@operstack/audit 0.13.0 → 0.14.0

package/README.md

@@ -141,3 +141,28 @@ The external tier reads public pages only. It does not run a lab performance tes
 ## License
 
 MIT. Built by OperStack.
+
+## Agency plan
+
+Signing a report with someone else's name is free:
+
+```
+operstack-audit render audit.json --by "Harper & Vale Digital"
+```
+
+The cover and every page footer then carry that name. The cover keeps one line saying which tool
+collected the signals, so the report still shows its method.
+
+The agency plan replaces that with the buyer's own identity and adds bulk runs:
+
+```
+operstack-audit batch clients.txt --by "Harper & Vale Digital" \
+  --logo brand/logo.svg --color "#7b3fa0" --no-tool-line --pdf
+```
+
+`clients.txt` holds one site per line, either `example.com` or `example.com, Client Name`. Every
+report lands in `reports/`, and a site that fails does not stop the rest.
+
+The key goes in `--licence`, in `OPERSTACK_LICENCE`, or in a `.operstack-licence` file beside the
+work. This package is MIT and its source is public, so the key states the terms of commercial use
+and records who bought them; it is not a technical lock. Plan: https://oper-stack.com/products/agency/

package/bin/audit.mjs

@@ -30,6 +30,8 @@ import { buildFoundationScope, renderFoundationScope, renderFoundationChecklist
 import { draftNarrative, stillEmpty } from '../src/narrative.mjs';
 import { renderAgentPrompts, agentPrompts } from '../src/prompts.mjs';
 import { render, checkNarrative } from '../src/render.mjs';
+import { resolveBranding } from '../src/agency.mjs';
+import { readList, runBatch, summarise } from '../src/batch.mjs';
 import { writeFileSync, readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
@@ -58,6 +60,21 @@ if (!cmd || cmd === '--help' || cmd === '-h') {
     '      what was closed, what was not, and how much to refund',
     '  operstack-audit foundation-scope <audit.json> [--lang ru|en] [--new-pages 3] [--gsc] [--price] [--out base]',
     '      the text work the Foundation package would do, page by page; --price also states the money',
+    '',
+    '  operstack-audit batch <sites.txt> [--out reports] [--pages 12] [--lang en|ru] [--pdf] [brand flags]',
+    '      one report per line of the list; a line is "url" or "url, Client Name"',
+    '',
+    '  White label:',
+    '    --by "Agency Name"        who the report says prepared it; also OPERSTACK_PREPARED_BY',
+    '                              works on collect and on render, so an existing audit can be re-signed',
+    '    --recheck-url <url>       where the fix report sends the client to re-check',
+    '                              with --by set to someone other than us and no url, the line is omitted',
+    '',
+    '  Agency plan (needs a licence key, https://oper-stack.com/products/agency/):',
+    '    --logo <file>             svg, png, jpg or webp on the cover, embedded in the PDF',
+    '    --color <hex>             replaces the report accent colour, six hex digits',
+    '    --no-tool-line            drops the line naming the tool that collected the signals',
+    '    --licence <key>           OSK1 key; also OPERSTACK_LICENCE or a .operstack-licence file',
   ].join('\n'));
   process.exit(cmd ? 0 : 2);
 }
@@ -71,18 +88,32 @@ if (cmd === 'collect') {
   const audit = await collect(target, {
     pages: Number(opt('--pages', 20)), backlinks, lang: opt('--lang', 'en'),
     rendered: !has('--no-rendered'), renderedPages: Number(opt('--rendered-pages', 3)),
+    preparedBy: opt('--by', ''),
     log: (m) => console.error(`  ${m}`),
   });
   const out = resolve(opt('--out', 'audit.json'));
   writeFileSync(out, JSON.stringify(audit, null, 2));
   console.log(`wrote ${out}: ${audit.checks.length} checks, ${audit.sample.length} pages sampled, scores ${Object.entries(audit.scores).map(([k, v]) => `${k} ${v === null ? 'not measured' : v}`).join(', ')}`);
   console.log(`next: fill the narrative fields (operstack-audit check ${out} lists them), then render.`);
+} else if (cmd === 'batch') {
+  const brand = brandFrom(opt, has);
+  const items = readList(target);
+  if (!items.length) { console.error('the list is empty'); process.exit(2); }
+  console.error(`${items.length} site(s) to audit`);
+  const results = await runBatch(items, {
+    outDir: opt('--out', 'reports'), pages: Number(opt('--pages', 12)), lang: opt('--lang', 'en'),
+    brand, pdf: has('--pdf'), log: (m) => console.error(`  ${m}`),
+  });
+  console.log(summarise(results));
+  if (!results.some((r) => r.ok)) process.exit(1);
 } else if (cmd === 'render') {
   const audit = JSON.parse(readFileSync(resolve(target), 'utf8'));
+  const by = opt('--by', '');
+  if (by) audit.client = { ...(audit.client || {}), preparedBy: by };
   const out = resolve(opt('--out', target.replace(/\.json$/, '') + '.html'));
   const drift = verifyScores(audit);
   if (drift.length) { for (const d of drift) console.error(`score ignored, ${d}`); console.error('the report prints the score the checks give, not the one stored in the JSON.'); }
-  const { html, pdf } = await render(audit, { out, pdf: has('--pdf') });
+  const { html, pdf } = await render(audit, { out, pdf: has('--pdf'), brand: brandFrom(opt, has) });
   console.log(`wrote ${out} (${html.length} bytes)${pdf ? `\nwrote ${pdf}` : ''}`);
   const missing = checkNarrative(audit);
   if (missing.length) console.log(`note: ${missing.length} narrative field(s) still carry placeholders: ${missing.slice(0, 6).join(', ')}${missing.length > 6 ? ', ...' : ''}`);
@@ -123,6 +154,7 @@ if (cmd === 'collect') {
     lang,
     price: Number(opt('--price', lang === 'en' ? 249 : 21000)),
     currency: opt('--currency', lang === 'en' ? 'USD' : 'RUB'),
+    recheckUrl: opt('--recheck-url', ''),
   });
   if (plan.langMismatch) { console.error(`this audit was collected in Russian: an English letter would carry Russian check names. Re-run: operstack-audit collect <site> --lang en`); process.exit(1); }
   if (plan.unknown.length) console.error(`note: ${plan.unknown.length} check(s) have no fix action yet: ${plan.unknown.join(', ')}`);
@@ -166,3 +198,15 @@ if (cmd === 'collect') {
   else console.log('no price in the letter: add --price once the list is agreed and you have decided what to charge');
   console.log(`wrote ${base}-foundation-scope.json, ${base}-foundation-letter.md, ${base}-foundation-checklist.md`);
 } else { console.error(`unknown command ${cmd}`); process.exit(2); }
+
+/** Оформление из флагов. Причины, по которым что-то не применилось, печатаются сразу: молча
+ *  проигнорированный логотип выглядит как поломка продукта, а не как отсутствие лицензии. */
+function brandFrom(opt, has) {
+  const brand = resolveBranding({
+    by: opt('--by', ''), logo: opt('--logo', ''), color: opt('--color', ''),
+    licence: opt('--licence', ''), toolLine: !has('--no-tool-line'),
+  });
+  for (const n of brand.notes) console.error(`  ${n}`);
+  if (brand.licensed) console.error(`  agency plan active${brand.licensee ? ` (${brand.licensee})` : ''}`);
+  return brand;
+}

package/licensing/public.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA6kj0h3XVWk3F524Me43hYC7EoqY2URR6cVFczVCMLd4=
+-----END PUBLIC KEY-----

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@operstack/audit",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "SEO, AEO and GEO audit generator: collect public signals from a site into audit.json, let an analyst or an agent fill the narrative, render the OperStack report as HTML and PDF.",
   "type": "module",
   "license": "MIT",
@@ -22,12 +22,13 @@
     "bin",
     "src",
     "templates",
+    "licensing",
     "examples/sample-audit.json",
     "README.md",
     "LICENSE"
   ],
   "scripts": {
-    "test": "node src/test-scores.mjs && node src/test-fix.mjs && node src/test-foundation.mjs && node src/test-narrative.mjs && node src/test-prompts.mjs && node src/test-rendered.mjs && node src/test-agent-surface.mjs && node src/test-i18n.mjs examples/sample-audit.json && node bin/audit.mjs check examples/sample-audit.json && node bin/audit.mjs render examples/sample-audit.json --out /tmp/operstack-audit-sample.html",
+    "test": "node src/test-scores.mjs && node src/test-fix.mjs && node src/test-foundation.mjs && node src/test-narrative.mjs && node src/test-prompts.mjs && node src/test-rendered.mjs && node src/test-agent-surface.mjs && node src/test-agency.mjs && node src/test-i18n.mjs examples/sample-audit.json && node bin/audit.mjs check examples/sample-audit.json && node bin/audit.mjs render examples/sample-audit.json --out /tmp/operstack-audit-sample.html",
     "sample": "node bin/audit.mjs render examples/sample-audit.json --pdf"
   },
   "keywords": [

package/src/agency.mjs

@@ -0,0 +1,108 @@
+/**
+ * Agency plan: the report comes out under the buyer's brand instead of ours.
+ *
+ * What is free and what is paid, and why the line is drawn here. Signing a report with
+ * `--by "Some Agency"` is free: that is honest attribution, and the cover still carries the line
+ * saying which tool collected the signals, so our name travels with every free report. The agency
+ * plan buys the visual identity, a logo and a colour, and the right to drop that tool line, which
+ * is what turns the PDF into the agency's own product.
+ *
+ * The package is MIT and its source is public, so this is a licence, not a lock: anyone able to
+ * edit node_modules can walk past it. It exists to state the terms and to record who bought them,
+ * the same way every open-core tool does.
+ */
+import { createPublicKey, verify } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve, dirname, extname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Ed25519, тот же формат ключа, что и у Site Kit: OSK1.<payload>.<signature>, base64url. */
+export function verifyKey(key, publicPem) {
+  const m = String(key || '').trim().match(/^OSK1\.([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/);
+  if (!m) return { ok: false, reason: 'malformed key' };
+  const payload = Buffer.from(m[1], 'base64url');
+  const sig = Buffer.from(m[2], 'base64url');
+  let data;
+  try { data = JSON.parse(payload.toString('utf8')); } catch { return { ok: false, reason: 'unreadable payload' }; }
+  if (!verify(null, payload, createPublicKey(publicPem), sig)) return { ok: false, reason: 'signature does not match' };
+  if (data.expires && new Date(data.expires) < new Date()) return { ok: false, reason: `the plan lapsed on ${data.expires}`, data };
+  if (data.plan && data.plan !== 'agency') return { ok: false, reason: `this key is for the ${data.plan} plan, not agency`, data };
+  return { ok: true, data };
+}
+
+/** Ключ берётся из флага, из переменной окружения или из файла рядом с работой. */
+export function findKey(explicit = '') {
+  if (explicit) return explicit.trim();
+  if (process.env.OPERSTACK_LICENCE) return process.env.OPERSTACK_LICENCE.trim();
+  for (const p of ['.operstack-licence', '.operstack-licence.json']) {
+    const f = resolve(process.cwd(), p);
+    if (!existsSync(f)) continue;
+    const raw = readFileSync(f, 'utf8').trim();
+    if (raw.startsWith('{')) { try { return String(JSON.parse(raw).key || '').trim(); } catch { return ''; } }
+    return raw;
+  }
+  return '';
+}
+
+const MIME = { '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp' };
+const HEX = /^#?[0-9a-f]{6}$/i;
+/** Логотип уезжает в PDF вместе с файлом, поэтому встраивается, а не подключается ссылкой. */
+const MAX_LOGO = 512 * 1024;
+
+/**
+ * Собирает оформление отчёта. Возвращает ещё и `notes`: причины, по которым что-то не применилось,
+ * чтобы человек увидел их в терминале, а не гадал, почему логотипа нет.
+ */
+export function resolveBranding({ by = '', logo = '', color = '', licence = '', toolLine = true } = {}) {
+  const notes = [];
+  const out = { preparedBy: by.trim(), logo: null, accent: '', showToolLine: true, licensed: false, licensee: '' };
+
+  const wantsPaid = Boolean(logo || color || toolLine === false);
+  if (!wantsPaid) return { ...out, notes };
+
+  const pubPath = resolve(root, 'licensing/public.pem');
+  const key = findKey(licence);
+  if (!key) {
+    notes.push('logo, colour and hiding the tool line need the agency plan: https://oper-stack.com/products/agency/');
+    return { ...out, notes };
+  }
+  if (!existsSync(pubPath)) {
+    notes.push('licensing/public.pem is missing from this copy, so the key cannot be checked');
+    return { ...out, notes };
+  }
+  const r = verifyKey(key, readFileSync(pubPath, 'utf8'));
+  if (!r.ok) {
+    notes.push(`licence rejected: ${r.reason}`);
+    return { ...out, notes };
+  }
+  out.licensed = true;
+  out.licensee = r.data.email || r.data.name || '';
+
+  if (logo) {
+    const f = resolve(process.cwd(), logo);
+    const type = MIME[extname(f).toLowerCase()];
+    if (!existsSync(f)) notes.push(`logo not found: ${logo}`);
+    else if (!type) notes.push(`logo must be svg, png, jpg or webp, got ${extname(f) || 'no extension'}`);
+    else {
+      const buf = readFileSync(f);
+      if (buf.length > MAX_LOGO) notes.push(`logo is ${Math.round(buf.length / 1024)} KB, over the 512 KB the PDF can carry`);
+      else out.logo = `data:${type};base64,${buf.toString('base64')}`;
+    }
+  }
+  if (color) {
+    if (!HEX.test(color)) notes.push(`colour must be six hex digits, got "${color}"`);
+    else out.accent = color.startsWith('#') ? color : `#${color}`;
+  }
+  if (toolLine === false) out.showToolLine = false;
+  return { ...out, notes };
+}
+
+/** Светлая версия цвета для подложек: тот же тон, разбавленный белым. */
+export function softenHex(hex, mix = 0.86) {
+  const h = hex.replace('#', '');
+  const [r, g, b] = [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16));
+  const up = (c) => Math.round(c + (255 - c) * mix);
+  return `#${[up(r), up(g), up(b)].map((c) => c.toString(16).padStart(2, '0')).join('')}`;
+}

package/src/batch.mjs

@@ -0,0 +1,82 @@
+/**
+ * Пакетный прогон: список сайтов на входе, готовые отчёты на выходе.
+ *
+ * Агентство живёт не одним сайтом, а двадцатью, и запускать их по одному вручную никто не станет.
+ * Здесь нет ничего, чего не делает обычный прогон: тот же сбор, тот же черновик, та же вёрстка,
+ * просто по очереди и с общим оформлением. Упавший сайт не останавливает остальные: он попадает
+ * в отчёт о прогоне со своей причиной, потому что девятнадцать готовых отчётов лучше, чем ноль.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { resolve, join } from 'node:path';
+import { collect } from './collect.mjs';
+import { render } from './render.mjs';
+import { draftNarrative as draft } from './narrative.mjs';
+
+/** Строки списка: адрес и, через запятую, имя клиента для обложки. Пустые строки и # игнорируются. */
+export function parseList(text) {
+  const out = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#')) continue;
+    const [url, ...rest] = line.split(',');
+    const name = rest.join(',').trim();
+    try {
+      const u = new URL(url.trim().startsWith('http') ? url.trim() : `https://${url.trim()}`);
+      out.push({ url: u.toString(), name: name || u.host });
+    } catch {
+      out.push({ url: url.trim(), name, invalid: true });
+    }
+  }
+  return out;
+}
+
+/** Имя файла из адреса: понятное человеку, без косых черт и без совпадений между сайтами. */
+const slug = (u) => {
+  try { return new URL(u).host.replace(/^www\./, '').replace(/[^a-z0-9.-]/gi, '-'); }
+  catch { return String(u).replace(/[^a-z0-9.-]/gi, '-').slice(0, 60) || 'site'; }
+};
+
+export async function runBatch(items, {
+  outDir = 'reports', pages = 12, lang = 'en', brand = null, pdf = false,
+  log = () => {}, onDone = () => {},
+} = {}) {
+  mkdirSync(resolve(outDir), { recursive: true });
+  const results = [];
+  for (const [i, item] of items.entries()) {
+    const label = `${i + 1}/${items.length} ${item.url}`;
+    if (item.invalid) {
+      results.push({ ...item, ok: false, reason: 'not a valid address' });
+      log(`${label}: пропущен, адрес не разобран`);
+      continue;
+    }
+    try {
+      log(`${label}: собираю`);
+      const audit = await collect(item.url, { pages, lang, rendered: false, preparedBy: brand?.preparedBy || '' });
+      audit.client.name = item.name;
+      draft(audit, { lang });
+      const base = join(resolve(outDir), slug(item.url));
+      writeFileSync(`${base}.json`, JSON.stringify(audit, null, 2));
+      const r = await render(audit, { out: `${base}.html`, pdf, brand });
+      results.push({ ...item, ok: true, json: `${base}.json`, html: `${base}.html`, pdf: r.pdf, scores: audit.scores });
+      log(`${label}: готово`);
+    } catch (err) {
+      results.push({ ...item, ok: false, reason: err.message });
+      log(`${label}: не вышло, ${err.message}`);
+    }
+    onDone(results[results.length - 1]);
+  }
+  return results;
+}
+
+/** Короткая сводка для человека: что получилось, что нет и почему. */
+export function summarise(results) {
+  const ok = results.filter((r) => r.ok);
+  const bad = results.filter((r) => !r.ok);
+  const lines = [`готово ${ok.length} из ${results.length}`];
+  for (const r of bad) lines.push(`  не вышло ${r.url}: ${r.reason}`);
+  return lines.join('\n');
+}
+
+export function readList(path) {
+  return parseList(readFileSync(resolve(path), 'utf8'));
+}

package/src/collect.mjs

@@ -175,7 +175,7 @@ async function readSitemap(url, seen = new Set(), depth = 0) {
   return out;
 }
 
-export async function collect(startUrl, { pages = 20, log = () => {}, backlinks = null, lang = 'en', rendered = false, renderedPages = 3 } = {}) {
+export async function collect(startUrl, { pages = 20, log = () => {}, backlinks = null, lang = 'en', rendered = false, renderedPages = 3, preparedBy = '' } = {}) {
   const opts = { backlinks };
   const origin = new URL(startUrl).origin;
   const host = new URL(startUrl).host;
@@ -185,7 +185,12 @@ export async function collect(startUrl, { pages = 20, log = () => {}, backlinks
   log(`homepage ${startUrl}`);
   const home = await follow(startUrl);
   const homePage = home.response.ok ? analysePage(home.final, home.response.text) : null;
-  checks.push(row('https', 'technical', 'HTTPS', home.final.startsWith('https://') ? 'ok' : 'bad', home.final.startsWith('https://') ? 'certificate active' : 'site served over http'));
+  // Сайт, который не ответил, не имеет ни сертификата, ни чего-либо ещё. Пока эта строка смотрела
+  // только на схему в адресе, отчёт по несуществующему домену уверенно сообщал «certificate active».
+  const homeAnswered = Boolean(home.response.ok);
+  checks.push(homeAnswered
+    ? row('https', 'technical', 'HTTPS', home.final.startsWith('https://') ? 'ok' : 'bad', home.final.startsWith('https://') ? 'certificate active' : 'site served over http')
+    : row('https', 'technical', 'HTTPS', 'bad', `the site did not answer${home.response.status ? `: HTTP ${home.response.status}` : ''}`, 'nothing below could be measured on a site that does not answer'));
   const altHost = host.startsWith('www.') ? host.slice(4) : `www.${host}`;
   const alt = await follow(`${new URL(home.final).protocol}//${altHost}/`);
   const altOk = alt.final.replace(/\/$/, '') === new URL(home.final).origin.replace(/\/$/, '') || alt.hops.some((h) => h.status >= 300 && h.status < 400);
@@ -423,8 +428,8 @@ export async function collect(startUrl, { pages = 20, log = () => {}, backlinks
   const critical = checks.filter((c) => c.status === 'bad').map((c) => ({ title: c.label, text: `${c.value}${c.comment ? `. ${c.comment}` : ''}`, level: 'bad' }));
 
   return {
-    meta: { site: home.final, host, collectedAt: new Date().toISOString(), tool: `@operstack/audit ${VERSION}`, auditType: lang === 'ru' ? 'Аудит по публичным сигналам' : 'External audit (no Search Console or analytics access)', lang, language: hp ? (hp.og?.locale || '') : '' },
-    client: { name: '{{CLIENT NAME}}', subject: '{{What the site sells and where}}', reportDate: new Date().toISOString().slice(0, 10), preparedBy: 'OperStack' },
+    meta: { site: home.final, host, reachable: homeAnswered, collectedAt: new Date().toISOString(), tool: `@operstack/audit ${VERSION}`, auditType: lang === 'ru' ? 'Аудит по публичным сигналам' : 'External audit (no Search Console or analytics access)', lang, language: hp ? (hp.og?.locale || '') : '' },
+    client: { name: '{{CLIENT NAME}}', subject: '{{What the site sells and where}}', reportDate: new Date().toISOString().slice(0, 10), preparedBy: preparedBy || process.env.OPERSTACK_PREPARED_BY || 'OperStack' },
     scores,
     scoreBasis,
     summary: { lead: '{{Three sentences: what the site is, what works, what holds it back.}}', verdict: '{{Key takeaway in three sentences, ending with how fast the critical issues can be fixed.}}', priorities: ['{{Priority one}}', '{{Priority two}}', '{{Priority three}}'] },

package/src/fix.mjs

@@ -108,7 +108,7 @@ const T = {
     after: 'Стало',
     nowLabel: 'Сейчас',
     gone: 'проверка исчезла из прогона',
-    recheck: 'Любую строку можно перепроверить бесплатным инструментом на oper-stack.ru/ai-visibility/',
+    recheck: (u) => `Любую строку можно перепроверить бесплатным инструментом на ${u}`,
   },
   en: {
     planTitle: (h) => `# What we will fix on ${h}`,
@@ -140,10 +140,15 @@ const T = {
     after: 'Now',
     nowLabel: 'Now',
     gone: 'the check disappeared from the run',
-    recheck: 'Every line can be re-checked with the free tool at oper-stack.com/ai-visibility/',
+    recheck: (u) => `Every line can be re-checked with the free tool at ${u}`,
   },
 };
 
+// Ссылка на бесплатную перепроверку. В отчёте под чужим брендом её нет: рекламировать нас
+// внутри документа, который подрядчик отдаёт своему клиенту, нельзя.
+const DEFAULT_RECHECK = { ru: 'oper-stack.ru/ai-visibility/', en: 'oper-stack.com/ai-visibility/' };
+const isOurBrand = (by) => !by || /operstack|oper-stack/i.test(by);
+
 const dict = (lang) => T[lang === 'en' ? 'en' : 'ru'];
 const pick = (field, lang) => (field && typeof field === 'object' ? field[lang === 'en' ? 'en' : 'ru'] : field);
 
@@ -186,7 +191,10 @@ export function buildFixPlan(audit, opts = {}) {
   // На здоровом сайте закрывать почти нечего, и продавать ему пакет по полной цене нечестно.
   // Порог не выдуман: ниже него доля одной проверки превышает треть чека.
   const thin = included.length > 0 && included.length < 5;
-  return { platform, price, currency, lang, langMismatch, included, needsClient, notPossible, share, thin, unknown, checkedAt: audit.meta?.collectedAt, host: audit.meta?.host };
+  const preparedBy = audit.client?.preparedBy || '';
+  const recheckUrl = opts.recheckUrl || (isOurBrand(preparedBy) ? DEFAULT_RECHECK[lang] : null);
+  const brand = { preparedBy, recheckUrl };
+  return { platform, price, currency, lang, langMismatch, included, needsClient, notPossible, share, thin, unknown, brand, checkedAt: audit.meta?.collectedAt, host: audit.meta?.host };
 }
 
 /** Письмо клиенту: то, что он согласовывает до оплаты. */
@@ -266,7 +274,7 @@ export function buildFixReport(plan, after) {
     else closed.push({ ...x, now: c.value });
   }
   const refund = Math.round(stillOpen.length * plan.share * 100) / 100;
-  return { host: plan.host, lang: plan.lang, closed, stillOpen, refund, currency: plan.currency, total: plan.included.length };
+  return { host: plan.host, lang: plan.lang, closed, stillOpen, refund, currency: plan.currency, total: plan.included.length, brand: plan.brand };
 }
 
 export function renderFixReport(report) {
@@ -285,8 +293,10 @@ export function renderFixReport(report) {
     L.push('');
     for (const x of report.stillOpen) L.push(`- **${x.check.label}.** ${t.before}: ${x.check.value}. ${t.nowLabel}: ${x.now}`);
   }
-  L.push('');
-  L.push(t.recheck);
+  if (report.brand?.recheckUrl) {
+    L.push('');
+    L.push(t.recheck(report.brand.recheckUrl));
+  }
   return L.join('\n');
 }
 

package/src/i18n.mjs

@@ -43,7 +43,7 @@ export function localiseBasisNote(note) {
  * пересобирая его из тех же чисел. Там, где текст постоянный, возвращается константа.
  */
 const RU = {
-  https: { label: 'HTTPS', value: (v) => (/certificate active/.test(v) ? 'сертификат активен' : 'сайт отдаётся по http, без шифрования') },
+  https: { label: 'HTTPS', value: (v) => (/did not answer/.test(v) ? `сайт не ответил${/HTTP (\d+)/.exec(v) ? `: HTTP ${/HTTP (\d+)/.exec(v)[1]}` : ''}` : /certificate active/.test(v) ? 'сертификат активен' : 'сайт отдаётся по http, без шифрования'), comment: (c) => (c ? 'на сайте, который не отвечает, измерить нельзя ничего' : '') },
   www: {
     label: 'Склейка адреса с www',
     value: (v) => (/redirects to/.test(v) ? 'адрес с www перенаправляется на основной'

package/src/render.mjs

@@ -9,6 +9,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { computeScores } from './collect.mjs';
 import { localiseBasisNote, AREAS_RU } from './i18n.mjs';
+import { softenHex } from './agency.mjs';
 
 const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 const isPlaceholder = (s) => typeof s === 'string' && /\{\{[^}]*\}\}/.test(s);
@@ -19,6 +20,7 @@ const LABELS = {
   en: {
     eyebrowAudit: 'Digital marketing audit', coverTitle: 'SEO, AEO and GEO<br>audit report',
     auditSubject: 'Audit subject', reportDate: 'Report date', auditType: 'Audit type', preparedBy: 'Prepared by',
+    reproducible: 'Every status in this report was read from the public site and can be reproduced from it as it stood on the report date.',
     collectedBy: (tool, date) => `Public signals were collected by ${tool} on ${date}. Every status in this report can be reproduced from the site as it stood on that day.`,
     secSummary: 'Executive summary', summaryEyebrow: '01 · Summary', keyTakeaway: 'Key takeaway:', threePriorities: 'Three priorities',
     scorecardFoot: 'Each score counts the checks in this report: a check that passes scores one, a check that needs attention a half, a failing check nothing. An area marked <strong>not measured</strong> is an area this audit does not test, and is never scored on an impression. Every figure here can be recomputed from section 04 onwards.',
@@ -41,6 +43,7 @@ const LABELS = {
   ru: {
     eyebrowAudit: 'Аудит цифрового маркетинга', coverTitle: 'Аудит сайта:<br>SEO, AEO и GEO',
     auditSubject: 'Что проверяли', reportDate: 'Дата отчёта', auditType: 'Тип аудита', preparedBy: 'Кто готовил',
+    reproducible: 'Каждый статус в этом отчёте прочитан с публичного сайта, и его можно перепроверить по сайту на дату отчёта.',
     collectedBy: (tool, date) => `Публичные сигналы собраны инструментом ${tool} ${date}. Любой статус в этом отчёте можно перепроверить по сайту в том виде, в каком он был в этот день.`,
     secSummary: 'Главное', summaryEyebrow: '01 · Итог', keyTakeaway: 'Главный вывод:', threePriorities: 'Три приоритета',
     scorecardFoot: 'Каждая оценка считает проверки из этого же отчёта: пройденная проверка это балл, спорная половина балла, проваленная ноль. Область с пометкой <strong>не измерялось</strong> это область, которую аудит не проверяет, и она никогда не оценивается на глаз. Любую цифру отсюда можно пересчитать по разделам начиная с четвёртого.',
@@ -96,6 +99,7 @@ function css() {
   .eyebrow { font-size: 8pt; letter-spacing: .12em; text-transform: uppercase; color: var(--accent); font-weight: 600; margin-bottom: 2mm; }
   .cover { min-height: calc(297mm - 38mm); display: flex; flex-direction: column; justify-content: space-between; }
   .cover-top { border-top: 3px solid var(--accent); padding-top: 8mm; }
+  .cover-logo { display: block; max-height: 16mm; max-width: 70mm; margin-bottom: 7mm; }
   .cover h1 { font-size: 34pt; margin: 2mm 0 4mm; }
   .cover-sub { font-size: 13pt; color: var(--ink-2); max-width: 85%; margin-bottom: 10mm; }
   .cover-url { display: inline-block; background: var(--accent-soft); color: var(--accent); padding: 2.5mm 4.5mm; border-radius: 4px; font-weight: 600; font-size: 11pt; }
@@ -140,12 +144,14 @@ function css() {
 }
 
 const header = (audit, section, L) => `<div class="page-header"><strong>${esc(audit.client.name)}</strong><span>${esc(L.runningHead)} · ${esc(section)}</span></div>`;
-const footer = (audit, n) => `<div class="page-footer"><span>${esc(audit.client.preparedBy || 'OperStack')} · ${esc(audit.client.reportDate)}</span><span>${n}</span></div>`;
+const footer = (audit, n, by) => `<div class="page-footer"><span>${esc(by || audit.client.preparedBy || 'OperStack')} · ${esc(audit.client.reportDate)}</span><span>${n}</span></div>`;
 const list = (items) => `<ul>${(items || []).map((i) => `<li>${t(i)}</li>`).join('')}</ul>`;
 const olist = (items) => `<ol>${(items || []).map((i) => `<li>${t(i)}</li>`).join('')}</ol>`;
 const statusCell = (s, L) => `<td class="${STATUS_CLASS[s] || STATUS_CLASS.na}">${L[STATUS_KEYS[s] || 'statusNa']}</td>`;
 
-export function toHtml(audit) {
+export function toHtml(audit, brand = null) {
+  // Цвет агентства подменяет только акцент: остальная палитра отчёта остаётся выверенной.
+  const accentCss = brand && brand.accent ? `:root{--accent:${brand.accent};--accent-soft:${softenHex(brand.accent)};}` : '';
   const a = audit;
   const L = LABELS[a.meta?.lang === 'ru' ? 'ru' : 'en'];
   const groups = [['technical', 'Technical'], ['onpage', 'On-page'], ['content', 'Content'], ['aeo', 'Answer engines'], ['geo', 'Generative engines'], ['offpage', 'Off-page and trust'], ['conversion', 'Conversion'], ['overview', 'Overview']];
@@ -162,29 +168,34 @@ export function toHtml(audit) {
   }).join('');
   let n = 1;
   const pages = [];
-  pages.push(`<div class="page"><div class="cover"><div><div class="cover-top"><div class="eyebrow">${L.eyebrowAudit}</div><h1>${L.coverTitle}</h1><p class="cover-sub">${t(a.client.subject)}</p><span class="cover-url">${esc(a.meta.host)}</span></div>
-    <dl class="cover-meta"><div><dt>${L.auditSubject}</dt><dd>${t(a.client.name)}</dd></div><div><dt>${L.reportDate}</dt><dd>${esc(a.client.reportDate)}</dd></div><div><dt>${L.auditType}</dt><dd>${esc(a.meta.auditType)}</dd></div><div><dt>${L.preparedBy}</dt><dd>${esc(a.client.preparedBy || 'OperStack')}</dd></div></dl></div>
-    <div class="cover-foot">${esc(L.collectedBy(a.meta.tool, (a.meta.collectedAt || '').slice(0, 10)))}</div></div></div>`);
+  const logo = brand && brand.logo ? `<img class="cover-logo" src="${brand.logo}" alt="">` : '';
+  const preparedBy = (brand && brand.preparedBy) || a.client.preparedBy || 'OperStack';
+  const toolLine = !brand || brand.showToolLine !== false
+    ? `<div class="cover-foot">${esc(L.collectedBy(a.meta.tool, (a.meta.collectedAt || '').slice(0, 10)))}</div>`
+    : `<div class="cover-foot">${esc(L.reproducible)}</div>`;
+  pages.push(`<div class="page"><div class="cover"><div><div class="cover-top">${logo}<div class="eyebrow">${L.eyebrowAudit}</div><h1>${L.coverTitle}</h1><p class="cover-sub">${t(a.client.subject)}</p><span class="cover-url">${esc(a.meta.host)}</span></div>
+    <dl class="cover-meta"><div><dt>${L.auditSubject}</dt><dd>${t(a.client.name)}</dd></div><div><dt>${L.reportDate}</dt><dd>${esc(a.client.reportDate)}</dd></div><div><dt>${L.auditType}</dt><dd>${esc(a.meta.auditType)}</dd></div><div><dt>${L.preparedBy}</dt><dd>${esc(preparedBy)}</dd></div></dl></div>
+    ${toolLine}</div></div>`);
   n++;
-  pages.push(`<div class="page">${header(a, L.secSummary, L)}<div class="eyebrow">${L.summaryEyebrow}</div><h2>${L.secSummary}</h2><p class="lead">${t(a.summary.lead)}</p><div class="scorecard">${scoreCards}</div><p class="scorecard-foot">${L.scorecardFoot}</p><div class="verdict"><p><strong>${L.keyTakeaway}</strong> ${t(a.summary.verdict)}</p></div><h3>${L.threePriorities}</h3>${olist(a.summary.priorities)}${footer(a, n++)}</div>`);
-  pages.push(`<div class="page">${header(a, L.secOverview, L)}<div class="eyebrow">${L.overviewEyebrow}</div><h2>${L.whatSiteIs}</h2><table><tr><th>${L.parameter}</th><th>${L.value}</th></tr>${(a.overview.rows || []).map(([k, v]) => `<tr><td>${t(k)}</td><td>${t(v)}</td></tr>`).join('')}</table><p>${t(a.overview.note)}</p><h3>${L.pagesSampled}</h3><table><tr><th>${L.colUrl}</th><th>${L.colTitle}</th><th>${L.colWords}</th><th>H1</th><th>Alt</th></tr>${(a.sample || []).filter((p) => p.title !== undefined).slice(0, 14).map((p) => `<tr><td><code>${esc(new URL(p.url).pathname)}</code></td><td>${esc(p.title)}</td><td>${p.words}</td><td>${p.h1Count}</td><td>${p.images ? `${p.images - p.imagesNoAlt}/${p.images}` : '·'}</td></tr>`).join('')}</table>${footer(a, n++)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secSummary, L)}<div class="eyebrow">${L.summaryEyebrow}</div><h2>${L.secSummary}</h2><p class="lead">${t(a.summary.lead)}</p><div class="scorecard">${scoreCards}</div><p class="scorecard-foot">${L.scorecardFoot}</p><div class="verdict"><p><strong>${L.keyTakeaway}</strong> ${t(a.summary.verdict)}</p></div><h3>${L.threePriorities}</h3>${olist(a.summary.priorities)}${footer(a, n++, preparedBy)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secOverview, L)}<div class="eyebrow">${L.overviewEyebrow}</div><h2>${L.whatSiteIs}</h2><table><tr><th>${L.parameter}</th><th>${L.value}</th></tr>${(a.overview.rows || []).map(([k, v]) => `<tr><td>${t(k)}</td><td>${t(v)}</td></tr>`).join('')}</table><p>${t(a.overview.note)}</p><h3>${L.pagesSampled}</h3><table><tr><th>${L.colUrl}</th><th>${L.colTitle}</th><th>${L.colWords}</th><th>H1</th><th>Alt</th></tr>${(a.sample || []).filter((p) => p.title !== undefined).slice(0, 14).map((p) => `<tr><td><code>${esc(new URL(p.url).pathname)}</code></td><td>${esc(p.title)}</td><td>${p.words}</td><td>${p.h1Count}</td><td>${p.images ? `${p.images - p.imagesNoAlt}/${p.images}` : '·'}</td></tr>`).join('')}</table>${footer(a, n++, preparedBy)}</div>`);
   const cardBody = (c) => [
     c.text ? `<p>${t(c.text)}</p>` : '',
     c.cost ? `<p><span class="card-tag">${L.whatItCosts}</span>${t(c.cost)}</p>` : '',
     c.fix ? `<p><span class="card-tag">${L.theFix}</span>${t(c.fix)}</p>` : '',
   ].join('') || '<p class="card-empty">${L.noBody}</p>';
   const cards = (a.critical || []).map((c, i) => `<div class="card ${c.level === 'warn' ? 'warn' : ''}"><h4>${i + 1}. ${t(c.title)}</h4>${cardBody(c)}</div>`).join('') || `<p>${L.noCritical}</p>`;
-  pages.push(`<div class="page">${header(a, L.secCritical, L)}<div class="eyebrow">${L.criticalEyebrow}</div><h2>${L.criticalTitle}</h2><div class="cards">${cards}</div>${footer(a, n++)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secCritical, L)}<div class="eyebrow">${L.criticalEyebrow}</div><h2>${L.criticalTitle}</h2><div class="cards">${cards}</div>${footer(a, n++, preparedBy)}</div>`);
   const techRows = [...checksBy('technical'), ...checksBy('onpage')].map((c) => `<tr><td>${esc(c.label)}</td>${statusCell(c.status, L)}<td>${esc(c.value)}${c.comment ? `<br><span style="color:var(--muted)">${esc(c.comment)}</span>` : ''}</td></tr>`).join('');
-  pages.push(`<div class="page">${header(a, L.secTechnical, L)}<div class="eyebrow">${L.technicalEyebrow}</div><h2>${L.technicalTitle}</h2><table><tr><th>${L.colCheck}</th><th>${L.colStatus}</th><th>${L.colFinding}</th></tr>${techRows}</table>${footer(a, n++)}</div>`);
-  pages.push(`<div class="page">${header(a, L.secContent, L)}<div class="eyebrow">${L.contentEyebrow}</div><h2>${L.contentTitle}</h2><div class="two-col"><div><h3>${L.strengths}</h3>${list(a.content.strengths)}</div><div><h3>${L.weaknesses}</h3>${list(a.content.weaknesses)}</div></div><h3>${L.gaps}</h3>${list(a.content.gaps)}${checksBy('content').length ? `<table><tr><th>${L.colCheck}</th><th>${L.colStatus}</th><th>${L.colFinding}</th></tr>${checksBy('content').map((c) => `<tr><td>${esc(c.label)}</td>${statusCell(c.status, L)}<td>${esc(c.value)}</td></tr>`).join('')}</table>` : ''}${footer(a, n++)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secTechnical, L)}<div class="eyebrow">${L.technicalEyebrow}</div><h2>${L.technicalTitle}</h2><table><tr><th>${L.colCheck}</th><th>${L.colStatus}</th><th>${L.colFinding}</th></tr>${techRows}</table>${footer(a, n++, preparedBy)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secContent, L)}<div class="eyebrow">${L.contentEyebrow}</div><h2>${L.contentTitle}</h2><div class="two-col"><div><h3>${L.strengths}</h3>${list(a.content.strengths)}</div><div><h3>${L.weaknesses}</h3>${list(a.content.weaknesses)}</div></div><h3>${L.gaps}</h3>${list(a.content.gaps)}${checksBy('content').length ? `<table><tr><th>${L.colCheck}</th><th>${L.colStatus}</th><th>${L.colFinding}</th></tr>${checksBy('content').map((c) => `<tr><td>${esc(c.label)}</td>${statusCell(c.status, L)}<td>${esc(c.value)}</td></tr>`).join('')}</table>` : ''}${footer(a, n++, preparedBy)}</div>`);
   const geoRows = [...checksBy('aeo'), ...checksBy('geo')].map((c) => `<tr><td>${esc(c.label)}</td>${statusCell(c.status, L)}<td>${esc(c.value)}${c.comment ? `. ${esc(c.comment.charAt(0).toUpperCase() + c.comment.slice(1))}` : ''}</td></tr>`).join('') + (a.geo.rows || []).map(([k, s, d]) => `<tr><td>${t(k)}</td><td>${t(s)}</td><td>${t(d)}</td></tr>`).join('');
-  pages.push(`<div class="page">${header(a, L.secAeo, L)}<div class="eyebrow">${L.aeoEyebrow}</div><h2>${L.aeoTitle}</h2><p class="lead">Whether the site's answers can be lifted into "People also ask", AI overviews, ChatGPT and Perplexity.</p><div class="two-col"><div><h3>${L.aeoWorks}</h3>${list(a.aeo.works)}</div><div><h3>${L.aeoBlocks}</h3>${list(a.aeo.blocks)}</div></div><div class="callout"><p><strong>${L.recommendation}</strong> ${t(a.aeo.recommendation)}</p></div><h2>${L.geoTitle}</h2><table><tr><th>${L.colSignal}</th><th>${L.colStatus}</th><th>${L.colDetail}</th></tr>${geoRows}</table><div class="callout"><p>${t(a.geo.callout)}</p></div>${footer(a, n++)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secAeo, L)}<div class="eyebrow">${L.aeoEyebrow}</div><h2>${L.aeoTitle}</h2><p class="lead">Whether the site's answers can be lifted into "People also ask", AI overviews, ChatGPT and Perplexity.</p><div class="two-col"><div><h3>${L.aeoWorks}</h3>${list(a.aeo.works)}</div><div><h3>${L.aeoBlocks}</h3>${list(a.aeo.blocks)}</div></div><div class="callout"><p><strong>${L.recommendation}</strong> ${t(a.aeo.recommendation)}</p></div><h2>${L.geoTitle}</h2><table><tr><th>${L.colSignal}</th><th>${L.colStatus}</th><th>${L.colDetail}</th></tr>${geoRows}</table><div class="callout"><p>${t(a.geo.callout)}</p></div>${footer(a, n++, preparedBy)}</div>`);
   const checkTable = (g) => (checksBy(g).length ? `<table><tr><th>${L.colCheck}</th><th>${L.colStatus}</th><th>${L.colFinding}</th></tr>${checksBy(g).map((c) => `<tr><td>${esc(c.label)}</td>${statusCell(c.status, L)}<td>${esc(c.value)}${c.comment ? `<br><span style="color:var(--muted)">${esc(c.comment)}</span>` : ''}</td></tr>`).join('')}</table>` : '');
-  pages.push(`<div class="page">${header(a, L.secOffpage, L)}<div class="eyebrow">${L.offpageEyebrow}</div><h2>${L.offpageTitle}</h2>${checkTable('offpage')}${list(a.offpage.listed)}<p>${t(a.offpage.note)}</p><div class="eyebrow" style="margin-top:8mm">${L.conversionEyebrow}</div><h2>${L.conversionTitle}</h2>${checkTable('conversion')}<table><tr><th>${L.colElement}</th><th>${L.colStatus}</th></tr>${(a.conversion.rows || []).map(([k, v]) => `<tr><td>${t(k)}</td><td>${t(v)}</td></tr>`).join('')}</table><div class="eyebrow" style="margin-top:8mm">${L.limitationsEyebrow}</div><h2>${L.sourcesTitle}</h2>${(a.sources || []).length ? `<table><tr><th>${L.colSource}</th><th>${L.colAccess}</th><th>${L.colWhatRead}</th></tr>${a.sources.map((s) => `<tr><td>${t(s.name)}</td><td>${t(s.access)}</td><td>${t(s.detail)}</td></tr>`).join('')}</table><p class="scorecard-foot">${L.sourcesFoot}</p>` : ''}<h3>${L.limitations}</h3>${list(a.limitations)}${footer(a, n++)}</div>`);
+  pages.push(`<div class="page">${header(a, L.secOffpage, L)}<div class="eyebrow">${L.offpageEyebrow}</div><h2>${L.offpageTitle}</h2>${checkTable('offpage')}${list(a.offpage.listed)}<p>${t(a.offpage.note)}</p><div class="eyebrow" style="margin-top:8mm">${L.conversionEyebrow}</div><h2>${L.conversionTitle}</h2>${checkTable('conversion')}<table><tr><th>${L.colElement}</th><th>${L.colStatus}</th></tr>${(a.conversion.rows || []).map(([k, v]) => `<tr><td>${t(k)}</td><td>${t(v)}</td></tr>`).join('')}</table><div class="eyebrow" style="margin-top:8mm">${L.limitationsEyebrow}</div><h2>${L.sourcesTitle}</h2>${(a.sources || []).length ? `<table><tr><th>${L.colSource}</th><th>${L.colAccess}</th><th>${L.colWhatRead}</th></tr>${a.sources.map((s) => `<tr><td>${t(s.name)}</td><td>${t(s.access)}</td><td>${t(s.detail)}</td></tr>`).join('')}</table><p class="scorecard-foot">${L.sourcesFoot}</p>` : ''}<h3>${L.limitations}</h3>${list(a.limitations)}${footer(a, n++, preparedBy)}</div>`);
   const phases = (a.roadmap || []).map((p) => `<div class="phase"><div class="phase-head"><span class="badge">${esc(p.badge)}</span><span class="phase-title">${t(p.title)}</span></div>${olist(p.items)}</div>`).join('');
-  pages.push(`<div class="page">${header(a, L.secRoadmap, L)}<div class="eyebrow">${L.roadmapEyebrow}</div><h2>${L.roadmapTitle}</h2>${phases}<div class="verdict"><p><strong>${L.keyMessage}</strong> ${t(a.closing)}</p></div>${footer(a, n++)}</div>`);
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(a.client.name)}: SEO, AEO and GEO audit</title><link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono&display=swap"><style>${css()}</style></head><body>${pages.join('\n')}</body></html>`;
+  pages.push(`<div class="page">${header(a, L.secRoadmap, L)}<div class="eyebrow">${L.roadmapEyebrow}</div><h2>${L.roadmapTitle}</h2>${phases}<div class="verdict"><p><strong>${L.keyMessage}</strong> ${t(a.closing)}</p></div>${footer(a, n++, preparedBy)}</div>`);
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(a.client.name)}: SEO, AEO and GEO audit</title><link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Fraunces:opsz,wght@9..144,600&family=IBM+Plex+Sans:wght@400;500;600&family=IBM+Plex+Mono&display=swap"><style>${css()}${accentCss}</style></head><body>${pages.join('\n')}</body></html>`;
 }
 
 function findChrome() {
@@ -192,8 +203,8 @@ function findChrome() {
   return candidates.find((p) => existsSync(p));
 }
 
-export async function render(audit, { out, pdf = false } = {}) {
-  const html = toHtml(audit);
+export async function render(audit, { out, pdf = false, brand = null } = {}) {
+  const html = toHtml(audit, brand);
   writeFileSync(out, html);
   let pdfPath = null;
   if (pdf) {

package/src/test-agency.mjs

@@ -0,0 +1,86 @@
+/**
+ * Правило, которое защищает этот файл: платное оформление не включается без лицензии, а
+ * бесплатная подпись работает всегда. Если сломать первое, агентский план перестанет продаваться,
+ * если второе, отчёт перестанет подписываться именем покупателя.
+ *
+ * Ключ здесь генерируется прямо в тесте одноразовой парой Ed25519: настоящий приватный ключ в
+ * репозитории не лежит и лежать не должен.
+ */
+import { generateKeyPairSync, sign } from 'node:crypto';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveBranding, verifyKey, softenHex } from './agency.mjs';
+import { toHtml } from './render.mjs';
+
+let failed = 0;
+const ok = (name, cond) => { if (cond) console.log(`ok   ${name}`); else { failed++; console.error(`FAIL ${name}`); } };
+
+const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+const pub = publicKey.export({ type: 'spki', format: 'pem' });
+const makeKey = (data) => {
+  const payload = Buffer.from(JSON.stringify(data));
+  return `OSK1.${payload.toString('base64url')}.${sign(null, payload, privateKey).toString('base64url')}`;
+};
+
+// Проверка подписи
+ok('правильный ключ принимается', verifyKey(makeKey({ email: 'a@b.co', plan: 'agency' }), pub).ok);
+ok('мусор отвергается', !verifyKey('OSK1.aaa.bbb', pub).ok);
+ok('чужая подпись отвергается', !verifyKey(makeKey({ plan: 'agency' }).replace(/.$/, 'A'), pub).ok);
+ok('просроченный план отвергается', !verifyKey(makeKey({ plan: 'agency', expires: '2020-01-01' }), pub).ok);
+ok('ключ другого продукта отвергается', !verifyKey(makeKey({ plan: 'site-kit' }), pub).ok);
+ok('срок в будущем проходит', verifyKey(makeKey({ plan: 'agency', expires: '2999-01-01' }), pub).ok);
+
+// Что бесплатно, а что нет
+const free = resolveBranding({ by: 'Harper & Vale' });
+ok('подпись именем работает без лицензии', free.preparedBy === 'Harper & Vale' && free.notes.length === 0);
+ok('без платных опций строка об инструменте остаётся', free.showToolLine === true);
+
+const blocked = resolveBranding({ by: 'X', color: '#123456', toolLine: false });
+ok('без лицензии цвет не применяется', !blocked.accent && blocked.showToolLine === true);
+ok('и человеку сказано почему', blocked.notes.some((n) => /agency plan/i.test(n)));
+
+// Цвет
+ok('светлая версия цвета светлее исходной', parseInt(softenHex('#0b7a75').slice(1, 3), 16) > 0x0b);
+ok('кривой цвет не проходит', resolveBranding({ color: 'нет', licence: makeKey({ plan: 'agency' }) }).accent === '');
+
+// Вёрстка
+const audit = {
+  meta: { host: 'example.com', tool: '@operstack/audit 0.0.0', collectedAt: '2026-01-01T00:00:00Z', auditType: 'External', lang: 'en' },
+  client: { name: 'Client', subject: 'Sells things', reportDate: '2026-01-01', preparedBy: 'OperStack' },
+  scores: {}, scoreBasis: {}, summary: { lead: 'a', verdict: 'b', priorities: ['c'] },
+  overview: { rows: [], note: '' }, sample: [], checks: [], critical: [],
+  content: { strengths: [], weaknesses: [], gaps: [] },
+  aeo: { works: [], blocks: [], recommendation: '' }, geo: { rows: [], callout: '' },
+  offpage: { listed: [], note: '' }, conversion: { rows: [] }, sources: [], limitations: [],
+  roadmap: [], closing: 'done',
+};
+const plain = toHtml(audit);
+ok('без оформления на обложке стоит наше имя', plain.includes('OperStack') && !plain.includes('<img class="cover-logo"'));
+
+const branded = toHtml(audit, { preparedBy: 'Harper & Vale Digital', logo: 'data:image/svg+xml;base64,AAA', accent: '#7b3fa0', showToolLine: false });
+ok('имя агентства попало на обложку', branded.includes('Harper &amp; Vale Digital'));
+ok('логотип попал на обложку', branded.includes('<img class="cover-logo"'));
+ok('цвет агентства подменил акцент', branded.includes('--accent:#7b3fa0'));
+ok('строка про инструмент убрана', !branded.includes('@operstack/audit 0.0.0'));
+ok('но воспроизводимость обещана по-прежнему', /reproduced from it/i.test(branded));
+ok('нашего имени в фирменном отчёте не осталось', !/OperStack/.test(branded));
+
+// Список сайтов
+const { parseList } = await import('./batch.mjs');
+const list = parseList('# комментарий\n\nexample.com, Northline Dental\nhttps://two.example\nне адрес\n');
+ok('список разбирается', list.length === 3 && list[0].name === 'Northline Dental');
+ok('адрес без схемы достраивается', list[0].url.startsWith('https://example.com'));
+ok('строка-мусор помечена, а не роняет прогон', list[2].invalid === true);
+
+// Ключ из файла рядом с работой
+const dir = mkdtempSync(join(tmpdir(), 'operstack-agency-'));
+writeFileSync(join(dir, '.operstack-licence'), makeKey({ plan: 'agency', email: 'x@y.z' }));
+const cwd = process.cwd();
+process.chdir(dir);
+const { findKey } = await import('./agency.mjs');
+ok('ключ читается из файла .operstack-licence', findKey().startsWith('OSK1.'));
+process.chdir(cwd);
+
+console.log(failed ? `\n${failed} проверок не прошли` : '\nагентский план: лицензия, оформление и список проверены');
+process.exit(failed ? 1 : 0);