@elitedcs/ghl-mcp 3.56.0 → 3.58.0

package/skills/clone-site/scripts/audit.mjs

@@ -0,0 +1,364 @@
+#!/usr/bin/env node
+/**
+ * audit.mjs — the mandatory pre-launch REVIEW REQUIRED report.
+ *
+ * Runs on every clone, clean or not. Nothing here is auto-fixed: the whole
+ * point is to surface what belongs to the ORIGINAL business so a human decides.
+ * Three review classes plus the exclusions:
+ *
+ *   1. MUST REPOINT   — destinations that route leads, bookings or money
+ *   2. REVIEW: other people's content — names, addresses, testimonials, likenesses
+ *   3. REVIEW: inherited + regulated claims — FDA/medical, ratings, counts, awards, pricing
+ *
+ * Usage:
+ *   node audit.mjs --dir <clone-dir> [--facts facts.json] [--out REVIEW-REQUIRED.md]
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parseArgs, readJson, walk, isTextFile, ext, humanBytes, nowIso, resolveRun } from "./lib.mjs";
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.dir) {
+  console.error("usage: audit.mjs --dir <clone-dir> [--facts facts.json] [--out REVIEW-REQUIRED.md]");
+  process.exit(1);
+}
+const RUN = resolveRun(String(args.dir));
+const DIR = RUN.site;
+const REPORTS = RUN.reports;
+fs.mkdirSync(REPORTS, { recursive: true });
+const OUT = path.resolve(String(args.out && args.out !== true ? args.out : path.join(REPORTS, "REVIEW-REQUIRED.md")));
+const facts = args.facts && args.facts !== true ? readJson(path.resolve(String(args.facts))) : {};
+
+const RULES = [
+  // ---- 1. MUST REPOINT ----------------------------------------------------
+  { s: "repoint", id: "form-action", label: "Form action", re: /<form[^>]*\saction=["']([^"']+)["']/gi, why: "Submissions go wherever this points — the original owner's CRM until you change it." },
+  { s: "repoint", id: "webhook", label: "Webhook / API endpoint", re: /https?:\/\/[^\s"'`)]*(?:webhook|hooks?\.|leadconnector|msgsndr|zapier|make\.com|n8n|formspree|netlify\.app\/\.netlify\/functions)[^\s"'`)]*/gi, why: "A live lead destination belonging to someone else." },
+  { s: "repoint", id: "api-path", label: "Same-site API path", re: /["'`](\/api\/[A-Za-z0-9._/-]+)["'`]/g, why: "The clone's form posts here; the backing function must exist on YOUR host or submissions vanish." },
+  { s: "repoint", id: "stripe-key", label: "Stripe publishable key", re: /pk_(?:live|test)_[A-Za-z0-9]{10,}/g, why: "Charges would land in the original owner's Stripe account. Never ship this." },
+  { s: "repoint", id: "payment-link", label: "Payment / checkout link", re: /https?:\/\/(?:buy\.stripe\.com|checkout\.stripe\.com|book\.stripe\.com|www\.paypal\.com\/[^\s"'`)]*|squareup\.com\/[^\s"'`)]*)[^\s"'`)]*/gi, why: "Money flows to whoever owns this link." },
+  { s: "repoint", id: "booking", label: "Booking / calendar embed", re: /https?:\/\/[^\s"'`)]*(?:calendly\.com|acuityscheduling\.com|api\.leadconnectorhq\.com\/widget\/(?:booking|appointment)|widget\.leadconnectorhq|cal\.com)[^\s"'`)]*/gi, why: "Appointments book onto the original owner's calendar." },
+  { s: "repoint", id: "ga", label: "Google Analytics / GTM ID", re: /\b(?:G-[A-Z0-9]{6,12}|UA-\d{4,}-\d+|GTM-[A-Z0-9]{4,})\b/g, why: "Your client's traffic reports into a stranger's analytics property." },
+  { s: "repoint", id: "meta-pixel", label: "Meta pixel ID", re: /fbq\(\s*["']init["']\s*,\s*["'](\d{8,})["']/gi, why: "Conversions attribute to the original owner's ad account." },
+  { s: "repoint", id: "other-pixel", label: "Other tracking (TikTok/Clarity/Hotjar)", re: /(?:ttq\.load\(\s*["'][^"']+["']|clarity\.ms\/tag\/[A-Za-z0-9]+|static\.hotjar\.com\/c\/hotjar-\d+)/gi, why: "Third-party tracking still wired to the original account." },
+  { s: "repoint", id: "financing", label: "Consumer financing link", re: /https?:\/\/[^\s"'`)]*(?:mysynchrony\.com|greensky|wellsfargo\.com\/.*(?:credit|financing)|affirm\.com|klarna\.com|acimacredit|foundationfinance)[^\s"'`)]*/gi, why: "A merchant-specific financing application. Applications and the resulting revenue are tied to the ORIGINAL owner's merchant account." },
+  { s: "repoint", id: "review-widget", label: "Reviews widget", re: /https?:\/\/[^\s"'`)]*(?:elfsight\.com|trustindex|birdeye|podium\.com|reviewsonmyweb|shopperapproved)[^\s"'`)]*/gi, why: "Loads the ORIGINAL business's reviews at runtime. No file edit changes it — it must be repointed or removed." },
+  { s: "repoint", id: "chat", label: "Chat widget", re: /https?:\/\/[^\s"'`)]*(?:tawk\.to|intercom|drift\.com|crisp\.chat|tidio)[^\s"'`)]*/gi, why: "Chats route to the original owner's inbox." },
+  { s: "repoint", id: "mailto", label: "mailto: address", re: /mailto:([^\s"'`)<]+)/gi, why: "Emails go to the original business." },
+  { s: "repoint", id: "tel", label: "tel: number", re: /tel:\+?[\d().\s-]{7,}/gi, why: "Calls ring the original business." },
+  { s: "repoint", id: "social", label: "Social / review profile", re: /https?:\/\/(?:www\.)?(?:facebook\.com|instagram\.com|tiktok\.com|linkedin\.com|youtube\.com|g\.page|goo\.gl\/maps|maps\.app\.goo\.gl|yelp\.com)\/[^\s"'`)]*/gi, why: "Links to the original owner's accounts and reviews." },
+  { s: "repoint", id: "map", label: "Map embed", re: /https?:\/\/(?:www\.)?google\.com\/maps\/embed[^\s"'`)]*/gi, why: "Shows the original business's location." },
+
+  // ---- 2. OTHER PEOPLE'S CONTENT -----------------------------------------
+  { scope: "text", s: "people", id: "street", label: "Street address", re: /\b\d{2,6}\s+(?:[NSEW]\.?\s+)?[A-Z][A-Za-z.'-]+(?:\s+[A-Z][A-Za-z.'-]+){0,3}\s+(?:St|Street|Ave|Avenue|Blvd|Boulevard|Rd|Road|Dr|Drive|Ln|Lane|Way|Pkwy|Parkway|Hwy|Highway|Ct|Court|Ste|Suite|Unit|Pl|Place|Ter|Terrace)\b\.?(?:\s*(?:Ste|Suite|Unit|#)\s*[A-Za-z0-9-]+)?/g, why: "A physical address belonging to the original business." },
+  { scope: "text", s: "people", id: "testimonial", label: "Testimonial / review text", re: /(?:"[^"]{40,400}"|“[^”]{40,400}”|‘[^’]{40,400}’)/g, why: "Quoted words from the original business's clients — their statement, not your client's.", limit: 12 },
+  { scope: "text", s: "people", id: "attribution", label: "Testimonial attribution", re: /(?:^|[>\s])[-—–]\s*[A-Z][a-z]+(?:\s+[A-Z][a-z.]+)?\s*(?:,|\||$)/gm, why: "A named person credited with a quote." },
+  { s: "people", id: "person-image", label: "Person / before-after image", re: /["'`][^"'`\s]*(?:before|after|patient|client|testimonial|headshot|staff|team|owner|founder|dr[-_])[^"'`\s]*\.(?:png|jpe?g|webp|avif|gif)["'`]/gi, why: "A real person's likeness. Before/after health images carry the heaviest liability." },
+  { s: "people", id: "license-number", label: "Contractor / professional license number", re: /\b(?:ROC|CSLB|LIC|License|Lic\.?|Reg(?:istration)?|Permit)[\s#:]*\u00a0?\s*\d{4,10}\b/gi, why: "A state license or registration number issued to the ORIGINAL business. Publishing it under another name misrepresents licensure — in the trades and in health care this is the single most serious item on the page." },
+  { scope: "text", s: "people", id: "credential", label: "Named credential", re: /\b[A-Z][a-z]+\s+[A-Z][a-z]+,\s*(?:MD|DO|DC|RN|NP|PA-C|DDS|LMT|PhD|MSN|FNP)\b/g, why: "A licensed professional's name and credential." },
+
+  // ---- 3. INHERITED + REGULATED CLAIMS ------------------------------------
+  { scope: "text", s: "claims", id: "regulated", label: "REGULATED health/efficacy claim", re: /\b(?:FDA[- ](?:approved|cleared|registered)|FDA\b|clinically (?:proven|shown|validated|tested)|doctor[- ]recommended|physician[- ]recommended|board[- ]certified|medically (?:proven|supervised)|prescription[- ]strength|HIPAA[- ]compliant|scientifically proven|cures?\b|treats?\s+(?:your\s+)?(?:disease|cancer|diabetes)|no side effects|100%\s*(?:safe|effective)|guaranteed results|pain[- ]free guarantee)/gi, why: "A regulated claim about a DIFFERENT business's product, staff or protocol. Substantiation does not transfer with a copy-paste — FTC/FDA exposure sits with whoever publishes it." },
+  { scope: "text", s: "claims", id: "rating", label: "Star rating / review count", re: /\b(?:[45](?:\.\d)?\s*(?:\/\s*5|stars?|-star)|\d{1,3}(?:,\d{3})*\+?\s*(?:5[- ]star\s*)?reviews?)\b/gi, why: "Ratings earned by the original business." },
+  { scope: "text", s: "claims", id: "count", label: "Client / result count", re: /\b\d{1,3}(?:,\d{3})*\+?\s*(?:happy\s+)?(?:clients?|customers?|patients?|members?|sessions?|treatments?|pounds?\s+lost|lbs\s+lost)\b/gi, why: "A results claim about the original business's book of business." },
+  { scope: "text", s: "claims", id: "tenure", label: "Years in business", re: /\b(?:since\s+(?:19|20)\d{2}|(?:over\s+)?\d{1,2}\+?\s*years?\s+(?:of\s+)?(?:experience|in business|serving))\b/gi, why: "Tenure the new business has not earned." },
+  { scope: "text", s: "claims", id: "award", label: "Award / superlative", re: /\b(?:#1\b|number one\b|award[- ]winning|best of\s+[A-Z][a-z]+|voted\s+best|top[- ]rated)\b/gi, why: "An award or superlative belonging to the original business." },
+  { scope: "text", s: "claims", id: "price", label: "Price / offer amount", re: /\$\s?\d{1,3}(?:,\d{3})*(?:\.\d{2})?(?:\s*(?:\/|per\s)\s*(?:mo|month|session|visit|year))?/g, why: "The original business's pricing — confirm it matches your client's offer.", limit: 15 },
+  { scope: "text", s: "claims", id: "guarantee", label: "Guarantee / refund promise", re: /\b(?:\d{1,3}[- ]day\s+(?:money[- ]back\s+)?guarantee|money[- ]back guarantee|risk[- ]free|full refund)\b/gi, why: "A promise your client must actually be willing and able to honor." },
+];
+
+const files = walk(DIR).filter((f) => isTextFile(f));
+
+const findings = new Map(); // key: section|id -> { rule, hits: [{file,line,snippet}] }
+const MAX_PER_RULE = 25;
+
+/** Visible page text: what a human actually reads. */
+function visibleText(html) {
+  return html
+    .replace(/<script[\s\S]*?<\/script>/gi, " ")
+    .replace(/<style[\s\S]*?<\/style>/gi, " ")
+    .replace(/<!--[\s\S]*?-->/g, " ")
+    .replace(/<[^>]+>/g, " ")
+    .replace(/&nbsp;/gi, " ")
+    .replace(/&amp;/gi, "&")
+    .replace(/&quot;/gi, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/[ \t]+/g, " ");
+}
+
+/**
+ * Copy that lives inside a JS bundle (SPAs keep every headline there).
+ * Keeps human sentences, drops minified code: needs spaces, letters, and no
+ * code punctuation.
+ */
+function jsCopyStrings(js) {
+  const out = [];
+  for (const m of js.matchAll(/(["'`])((?:\\.|(?!\1)[^\\\r\n]){25,400})\1/g)) {
+    const v = m[2];
+    if (!/[A-Za-z]{3}/.test(v)) continue;
+    if ((v.match(/ /g) || []).length < 4) continue;
+    if (/[{}=;<>]|\)\s*\{|=>|function |var |const |return /.test(v)) continue;
+    out.push(v);
+  }
+  return out.join("\n");
+}
+
+for (const file of files) {
+  const rel = path.relative(DIR, file);
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    continue;
+  }
+  const e = ext(file);
+  // Text-scope rules read what a visitor reads — never minified internals.
+  const derived =
+    [".html", ".htm"].includes(e) ? visibleText(text) :
+    [".js", ".mjs"].includes(e) ? jsCopyStrings(text) :
+    "";
+  const lineStarts = [];
+  {
+    let idx = 0;
+    for (const line of text.split("\n")) {
+      lineStarts.push(idx);
+      idx += line.length + 1;
+    }
+  }
+  const lineOf = (pos) => {
+    let lo = 0, hi = lineStarts.length - 1, ans = 0;
+    while (lo <= hi) {
+      const mid = (lo + hi) >> 1;
+      if (lineStarts[mid] <= pos) { ans = mid; lo = mid + 1; } else hi = mid - 1;
+    }
+    return ans + 1;
+  };
+
+  for (const rule of RULES) {
+    const scope = rule.scope || "raw";
+    const haystack = scope === "text" ? derived : text;
+    if (!haystack) continue;
+    const key = `${rule.s}|${rule.id}`;
+    const re = new RegExp(rule.re.source, rule.re.flags.includes("g") ? rule.re.flags : rule.re.flags + "g");
+    let m;
+    const seen = new Set();
+    while ((m = re.exec(haystack)) !== null) {
+      if (m[0].length === 0) { re.lastIndex++; continue; }
+      const raw = (m[1] || m[0]).trim();
+      const snippet = raw.replace(/\s+/g, " ").slice(0, 160);
+      if (!snippet || seen.has(snippet)) continue;
+      seen.add(snippet);
+      if (!findings.has(key)) findings.set(key, { rule, hits: [] });
+      const rec = findings.get(key);
+      if (rec.hits.length >= (rule.limit || MAX_PER_RULE)) continue;
+      const pos = scope === "text" ? text.indexOf(raw.slice(0, 40)) : m.index;
+      rec.hits.push({ file: rel, line: lineOf(pos >= 0 ? pos : 0), snippet });
+    }
+  }
+}
+
+// ---- context from the mirror + substitution runs ---------------------------
+let mirror = null, subs = null;
+try { mirror = readJson(path.join(REPORTS, "run-report.json")); } catch {}
+try { subs = readJson(path.join(REPORTS, "substitution-report.json")); } catch {}
+
+const SECTIONS = [
+  { key: "repoint", title: "1. MUST REPOINT — leads, bookings and money", lead: "Every item below still points at the ORIGINAL owner. Anything left unchanged sends your client's leads, appointments, tracking or payments to someone else." },
+  { key: "people", title: "2. REVIEW — other people's content", lead: "Names, addresses, likenesses and words that belong to the original business and its clients. Replace or remove; do not simply delete blocks you have not looked at." },
+  { key: "claims", title: "3. REVIEW — inherited and regulated claims", lead: "Factual assertions about a DIFFERENT business. Regulated health/efficacy claims are the highest-risk items on this page: the substantiation does not travel with the copy." },
+];
+
+const md = [];
+md.push("# REVIEW REQUIRED — before this page takes real traffic");
+md.push("");
+md.push(`Generated ${nowIso()} by GHL Command clone-site.`);
+md.push("");
+if (mirror) {
+  md.push("| | |");
+  md.push("|---|---|");
+  md.push(`| Source | ${mirror.source?.url || "(unknown)"} |`);
+  md.push(`| Rights declared | **${mirror.rights?.declaration || "(not recorded)"}**${mirror.rights?.note ? ` — "${mirror.rights.note}"` : ""} |`);
+  md.push(`| Declaration recorded | ${mirror.generatedAt} (user's statement; this tool does not verify ownership) |`);
+  md.push(`| Files mirrored | ${mirror.inventory?.files ?? "?"} (${mirror.inventory?.totalHuman ?? "?"}) |`);
+  md.push("");
+}
+
+let totalFindings = 0;
+for (const sec of SECTIONS) {
+  const recs = [...findings.values()].filter((f) => f.rule.s === sec.key);
+  md.push(`## ${sec.title}`);
+  md.push("");
+  md.push(sec.lead);
+  md.push("");
+  if (recs.length === 0) {
+    md.push("_Nothing detected._ Detection is pattern-based — read the page yourself before launch.");
+    md.push("");
+    continue;
+  }
+  for (const rec of recs) {
+    totalFindings += rec.hits.length;
+    md.push(`### ${rec.rule.label} (${rec.hits.length}${rec.hits.length >= (rec.rule.limit || MAX_PER_RULE) ? "+" : ""})`);
+    md.push("");
+    md.push(`${rec.rule.why}`);
+    md.push("");
+    for (const h of rec.hits) md.push(`- \`${h.file}:${h.line}\` — ${h.snippet.replace(/\|/g, "\\|")}`);
+    md.push("");
+  }
+}
+
+// Internal navigation that has no page in this clone. Standard for a single-page
+// mirror, and the first thing a client clicks. Worth naming explicitly.
+const dangling = new Set();
+// After a rebrand, internal nav is often absolute on the NEW domain. Treat those
+// hosts as our own, or every internal link looks "external" and goes unchecked.
+const ownHosts = new Set();
+try {
+  const subsForHosts = readJson(path.join(REPORTS, "substitution-report.json"));
+  for (const h of subsForHosts.hits || []) {
+    if (!/^domain/.test(h.label) || !h.new) continue;
+    const host = String(h.new).replace(/^https?:\/\//, "").replace(/\/.*$/, "").toLowerCase();
+    if (host) {
+      ownHosts.add(host);
+      ownHosts.add(host.replace(/^www\./, ""));
+      ownHosts.add("www." + host.replace(/^www\./, ""));
+    }
+  }
+} catch {}
+
+for (const file of files) {
+  if (![".html", ".htm"].includes(ext(file))) continue;
+  const text = fs.readFileSync(file, "utf8");
+  for (const m of text.matchAll(/href=["']([^"'#]+)["']/gi)) {
+    let href = m[1].trim();
+    if (/^(mailto:|tel:|javascript:|data:)/i.test(href)) continue;
+    let p2 = null;
+    if (href.startsWith("/")) p2 = href;
+    else if (/^https?:\/\//i.test(href)) {
+      let u = null;
+      try { u = new URL(href); } catch { continue; }
+      if (!ownHosts.has(u.hostname.toLowerCase())) continue; // truly external — the repoint rules cover it
+      p2 = u.pathname;
+    }
+    else if (!href.includes(":")) p2 = "/" + href;
+    if (!p2) continue;
+    p2 = p2.split("?")[0].replace(/\/+$/, "");
+    if (!p2 || p2 === "") continue;
+    const rel = p2.replace(/^\/+/, "");
+    const candidates = [rel, rel + ".html", path.posix.join(rel, "index.html")];
+    if (!candidates.some((c) => fs.existsSync(path.join(DIR, c)))) dangling.add(p2);
+  }
+}
+
+// Brand baked into image files. Text substitution cannot reach pixels: the logo,
+// and any graphic carrying the old phone number or URL, still belong to the
+// original business after a "clean" rebrand. Live-caught 2026-07-30 — the header
+// logo still read the original name, phone and domain on an otherwise clean clone.
+const loose = (v) => String(v).toLowerCase().replace(/[^a-z0-9]+/g, "");
+const brandedAssets = [];
+try {
+  const mirrorForAssets = readJson(path.join(REPORTS, "run-report.json"));
+  const subsForAssets = (() => { try { return readJson(path.join(REPORTS, "substitution-report.json")); } catch { return { hits: [] }; } })();
+  const needles = [...new Set((subsForAssets.hits || [])
+    .map((h) => loose(h.old))
+    .filter((v) => v.length >= 6))];
+  const imageExt = [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg", ".avif", ".bmp", ".pdf"];
+  for (const a of mirrorForAssets.assets || []) {
+    if (!imageExt.includes(ext(a.local))) continue;
+    const base = loose(path.posix.basename(a.local));
+    const brandHit = needles.find((n) => base.includes(n));
+    const looksIdentity = /logo|header|banner|watermark|letterhead|business.?card|truck|van|sign/.test(path.posix.basename(a.local).toLowerCase());
+    if (brandHit || looksIdentity) {
+      brandedAssets.push({ local: a.local, reason: brandHit ? `filename carries the old brand ("${brandHit}")` : "filename suggests an identity asset (logo/banner/signage)" });
+    }
+  }
+} catch {}
+if (brandedAssets.length) {
+  md.push("### Brand baked into image files (" + brandedAssets.length + ")");
+  md.push("");
+  md.push("**Substitution cannot edit pixels.** These image files carry the original business's name, phone number, web address or signage inside the artwork. On a rebranded page the text reads correctly while the logo still advertises the original company — the single most visible way a clone gives itself away, and a straight trademark problem if it ships. Replace the logo and any graphic containing contact details with the new client's artwork.");
+  md.push("");
+  for (const b of brandedAssets.slice(0, 40)) md.push(`- \`${b.local}\` — ${b.reason}`);
+  if (brandedAssets.length > 40) md.push(`- …and ${brandedAssets.length - 40} more`);
+  md.push("");
+}
+
+md.push("## 4. Excluded, oversized and unresolved");
+md.push("");
+if (dangling.size) {
+  md.push(`**Internal links with no page in this clone:** ${dangling.size}`);
+  md.push("");
+  md.push("This is normal for a single-page mirror — the nav still lists the whole original site. Either mirror those pages too, point the links somewhere real, or trim the nav. As it stands they are the first thing a visitor clicks and the first thing that 404s.");
+  md.push("");
+  for (const d of [...dangling].sort().slice(0, 30)) md.push(`- ${d}`);
+  if (dangling.size > 30) md.push(`- …and ${dangling.size - 30} more`);
+  md.push("");
+}
+if (mirror) {
+  if ((mirror.oversized || []).length) {
+    md.push(`**Oversized — NOT downloaded (route to object storage, never hot-link the source):** ${mirror.oversized.length}`);
+    md.push("");
+    for (const o of mirror.oversized) md.push(`- ${humanBytes(o.bytes)} — ${o.url}`);
+    md.push("");
+  }
+  if ((mirror.skippedForeignOrMissing || []).length) {
+    md.push(`**Excluded — the origin served HTML where an asset should be** (missing, or another tenant's file): ${mirror.skippedForeignOrMissing.length}`);
+    md.push("");
+    for (const s of mirror.skippedForeignOrMissing.slice(0, 25)) md.push(`- ${s.url}`);
+    md.push("");
+  }
+  if ((mirror.failed || []).length) {
+    md.push(`**Failed to fetch:** ${mirror.failed.length}`);
+    md.push("");
+    for (const f of mirror.failed.slice(0, 25)) md.push(`- [${f.status}] ${f.url}`);
+    md.push("");
+  }
+  if ((mirror.externalRefsLeft || []).length) {
+    md.push(`**Third-party references left as-is** (fonts, SDKs, analytics loaders): ${mirror.externalRefsLeft.length}`);
+    md.push("");
+    for (const u of mirror.externalRefsLeft.slice(0, 25)) md.push(`- ${u}`);
+    md.push("");
+  }
+}
+if (subs) {
+  const noReplacement = (subs.hits || []).filter((h) => !h.new);
+  if (noReplacement.length) {
+    md.push(`**Present in the page with no replacement value supplied:** ${noReplacement.length}`);
+    md.push("");
+    for (const h of noReplacement) md.push(`- ${h.label}: \`${h.old}\` ×${h.total}`);
+    md.push("");
+  }
+}
+if (!mirror && !subs) {
+  md.push("_No mirror/substitution reports found in this directory._");
+  md.push("");
+}
+
+md.push("---");
+md.push("");
+md.push("**Everything above describes the original business, not your client. Replace or remove each item before this page takes real traffic.**");
+md.push("");
+md.push("This report is pattern-based and deliberately over-inclusive. It is not legal advice, and it is not a rights check: you declared your authorization at step 0 and you are responsible for that declaration and for what you publish.");
+md.push("");
+
+fs.writeFileSync(OUT, md.join("\n"));
+
+// ---- console summary -------------------------------------------------------
+const counts = {};
+for (const sec of SECTIONS) {
+  counts[sec.key] = [...findings.values()].filter((f) => f.rule.s === sec.key).reduce((n, f) => n + f.hits.length, 0);
+}
+const regulated = findings.get("claims|regulated");
+const out = [];
+out.push("");
+out.push("PRE-LAUNCH AUDIT COMPLETE");
+out.push(`  MUST REPOINT (leads/bookings/money) : ${counts.repoint}`);
+out.push(`  Other people's content             : ${counts.people}`);
+out.push(`  Inherited + regulated claims       : ${counts.claims}`);
+if (regulated) out.push(`  ⚠ REGULATED CLAIMS FLAGGED       : ${regulated.hits.length} — highest-risk items on the page`);
+if (brandedAssets.length) out.push(`  ⚠ Images with the ORIGINAL brand baked in (logo etc.): ${brandedAssets.length} — substitution cannot fix these`);
+if (dangling.size) out.push(`  Internal links with no page in this clone: ${dangling.size}`);
+out.push(`  report: ${OUT}`);
+out.push("");
+out.push("  Show the user this report before deploying. Never auto-delete a finding.");
+out.push("");
+console.log(out.join("\n"));