@elitedcs/ghl-mcp 3.56.0 → 3.57.0

package/skills/clone-site/references/rights-and-lanes.md

@@ -0,0 +1,72 @@
+# Rights, the two lanes, and how to talk about them
+
+## Why this is step 0 and not a footnote
+
+Two things are true at once:
+
+1. The tool should do what the user asks. A user who owns a page, or whose client owns it, has a completely ordinary job — migrating a site — and refusing it produces a worse result and a worse experience. When that refusal happened in the field, the fallback rebuild came back "not even close."
+2. Copying a page you have no rights to is a real exposure — the layout and copy, other people's testimonials and photographs, trademarks, and advertising claims that were substantiated by a different business.
+
+Asking once, at the start, resolves both. The answer is recorded, the user owns their declaration, and the flow adapts. What you must not do is stay silent and let the request fail later, or ask and then keep re-litigating it.
+
+## The question (ask it in these words)
+
+> **Before I copy this page — who owns it, or what permission do you have to copy it?**
+> 1. **I own it**
+> 2. **My client owns it and authorized the migration**
+> 3. **I have written permission from the owner**
+> 4. **None of these** — I found the page and want something like it
+>
+> I'm not checking this, and I'm not going to argue with your answer — it goes in the run report so it's on the record, and it decides which of two ways I build this.
+
+Ask it once. Do not ask for evidence. Do not ask again later in the run.
+
+## Recording
+
+The answer becomes `--rights <own|client-authorized|written-permission|none>` on `mirror.mjs`, with the user's own words in `--declared`. It is written into `reports/run-report.json` and reprinted in the header of `REVIEW-REQUIRED.md`:
+
+```
+| Rights declared | **client-authorized** — "Client owns northgate-wellness.com, moving to a new host" |
+| Declaration recorded | 2026-07-30T17:18:49.094Z (user's statement; this tool does not verify ownership) |
+```
+
+`mirror.mjs` exits 2 if `--rights` is missing and exits 3 on `none`. The gate is structural: it cannot be skipped because you were in a hurry.
+
+## Lane routing
+
+| Answer | Lane | What gets copied |
+|---|---|---|
+| `own` | Full clone | Everything — bytes, media, CSS, JS |
+| `client-authorized` | Full clone | Everything |
+| `written-permission` | Full clone | Everything |
+| `none` | **Style clone** | Design tokens and structure only. No bytes, images, video or copy. |
+
+## When the user has no rights but wants the full copy anyway
+
+Say it once, plainly, then move:
+
+> I can't do a byte-for-byte copy of a page you don't have rights to — that's their layout, their copy, their customers' testimonials and photos, and any claims on the page were substantiated by their business, not yours.
+>
+> Here's the thing though: what I *can* do is usually closer to what you want. I'll pull the page's actual design system — the exact palette, type scale, spacing rhythm, radii and section structure — and rebuild on that with your copy and your images. That's not me redrawing it from memory, which is what makes those rebuilds look cheap. It's the real design with your business in it.
+
+Then run the style lane. Do not moralize, do not repeat it, do not add disclaimers to every later message.
+
+If they come back with "actually, my client owns it" — take the new answer, record it (both answers, in order, in the `--declared` note), and proceed on the full-clone lane. It is their declaration to make.
+
+## What the tool is and is not
+
+**Is:** a copy engine with a recorded declaration and an over-inclusive liability report.
+
+**Is not:** a rights verifier, a lawyer, or a filter on what the user may publish. `REVIEW-REQUIRED.md` says this in its own footer, and you should say the same if asked.
+
+## Style-lane quality bar
+
+The style lane is a first-class mode, not a consolation prize. A style-lane rebuild is done when:
+
+- the palette, font stack, type scale, spacing values and radii come from `design-tokens.json`, not from taste
+- the section order and density match the table in `DESIGN-SYSTEM.md`
+- every line of copy is original
+- every image is the client's own or licensed, with the source recorded
+- `audit.mjs` has been run on the finished page and shown to the user
+
+If the source is a client-rendered SPA, `extract-design.mjs` reports `spaShell: true` and the structure table will be empty. Open the page in a browser and record the section order by eye before rebuilding — do not guess.

package/skills/clone-site/scripts/audit.mjs

@@ -0,0 +1,364 @@
+#!/usr/bin/env node
+/**
+ * audit.mjs — the mandatory pre-launch REVIEW REQUIRED report.
+ *
+ * Runs on every clone, clean or not. Nothing here is auto-fixed: the whole
+ * point is to surface what belongs to the ORIGINAL business so a human decides.
+ * Three review classes plus the exclusions:
+ *
+ *   1. MUST REPOINT   — destinations that route leads, bookings or money
+ *   2. REVIEW: other people's content — names, addresses, testimonials, likenesses
+ *   3. REVIEW: inherited + regulated claims — FDA/medical, ratings, counts, awards, pricing
+ *
+ * Usage:
+ *   node audit.mjs --dir <clone-dir> [--facts facts.json] [--out REVIEW-REQUIRED.md]
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parseArgs, readJson, walk, isTextFile, ext, humanBytes, nowIso, resolveRun } from "./lib.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.dir) {
+  console.error("usage: audit.mjs --dir <clone-dir> [--facts facts.json] [--out REVIEW-REQUIRED.md]");
+  process.exit(1);
+}
+const RUN = resolveRun(String(args.dir));
+const DIR = RUN.site;
+const REPORTS = RUN.reports;
+fs.mkdirSync(REPORTS, { recursive: true });
+const OUT = path.resolve(String(args.out && args.out !== true ? args.out : path.join(REPORTS, "REVIEW-REQUIRED.md")));
+const facts = args.facts && args.facts !== true ? readJson(path.resolve(String(args.facts))) : {};
+
+const RULES = [
+  // ---- 1. MUST REPOINT ----------------------------------------------------
+  { s: "repoint", id: "form-action", label: "Form action", re: /<form[^>]*\saction=["']([^"']+)["']/gi, why: "Submissions go wherever this points — the original owner's CRM until you change it." },
+  { s: "repoint", id: "webhook", label: "Webhook / API endpoint", re: /https?:\/\/[^\s"'`)]*(?:webhook|hooks?\.|leadconnector|msgsndr|zapier|make\.com|n8n|formspree|netlify\.app\/\.netlify\/functions)[^\s"'`)]*/gi, why: "A live lead destination belonging to someone else." },
+  { s: "repoint", id: "api-path", label: "Same-site API path", re: /["'`](\/api\/[A-Za-z0-9._/-]+)["'`]/g, why: "The clone's form posts here; the backing function must exist on YOUR host or submissions vanish." },
+  { s: "repoint", id: "stripe-key", label: "Stripe publishable key", re: /pk_(?:live|test)_[A-Za-z0-9]{10,}/g, why: "Charges would land in the original owner's Stripe account. Never ship this." },
+  { s: "repoint", id: "payment-link", label: "Payment / checkout link", re: /https?:\/\/(?:buy\.stripe\.com|checkout\.stripe\.com|book\.stripe\.com|www\.paypal\.com\/[^\s"'`)]*|squareup\.com\/[^\s"'`)]*)[^\s"'`)]*/gi, why: "Money flows to whoever owns this link." },
+  { s: "repoint", id: "booking", label: "Booking / calendar embed", re: /https?:\/\/[^\s"'`)]*(?:calendly\.com|acuityscheduling\.com|api\.leadconnectorhq\.com\/widget\/(?:booking|appointment)|widget\.leadconnectorhq|cal\.com)[^\s"'`)]*/gi, why: "Appointments book onto the original owner's calendar." },
+  { s: "repoint", id: "ga", label: "Google Analytics / GTM ID", re: /\b(?:G-[A-Z0-9]{6,12}|UA-\d{4,}-\d+|GTM-[A-Z0-9]{4,})\b/g, why: "Your client's traffic reports into a stranger's analytics property." },
+  { s: "repoint", id: "meta-pixel", label: "Meta pixel ID", re: /fbq\(\s*["']init["']\s*,\s*["'](\d{8,})["']/gi, why: "Conversions attribute to the original owner's ad account." },
+  { s: "repoint", id: "other-pixel", label: "Other tracking (TikTok/Clarity/Hotjar)", re: /(?:ttq\.load\(\s*["'][^"']+["']|clarity\.ms\/tag\/[A-Za-z0-9]+|static\.hotjar\.com\/c\/hotjar-\d+)/gi, why: "Third-party tracking still wired to the original account." },
+  { s: "repoint", id: "financing", label: "Consumer financing link", re: /https?:\/\/[^\s"'`)]*(?:mysynchrony\.com|greensky|wellsfargo\.com\/.*(?:credit|financing)|affirm\.com|klarna\.com|acimacredit|foundationfinance)[^\s"'`)]*/gi, why: "A merchant-specific financing application. Applications and the resulting revenue are tied to the ORIGINAL owner's merchant account." },
+  { s: "repoint", id: "review-widget", label: "Reviews widget", re: /https?:\/\/[^\s"'`)]*(?:elfsight\.com|trustindex|birdeye|podium\.com|reviewsonmyweb|shopperapproved)[^\s"'`)]*/gi, why: "Loads the ORIGINAL business's reviews at runtime. No file edit changes it — it must be repointed or removed." },
+  { s: "repoint", id: "chat", label: "Chat widget", re: /https?:\/\/[^\s"'`)]*(?:tawk\.to|intercom|drift\.com|crisp\.chat|tidio)[^\s"'`)]*/gi, why: "Chats route to the original owner's inbox." },
+  { s: "repoint", id: "mailto", label: "mailto: address", re: /mailto:([^\s"'`)<]+)/gi, why: "Emails go to the original business." },
+  { s: "repoint", id: "tel", label: "tel: number", re: /tel:\+?[\d().\s-]{7,}/gi, why: "Calls ring the original business." },
+  { s: "repoint", id: "social", label: "Social / review profile", re: /https?:\/\/(?:www\.)?(?:facebook\.com|instagram\.com|tiktok\.com|linkedin\.com|youtube\.com|g\.page|goo\.gl\/maps|maps\.app\.goo\.gl|yelp\.com)\/[^\s"'`)]*/gi, why: "Links to the original owner's accounts and reviews." },
+  { s: "repoint", id: "map", label: "Map embed", re: /https?:\/\/(?:www\.)?google\.com\/maps\/embed[^\s"'`)]*/gi, why: "Shows the original business's location." },
+
+  // ---- 2. OTHER PEOPLE'S CONTENT -----------------------------------------
+  { scope: "text", s: "people", id: "street", label: "Street address", re: /\b\d{2,6}\s+(?:[NSEW]\.?\s+)?[A-Z][A-Za-z.'-]+(?:\s+[A-Z][A-Za-z.'-]+){0,3}\s+(?:St|Street|Ave|Avenue|Blvd|Boulevard|Rd|Road|Dr|Drive|Ln|Lane|Way|Pkwy|Parkway|Hwy|Highway|Ct|Court|Ste|Suite|Unit|Pl|Place|Ter|Terrace)\b\.?(?:\s*(?:Ste|Suite|Unit|#)\s*[A-Za-z0-9-]+)?/g, why: "A physical address belonging to the original business." },
+  { scope: "text", s: "people", id: "testimonial", label: "Testimonial / review text", re: /(?:"[^"]{40,400}"|“[^”]{40,400}”|‘[^’]{40,400}’)/g, why: "Quoted words from the original business's clients — their statement, not your client's.", limit: 12 },
+  { scope: "text", s: "people", id: "attribution", label: "Testimonial attribution", re: /(?:^|[>\s])[-—–]\s*[A-Z][a-z]+(?:\s+[A-Z][a-z.]+)?\s*(?:,|\||$)/gm, why: "A named person credited with a quote." },
+  { s: "people", id: "person-image", label: "Person / before-after image", re: /["'`][^"'`\s]*(?:before|after|patient|client|testimonial|headshot|staff|team|owner|founder|dr[-_])[^"'`\s]*\.(?:png|jpe?g|webp|avif|gif)["'`]/gi, why: "A real person's likeness. Before/after health images carry the heaviest liability." },
+  { s: "people", id: "license-number", label: "Contractor / professional license number", re: /\b(?:ROC|CSLB|LIC|License|Lic\.?|Reg(?:istration)?|Permit)[\s#:]*\u00a0?\s*\d{4,10}\b/gi, why: "A state license or registration number issued to the ORIGINAL business. Publishing it under another name misrepresents licensure — in the trades and in health care this is the single most serious item on the page." },
+  { scope: "text", s: "people", id: "credential", label: "Named credential", re: /\b[A-Z][a-z]+\s+[A-Z][a-z]+,\s*(?:MD|DO|DC|RN|NP|PA-C|DDS|LMT|PhD|MSN|FNP)\b/g, why: "A licensed professional's name and credential." },
+
+  // ---- 3. INHERITED + REGULATED CLAIMS ------------------------------------
+  { scope: "text", s: "claims", id: "regulated", label: "REGULATED health/efficacy claim", re: /\b(?:FDA[- ](?:approved|cleared|registered)|FDA\b|clinically (?:proven|shown|validated|tested)|doctor[- ]recommended|physician[- ]recommended|board[- ]certified|medically (?:proven|supervised)|prescription[- ]strength|HIPAA[- ]compliant|scientifically proven|cures?\b|treats?\s+(?:your\s+)?(?:disease|cancer|diabetes)|no side effects|100%\s*(?:safe|effective)|guaranteed results|pain[- ]free guarantee)/gi, why: "A regulated claim about a DIFFERENT business's product, staff or protocol. Substantiation does not transfer with a copy-paste — FTC/FDA exposure sits with whoever publishes it." },
+  { scope: "text", s: "claims", id: "rating", label: "Star rating / review count", re: /\b(?:[45](?:\.\d)?\s*(?:\/\s*5|stars?|-star)|\d{1,3}(?:,\d{3})*\+?\s*(?:5[- ]star\s*)?reviews?)\b/gi, why: "Ratings earned by the original business." },
+  { scope: "text", s: "claims", id: "count", label: "Client / result count", re: /\b\d{1,3}(?:,\d{3})*\+?\s*(?:happy\s+)?(?:clients?|customers?|patients?|members?|sessions?|treatments?|pounds?\s+lost|lbs\s+lost)\b/gi, why: "A results claim about the original business's book of business." },
+  { scope: "text", s: "claims", id: "tenure", label: "Years in business", re: /\b(?:since\s+(?:19|20)\d{2}|(?:over\s+)?\d{1,2}\+?\s*years?\s+(?:of\s+)?(?:experience|in business|serving))\b/gi, why: "Tenure the new business has not earned." },
+  { scope: "text", s: "claims", id: "award", label: "Award / superlative", re: /\b(?:#1\b|number one\b|award[- ]winning|best of\s+[A-Z][a-z]+|voted\s+best|top[- ]rated)\b/gi, why: "An award or superlative belonging to the original business." },
+  { scope: "text", s: "claims", id: "price", label: "Price / offer amount", re: /\$\s?\d{1,3}(?:,\d{3})*(?:\.\d{2})?(?:\s*(?:\/|per\s)\s*(?:mo|month|session|visit|year))?/g, why: "The original business's pricing — confirm it matches your client's offer.", limit: 15 },
+  { scope: "text", s: "claims", id: "guarantee", label: "Guarantee / refund promise", re: /\b(?:\d{1,3}[- ]day\s+(?:money[- ]back\s+)?guarantee|money[- ]back guarantee|risk[- ]free|full refund)\b/gi, why: "A promise your client must actually be willing and able to honor." },
+];
+
+const files = walk(DIR).filter((f) => isTextFile(f));
+
+const findings = new Map(); // key: section|id -> { rule, hits: [{file,line,snippet}] }
+const MAX_PER_RULE = 25;
+
+/** Visible page text: what a human actually reads. */
+function visibleText(html) {
+  return html
+    .replace(/<script[\s\S]*?<\/script>/gi, " ")
+    .replace(/<style[\s\S]*?<\/style>/gi, " ")
+    .replace(/<!--[\s\S]*?-->/g, " ")
+    .replace(/<[^>]+>/g, " ")
+    .replace(/&nbsp;/gi, " ")
+    .replace(/&amp;/gi, "&")
+    .replace(/&quot;/gi, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/[ \t]+/g, " ");
+}
+
+/**
+ * Copy that lives inside a JS bundle (SPAs keep every headline there).
+ * Keeps human sentences, drops minified code: needs spaces, letters, and no
+ * code punctuation.
+ */
+function jsCopyStrings(js) {
+  const out = [];
+  for (const m of js.matchAll(/(["'`])((?:\\.|(?!\1)[^\\\r\n]){25,400})\1/g)) {
+    const v = m[2];
+    if (!/[A-Za-z]{3}/.test(v)) continue;
+    if ((v.match(/ /g) || []).length < 4) continue;
+    if (/[{}=;<>]|\)\s*\{|=>|function |var |const |return /.test(v)) continue;
+    out.push(v);
+  }
+  return out.join("\n");
+}
+
+for (const file of files) {
+  const rel = path.relative(DIR, file);
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    continue;
+  }
+  const e = ext(file);
+  // Text-scope rules read what a visitor reads — never minified internals.
+  const derived =
+    [".html", ".htm"].includes(e) ? visibleText(text) :
+    [".js", ".mjs"].includes(e) ? jsCopyStrings(text) :
+    "";
+  const lineStarts = [];
+  {
+    let idx = 0;
+    for (const line of text.split("\n")) {
+      lineStarts.push(idx);
+      idx += line.length + 1;
+    }
+  }
+  const lineOf = (pos) => {
+    let lo = 0, hi = lineStarts.length - 1, ans = 0;
+    while (lo <= hi) {
+      const mid = (lo + hi) >> 1;
+      if (lineStarts[mid] <= pos) { ans = mid; lo = mid + 1; } else hi = mid - 1;
+    }
+    return ans + 1;
+  };
+
+  for (const rule of RULES) {
+    const scope = rule.scope || "raw";
+    const haystack = scope === "text" ? derived : text;
+    if (!haystack) continue;
+    const key = `${rule.s}|${rule.id}`;
+    const re = new RegExp(rule.re.source, rule.re.flags.includes("g") ? rule.re.flags : rule.re.flags + "g");
+    let m;
+    const seen = new Set();
+    while ((m = re.exec(haystack)) !== null) {
+      if (m[0].length === 0) { re.lastIndex++; continue; }
+      const raw = (m[1] || m[0]).trim();
+      const snippet = raw.replace(/\s+/g, " ").slice(0, 160);
+      if (!snippet || seen.has(snippet)) continue;
+      seen.add(snippet);
+      if (!findings.has(key)) findings.set(key, { rule, hits: [] });
+      const rec = findings.get(key);
+      if (rec.hits.length >= (rule.limit || MAX_PER_RULE)) continue;
+      const pos = scope === "text" ? text.indexOf(raw.slice(0, 40)) : m.index;
+      rec.hits.push({ file: rel, line: lineOf(pos >= 0 ? pos : 0), snippet });
+    }
+  }
+}
+
+// ---- context from the mirror + substitution runs ---------------------------
+let mirror = null, subs = null;
+try { mirror = readJson(path.join(REPORTS, "run-report.json")); } catch {}
+try { subs = readJson(path.join(REPORTS, "substitution-report.json")); } catch {}
+
+const SECTIONS = [
+  { key: "repoint", title: "1. MUST REPOINT — leads, bookings and money", lead: "Every item below still points at the ORIGINAL owner. Anything left unchanged sends your client's leads, appointments, tracking or payments to someone else." },
+  { key: "people", title: "2. REVIEW — other people's content", lead: "Names, addresses, likenesses and words that belong to the original business and its clients. Replace or remove; do not simply delete blocks you have not looked at." },
+  { key: "claims", title: "3. REVIEW — inherited and regulated claims", lead: "Factual assertions about a DIFFERENT business. Regulated health/efficacy claims are the highest-risk items on this page: the substantiation does not travel with the copy." },
+];
+
+const md = [];
+md.push("# REVIEW REQUIRED — before this page takes real traffic");
+md.push("");
+md.push(`Generated ${nowIso()} by GHL Command clone-site.`);
+md.push("");
+if (mirror) {
+  md.push("| | |");
+  md.push("|---|---|");
+  md.push(`| Source | ${mirror.source?.url || "(unknown)"} |`);
+  md.push(`| Rights declared | **${mirror.rights?.declaration || "(not recorded)"}**${mirror.rights?.note ? ` — "${mirror.rights.note}"` : ""} |`);
+  md.push(`| Declaration recorded | ${mirror.generatedAt} (user's statement; this tool does not verify ownership) |`);
+  md.push(`| Files mirrored | ${mirror.inventory?.files ?? "?"} (${mirror.inventory?.totalHuman ?? "?"}) |`);
+  md.push("");
+}
+
+let totalFindings = 0;
+for (const sec of SECTIONS) {
+  const recs = [...findings.values()].filter((f) => f.rule.s === sec.key);
+  md.push(`## ${sec.title}`);
+  md.push("");
+  md.push(sec.lead);
+  md.push("");
+  if (recs.length === 0) {
+    md.push("_Nothing detected._ Detection is pattern-based — read the page yourself before launch.");
+    md.push("");
+    continue;
+  }
+  for (const rec of recs) {
+    totalFindings += rec.hits.length;
+    md.push(`### ${rec.rule.label} (${rec.hits.length}${rec.hits.length >= (rec.rule.limit || MAX_PER_RULE) ? "+" : ""})`);
+    md.push("");
+    md.push(`${rec.rule.why}`);
+    md.push("");
+    for (const h of rec.hits) md.push(`- \`${h.file}:${h.line}\` — ${h.snippet.replace(/\|/g, "\\|")}`);
+    md.push("");
+  }
+}
+
+// Internal navigation that has no page in this clone. Standard for a single-page
+// mirror, and the first thing a client clicks. Worth naming explicitly.
+const dangling = new Set();
+// After a rebrand, internal nav is often absolute on the NEW domain. Treat those
+// hosts as our own, or every internal link looks "external" and goes unchecked.
+const ownHosts = new Set();
+try {
+  const subsForHosts = readJson(path.join(REPORTS, "substitution-report.json"));
+  for (const h of subsForHosts.hits || []) {
+    if (!/^domain/.test(h.label) || !h.new) continue;
+    const host = String(h.new).replace(/^https?:\/\//, "").replace(/\/.*$/, "").toLowerCase();
+    if (host) {
+      ownHosts.add(host);
+      ownHosts.add(host.replace(/^www\./, ""));
+      ownHosts.add("www." + host.replace(/^www\./, ""));
+    }
+  }
+} catch {}
+
+for (const file of files) {
+  if (![".html", ".htm"].includes(ext(file))) continue;
+  const text = fs.readFileSync(file, "utf8");
+  for (const m of text.matchAll(/href=["']([^"'#]+)["']/gi)) {
+    let href = m[1].trim();
+    if (/^(mailto:|tel:|javascript:|data:)/i.test(href)) continue;
+    let p2 = null;
+    if (href.startsWith("/")) p2 = href;
+    else if (/^https?:\/\//i.test(href)) {
+      let u = null;
+      try { u = new URL(href); } catch { continue; }
+      if (!ownHosts.has(u.hostname.toLowerCase())) continue; // truly external — the repoint rules cover it
+      p2 = u.pathname;
+    }
+    else if (!href.includes(":")) p2 = "/" + href;
+    if (!p2) continue;
+    p2 = p2.split("?")[0].replace(/\/+$/, "");
+    if (!p2 || p2 === "") continue;
+    const rel = p2.replace(/^\/+/, "");
+    const candidates = [rel, rel + ".html", path.posix.join(rel, "index.html")];
+    if (!candidates.some((c) => fs.existsSync(path.join(DIR, c)))) dangling.add(p2);
+  }
+}
+
+// Brand baked into image files. Text substitution cannot reach pixels: the logo,
+// and any graphic carrying the old phone number or URL, still belong to the
+// original business after a "clean" rebrand. Live-caught 2026-07-30 — the header
+// logo still read the original name, phone and domain on an otherwise clean clone.
+const loose = (v) => String(v).toLowerCase().replace(/[^a-z0-9]+/g, "");
+const brandedAssets = [];
+try {
+  const mirrorForAssets = readJson(path.join(REPORTS, "run-report.json"));
+  const subsForAssets = (() => { try { return readJson(path.join(REPORTS, "substitution-report.json")); } catch { return { hits: [] }; } })();
+  const needles = [...new Set((subsForAssets.hits || [])
+    .map((h) => loose(h.old))
+    .filter((v) => v.length >= 6))];
+  const imageExt = [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg", ".avif", ".bmp", ".pdf"];
+  for (const a of mirrorForAssets.assets || []) {
+    if (!imageExt.includes(ext(a.local))) continue;
+    const base = loose(path.posix.basename(a.local));
+    const brandHit = needles.find((n) => base.includes(n));
+    const looksIdentity = /logo|header|banner|watermark|letterhead|business.?card|truck|van|sign/.test(path.posix.basename(a.local).toLowerCase());
+    if (brandHit || looksIdentity) {
+      brandedAssets.push({ local: a.local, reason: brandHit ? `filename carries the old brand ("${brandHit}")` : "filename suggests an identity asset (logo/banner/signage)" });
+    }
+  }
+} catch {}
+if (brandedAssets.length) {
+  md.push("### Brand baked into image files (" + brandedAssets.length + ")");
+  md.push("");
+  md.push("**Substitution cannot edit pixels.** These image files carry the original business's name, phone number, web address or signage inside the artwork. On a rebranded page the text reads correctly while the logo still advertises the original company — the single most visible way a clone gives itself away, and a straight trademark problem if it ships. Replace the logo and any graphic containing contact details with the new client's artwork.");
+  md.push("");
+  for (const b of brandedAssets.slice(0, 40)) md.push(`- \`${b.local}\` — ${b.reason}`);
+  if (brandedAssets.length > 40) md.push(`- …and ${brandedAssets.length - 40} more`);
+  md.push("");
+}
+
+md.push("## 4. Excluded, oversized and unresolved");
+md.push("");
+if (dangling.size) {
+  md.push(`**Internal links with no page in this clone:** ${dangling.size}`);
+  md.push("");
+  md.push("This is normal for a single-page mirror — the nav still lists the whole original site. Either mirror those pages too, point the links somewhere real, or trim the nav. As it stands they are the first thing a visitor clicks and the first thing that 404s.");
+  md.push("");
+  for (const d of [...dangling].sort().slice(0, 30)) md.push(`- ${d}`);
+  if (dangling.size > 30) md.push(`- …and ${dangling.size - 30} more`);
+  md.push("");
+}
+if (mirror) {
+  if ((mirror.oversized || []).length) {
+    md.push(`**Oversized — NOT downloaded (route to object storage, never hot-link the source):** ${mirror.oversized.length}`);
+    md.push("");
+    for (const o of mirror.oversized) md.push(`- ${humanBytes(o.bytes)} — ${o.url}`);
+    md.push("");
+  }
+  if ((mirror.skippedForeignOrMissing || []).length) {
+    md.push(`**Excluded — the origin served HTML where an asset should be** (missing, or another tenant's file): ${mirror.skippedForeignOrMissing.length}`);
+    md.push("");
+    for (const s of mirror.skippedForeignOrMissing.slice(0, 25)) md.push(`- ${s.url}`);
+    md.push("");
+  }
+  if ((mirror.failed || []).length) {
+    md.push(`**Failed to fetch:** ${mirror.failed.length}`);
+    md.push("");
+    for (const f of mirror.failed.slice(0, 25)) md.push(`- [${f.status}] ${f.url}`);
+    md.push("");
+  }
+  if ((mirror.externalRefsLeft || []).length) {
+    md.push(`**Third-party references left as-is** (fonts, SDKs, analytics loaders): ${mirror.externalRefsLeft.length}`);
+    md.push("");
+    for (const u of mirror.externalRefsLeft.slice(0, 25)) md.push(`- ${u}`);
+    md.push("");
+  }
+}
+if (subs) {
+  const noReplacement = (subs.hits || []).filter((h) => !h.new);
+  if (noReplacement.length) {
+    md.push(`**Present in the page with no replacement value supplied:** ${noReplacement.length}`);
+    md.push("");
+    for (const h of noReplacement) md.push(`- ${h.label}: \`${h.old}\` ×${h.total}`);
+    md.push("");
+  }
+}
+if (!mirror && !subs) {
+  md.push("_No mirror/substitution reports found in this directory._");
+  md.push("");
+}
+
+md.push("---");
+md.push("");
+md.push("**Everything above describes the original business, not your client. Replace or remove each item before this page takes real traffic.**");
+md.push("");
+md.push("This report is pattern-based and deliberately over-inclusive. It is not legal advice, and it is not a rights check: you declared your authorization at step 0 and you are responsible for that declaration and for what you publish.");
+md.push("");
+
+fs.writeFileSync(OUT, md.join("\n"));
+
+// ---- console summary -------------------------------------------------------
+const counts = {};
+for (const sec of SECTIONS) {
+  counts[sec.key] = [...findings.values()].filter((f) => f.rule.s === sec.key).reduce((n, f) => n + f.hits.length, 0);
+}
+const regulated = findings.get("claims|regulated");
+const out = [];
+out.push("");
+out.push("PRE-LAUNCH AUDIT COMPLETE");
+out.push(`  MUST REPOINT (leads/bookings/money) : ${counts.repoint}`);
+out.push(`  Other people's content             : ${counts.people}`);
+out.push(`  Inherited + regulated claims       : ${counts.claims}`);
+if (regulated) out.push(`  ⚠ REGULATED CLAIMS FLAGGED       : ${regulated.hits.length} — highest-risk items on the page`);
+if (brandedAssets.length) out.push(`  ⚠ Images with the ORIGINAL brand baked in (logo etc.): ${brandedAssets.length} — substitution cannot fix these`);
+if (dangling.size) out.push(`  Internal links with no page in this clone: ${dangling.size}`);
+out.push(`  report: ${OUT}`);
+out.push("");
+out.push("  Show the user this report before deploying. Never auto-delete a finding.");
+out.push("");
+console.log(out.join("\n"));