boughtPlanViews(input.data.signupViews, input);
   if (views.length === 0) return missingData(checkId, NO_CHECKOUT_CAPTURE_MESSAGE);
   const outcomes = [];
   for (const view of views) outcomes.push({ view, unit: await evaluateView(view) });
@@ -19283,7 +19392,7 @@ function introPriceUnit(u, view, plans, promosDeclared = false) {
 function setOffAdvice(sizePx, contrast, weight, ref) {
   const refWeight = ref.fontWeight ?? 400;
   const larger = Math.ceil(ref.fontSizePx * SET_OFF_MIN_SIZE_RATIO);
-  const ways = [`${larger}px or larger (the surrounding text is about ${ref.fontSizePx}px)`, ...refWeight < 600 ? ["semibold or bold (weight 600+; the surrounding text is weight " + refWeight + ")"] : [], "a contrasting colour", "a border or shaded box (confirm by eye: borders and symbols cannot be measured from a capture)"];
+  const ways = [`${larger}px or larger (the surrounding text is about ${ref.fontSizePx}px)`, ...refWeight < 600 ? ["semibold or bold (weight 600+; the surrounding text is weight " + refWeight + ")"] : [], "a contrasting colour", "a border or a shaded box around them (Checkbox measures both; symbols and italics are not measured)"];
   return `the renewal terms are legible (${sizePx}px, weight ${weight}${contrast !== null ? `, ${contrast}:1 contrast` : ""}) but look like the surrounding text (about ${ref.fontSizePx}px, weight ${refWeight}${refWeight >= 600 ? ": already bold, so a bolder weight cannot set them apart" : ""}, similar colour) \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border. Any one of these would: ${ways.join("; ")}`;
 }
 function trialObservedOutsideCheckout(input) {
@@ -19421,7 +19530,7 @@ function boxNearCta(box, cta) {
   const gap2 = box.y >= cta.y + cta.height ? box.y - (cta.y + cta.height) : cta.y >= box.y + box.height ? cta.y - (box.y + box.height) : 0;
   return gap2 <= 200;
 }
-var NO_CHECKOUT_CAPTURE_MESSAGE, NO_PURCHASE_BUTTON, OTHER_PLAN_CARD_NOTE, heuristicCache, PROCESSOR_LINE_NOTE, RENEWAL_CONTEXT_RE, autorenewLanguage, autorenewOverViews, FOOTNOTE_RE, NON_CHARGE_AMOUNT_RE, INTRO_PRICE_RE, RENEWAL_PRICE_RE, PRODUCT_TITLE_RE, CHARGED_NOW_RE, LATER_CHARGE_RE, price, frequency, CANCEL_LINK_RE, cancellationPolicy, TRIAL_DAYS_SLACK, trialTerms2, termLength, PLACEMENT_RANK, proximity, conspicuous, RENEWAL_CONSENT_RE, CONSENT_CHECKBOX_RE, TOS_RE, SUBSCRIPTION_CTA_RE, MARKETING_RE, RENEWAL_TERMS_RE, NOTIFICATION_OPT_IN_RE, AGREEMENT_RE, SEPARATE_CONSENT_JURISDICTIONS, EXPRESS_CONSENT_COUNSEL_QUESTION, CA_SEPARATE_CONSENT, consentAffirmative, consentOverViews, notPrechecked, SIGNUP_CHECKS;
+var NO_CHECKOUT_CAPTURE_MESSAGE, NO_PURCHASE_BUTTON, OTHER_PLAN_CARD_NOTE, heuristicCache, PROCESSOR_LINE_NOTE, RENEWAL_CONTEXT_RE, autorenewLanguage, autorenewOverViews, FOOTNOTE_RE, NON_CHARGE_AMOUNT_RE, INTRO_PRICE_RE, RENEWAL_PRICE_RE, PRODUCT_TITLE_RE, CHARGED_NOW_RE, LATER_CHARGE_RE, HOSTED_SET_OFF_NOTE, price, frequency, CANCEL_LINK_RE, cancellationPolicy, TRIAL_DAYS_SLACK, trialTerms2, termLength, PLACEMENT_RANK, proximity, conspicuous, RENEWAL_CONSENT_RE, CONSENT_CHECKBOX_RE, TOS_RE, SUBSCRIPTION_CTA_RE, MARKETING_RE, RENEWAL_TERMS_RE, NOTIFICATION_OPT_IN_RE, AGREEMENT_RE, SEPARATE_CONSENT_JURISDICTIONS, EXPRESS_CONSENT_COUNSEL_QUESTION, CA_SEPARATE_CONSENT, consentAffirmative, consentOverViews, notPrechecked, SIGNUP_CHECKS;
 var init_signup = __esm({
   "../rules/src/checks/signup.ts"() {
     "use strict";
@@ -19522,6 +19631,7 @@ var init_signup = __esm({
     PRODUCT_TITLE_RE = /^(?:[A-Z0-9][\w'&.+]*\s+){0,6}[A-Z0-9][\w'&.+]*\s*[-–—|:·]\s*[$€£]\s?\d[\d,]*(?:\.\d{1,2})?\s*$/;
     CHARGED_NOW_RE = /\b(?:starting|beginning|effective|from)\s+today\b|\b(?:charged|billed|charge|bill)\b(?:[^.\n]|\.(?=\d)){0,50}?\b(?:today|immediately|right\s+away)\b|\btoday\b(?:[^.\n]|\.(?=\d)){0,30}?\b(?:charged|billed)\b/i;
     LATER_CHARGE_RE = /\b(?:then|thereafter|afterwards?|after\s+(?:that|which|the|your|an?)|from\s+(?:the\s+)?(?:second|2nd|next)|renews?\s+(?:automatically\s+)?at)\b/i;
+    HOSTED_SET_OFF_NOTE = "This was measured on the Stripe-hosted page, where Stripe sets the size and colour of the text and the merchant cannot restyle it";
     price = {
       id: "signup.disclosure.price",
       usesText: true,
@@ -20266,16 +20376,20 @@ ${view.pageText}`;
             if (setOff && !setOff.differentiators.length) {
               return unit(
                 "needs_review",
-                setOff.referenceUnknown ? `the renewal terms are legible (${best.a.fontSizePx}px, ${best.a.contrastRatio}:1 contrast), but there is no surrounding text to show they are set apart from it \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border` : setOffAdvice(best.a.fontSizePx, best.a.contrastRatio, best.el.style?.fontWeight ?? 400, setOff.reference),
+                setOff.referenceUnknown ? `the renewal terms are legible (${best.a.fontSizePx}px, ${best.a.contrastRatio}:1 contrast), but there is no surrounding text to show they are set apart from it \u2014 California requires larger type, contrasting type / font / color, or setting them off with symbols or a border` : `${setOffAdvice(best.a.fontSizePx, best.a.contrastRatio, best.el.style?.fontWeight ?? 400, setOff.reference)}${stripeHosted(view) ? `. ${HOSTED_SET_OFF_NOTE}` : ""}`,
                 0.55,
-                { meta: { ...meta, ...setOffMeta }, quote: q2 }
+                // Round 34 (pilot 33 item 26, nontech-founder): measured on a Stripe-hosted page, where the merchant cannot
+                // restyle the text; the fix (setOffFix) then names what they can change: the product name / description.
+                { meta: { ...meta, ...setOffMeta, ...stripeHosted(view) ? { hostedCheckout: "stripe" } : {} }, quote: q2 }
               );
             }
+            const smallerNearButton = view.hosted ? elements.filter((o) => o !== best.el && o !== view.primaryCta && hasRenewalLanguage(analyzeTerms(o.text ?? ""))).filter((o) => typeof o.style?.fontSizePx === "number" && typeof best.a.fontSizePx === "number" && o.style.fontSizePx < best.a.fontSizePx).find((o) => !cta || nearButton(view, o)) : void 0;
+            const hostedNote = smallerNearButton ? `; the renewal text next to the pay button (\u201C${quote(labelOf(smallerNearButton))}\u201D) is still smaller (${smallerNearButton.style.fontSizePx}px) \u2014 the checkout provider sets its style, so it is the ${best.a.fontSizePx}px line that stands out` : "";
             return unit(
               "pass",
-              `terms are ${best.a.fontSizePx}px with ${best.a.contrastRatio}:1 contrast and set off from the surrounding text (${setOff ? setOff.differentiators.join(", ").replace(/_/g, " ") : "on the purchase button"})${terms2.tier === 2 ? " (subscription terms block; no explicit renewal sentence found)" : ""}`,
+              `terms are ${best.a.fontSizePx}px with ${best.a.contrastRatio}:1 contrast and set off from the surrounding text (${setOff ? setOff.differentiators.join(", ").replace(/_/g, " ") : "on the purchase button"})${terms2.tier === 2 ? " (subscription terms block; no explicit renewal sentence found)" : ""}${hostedNote}`,
               terms2.tier === 2 ? 0.65 : 0.85,
-              { meta: { ...meta, ...setOffMeta }, quote: q2 }
+              { meta: { ...meta, ...setOffMeta, ...smallerNearButton ? { hostedSmallerNearButton: { fontSizePx: smallerNearButton.style.fontSizePx, quote: quote(labelOf(smallerNearButton)) } } : {} }, quote: q2 }
             );
           }
           if (best.a.status === "needs_review") return unit("needs_review", best.a.warnings.join("; "), 0.5, { meta, quote: q2 });
@@ -22272,6 +22386,7 @@ var init_brand_scope = __esm({
 
 // ../rules/src/set-off-fix.ts
 function setOffFix(text) {
+  if (/measured on the Stripe-hosted page/.test(text)) return HOSTED_SET_OFF_FIX;
   const own = /legible \((\d+(?:\.\d+)?)px, weight (\d+)/.exec(text);
   const ref = /look like the surrounding text \(about (\d+(?:\.\d+)?)px, weight (\d+)/.exec(text);
   if (!ref) return 'Set the renewal line apart from the text around it in a way Checkbox can measure: larger type (about 15% larger), semibold (weight 600+) where the text around it is not bold, a contrasting colour, or a border (e.g. style="border:1px solid currentColor;padding:8px 12px"). Any one of these is enough.';
@@ -22282,9 +22397,11 @@ function setOffFix(text) {
   const ways = [`${larger}px or larger`, ...refWeight < 600 ? ["semibold (font-weight 600 or more)"] : [], "a contrasting colour (not grey)", 'a border around it (e.g. style="border:1px solid currentColor;padding:8px 12px")'];
   return `Set the renewal line apart in a way Checkbox can measure. ${measured} Any one of these is enough: ${ways.join("; ")}.`;
 }
+var HOSTED_SET_OFF_FIX;
 var init_set_off_fix = __esm({
   "../rules/src/set-off-fix.ts"() {
     "use strict";
+    HOSTED_SET_OFF_FIX = 'This line is on the Stripe-hosted page, where Stripe sets the size and colour of your custom text: it cannot be made bigger or bolder there. What you can change: put the renewal terms in the product name or description in Stripe (Product catalog \u2192 your product \u2192 Edit), for example "Monthly box: renews monthly at $29 until you cancel". Stripe shows the product name and description in larger type in the order summary. Then check again. Also show the same line, set off, on your own page before the redirect.';
   }
 });
 
@@ -22471,6 +22588,9 @@ function classifyRaw(input) {
       if (input.origin !== "preflight" && input.data?.verifiedFrom === "checkbox_hosted") {
         return finish({ status: "compliant", note: VERIFIED_FROM_HOSTED_NOTE }, "verified_from_checkbox_settings", checkId);
       }
+      if (checkId === "signup.disclosure.conspicuous" && Array.isArray(input.data?.units) && input.data.units.some((u) => u && u.status === "pass" && !!u.hostedSmallerNearButton)) {
+        return finish({ status: "compliant", note: HOSTED_SMALLER_NEAR_BUTTON_NOTE }, "hosted_checkout_styling", checkId);
+      }
       if (input.origin !== "preflight" && LIVE_CHECKS.has(checkId)) {
         if (/on-screen only/.test(text)) return finish({ status: "pending_live_check", pending: pendingFor(checkId, "stripe was not checked", input.data), note: "Confirmed on screen only: run a proof to confirm the cancellation reaches Stripe." }, "pass_on_screen_only", checkId);
         return finish({ status: "verified_live" }, "verdict_pass_live", checkId);
@@ -22626,7 +22746,7 @@ function classifyFindings(findings) {
     info: classify({ checkId: f.checkId, status: f.status, detail: f.detail, missing: f.evidence?.missing, data: f.data, origin: "evaluation", siblings })
   }));
 }
-var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, RENEWAL_LINE_EXAMPLE, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
+var STATUS_LABELS, CHECK_TIERS, LIVE_CHECKS, has, isStripeInput, HOSTED_BEFORE_LINE_NOTE, HOSTED_SMALLER_NEAR_BUTTON_NOTE, HOSTED_CHECKOUT_NOTE, family, isEmailCheck, ask, PLAN_FACTS_FIX, STRIPE_CANCEL_UNREAD_FIX, BILLING_CONTRADICTS_FIX, VERIFIED_FROM_STRIPE_NOTE, VERIFIED_FROM_HOSTED_NOTE, HOSTED_UNLINKED_FIX, NOT_CHECKED_CANCEL_FIX, CANCEL_STEPS_FIX, EMAIL_EXISTS, RULES, STATUS_RULES, NY_EMAIL_ONLY_LABEL, NY_EMAIL_ONLY_NOTE, STRIPE_HOSTED_UNITS, PLATFORM_NAMES2, PORTAL_REQUIRED_FIX, PORTAL_IN_APP_BROKEN_FIX, PORTAL_OFFLINE_FIX, PAYMENT_LINK_PORTAL_FIX, PAYMENT_LINK_OFFLINE_FIX, RENEWAL_LINE_EXAMPLE, FAIL_FIX, CHECKS_PASS_UNREAD_LABEL, STATUS_RANK;
 var init_status = __esm({
   "../rules/src/status.ts"() {
     "use strict";
@@ -22692,7 +22812,8 @@ var init_status = __esm({
     has = (re) => (c) => re.test(c.text);
     isStripeInput = (c) => (c.kind ?? "").startsWith("stripe_") || onlyStripeHostedOpen(c.data) || /checkout\.stripe\.com|buy\.stripe\.com|stripe|custom_text/.test(c.text);
     HOSTED_BEFORE_LINE_NOTE = 'Checked once the renewal line exists (see "renewal language"). Stripe shows custom text small and grey below the button, and you cannot change that on its page.';
-    HOSTED_CHECKOUT_NOTE = "Stripe shows custom text small and grey below the button, and you cannot change that. Also show the same line, set off, on your own page before the redirect.";
+    HOSTED_SMALLER_NEAR_BUTTON_NOTE = "This passes on the larger line that states the renewal terms (for example the product name). The renewal text next to the pay button is still smaller, and the checkout provider sets its style. Also show the same line, set off, on your own page before the redirect.";
+    HOSTED_CHECKOUT_NOTE = "Stripe shows custom text small and grey below the button, and you cannot change that. What you can change: put the renewal terms in the product name or description in Stripe (shown larger in the order summary), and show the same line, set off, on your own page before the redirect.";
     family = (c) => String(c.checkId).split(".")[0];
     isEmailCheck = (id) => id.startsWith("confirmation.") || id.startsWith("reminder.");
     ask = (text, recommended, why) => ({ text, recommended, why });
@@ -22703,6 +22824,7 @@ var init_status = __esm({
     VERIFIED_FROM_HOSTED_NOTE = "Verified from Checkbox settings: your Checkbox cancellation page is on and working, and your site links to it. Checkbox runs each cancellation there itself and confirms it on screen and by email.";
     HOSTED_UNLINKED_FIX = (url, hiddenOn) => `${hiddenOn ? `The link to your Checkbox cancellation page on ${hiddenOn} is hidden from visitors, so it does not count. ` : ""}Add a visible "Cancel subscription" link to your Checkbox cancellation page${url ? ` (${url})` : ""} on your site (the footer is fine), or turn on Checkbox Notices so every acknowledgment email carries it. Then re-check; no test account is needed.`;
     NOT_CHECKED_CANCEL_FIX = "Let Checkbox try your cancel flow: add a test subscriber account in Site settings \u2192 Test account (agents: updateSite field test_account { login_url, email, password }; the shopper signs in and cancels), or start a test run in Stripe test mode (it signs up and cancels a test subscription). If subscribers cancel in the Stripe customer portal, no test account is needed: turn on cancellation there and link its login page from your site.";
+    CANCEL_STEPS_FIX = `Shorten the cancellation to 4 steps or fewer from the account page. With Stripe, make your "Cancel subscription" button create a customer portal session with flow_data: { type: "subscription_cancel", subscription_cancel: { subscription: "<the subscriber's subscription id>" } } and redirect to its url: the subscriber lands straight on Stripe's cancel confirmation. In your own flow, drop extra pages (one confirmation and at most one save offer). Then run a test run again.`;
     EMAIL_EXISTS = /not seen sent yet|only a template or sample|shows the template, not that|turned on in your billing platform|only been received for|captured, but its timing|from another system|not linked to a subscriber|sign-ups have no acknowledgment on record|window has not closed yet|upcoming .* observed|no price change observed yet|confirm they reach every/;
     RULES = [
       // Round 23 (pilot 22, ai-builder "soft false pass"): a test cancellation worked in the Stripe customer portal, but no
@@ -22713,6 +22835,16 @@ var init_status = __esm({
         when: (c) => String(c.checkId).startsWith("cancel.") && c.data?.portalUnlinked === true,
         build: (c) => ({ status: "needs_fix", fix: portalUnlinkedFix(typeof c.data?.portalUrl === "string" ? c.data.portalUrl : void 0) })
       },
+      // Round 34 (pilot 33 item 16, core-discovery: a test run said "nothing to change" for a 5-step cancellation, then the
+      // plan asked the owner "Is this requirement met?" with an unrelated fix): a cancellation that took more steps than
+      // Checkbox's limit is a change the agent can make first (a deep link straight to the cancel confirmation), not a
+      // question for the owner.
+      {
+        code: "cancel_too_many_steps",
+        category: "content",
+        when: (c) => c.checkId === "cancel.flow_friction" && c.status === "needs_review" && /cancelling took \d+ steps \(more than \d+\)/.test(c.text),
+        build: () => ({ status: "needs_fix", fix: CANCEL_STEPS_FIX })
+      },
       // Round 20 (pilot 19 item 1): an acknowledgment that does not mention a trial, on a site where only some plans have
       // one, and Checkbox cannot tell which plan it goes to. Not a fix and not a pass: the plan of the email is unknown.
       {
@@ -24498,6 +24630,9 @@ var init_model = __esm({
 });
 
 // ../rules/src/preflight/disclosure.ts
+function stripeConsentText(kind) {
+  return kind === "payment_link" ? 'The purchase is completed on a Stripe Payment Link, which collects consent (consent_collection.terms_of_service), so no checkbox is needed on this page. This page check cannot read the Payment Link: check it with checkStripePaymentLink (pass the retrieved link, plink_\u2026, as params). It needs consent_collection.terms_of_service = "required" and the renewal terms in custom_text.' : "The purchase is completed on Stripe Checkout, which collects consent (consent_collection.terms_of_service), so no checkbox is needed on this page. This page check cannot read the Checkout Session: check the params your code sends with checkStripeCheckoutSession.";
+}
 function resolvePlan(input, prefix = "") {
   const currency = parseCurrency(input.currency, `${prefix}currency`);
   const amount = minorAmount({ price: input.price, amount: input.amount, currency }, `${prefix}price`);
@@ -24516,6 +24651,20 @@ function resolvePlan(input, prefix = "") {
     throw new PreflightInputError(`${prefix}intro_percent_off must be a number above 0 and below 100 (20 for 20% off)`, `${prefix}intro_percent_off`);
   }
   const off = input.intro_amount_off;
+  const majorPrice = input.amount === void 0 && input.price !== void 0 && input.price !== null ? Number(String(input.price).replace(/[^0-9.]/g, "")) : NaN;
+  const looksMajor = (v) => typeof v === "number" && Number.isFinite(majorPrice) && majorPrice > 0 && v > 0 && v < 100 && v <= majorPrice;
+  if (looksMajor(off)) {
+    throw new PreflightInputError(
+      `${prefix}intro_amount_off is in minor units (cents), like ${prefix}amount: ${off} means ${(off / 100).toFixed(2)} off, next to a ${prefix}price of ${majorPrice.toFixed(2)} in major units. For ${off.toFixed(2)} off send ${prefix}intro_amount_off: ${Math.round(off * 100)}, or ${prefix}intro_price: ${Math.max(0, majorPrice - off).toFixed(2)} (the first-period price in major units, like ${prefix}price)`,
+      `${prefix}intro_amount_off`
+    );
+  }
+  if (input.intro_price === void 0 && looksMajor(input.intro_amount)) {
+    throw new PreflightInputError(
+      `${prefix}intro_amount is in minor units (cents), like ${prefix}amount: ${input.intro_amount} means ${(input.intro_amount / 100).toFixed(2)}, next to a ${prefix}price of ${majorPrice.toFixed(2)} in major units. Send ${prefix}intro_price: ${input.intro_amount} (major units, like ${prefix}price) or ${prefix}intro_amount: ${Math.round(input.intro_amount * 100)}`,
+      `${prefix}intro_amount`
+    );
+  }
   if (off !== void 0 && off !== null && !(typeof off === "number" && Number.isInteger(off) && off > 0 && off < amount)) {
     throw new PreflightInputError(`${prefix}intro_amount_off must be a whole number of minor units above 0 and below the recurring price (200 for $2.00 off)`, `${prefix}intro_amount_off`);
   }
@@ -24734,15 +24883,20 @@ function modelDisclosureCheckout(input) {
   return { captures, viewport: VIEWPORT };
 }
 function nextActionFor(checks, replacement, input) {
-  const failing = checks.filter((c) => c.status === "fail");
-  const review2 = checks.filter((c) => c.status === "needs_review");
+  const own = input.onStripe ? checks.filter((c) => c.check_id !== "signup.consent.affirmative") : checks;
+  const failing = own.filter((c) => c.status === "fail");
+  const review2 = own.filter((c) => c.status === "needs_review");
   const fill2 = replacement.placeholders.length ? ` Replace ${replacement.placeholders.join(", ")} with your real cancellation URL (or pass cancel_url).` : "";
+  const stripeNote = input.onStripe ? ` ${stripeConsentText(input.onStripe)}` : "";
   if (failing.length) {
     return {
       type: "replace_text",
-      message: `Failing: ${openChecks(checks)}. Replace the disclosure with ${replacement.short_disclosure_text ? "replacement.short_disclosure_text (one line; replacement.disclosure_text is the fuller version)" : "replacement.disclosure_text"}, show it under the price, before the card and email fields and the purchase button (semibold or boxed, at least your body text size), add an unchecked required checkbox labelled replacement.consent_label (or paste replacement.html), then call this check again.${fill2}`
+      message: input.onStripe ? `Failing: ${openChecks(own)}. Replace the text with ${replacement.short_disclosure_text ? "replacement.short_disclosure_text (one line; replacement.disclosure_text is the fuller version)" : "replacement.disclosure_text"} (or paste replacement.html, the terms only), show it directly above your purchase link (semibold or boxed, at least your body text size), then call this check again.${stripeNote}${fill2}` : `Failing: ${openChecks(checks)}. Replace the disclosure with ${replacement.short_disclosure_text ? "replacement.short_disclosure_text (one line; replacement.disclosure_text is the fuller version)" : "replacement.disclosure_text"}, show it under the price, before the card and email fields and the purchase button (semibold or boxed, at least your body text size), add an unchecked required checkbox labelled replacement.consent_label (or paste replacement.html), then call this check again.${fill2}`
     };
   }
+  if (input.onStripe && !review2.length) {
+    return { type: "fix_and_recheck", message: `The text passes every check that can be judged here. Keep it directly above your purchase link.${stripeNote}${fill2}` };
+  }
   if (review2.length && review2.every((c) => c.check_id === "signup.disclosure.conspicuous")) {
     const same = norm(input.text) === norm(replacement.disclosure_text);
     if (!input.bold && !input.boxed) {
@@ -24791,20 +24945,24 @@ async function checkDisclosure(input, opts = {}) {
     label: str2(c.label, 1e3, "consent.label") ?? DEFAULT_CONSENT_LABEL,
     required: bool2(c.required, true, "consent.required")
   } : void 0;
+  const checkoutType = input.checkout_type;
+  if (checkoutType !== void 0 && checkoutType !== "own_page" && checkoutType !== "stripe_checkout" && checkoutType !== "payment_link") throw new PreflightInputError('checkout_type must be "own_page", "stripe_checkout" or "payment_link"', "checkout_type");
+  const onStripe = checkoutType === "stripe_checkout" || checkoutType === "payment_link" ? checkoutType : void 0;
+  const facts = { ...planFacts(plan2), ...checkoutType ? { checkoutType } : {} };
   const warnings = [];
-  if (!c) warnings.push({ code: "consent_unspecified", message: "consent was not given; the check assumes there is no consent checkbox.", param: "consent" });
+  if (!c && !onStripe) warnings.push({ code: "consent_unspecified", message: "consent was not given; the check assumes there is no consent checkbox.", param: "consent" });
   if (placement.contrast_ratio !== void 0 && placement.contrast_ratio < CONSPICUOUS_MIN_CONTRAST) {
     warnings.push({ code: "low_contrast", message: `contrast_ratio ${placement.contrast_ratio} is below ${CONSPICUOUS_MIN_CONTRAST}:1.`, param: "placement.contrast_ratio" });
   }
   const buttonText = str2(input.button_text, 200, "button_text") ?? (plan2.trialDays ? "Start free trial" : "Subscribe");
   const orderSummary = str2(input.order_summary, 1e3, "order_summary");
   const { captures } = modelDisclosureCheckout({ text, buttonText, ...orderSummary ? { orderSummary } : {}, placement, ...consent ? { consent } : {}, asOf });
-  const ctx = modelContext(jurisdictions, asOf, planFacts(plan2), { captures, config: planConfig(plan2, asOf), ...plan2.merchantName ? { merchantNames: [plan2.merchantName] } : {} });
+  const ctx = modelContext(jurisdictions, asOf, facts, { captures, config: planConfig(plan2, asOf), ...plan2.merchantName ? { merchantNames: [plan2.merchantName] } : {} });
   const run2 = await runChecks(ctx, SIGNUP_FIX_CHECKS, now);
   let checks = shapeChecks(run2.findings);
   if (!placement.same_page_as_payment) {
     const onPage = modelDisclosureCheckout({ text, buttonText, ...orderSummary ? { orderSummary } : {}, placement: { ...placement, same_page_as_payment: true }, ...consent ? { consent } : {}, asOf });
-    const textCtx = modelContext(jurisdictions, asOf, planFacts(plan2), { captures: onPage.captures, config: planConfig(plan2, asOf), ...plan2.merchantName ? { merchantNames: [plan2.merchantName] } : {} });
+    const textCtx = modelContext(jurisdictions, asOf, facts, { captures: onPage.captures, config: planConfig(plan2, asOf), ...plan2.merchantName ? { merchantNames: [plan2.merchantName] } : {} });
     const byText = new Map(shapeChecks((await runChecks(textCtx, SIGNUP_FIX_CHECKS, now)).findings).map((v) => [v.check_id, v]));
     checks = checks.map((v) => {
       const t = byText.get(v.check_id);
@@ -24820,13 +24978,17 @@ async function checkDisclosure(input, opts = {}) {
       };
     });
   }
-  const replacement = await buildReplacement(plan2, jurisdictions, asOf, now);
+  if (onStripe) {
+    const said = stripeConsentText(onStripe);
+    checks = checks.map((v) => v.check_id === "signup.consent.affirmative" && v.status !== "pass" && v.status !== "not_applicable" ? { ...v, status: "needs_review", explanation: said, fix: said } : v);
+  }
+  const replacement = await buildReplacement(plan2, jurisdictions, asOf, now, onStripe ? { onStripe } : {});
   const ownButton = str2(input.button_text, 200, "button_text");
-  if (ownButton && buttonFitsPlan(ownButton, plan2)) {
+  if (ownButton && buttonFitsPlan(ownButton, plan2) && !onStripe) {
     replacement.button_text = ownButton;
-    replacement.html = htmlDisclosureComponent({ disclosure: replacement.disclosure_text, consentLabel: replacement.consent_label, cta: ownButton }, replacement.sha256);
+    replacement.html = htmlDisclosureComponent({ disclosure: replacement.disclosure_text, consentLabel: replacement.consent_label, cta: ownButton }, replacement.sha256, /data-checkbox-terms="[^"]*" style="[^"]*border:1px solid currentColor/.test(replacement.html) ? { boxed: true } : {});
   }
-  return { ...baseReport("disclosure", checks, jurisdictions, asOf, warnings, nextActionFor(checks, replacement, { text, bold: placement.bold, boxed: placement.boxed }), `${input.text}
+  return { ...baseReport("disclosure", checks, jurisdictions, asOf, warnings, nextActionFor(checks, replacement, { text, bold: placement.bold, boxed: placement.boxed, ...onStripe ? { onStripe } : {} }), `${input.text}
 ${input.consent?.label ?? ""}`, plan2), kind: "disclosure", replacement };
 }
 var MAX_DISCLOSURE_CHARS, PREFLIGHT_PLAN_ID, CANCEL_URL_PLACEHOLDER, SAMPLE_CANCEL_URL, DEFAULT_CONSENT_LABEL, norm, TEXT_CONTENT_CHECKS;
@@ -25304,7 +25466,7 @@ function planAsMerchant(shape, merchant) {
 }
 function correct(params, shape, checks, forLink, style2 = "full") {
   const byId = new Map(checks.map((c) => [c.check_id, c]));
-  const needText = TEXT_CHECKS.some((id) => open(byId.get(id)));
+  const needText = TEXT_CHECKS.some((id) => open(byId.get(id)) && !isHostedStylingNote(byId.get(id), checks, "stripe_checkout_session"));
   const needConsent = CONSENT_CHECKS2.some((id) => open(byId.get(id))) || !shape.consentRequired && needText;
   const terms2 = merchantTerms(shape.plan, false);
   const full = lockedTexts(terms2);
@@ -25425,6 +25587,11 @@ function withResolvedPrices(input, knownPrices, amountSource = "merchant.price")
     const m = input.merchant ?? {};
     const stated = typeof m.amount === "number" ? m.amount : typeof m.price === "number" ? Math.round(m.price * 10 ** currencyDigitsOf(r.resolved.currency)) : void 0;
     const warnings = [];
+    const sd = isObj(input.params.subscription_data) ? input.params.subscription_data : {};
+    const paramsTrial = typeof sd.trial_period_days === "number" ? sd.trial_period_days : void 0;
+    const priceTrial = r.resolved.trialDays && r.resolved.trialDays > 0 ? r.resolved.trialDays : void 0;
+    const trialNote = priceTrial ? paramsTrial !== void 0 ? paramsTrial === priceTrial ? `, with a ${priceTrial}-day trial on the Price (the same as subscription_data.trial_period_days)` : `, with a ${priceTrial}-day trial on the Price; these params set subscription_data.trial_period_days to ${paramsTrial}, which is the trial this Checkout gives` : `, with a ${priceTrial}-day trial on the Price (trial_period_days); these params set no trial of their own` : "";
+    warnings.push({ code: "price_read", message: `Stripe Price ${r.resolved.id} was read from your connected Stripe account: ${formatMoney(r.resolved.amount, r.resolved.currency)} per ${intervalPhrase(r.resolved.interval, r.resolved.intervalCount)}${trialNote}.`, param: "params.line_items" });
     if (stated !== void 0 && stated !== r.resolved.amount) {
       warnings.push({ code: "merchant_price_contradicts_price", message: `merchant.price says ${formatMoney(stated, r.resolved.currency)}, but ${r.resolved.id} charges ${formatMoney(r.resolved.amount, r.resolved.currency)} per ${intervalPhrase(r.resolved.interval, r.resolved.intervalCount)} in your connected Stripe account; the Price wins and the corrected custom_text states it.`, param: "merchant.price" });
     }
@@ -26145,9 +26312,6 @@ function stripeButtonsKind(capture) {
   const [only] = [...kinds];
   return kinds.size === 1 && only ? only : void 0;
 }
-function stripeConsentText(kind) {
-  return kind === "payment_link" ? 'The purchase is completed on a Stripe Payment Link, which collects consent (consent_collection.terms_of_service), so no checkbox is needed on this page. This page check cannot read the Payment Link: check it with checkStripePaymentLink (pass the retrieved link, plink_\u2026, as params). It needs consent_collection.terms_of_service = "required" and the renewal terms in custom_text.' : "The purchase is completed on Stripe Checkout, which collects consent (consent_collection.terms_of_service), so no checkbox is needed on this page. This page check cannot read the Checkout Session: check the params your code sends with checkStripeCheckoutSession.";
-}
 function hasPrice(t) {
   return !!t && (t.price !== void 0 && t.price !== null && t.price !== "" || t.amount !== void 0 && t.amount !== null);
 }
@@ -27746,13 +27910,19 @@ function detectProject(root, processEnv = {}) {
   const payButtons = [];
   const checkoutSessions = [];
   const policyPaths = {};
+  const linkedPolicies = {};
   walk2(root, (abs, rel2) => {
     const route = routeOf(rel2);
+    const served = route && /\.html?$/i.test(rel2) && !/(?:^|\/)index\.html?$/i.test(rel2) ? `/${route}${/\.htm$/i.test(rel2) ? ".htm" : ".html"}` : `/${route}`;
     if (route) {
-      for (const p of POLICY_ROUTES) if (!policyPaths[p.kind] && p.re.test(route)) policyPaths[p.kind] = `/${route}`;
+      for (const p of POLICY_ROUTES) if (!policyPaths[p.kind] && p.re.test(route)) policyPaths[p.kind] = served;
     }
     const text = readText(abs);
     if (!text) return;
+    for (const m of text.matchAll(/\bhref=\{?\s*["'`](\/[A-Za-z0-9._~\/-]*)["'`]/g)) {
+      const path = m[1].slice(1).replace(/\/$/, "").replace(/\.html?$/i, "").toLowerCase();
+      for (const p of POLICY_ROUTES) if (!linkedPolicies[p.kind] && p.re.test(path)) linkedPolicies[p.kind] = m[1].replace(/(.)\/$/, "$1");
+    }
     const lines = text.split("\n");
     lines.forEach((line2, i) => {
       for (const p of CHECKOUT_PATTERNS) {
@@ -27772,6 +27942,7 @@ function detectProject(root, processEnv = {}) {
     }
   });
   if (billingPlatform === "custom" && checkoutCode.some((c) => c.kind.startsWith("stripe_"))) billingPlatform = "stripe";
+  Object.assign(policyPaths, linkedPolicies);
   const site = detectSiteUrl(root, env2, pkg);
   const stripeKey = findStripeKey(env2, processEnv, envFile);
   const brand = detectBrand(root, layoutFile, typeof pkg?.name === "string" ? pkg.name : void 0);
@@ -28051,6 +28222,10 @@ function pairCall(root, s2, plans, priceIds, calls) {
   }
   return { ref: literalIds[0] ?? exprs[0] };
 }
+function supportAddressIn(text) {
+  const all = [...text.matchAll(EMAIL_ADDRESS)].map((m) => m[1]).filter((a) => !/^(?:no-?reply|do-?not-?reply|mailer-daemon|bounce)/i.test(a) && !/@(?:example\.(?:com|org|net)|email\.com|domain\.com)$/i.test(a));
+  return all[0];
+}
 function scaffoldConfig(root, env2 = {}, facts = {}) {
   const det = detectProject(root, env2);
   const todos = [];
@@ -28187,6 +28362,7 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     } else stripe.push(entry);
   }
   const emails = [];
+  const supportSeen = /* @__PURE__ */ new Map();
   const pages = [];
   const disclosures = [];
   walk3(root, (rel2) => {
@@ -28203,6 +28379,8 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
         const hint = intervalHintOf(basename(rel2).replace(/\.[^.]+$/, ""));
         const byName = hint && plans.length > 1 ? plans.filter((p) => p.interval === hint && (Number(p.interval_count ?? 1) || 1) === 1) : [];
         const plan2 = plans.length > 1 && planTagged ? { plan: "all" } : byName.length === 1 ? { plan: String(byName[0].name) } : planFor();
+        const contact2 = supportAddressIn(text);
+        if (contact2 && !supportSeen.has(contact2)) supportSeen.set(contact2, rel2);
         emails.push({ name: unique(names, `Email: ${basename(rel2)}`), kind, file: rel2, ...plan2, ...Object.keys(tags).length ? { merge_tags: tags } : {} });
         found.push(`${rel2}: ${kind} email${Object.keys(tags).length ? ` (its merge tags ${Object.keys(tags).map((t) => `{{${t}}}`).join(", ")} are filled from checkbox.json: see "merge_tags")` : ""}`);
         return;
@@ -28249,6 +28427,11 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
   if (!disclosures.length && det.payButtons.length && !det.payButtons.some((b) => inPages(b.file))) {
     notes2.push(`The renewal disclosure lives in code (${det.payButtons[0].file}); keep its text in a .txt file the component imports and add it under checks.disclosures, or check the rendered page under checks.pages`);
   }
+  const [contact] = [...supportSeen.entries()];
+  if (!merchant.support_contact && contact) {
+    merchant.support_contact = contact[0];
+    found.push(`support contact ${contact[0]} (from ${contact[1]}; check it is the address subscribers should write to)`);
+  }
   if (planTodo) todos.push('plan: pick the plan of each disclosure, page and email entry marked TODO ("all" for a page that shows every plan)');
   const checks = {};
   if (stripe.length) checks.stripe_checkout = stripe;
@@ -28267,7 +28450,7 @@ function scaffoldConfig(root, env2 = {}, facts = {}) {
     todoValues: countTodoValues({ merchant, plans, checks })
   };
 }
-var PAGE_ROUTE, IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE;
+var PAGE_ROUTE, IGNORE, MAX_FILES2, EMAIL_NAMES, IN_EMAIL_DIR, PAGE_FILE, DISCLOSURE_TEXT, unique, PLAN_FILE, EMAIL_ADDRESS;
 var init_scaffold = __esm({
   "src/ci/scaffold.ts"() {
     "use strict";
@@ -28296,6 +28479,7 @@ var init_scaffold = __esm({
       return n;
     };
     PLAN_FILE = /(?:^|\/)(?:plans?|pricing|prices|tiers|subscriptions?|billing|products?)(?:\.config)?\.(?:[cm]?[jt]sx?|json)$/i;
+    EMAIL_ADDRESS = /(?:mailto:)?([A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,})/g;
   }
 });
 
@@ -28762,7 +28946,8 @@ function pageJob(loaded, e, o, root) {
     const { merchant_name: _m, cancel_url: _c, ...own } = planTerms(config, pickPlan(config, n));
     return own;
   });
-  const common3 = { ...e.kind ? { page_kind: e.kind } : {}, ...Object.keys(terms2).length ? { terms: terms2 } : {}, ...every ? { plans: every } : {}, ...jurisdictionsOf(config) };
+  const viaCheckout = e.kind !== "checkout" && (config.checks.stripe_checkout?.length ?? 0) > 0;
+  const common3 = { ...e.kind ? { page_kind: e.kind } : {}, ...viaCheckout ? { checkout_type: "stripe_checkout" } : {}, ...Object.keys(terms2).length ? { terms: terms2 } : {}, ...every ? { plans: every } : {}, ...jurisdictionsOf(config) };
   if (e.source) {
     job.target = { file: rel(loaded, root, e.source), line: 1 };
     job.inputs.push(e.source);
@@ -29078,6 +29263,7 @@ var init_src3 = __esm({
     init_checkout_plans();
     init_notices_on();
     init_stripe_account();
+    init_intro_terms();
     CATALOG2 = [...CATALOG];
   }
 });
@@ -29491,6 +29677,17 @@ function operationFor2(kind) {
 function onlineEngine(client) {
   return { mode: "online", run: (kind, body) => client.sdk.call(operationFor2(kind), body) };
 }
+function withStripeNotChecked(run2, strict) {
+  const strictFailed = strict && run2.exit_code === EXIT.ok;
+  const exit = strictFailed ? EXIT.needs_review : run2.exit_code;
+  return {
+    ...run2,
+    offline_notice: STRIPE_OBJECTS_OFFLINE_NOTICE,
+    stripe_not_checked: { reason: STRIPE_OBJECTS_OFFLINE_NOTICE, secret: "CHECKBOX_SECRET_KEY", workflow_diff: STRIPE_ONLINE_WORKFLOW_DIFF, strict_failed: strictFailed },
+    exit_code: exit,
+    result: strictFailed ? `failed: Stripe was NOT checked (an offline run on a trial, price or interval change) and --strict is on (exit ${exit})` : resultOf(run2.status, exit, strict)
+  };
+}
 function resultOf(status, exit, strict) {
   if (exit === 0) return status === "needs_review" ? "passed with items to review (they do not fail this run)" : "passed";
   if (status === "needs_review") return `failed: items need review and ${strict ? "--strict is on" : 'a "strict" entry or a blocking check makes them fail the run'} (exit ${exit})`;
@@ -29717,8 +29914,30 @@ function unverifiedOffer(r) {
   if (coupon && open2.length) return coupon.message;
   return void 0;
 }
+function consentOnStripeCovered(report) {
+  const c = (report.checks ?? []).find((x) => x.check_id === "signup.consent.affirmative" && x.status === "needs_review" && !(x.compliance_status && OK_STATUSES.has(x.compliance_status)));
+  if (!c) return report;
+  const was = c.compliance_status;
+  const checks = (report.checks ?? []).map((x) => x === c ? { ...x, status: "not_applicable", compliance_status: "not_applicable", explanation: CONSENT_COVERED, fix: CONSENT_COVERED, compliance: { ...x.compliance ?? {}, fix: null, question: null } } : x);
+  const compliance = report.compliance ?? {};
+  const counts = { ...compliance.counts ?? {} };
+  if (was && typeof counts[was] === "number" && counts[was] > 0) counts[was] = counts[was] - 1;
+  const open2 = OPEN_COUNTS.some((k) => (counts[k] ?? 0) > 0) || checks.some((x) => x.status === "fail" || x.status === "needs_review" && !(x.compliance_status && OK_STATUSES.has(x.compliance_status)));
+  if (!open2 && report.verdict !== "fail") {
+    const pending = counts.pending_live_check ?? 0;
+    return { ...report, checks, verdict: "pass", compliance_status: pending ? "pending_live_check" : "compliant", compliance: { ...compliance, counts, status: pending ? "pending_live_check" : "compliant", label: pending ? `Checks pass \xB7 ${pending} live check${pending === 1 ? "" : "s"} pending` : "Checks pass" } };
+  }
+  const words = {
+    not_checked: [/(\d+) not checked yet/, (n) => `${n} not checked yet`],
+    your_call: [/(\d+) decisions? for you/, (n) => `${n} decision${n === 1 ? "" : "s"} for you`]
+  };
+  let label = compliance.label ?? "";
+  const w = was ? words[was] : void 0;
+  if (w) label = label.replace(w[0], (_m, n) => Number(n) > 1 ? w[1](Number(n) - 1) : "").replace(/^ · | · (?= · )| · $/g, "").replace(/ · · /g, " \xB7 ");
+  return { ...report, checks, compliance: { ...compliance, counts, label } };
+}
 function sitePlansDifferInCi(message) {
-  const m = /\(you sent (.+?); (site_\w+) has (.+?)\), then check again/.exec(message);
+  const m = /\(you sent (.+?); (site_\w+) has (.+?)\)(?:, then check again|\. This result is judged)/.exec(message);
   if (!m) return message;
   return `The site's plans in Checkbox (${m[3]}) are older than checkbox.json (${m[1]}). This run checks against checkbox.json, what this code sells. Once this change is deployed, update the site's plans (updateSetupSession plans[], or \`checkbox init --plan \u2026\`) so the site's own checks and its compliance plan use them; until then the plan's tasks may quote the old terms.`;
 }
@@ -29742,6 +29961,10 @@ async function runJob(job, engine, config, opts = {}) {
   }
   const alerts = job.warnings.filter((w) => /^The params and checkbox\.json disagree/.test(w));
   for (const w of report.warnings ?? []) {
+    if (w.code === "price_read") {
+      Object.assign(base, { stripe: [...base.stripe ?? [], w.message] });
+      continue;
+    }
     const text = w.code === "site_plans_differ" ? sitePlansDifferInCi(w.message) : ciVocabulary(w.message);
     base.warnings.push(text);
     if (ALERT_CODES.has(w.code)) alerts.push(text);
@@ -29752,6 +29975,7 @@ async function runJob(job, engine, config, opts = {}) {
     const pending = Number(report.compliance?.counts?.pending_live_check) || 0;
     report = { ...report, verdict: "pass", compliance_status: pending ? "pending_live_check" : "compliant", compliance: { ...report.compliance ?? {}, label: pending ? `Checks pass \xB7 ${pending} live check${pending === 1 ? "" : "s"} pending` : "Checks pass" } };
   }
+  if (job.type === "page" && job.body?.checkout_type === "stripe_checkout") report = consentOnStripeCovered(report);
   const status = ciStatusOf(report);
   const params = job.type === "stripe_checkout" ? job.body?.params ?? void 0 : void 0;
   let fixes = (status === "pass" || status === "not_applicable" ? [] : fixesOf(report)).map((f) => ciVocabulary(job.type === "stripe_checkout" ? stripeConsentFix(f, params) : f));
@@ -29892,7 +30116,7 @@ async function runCi(jobs, engine, opts) {
     result: resultOf(status, exit, opts.strict)
   };
 }
-var ENGINE_KIND, STRIPE_OBJECTS_OFFLINE_NOTICE, CI_DISCLAIMER, RANK2, OK_STATUSES, BOXED_HTML, BOXED_LINE, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, ALERT_CODES;
+var ENGINE_KIND, STRIPE_OBJECTS_OFFLINE_NOTICE, STRIPE_ONLINE_WORKFLOW_DIFF, CI_DISCLAIMER, RANK2, OK_STATUSES, BOXED_HTML, BOXED_LINE, NOTICE_TO_EMAIL, EMAIL_LABEL, DEFAULT_LABEL, CONSENT_COVERED, OPEN_COUNTS, ALERT_CODES;
 var init_runner = __esm({
   "src/ci/runner.ts"() {
     "use strict";
@@ -29910,7 +30134,19 @@ var init_runner = __esm({
       email: "email",
       notice_schedule: "notice_schedule"
     };
-    STRIPE_OBJECTS_OFFLINE_NOTICE = "Stripe objects (Payment Links, and the trial or price set on a Stripe Price) are not checked offline: this change touches a trial, price or interval, so run checkbox ci --online (CHECKBOX_SECRET_KEY, with Stripe connected on the site) to check that Stripe sells the same terms.";
+    STRIPE_OBJECTS_OFFLINE_NOTICE = "Stripe NOT checked: this change touches a trial, price or interval, and this run was offline, so Checkbox did not check that Stripe (the Price, Payment Links) sells the same terms. Run checkbox ci --online with CHECKBOX_SECRET_KEY set (and Stripe connected on the site in Checkbox). In GitHub Actions: add the repository secret CHECKBOX_SECRET_KEY and the --online args shown below.";
+    STRIPE_ONLINE_WORKFLOW_DIFF = [
+      "--- a/.github/workflows/checkbox.yml",
+      "+++ b/.github/workflows/checkbox.yml",
+      "@@",
+      "       - uses: checkbox-site/checkbox@v1",
+      "-        # with:",
+      "-        #   strict: true          # also fail when a check needs review",
+      "+        with:",
+      "+          args: --online",
+      "+        env:",
+      "+          CHECKBOX_SECRET_KEY: ${{ secrets.CHECKBOX_SECRET_KEY }}"
+    ].join("\n");
     CI_DISCLAIMER = "Automated check against Checkbox's catalog of automatic-renewal laws; not legal advice.";
     RANK2 = { fail: 0, needs_review: 1 };
     OK_STATUSES = /* @__PURE__ */ new Set(["compliant", "pending_live_check", "verified_live", "not_applicable"]);
@@ -29934,6 +30170,8 @@ var init_runner = __esm({
       cancellation_confirmation: "cancellation confirmation"
     };
     DEFAULT_LABEL = { pass: "Checks pass", fail: "Fixes needed", needs_review: "Needs review", not_applicable: "Not required for this plan" };
+    CONSENT_COVERED = "Consent is collected on Stripe Checkout, not on this page: this run checks it in checkbox.json's stripe_checkout entries (consent_collection.terms_of_service and the renewal terms in custom_text). No checkbox is needed on this page.";
+    OPEN_COUNTS = ["needs_fix", "not_set_up", "your_call", "not_checked"];
     ALERT_CODES = /* @__PURE__ */ new Set(["coupon_unverified", "coupon_read", "merchant_trial_ignored", "merchant_price_ignored", "price_not_in_site_plans", "price_from_setup_plan", "plan_terms_conflict", "trial_mismatch", "intro_mismatch"]);
   }
 });
@@ -29967,10 +30205,13 @@ function renderHuman(run2, c, opts = {}) {
     lines.push(`  ${icon(x.status, c)} ${x.name.padEnd(width)} \u2192 ${label}`);
     if (x.message) lines.push(c.dim(`      ${wrap(x.message, 110, "      ")}`));
     if (x.fix) lines.push(`      fix: ${wrap(x.fix, 110, "           ")}${c.dim(` (${where(x)})`)}`);
+    const restore = restoreStylingLine(x);
+    if (restore) lines.push(`      fix: ${wrap(restore, 110, "           ")}`);
     for (const f of x.fixes.slice(1, opts.verbose ? void 0 : 4)) lines.push(/^Plan card [^:]+: Decision for you\b/.test(f) ? `      decision: ${wrap(f.replace(/Decision for you \(not a fix\): /, ""), 110, "                ")}` : `      fix: ${wrap(f, 110, "           ")}`);
     if (!opts.verbose && x.fixes.length > 4) lines.push(c.dim(`      (+${x.fixes.length - 4} more with --verbose)`));
     const alerts = x.alerts ?? [];
     for (const a of alerts) lines.push(c.yellow(`      warning: ${wrap(a, 110, "               ")}`));
+    for (const st of x.stripe ?? []) lines.push(`      stripe: ${wrap(st, 110, "              ")}`);
     for (const w of x.warnings.filter((w2) => !alerts.includes(w2) && !PRICE_UNREAD.test(w2)).slice(0, opts.verbose ? 10 : alerts.length ? 0 : 1)) lines.push(c.dim(`      note: ${wrap(w, 110, "            ")}`));
     for (const w of x.warnings) {
       const id = PRICE_UNREAD.exec(w)?.[1];
@@ -29981,12 +30222,35 @@ function renderHuman(run2, c, opts = {}) {
   if (unreadPrices.length) lines.push("", c.dim(wrap(`note: ${unreadPrices.length === 1 ? `Price ${unreadPrices[0]} was` : `Prices ${unreadPrices.join(", ")} were`} not read (no connected Stripe account has ${unreadPrices.length === 1 ? "it" : "them"}), so the amounts checked come from "plans" in checkbox.json. To check them against Stripe, connect Stripe on the site in Checkbox and run checkbox ci --online.`, 110, "      ")));
   const tone = run2.status === "pass" ? c.green : run2.status === "needs_review" && run2.exit_code === 0 ? c.yellow : c.red;
   if (run2.status === "skipped") lines.push("", c.red(wrap(nothingCheckedMessage(run2), 110, "")));
-  if (run2.offline_notice) lines.push("", c.yellow(wrap(`Not checked offline: ${run2.offline_notice}`, 110, "      ")));
+  if (run2.stripe_not_checked) {
+    lines.push("", (run2.stripe_not_checked.strict_failed ? c.red : c.yellow)(wrap(run2.stripe_not_checked.reason, 110, "")));
+    lines.push(c.dim("Workflow change (.github/workflows/checkbox.yml), plus the repository secret CHECKBOX_SECRET_KEY:"), ...run2.stripe_not_checked.workflow_diff.split("\n").map((l) => c.dim(`  ${l}`)));
+  } else if (run2.offline_notice) lines.push("", c.yellow(wrap(run2.offline_notice, 110, "      ")));
   lines.push("", `${tone(overallLine(run2))} \xB7 exit ${run2.exit_code}${run2.result ? ` (${run2.result.replace(/ \(exit \d+\)$/, "")})` : ""}`);
   if (run2.checks.some((x) => x.corrected) && !opts.verbose) lines.push(c.dim("Corrected params / text: --verbose, --json, or the job summary in GitHub Actions."));
   lines.push(c.dim(run2.disclaimer));
   return lines;
 }
+function removedStyling(removed) {
+  const parts = [];
+  for (const l of removed) {
+    const jsx = /\bstyle=\{\{([^}]*)\}\}/.exec(l);
+    if (jsx) parts.push(`style={{${jsx[1]}}}`);
+    const html = /\bstyle=(["'])([^"']*)\1/.exec(l);
+    if (html && html[2].trim()) parts.push(`style="${html[2].trim()}"`);
+    const cls = /\b(className|class)=(["'])([^"']*)\2/.exec(l);
+    if (cls && cls[3].trim()) parts.push(`${cls[1]}="${cls[3].trim()}"`);
+    const tag = /<(strong|b)[\s>]/i.exec(l);
+    if (tag) parts.push(`<${tag[1].toLowerCase()}>`);
+    if (parts.length) break;
+  }
+  return parts.length ? parts.join(" ") : void 0;
+}
+function restoreStylingLine(x) {
+  if (x.type !== "page" && x.type !== "disclosure") return void 0;
+  const style2 = x.anchored?.removed?.length ? removedStyling(x.anchored.removed) : void 0;
+  return style2 ? `Restore the line with its styling (${style2}), not as plain text: Checkbox checks that the renewal terms stand out next to the button, not only that they are there.` : void 0;
+}
 function annotations(run2) {
   const out = [];
   for (const x of run2.checks) {
@@ -29995,8 +30259,10 @@ function annotations(run2) {
     if (!level) continue;
     const props = [`file=${escProp(x.target.file)}`, ...x.target.line ? [`line=${x.target.line}`] : [], `title=${escProp(`Checkbox: ${x.name} \u2014 ${x.label}`)}`];
     const removed = x.anchored?.removed?.length ? `This change removed ${x.anchored.removed.length === 1 ? "a line" : `${x.anchored.removed.length} lines`} here: ${x.anchored.removed.slice(0, 2).map((l) => `"${l.trim().slice(0, 120)}"`).join(", ")}${x.anchored.removed.length > 2 ? ", \u2026" : ""}` : "";
+    const corrected = !x.corrected ? "" : x.corrected.format === "text" && x.corrected.body.length <= 1500 ? `${x.corrected.title}:
+${x.corrected.body}` : `${x.corrected.title}: see the job summary.`;
     const body = x.status === "error" ? x.fix ? `${x.message ?? ""}
-${x.fix}` : `Could not run: ${x.message ?? ""}` : [removed, x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), x.corrected ? `${x.corrected.title}: see the job summary.` : ""].filter(Boolean).join("\n");
+${x.fix}` : `Could not run: ${x.message ?? ""}` : [removed, restoreStylingLine(x) ?? "", x.status === "pass" && !x.fix ? "" : x.fix ?? x.label, ...x.fixes.slice(1, 4).map((f) => `\u2022 ${f}`), ...alerts.map((a) => `Warning: ${a}`), corrected].filter(Boolean).join("\n");
     out.push(`::${level} ${props.join(",")}::${escData(body)}`);
   }
   if (run2.status === "skipped") out.push(`::error file=${escProp(run2.config)},title=${escProp("Checkbox: nothing was checked")}::${escData(nothingCheckedMessage(run2))}`);
@@ -30009,11 +30275,14 @@ function stepSummary(run2) {
   lines.push(`**${overallLine(run2)}** \u2014 \`${run2.config}\` \xB7 ${run2.mode}${versions}`, "");
   if (run2.status === "skipped") lines.push(`\u274C ${nothingCheckedMessage(run2)}`, "");
   if (run2.result) lines.push(`Result: ${run2.result}.`, "");
-  if (run2.offline_notice) lines.push(`\u26A0\uFE0F ${run2.offline_notice}`, "");
+  if (run2.stripe_not_checked) {
+    lines.push(`${run2.stripe_not_checked.strict_failed ? "\u274C" : "\u26A0\uFE0F"} **Stripe NOT checked.** ${run2.stripe_not_checked.reason.replace(/^Stripe NOT checked: /, "")}`, "");
+    lines.push("<details><summary>Workflow change that checks Stripe (plus the repository secret <code>CHECKBOX_SECRET_KEY</code>)</summary>", "", "```diff", run2.stripe_not_checked.workflow_diff, "```", "", "</details>", "");
+  } else if (run2.offline_notice) lines.push(`\u26A0\uFE0F ${run2.offline_notice}`, "");
   lines.push("| Check | Status | Fix | File |", "|---|---|---|---|");
   for (const x of run2.checks) {
     const fix0 = x.status === "error" || x.status === "skipped" ? [x.message, x.fix].filter(Boolean).join(" ") : x.fix ? `${x.fix}${x.fixes.length > 1 ? ` (+${x.fixes.length - 1} more)` : ""}` : x.status === "needs_review" && x.message ? x.message : "";
-    const fix = [fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`)].filter(Boolean).join("\n");
+    const fix = [restoreStylingLine(x) ?? "", fix0, ...(x.alerts ?? []).map((a) => `\u26A0\uFE0F ${a}`), ...(x.stripe ?? []).map((st) => `Stripe: ${st}`)].filter(Boolean).join("\n");
     lines.push(`| ${STATUS_MD[x.status]} ${cell(x.name)}<br><sub>${TYPE_LABEL[x.type]}</sub> | ${cell(x.label)} | ${cell(fix)} | \`${cell(where(x))}\` |`);
   }
   const detailed = run2.checks.filter((x) => x.corrected || x.fixes.length > 1);
@@ -30625,16 +30894,17 @@ ${message}
         const run0 = await runCi(jobs, engine, { config: loaded.config, configPath: configName, strict, extra, ...notices ? { notices, noticesTarget: { file: relative5(workspace, path).split("\\").join("/") || configName, line: noticesLine } } : {} });
         const baseRef = str(p.flags, "base") ?? (ctx.env.GITHUB_BASE_REF ? `origin/${ctx.env.GITHUB_BASE_REF}` : void 0);
         if (baseRef) anchorToChanges(run0.checks, ctx.cwd, workspace, baseRef);
-        const run2 = !client && termsChanged(ctx.cwd, baseRef, jobs) ? { ...run0, offline_notice: STRIPE_OBJECTS_OFFLINE_NOTICE } : run0;
+        const run2 = !client && termsChanged(ctx.cwd, baseRef, jobs) ? withStripeNotChecked(run0, strict) : run0;
         ctx.out.result(run2, () => renderHuman(run2, ctx.out.c, { verbose: bool(p.flags, "verbose") === true }));
         if (gha) {
           for (const a of annotations(run2)) emit(a);
           writeGithubFile(ctx.env.GITHUB_STEP_SUMMARY, stepSummary(run2));
-          if (run2.offline_notice) emit(`::notice title=Checkbox%3A Stripe not checked offline::${run2.offline_notice}`);
+          if (run2.stripe_not_checked) emit(`::${run2.stripe_not_checked.strict_failed ? "error" : "warning"} title=Checkbox%3A Stripe NOT checked::${`${run2.stripe_not_checked.reason}
+${run2.stripe_not_checked.workflow_diff}`.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A")}`);
           writeGithubFile(ctx.env.GITHUB_OUTPUT, `status=${run2.status}
 exit_code=${run2.exit_code}
 result=${run2.result}
-`);
+${run2.stripe_not_checked ? "stripe_checked=false\n" : ""}`);
         }
         return run2.exit_code;
       }
@@ -31265,7 +31535,8 @@ function planEnv(d, v) {
     [names.secret, v.secretKey],
     [names.publishable, v.publishableKey],
     ...v.liveSecretKey ? [[names.liveSecret, v.liveSecretKey]] : [],
-    ...v.livePublishableKey ? [[names.livePublishable, v.livePublishableKey]] : []
+    ...v.livePublishableKey ? [[names.livePublishable, v.livePublishableKey]] : [],
+    ...v.apiBase ? [["CHECKBOX_API_BASE", v.apiBase]] : []
   ];
   const existing = read(d.root, d.envFile);
   let text = existing ?? "";
@@ -31276,7 +31547,7 @@ function planEnv(d, v) {
     if (re.test(text)) {
       if (!text.match(re)[0].endsWith(`=${val}`)) {
         text = text.replace(re, `${k}=${val}`);
-        added.push(`${k}=${mask(val)}`);
+        added.push(`${k}=${k === "CHECKBOX_API_BASE" ? val : mask(val)}`);
       }
     } else missing.push([k, val]);
   }
@@ -31284,7 +31555,7 @@ function planEnv(d, v) {
     const block = ["# Checkbox (subscription compliance) \u2014 written by `checkbox init`. Secret: never commit this file.", ...missing.map(([k, val]) => `${k}=${val}`)];
     text = `${text}${text && !text.endsWith("\n") ? "\n" : ""}${text ? "\n" : ""}${block.join("\n")}
 `;
-    added.push(...missing.map(([k, val]) => `${k}=${mask(val)}`));
+    added.push(...missing.map(([k, val]) => `${k}=${k === "CHECKBOX_API_BASE" ? val : mask(val)}`));
   }
   if (existing === text) return { file: d.envFile, action: "unchanged", summary: `${d.envFile} already has the Checkbox keys`, added: [] };
   return { file: d.envFile, action: existing === null ? "create" : "modify", summary: `Keys written to ${d.envFile} (${entries.map(([k]) => k).join(", ")})`, contents: text, added };
@@ -31410,7 +31681,8 @@ function saveState(ctx, root, patch) {
 }
 function withEvaluatedAt(c) {
   const t = c.evaluated;
-  return typeof t === "number" && t > 0 ? { evaluated_at: new Date(t * 1e3).toISOString(), ...c } : c;
+  const at = typeof t === "number" && t > 0 ? new Date(t * 1e3).toISOString() : typeof c.evaluated_at === "string" && c.evaluated_at ? c.evaluated_at : null;
+  return { ...c, evaluated: !!at, evaluated_at: at };
 }
 async function ask2(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stderr, terminal: true });
@@ -31585,8 +31857,8 @@ function resultOf2(status, d, session, changes, extra, apiBase) {
     install: session.install,
     stripe: { ...session.stripe, ...extra.stripe ?? {} },
     ...extra.live && Object.keys(extra.live).length ? { live: extra.live } : {},
-    // Round 32 (pilot 31, discovery-agent: "compliance.evaluated" read like a count but is a Unix timestamp): the CLI says
-    // when, as evaluated_at (ISO 8601), next to the API's field.
+    // Round 32 (pilot 31, discovery-agent: "compliance.evaluated" read like a count but is a Unix timestamp); round 34:
+    // evaluated is a boolean, evaluated_at (ISO 8601) says when.
     compliance: session.compliance ? withEvaluatedAt(session.compliance) : session.compliance,
     ...session.go_live ? { go_live: session.go_live } : {},
     steps: session.steps.map((s2) => ({ key: s2.key, status: s2.status, summary: s2.summary })),
@@ -31706,7 +31978,7 @@ var init_init = __esm({
         const dryRun = bool(flags, "dry-run") === true;
         const yes = bool(flags, "yes") === true || ctx.flags.json;
         const out = ctx.out;
-        const apiBase = (ctx.flags.apiBase ?? ctx.env.CHECKBOX_API_BASE ?? ctx.config.load().api_base ?? DEFAULT_API_BASE).replace(/\/+$/, "");
+        const apiBase = (ctx.credentials()?.apiBase ?? ctx.flags.apiBase ?? ctx.env.CHECKBOX_API_BASE ?? ctx.config.load().api_base ?? DEFAULT_API_BASE).replace(/\/+$/, "");
         const d = detectProject(root, ctx.env);
         const state = loadState(ctx, root);
         const remembered = state.facts ?? {};
@@ -31904,7 +32176,7 @@ var init_init = __esm({
           if (token) warnings.push(`This folder is deployed as it is (${d.framework}), so the secret key was not written to a file in it: it is saved in the Checkbox CLI config (\`checkbox plan\`, \`checkbox verify\` use it). Server code that calls the API should read it from your host's secret settings (CHECKBOX_SECRET_KEY).`);
         } else {
           if (token && envTracked) warnings.push(trackedEnvWarning(d.envFile));
-          else if (token) changes.push(planEnv(d, { secretKey: token.secret_key, publishableKey: token.publishable_key, ...token.live_secret_key ? { liveSecretKey: token.live_secret_key } : {}, ...token.live_publishable_key ? { livePublishableKey: token.live_publishable_key } : {} }));
+          else if (token) changes.push(planEnv(d, { secretKey: token.secret_key, publishableKey: token.publishable_key, ...token.live_secret_key ? { liveSecretKey: token.live_secret_key } : {}, ...token.live_publishable_key ? { livePublishableKey: token.live_publishable_key } : {}, ...apiBase !== DEFAULT_API_BASE ? { apiBase } : {} }));
           const gi = planGitignore(d);
           if (gi) changes.push(gi);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkbox-site/cli",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "The checkbox CLI: auto-renewal law and subscription compliance checks (FTC ROSCA, California ARL, New York and other states) for Stripe Checkout params, pages, disclosures and emails, from a terminal, CI or an AI coding agent. Runs offline.",
   "keywords": [
     "checkbox",