@rankcli/cli 0.0.21 → 0.0.22

package/dist/chunk-YX67Q5F6.mjs

@@ -0,0 +1,162 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/wasm-engine.ts
+import * as vm from "vm";
+import * as path from "path";
+import * as fs from "fs";
+var PREMIUM_CHECK_NAMES = [
+  "analyzeFeaturedSnippet",
+  "analyzeInternalLinkGraph",
+  "analyzeEEATSignals",
+  "analyzeContentScience",
+  "analyzeKeywordCannibalizationSinglePage",
+  "analyzeConversionElements",
+  "analyzeKeywordPlacement",
+  "analyzeTopicalClusters",
+  "analyzePlatformPresence",
+  "analyzeInteractiveTools",
+  "analyzeFunnelIntent",
+  "analyzeNavBoostSignals",
+  "analyzeEntitySEO",
+  "analyzeFreshnessSignals",
+  "analyzeAIContentStructure",
+  "analyzeRAGChunkReadiness",
+  "analyzeCitationQuality",
+  "analyzeAnswerConciseness",
+  "analyzeBrandMentionOptimization",
+  "analyzeAICitationWorthiness",
+  "analyzeReviewEcosystem"
+];
+var wasmModule = null;
+var auditContext = null;
+async function loadWasm() {
+  if (wasmModule) return wasmModule;
+  const possiblePaths = [
+    path.join(__dirname, "../native/pkg/rankcli_audit_engine.js"),
+    path.join(__dirname, "../wasm/rankcli_audit_engine.js"),
+    path.join(__dirname, "../../native/pkg/rankcli_audit_engine.js")
+  ];
+  for (const wasmPath of possiblePaths) {
+    if (fs.existsSync(wasmPath)) {
+      wasmModule = __require(wasmPath);
+      return wasmModule;
+    }
+  }
+  throw new Error(
+    `WASM engine not found. Run \`npm run build:wasm\` first.
+Searched: ${possiblePaths.join(", ")}`
+  );
+}
+async function initEngine(decryptPassphrase) {
+  const wasm = await loadWasm();
+  try {
+    wasm.init_engine(decryptPassphrase);
+  } catch (error) {
+    throw new Error(`Failed to decrypt premium checks: ${error}`);
+  }
+  if (!wasm.is_initialized()) {
+    throw new Error("Failed to decrypt premium checks: engine did not initialize");
+  }
+  const jsCode = wasm.get_decrypted_code();
+  createExecutionContext(jsCode);
+}
+function createExecutionContext(jsCode) {
+  const sandbox = {
+    // Console for debugging (can be disabled in production)
+    console: {
+      log: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      }
+    },
+    // Timers (some checks may use setTimeout)
+    setTimeout,
+    clearTimeout,
+    // JSON parsing
+    JSON,
+    // Math operations
+    Math,
+    // String/Array operations
+    String,
+    Array,
+    Object,
+    RegExp,
+    Date,
+    // URL parsing
+    URL,
+    URLSearchParams,
+    // Node.js globals needed by bundled dependencies (e.g., cheerio)
+    Buffer,
+    process: { env: {} },
+    // TextEncoder/TextDecoder for string handling
+    TextEncoder,
+    TextDecoder,
+    // The RankCLI namespace will be populated by the code
+    RankCLI: {},
+    // Global reference
+    globalThis: {}
+  };
+  sandbox.globalThis = sandbox;
+  auditContext = vm.createContext(sandbox);
+  try {
+    vm.runInContext(jsCode, auditContext, {
+      filename: "rankcli-checks.js",
+      timeout: 5e3
+      // 5 second timeout for initialization
+    });
+  } catch (error) {
+    throw new Error(`Failed to initialize audit checks: ${error}`);
+  }
+}
+function callSandboxCheck(fnName, html, url) {
+  if (!auditContext) {
+    throw new Error("Engine not initialized. Call initEngine() first.");
+  }
+  const script = new vm.Script(`
+    (function() {
+      if (typeof RankCLI.${fnName} !== 'function') {
+        throw new Error('RankCLI.${fnName} not found in decrypted code');
+      }
+      return JSON.stringify(RankCLI.${fnName}(${JSON.stringify(html)}, ${JSON.stringify(url)}));
+    })()
+  `);
+  const resultJson = script.runInContext(auditContext, { timeout: 1e4 });
+  return JSON.parse(resultJson);
+}
+async function getPremiumChecks() {
+  const wasm = await loadWasm();
+  if (!wasm.is_initialized()) {
+    throw new Error("Engine not initialized. Call initEngine() first.");
+  }
+  const checks = {};
+  for (const name of PREMIUM_CHECK_NAMES) {
+    checks[name] = (html, url) => callSandboxCheck(name, html, url);
+  }
+  return checks;
+}
+async function getVersion() {
+  const wasm = await loadWasm();
+  return wasm.version();
+}
+async function isReady() {
+  try {
+    const wasm = await loadWasm();
+    return wasm.is_initialized();
+  } catch {
+    return false;
+  }
+}
+
+export {
+  initEngine,
+  getPremiumChecks,
+  getVersion,
+  isReady
+};

package/dist/index.js

@@ -289,7 +289,7 @@ var import_chalk2 = __toESM(require("chalk"));
 // src/lib/config.ts
 var import_conf = __toESM(require("conf"));
 var import_supabase_js = require("@supabase/supabase-js");
-var INJECTED_CONFIG = {"supabaseUrl":"https://bspljbxwbjiqueeyzyat.supabase.co","supabaseAnonKey":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJzcGxqYnh3YmppcXVlZXl6eWF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjkyNzQ1NTksImV4cCI6MjA4NDg1MDU1OX0.7gprxM2gT9cZ99sjZURLltrln78dEnwyFFKYpTzBaUU","webAppUrl":"https://rankcli.dev"};
+var INJECTED_CONFIG = {"supabaseUrl":"https://bspljbxwbjiqueeyzyat.supabase.co","supabaseAnonKey":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJzcGxqYnh3YmppcXVlZXl6eWF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjkyNzQ1NTksImV4cCI6MjA4NDg1MDU1OX0.7gprxM2gT9cZ99sjZURLltrln78dEnwyFFKYpTzBaUU","webAppUrl":"https://rankcli.dev","decryptPassphrase":"lKFLeIw/xGPa6E8c4XswZX/oiLtJf/yLF/Y6zwovte8="};
 function getSupabaseUrl() {
   const url = process.env.RANKCLI_SUPABASE_URL || process.env.VITE_SUPABASE_URL || INJECTED_CONFIG?.supabaseUrl;
   if (!url) {
@@ -319,6 +319,9 @@ function getSupabaseAnonKeyLazy() {
   return _supabaseAnonKey;
 }
 var WEB_APP_URL = process.env.RANKCLI_WEB_URL || INJECTED_CONFIG?.webAppUrl || "https://rankcli.dev";
+function getDecryptPassphrase() {
+  return process.env.RANKCLI_BUILD_KEY || INJECTED_CONFIG?.decryptPassphrase;
+}
 function getApiUrl() {
   return process.env.RANKCLI_API_URL || getSupabaseUrlLazy();
 }
@@ -462,6 +465,7 @@ function getUserInfo() {
   return {
     userId: config.get("userId"),
     email: config.get("email"),
+    planId: config.get("planId"),
     planName: config.get("planName") || "Free",
     sitesLimit: config.get("sitesLimit") || 1
   };
@@ -664,6 +668,143 @@ function hasFeature(tier, feature) {
   return limits?.features?.[feature] ?? false;
 }
 
+// src/wasm-engine.ts
+var vm = __toESM(require("vm"));
+var path = __toESM(require("path"));
+var fs = __toESM(require("fs"));
+var PREMIUM_CHECK_NAMES = [
+  "analyzeFeaturedSnippet",
+  "analyzeInternalLinkGraph",
+  "analyzeEEATSignals",
+  "analyzeContentScience",
+  "analyzeKeywordCannibalizationSinglePage",
+  "analyzeConversionElements",
+  "analyzeKeywordPlacement",
+  "analyzeTopicalClusters",
+  "analyzePlatformPresence",
+  "analyzeInteractiveTools",
+  "analyzeFunnelIntent",
+  "analyzeNavBoostSignals",
+  "analyzeEntitySEO",
+  "analyzeFreshnessSignals",
+  "analyzeAIContentStructure",
+  "analyzeRAGChunkReadiness",
+  "analyzeCitationQuality",
+  "analyzeAnswerConciseness",
+  "analyzeBrandMentionOptimization",
+  "analyzeAICitationWorthiness",
+  "analyzeReviewEcosystem"
+];
+var wasmModule = null;
+var auditContext = null;
+async function loadWasm() {
+  if (wasmModule) return wasmModule;
+  const possiblePaths = [
+    path.join(__dirname, "../native/pkg/rankcli_audit_engine.js"),
+    path.join(__dirname, "../wasm/rankcli_audit_engine.js"),
+    path.join(__dirname, "../../native/pkg/rankcli_audit_engine.js")
+  ];
+  for (const wasmPath of possiblePaths) {
+    if (fs.existsSync(wasmPath)) {
+      wasmModule = require(wasmPath);
+      return wasmModule;
+    }
+  }
+  throw new Error(
+    `WASM engine not found. Run \`npm run build:wasm\` first.
+Searched: ${possiblePaths.join(", ")}`
+  );
+}
+async function initEngine(decryptPassphrase) {
+  const wasm = await loadWasm();
+  try {
+    wasm.init_engine(decryptPassphrase);
+  } catch (error) {
+    throw new Error(`Failed to decrypt premium checks: ${error}`);
+  }
+  if (!wasm.is_initialized()) {
+    throw new Error("Failed to decrypt premium checks: engine did not initialize");
+  }
+  const jsCode = wasm.get_decrypted_code();
+  createExecutionContext(jsCode);
+}
+function createExecutionContext(jsCode) {
+  const sandbox = {
+    // Console for debugging (can be disabled in production)
+    console: {
+      log: () => {
+      },
+      warn: () => {
+      },
+      error: () => {
+      }
+    },
+    // Timers (some checks may use setTimeout)
+    setTimeout,
+    clearTimeout,
+    // JSON parsing
+    JSON,
+    // Math operations
+    Math,
+    // String/Array operations
+    String,
+    Array,
+    Object,
+    RegExp,
+    Date,
+    // URL parsing
+    URL,
+    URLSearchParams,
+    // Node.js globals needed by bundled dependencies (e.g., cheerio)
+    Buffer,
+    process: { env: {} },
+    // TextEncoder/TextDecoder for string handling
+    TextEncoder,
+    TextDecoder,
+    // The RankCLI namespace will be populated by the code
+    RankCLI: {},
+    // Global reference
+    globalThis: {}
+  };
+  sandbox.globalThis = sandbox;
+  auditContext = vm.createContext(sandbox);
+  try {
+    vm.runInContext(jsCode, auditContext, {
+      filename: "rankcli-checks.js",
+      timeout: 5e3
+      // 5 second timeout for initialization
+    });
+  } catch (error) {
+    throw new Error(`Failed to initialize audit checks: ${error}`);
+  }
+}
+function callSandboxCheck(fnName, html, url) {
+  if (!auditContext) {
+    throw new Error("Engine not initialized. Call initEngine() first.");
+  }
+  const script = new vm.Script(`
+    (function() {
+      if (typeof RankCLI.${fnName} !== 'function') {
+        throw new Error('RankCLI.${fnName} not found in decrypted code');
+      }
+      return JSON.stringify(RankCLI.${fnName}(${JSON.stringify(html)}, ${JSON.stringify(url)}));
+    })()
+  `);
+  const resultJson = script.runInContext(auditContext, { timeout: 1e4 });
+  return JSON.parse(resultJson);
+}
+async function getPremiumChecks() {
+  const wasm = await loadWasm();
+  if (!wasm.is_initialized()) {
+    throw new Error("Engine not initialized. Call initEngine() first.");
+  }
+  const checks = {};
+  for (const name of PREMIUM_CHECK_NAMES) {
+    checks[name] = (html, url) => callSandboxCheck(name, html, url);
+  }
+  return checks;
+}
+
 // src/commands/audit.ts
 var { detectFramework: detectFramework2, getFrameworkDisplayName, getFrameworkIssues } = import_agent_runtime.frameworks;
 async function fetchHtml(url, timeout = 1e4) {
@@ -868,6 +1009,21 @@ async function audit(options) {
   const aiProvider = options.aiProvider || "openai";
   const aiKey = options.aiKey || (aiProvider === "anthropic" ? process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY : process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY) || "";
   const loggedIn = isLoggedIn();
+  const { planId } = getUserInfo();
+  const tierId = planId && planId in TIER_LIMITS ? planId : loggedIn ? "free" : "free_anon";
+  const checksLimit = TIER_LIMITS[tierId].checks;
+  let premiumChecks;
+  if (checksLimit > TIER_LIMITS.free.checks) {
+    const passphrase = getDecryptPassphrase();
+    if (passphrase) {
+      try {
+        await initEngine(passphrase);
+        premiumChecks = await getPremiumChecks();
+      } catch (error) {
+        console.error(import_chalk2.default.dim(`(premium checks unavailable: ${error instanceof Error ? error.message : error})`));
+      }
+    }
+  }
   if (!url) {
     console.log("\n\u26A0\uFE0F  Please provide a URL to audit:");
     console.log("   rankcli audit --url https://your-site.com");
@@ -912,7 +1068,9 @@ async function audit(options) {
         const report = await (0, import_agent_runtime.runFullAudit)({
           url: pageUrl,
           maxPages: 1,
-          checkBrokenLinks: options.checkLinks || false
+          checkBrokenLinks: options.checkLinks || false,
+          checksLimit,
+          premiumChecks
         });
         auditSpinner.text = `Auditing pages... (${index + 1}/${pagesToAudit.length} complete)`;
         return { report, url: pageUrl };
@@ -2673,13 +2831,13 @@ function extractBodyText(html) {
 
 // src/commands/setup.ts
 var readline2 = __toESM(require("readline"));
-var fs = __toESM(require("fs"));
-var path = __toESM(require("path"));
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
 var import_agent_runtime8 = require("@rankcli/agent-runtime");
 async function setup(options) {
   console.log("\n\u{1F527} SEO Autopilot - Setup\n");
   const projectPath = process.cwd();
-  if (!fs.existsSync(path.join(projectPath, "package.json")) && !fs.existsSync(path.join(projectPath, "index.html"))) {
+  if (!fs2.existsSync(path2.join(projectPath, "package.json")) && !fs2.existsSync(path2.join(projectPath, "index.html"))) {
     console.log("\u26A0\uFE0F  No package.json or index.html found. Are you in a web project directory?\n");
   }
   if (options.all || !options.ga4 && !options.gsc && !options.githubAction) {
@@ -2790,16 +2948,16 @@ async function setupGA4(projectPath, measurementId) {
       console.log(result.code);
     }
   }
-  const envExamplePath = path.join(projectPath, ".env.example");
+  const envExamplePath = path2.join(projectPath, ".env.example");
   const envContent = (0, import_agent_runtime8.generateGA4EnvTemplate)();
-  if (fs.existsSync(envExamplePath)) {
-    const existing = fs.readFileSync(envExamplePath, "utf-8");
+  if (fs2.existsSync(envExamplePath)) {
+    const existing = fs2.readFileSync(envExamplePath, "utf-8");
     if (!existing.includes("GA4_MEASUREMENT_ID")) {
-      fs.appendFileSync(envExamplePath, "\n" + envContent);
+      fs2.appendFileSync(envExamplePath, "\n" + envContent);
       console.log("   Updated: .env.example");
     }
   } else {
-    fs.writeFileSync(envExamplePath, envContent);
+    fs2.writeFileSync(envExamplePath, envContent);
     console.log("   Created: .env.example");
   }
   console.log("");
@@ -2833,7 +2991,7 @@ async function setupGitHubAction(projectPath, schedule, siteUrl) {
   const { files, instructions } = (0, import_agent_runtime8.writeGitHubActionFiles)(projectPath, config2);
   console.log("\u2705 GitHub Action files created:");
   for (const file of files) {
-    console.log(`   - ${path.relative(projectPath, file)}`);
+    console.log(`   - ${path2.relative(projectPath, file)}`);
   }
   console.log(instructions);
 }
@@ -3224,7 +3382,7 @@ async function fetchAndSaveSubscription() {
 }
 
 // src/version.ts
-var VERSION = "0.0.21";
+var VERSION = "0.0.22";
 
 // src/index.ts
 var program = new import_commander.Command();

package/dist/index.mjs

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
-import "./chunk-Y6FXYEAI.mjs";
+import {
+  getPremiumChecks,
+  initEngine
+} from "./chunk-YX67Q5F6.mjs";
 
 // src/index.ts
 import { Command } from "commander";
@@ -267,7 +270,7 @@ import chalk2 from "chalk";
 // src/lib/config.ts
 import Conf from "conf";
 import { createClient } from "@supabase/supabase-js";
-const INJECTED_CONFIG = {"supabaseUrl":"https://bspljbxwbjiqueeyzyat.supabase.co","supabaseAnonKey":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJzcGxqYnh3YmppcXVlZXl6eWF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjkyNzQ1NTksImV4cCI6MjA4NDg1MDU1OX0.7gprxM2gT9cZ99sjZURLltrln78dEnwyFFKYpTzBaUU","webAppUrl":"https://rankcli.dev"};
+const INJECTED_CONFIG = {"supabaseUrl":"https://bspljbxwbjiqueeyzyat.supabase.co","supabaseAnonKey":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJzcGxqYnh3YmppcXVlZXl6eWF0Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjkyNzQ1NTksImV4cCI6MjA4NDg1MDU1OX0.7gprxM2gT9cZ99sjZURLltrln78dEnwyFFKYpTzBaUU","webAppUrl":"https://rankcli.dev","decryptPassphrase":"lKFLeIw/xGPa6E8c4XswZX/oiLtJf/yLF/Y6zwovte8="};
 function getSupabaseUrl() {
   const url = process.env.RANKCLI_SUPABASE_URL || process.env.VITE_SUPABASE_URL || INJECTED_CONFIG?.supabaseUrl;
   if (!url) {
@@ -297,6 +300,9 @@ function getSupabaseAnonKeyLazy() {
   return _supabaseAnonKey;
 }
 var WEB_APP_URL = process.env.RANKCLI_WEB_URL || INJECTED_CONFIG?.webAppUrl || "https://rankcli.dev";
+function getDecryptPassphrase() {
+  return process.env.RANKCLI_BUILD_KEY || INJECTED_CONFIG?.decryptPassphrase;
+}
 function getApiUrl() {
   return process.env.RANKCLI_API_URL || getSupabaseUrlLazy();
 }
@@ -440,6 +446,7 @@ function getUserInfo() {
   return {
     userId: config.get("userId"),
     email: config.get("email"),
+    planId: config.get("planId"),
     planName: config.get("planName") || "Free",
     sitesLimit: config.get("sitesLimit") || 1
   };
@@ -846,6 +853,21 @@ async function audit(options) {
   const aiProvider = options.aiProvider || "openai";
   const aiKey = options.aiKey || (aiProvider === "anthropic" ? process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY : process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY) || "";
   const loggedIn = isLoggedIn();
+  const { planId } = getUserInfo();
+  const tierId = planId && planId in TIER_LIMITS ? planId : loggedIn ? "free" : "free_anon";
+  const checksLimit = TIER_LIMITS[tierId].checks;
+  let premiumChecks;
+  if (checksLimit > TIER_LIMITS.free.checks) {
+    const passphrase = getDecryptPassphrase();
+    if (passphrase) {
+      try {
+        await initEngine(passphrase);
+        premiumChecks = await getPremiumChecks();
+      } catch (error) {
+        console.error(chalk2.dim(`(premium checks unavailable: ${error instanceof Error ? error.message : error})`));
+      }
+    }
+  }
   if (!url) {
     console.log("\n\u26A0\uFE0F  Please provide a URL to audit:");
     console.log("   rankcli audit --url https://your-site.com");
@@ -890,7 +912,9 @@ async function audit(options) {
         const report = await runFullAudit({
           url: pageUrl,
           maxPages: 1,
-          checkBrokenLinks: options.checkLinks || false
+          checkBrokenLinks: options.checkLinks || false,
+          checksLimit,
+          premiumChecks
         });
         auditSpinner.text = `Auditing pages... (${index + 1}/${pagesToAudit.length} complete)`;
         return { report, url: pageUrl };
@@ -1615,7 +1639,7 @@ ${chalk3.green("\u2705")} Changes committed`);
 import ora3 from "ora";
 import chalk4 from "chalk";
 import { table } from "table";
-import { RankTracker, TIER_LIMITS as TIER_LIMITS3 } from "@rankcli/agent-runtime";
+import { RankTracker, TIER_LIMITS as TIER_LIMITS2 } from "@rankcli/agent-runtime";
 async function getProjectForUrl(url) {
   const supabase = await getAuthenticatedClient();
   if (!supabase) return null;
@@ -1645,7 +1669,7 @@ async function getProjectForUrl(url) {
   };
 }
 function getTierLimits(tier) {
-  const limits = TIER_LIMITS3[tier] || TIER_LIMITS3.free;
+  const limits = TIER_LIMITS2[tier] || TIER_LIMITS2.free;
   return {
     maxKeywords: limits.maxKeywords,
     checksPerDay: limits.checksPerDay
@@ -3241,7 +3265,7 @@ async function fetchAndSaveSubscription() {
 }
 
 // src/version.ts
-var VERSION = "0.0.21";
+var VERSION = "0.0.22";
 
 // src/index.ts
 var program = new Command();

package/dist/wasm-engine.d.mts

@@ -1,55 +1,43 @@
+import { AuditIssue } from '@rankcli/agent-runtime';
+
 /**
  * WASM Engine Wrapper
  *
- * This module bridges the WASM binary (which contains encrypted checks)
- * with Node.js execution. The flow is:
+ * Bridges the WASM binary (which contains AES-encrypted paid-tier check
+ * source) with Node.js execution:
  *
- * 1. WASM decrypts the JS code using the license key
+ * 1. WASM decrypts the JS code using a fixed, build-embedded passphrase
  * 2. We get the decrypted code from WASM
  * 3. We execute it in a Node.js VM sandbox
- * 4. Results are returned to the caller
+ * 4. Individual premium check functions are called from that sandbox
  *
- * Security: The JS source code only exists in memory briefly during execution.
- * Users cannot extract it from node_modules - they only see the WASM binary.
+ * This is code protection, not access control: entitlement (is this user
+ * actually paid?) is decided by the caller, from the real Supabase-backed
+ * apiKey/plan the CLI validates on login - see commands/audit.ts. This
+ * module should only ever be initialized after that check passes; there
+ * is no per-user license key, and passing an arbitrary string here does
+ * not grant anything a validated apiKey didn't already grant.
  */
-interface AuditResult {
-    success: boolean;
-    score: number;
+
+type PremiumCheckFn = (html: string, url: string) => {
     issues: AuditIssue[];
-    checksRun: number;
-    tier: string;
-}
-interface AuditIssue {
-    code: string;
-    severity: 'error' | 'warning' | 'notice';
-    category: string;
-    title: string;
-    description?: string;
-    impact?: string;
-    howToFix?: string;
-    affectedUrls?: string[];
-}
-type Tier = 'free' | 'registered' | 'solo' | 'pro' | 'agency';
-/**
- * Initialize the engine with a license key
- */
-declare function initEngine(licenseKey?: string): Promise<void>;
-/**
- * Run an SEO audit on a URL
- */
-declare function runAudit(url: string, html: string): Promise<AuditResult>;
-/**
- * Get the current tier
- */
-declare function getTier(): Promise<Tier>;
+    data: unknown;
+};
+declare const PREMIUM_CHECK_NAMES: readonly ["analyzeFeaturedSnippet", "analyzeInternalLinkGraph", "analyzeEEATSignals", "analyzeContentScience", "analyzeKeywordCannibalizationSinglePage", "analyzeConversionElements", "analyzeKeywordPlacement", "analyzeTopicalClusters", "analyzePlatformPresence", "analyzeInteractiveTools", "analyzeFunnelIntent", "analyzeNavBoostSignals", "analyzeEntitySEO", "analyzeFreshnessSignals", "analyzeAIContentStructure", "analyzeRAGChunkReadiness", "analyzeCitationQuality", "analyzeAnswerConciseness", "analyzeBrandMentionOptimization", "analyzeAICitationWorthiness", "analyzeReviewEcosystem"];
+type PremiumChecks = Record<(typeof PREMIUM_CHECK_NAMES)[number], PremiumCheckFn>;
 /**
- * Get the checks limit for the current tier
+ * Decrypt the embedded premium checks and prepare them for execution.
+ * Only call this once the caller has independently confirmed the user is
+ * entitled to premium checks (a validated paid apiKey) - see the module
+ * doc comment above.
  */
-declare function getChecksLimit(): Promise<number>;
+declare function initEngine(decryptPassphrase: string): Promise<void>;
 /**
- * Validate a license key without initializing
+ * Build a PremiumChecks object (matching agent-runtime's
+ * premium-checks.types.ts) whose methods each call into the decrypted
+ * VM sandbox. Pass the result as runFullAudit({ premiumChecks }).
  */
-declare function validateLicense(licenseKey: string): Promise<Tier>;
+declare function getPremiumChecks(): Promise<PremiumChecks>;
 /**
  * Get engine version info
  */
@@ -59,4 +47,4 @@ declare function getVersion(): Promise<string>;
  */
 declare function isReady(): Promise<boolean>;
 
-export { type AuditIssue, type AuditResult, type Tier, getChecksLimit, getTier, getVersion, initEngine, isReady, runAudit, validateLicense };
+export { type PremiumCheckFn, type PremiumChecks, getPremiumChecks, getVersion, initEngine, isReady };

package/dist/wasm-engine.d.ts

@@ -1,55 +1,43 @@
+import { AuditIssue } from '@rankcli/agent-runtime';
+
 /**
  * WASM Engine Wrapper
  *
- * This module bridges the WASM binary (which contains encrypted checks)
- * with Node.js execution. The flow is:
+ * Bridges the WASM binary (which contains AES-encrypted paid-tier check
+ * source) with Node.js execution:
  *
- * 1. WASM decrypts the JS code using the license key
+ * 1. WASM decrypts the JS code using a fixed, build-embedded passphrase
  * 2. We get the decrypted code from WASM
  * 3. We execute it in a Node.js VM sandbox
- * 4. Results are returned to the caller
+ * 4. Individual premium check functions are called from that sandbox
  *
- * Security: The JS source code only exists in memory briefly during execution.
- * Users cannot extract it from node_modules - they only see the WASM binary.
+ * This is code protection, not access control: entitlement (is this user
+ * actually paid?) is decided by the caller, from the real Supabase-backed
+ * apiKey/plan the CLI validates on login - see commands/audit.ts. This
+ * module should only ever be initialized after that check passes; there
+ * is no per-user license key, and passing an arbitrary string here does
+ * not grant anything a validated apiKey didn't already grant.
  */
-interface AuditResult {
-    success: boolean;
-    score: number;
+
+type PremiumCheckFn = (html: string, url: string) => {
     issues: AuditIssue[];
-    checksRun: number;
-    tier: string;
-}
-interface AuditIssue {
-    code: string;
-    severity: 'error' | 'warning' | 'notice';
-    category: string;
-    title: string;
-    description?: string;
-    impact?: string;
-    howToFix?: string;
-    affectedUrls?: string[];
-}
-type Tier = 'free' | 'registered' | 'solo' | 'pro' | 'agency';
-/**
- * Initialize the engine with a license key
- */
-declare function initEngine(licenseKey?: string): Promise<void>;
-/**
- * Run an SEO audit on a URL
- */
-declare function runAudit(url: string, html: string): Promise<AuditResult>;
-/**
- * Get the current tier
- */
-declare function getTier(): Promise<Tier>;
+    data: unknown;
+};
+declare const PREMIUM_CHECK_NAMES: readonly ["analyzeFeaturedSnippet", "analyzeInternalLinkGraph", "analyzeEEATSignals", "analyzeContentScience", "analyzeKeywordCannibalizationSinglePage", "analyzeConversionElements", "analyzeKeywordPlacement", "analyzeTopicalClusters", "analyzePlatformPresence", "analyzeInteractiveTools", "analyzeFunnelIntent", "analyzeNavBoostSignals", "analyzeEntitySEO", "analyzeFreshnessSignals", "analyzeAIContentStructure", "analyzeRAGChunkReadiness", "analyzeCitationQuality", "analyzeAnswerConciseness", "analyzeBrandMentionOptimization", "analyzeAICitationWorthiness", "analyzeReviewEcosystem"];
+type PremiumChecks = Record<(typeof PREMIUM_CHECK_NAMES)[number], PremiumCheckFn>;
 /**
- * Get the checks limit for the current tier
+ * Decrypt the embedded premium checks and prepare them for execution.
+ * Only call this once the caller has independently confirmed the user is
+ * entitled to premium checks (a validated paid apiKey) - see the module
+ * doc comment above.
  */
-declare function getChecksLimit(): Promise<number>;
+declare function initEngine(decryptPassphrase: string): Promise<void>;
 /**
- * Validate a license key without initializing
+ * Build a PremiumChecks object (matching agent-runtime's
+ * premium-checks.types.ts) whose methods each call into the decrypted
+ * VM sandbox. Pass the result as runFullAudit({ premiumChecks }).
  */
-declare function validateLicense(licenseKey: string): Promise<Tier>;
+declare function getPremiumChecks(): Promise<PremiumChecks>;
 /**
  * Get engine version info
  */
@@ -59,4 +47,4 @@ declare function getVersion(): Promise<string>;
  */
 declare function isReady(): Promise<boolean>;
 
-export { type AuditIssue, type AuditResult, type Tier, getChecksLimit, getTier, getVersion, initEngine, isReady, runAudit, validateLicense };
+export { type PremiumCheckFn, type PremiumChecks, getPremiumChecks, getVersion, initEngine, isReady };

package/dist/wasm-engine.js

@@ -30,18 +30,38 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/wasm-engine.ts
 var wasm_engine_exports = {};
 __export(wasm_engine_exports, {
-  getChecksLimit: () => getChecksLimit,
-  getTier: () => getTier,
+  getPremiumChecks: () => getPremiumChecks,
   getVersion: () => getVersion,
   initEngine: () => initEngine,
-  isReady: () => isReady,
-  runAudit: () => runAudit,
-  validateLicense: () => validateLicense
+  isReady: () => isReady
 });
 module.exports = __toCommonJS(wasm_engine_exports);
 var vm = __toESM(require("vm"));
 var path = __toESM(require("path"));
 var fs = __toESM(require("fs"));
+var PREMIUM_CHECK_NAMES = [
+  "analyzeFeaturedSnippet",
+  "analyzeInternalLinkGraph",
+  "analyzeEEATSignals",
+  "analyzeContentScience",
+  "analyzeKeywordCannibalizationSinglePage",
+  "analyzeConversionElements",
+  "analyzeKeywordPlacement",
+  "analyzeTopicalClusters",
+  "analyzePlatformPresence",
+  "analyzeInteractiveTools",
+  "analyzeFunnelIntent",
+  "analyzeNavBoostSignals",
+  "analyzeEntitySEO",
+  "analyzeFreshnessSignals",
+  "analyzeAIContentStructure",
+  "analyzeRAGChunkReadiness",
+  "analyzeCitationQuality",
+  "analyzeAnswerConciseness",
+  "analyzeBrandMentionOptimization",
+  "analyzeAICitationWorthiness",
+  "analyzeReviewEcosystem"
+];
 var wasmModule = null;
 var auditContext = null;
 async function loadWasm() {
@@ -62,16 +82,15 @@ async function loadWasm() {
 Searched: ${possiblePaths.join(", ")}`
   );
 }
-async function initEngine(licenseKey) {
+async function initEngine(decryptPassphrase) {
   const wasm = await loadWasm();
-  const key = licenseKey || process.env.RANKCLI_LICENSE_KEY || "";
   try {
-    wasm.init_engine(key);
+    wasm.init_engine(decryptPassphrase);
   } catch (error) {
-    if (error instanceof Error && error.message.includes("Invalid license")) {
-      throw new Error("Invalid license key. Get one at https://rankcli.dev/pricing");
-    }
-    throw error;
+    throw new Error(`Failed to decrypt premium checks: ${error}`);
+  }
+  if (!wasm.is_initialized()) {
+    throw new Error("Failed to decrypt premium checks: engine did not initialize");
   }
   const jsCode = wasm.get_decrypted_code();
   createExecutionContext(jsCode);
@@ -126,59 +145,31 @@ function createExecutionContext(jsCode) {
     throw new Error(`Failed to initialize audit checks: ${error}`);
   }
 }
-async function runAudit(url, html) {
+function callSandboxCheck(fnName, html, url) {
+  if (!auditContext) {
+    throw new Error("Engine not initialized. Call initEngine() first.");
+  }
+  const script = new vm.Script(`
+    (function() {
+      if (typeof RankCLI.${fnName} !== 'function') {
+        throw new Error('RankCLI.${fnName} not found in decrypted code');
+      }
+      return JSON.stringify(RankCLI.${fnName}(${JSON.stringify(html)}, ${JSON.stringify(url)}));
+    })()
+  `);
+  const resultJson = script.runInContext(auditContext, { timeout: 1e4 });
+  return JSON.parse(resultJson);
+}
+async function getPremiumChecks() {
   const wasm = await loadWasm();
   if (!wasm.is_initialized()) {
     throw new Error("Engine not initialized. Call initEngine() first.");
   }
-  if (!auditContext) {
-    throw new Error("Execution context not ready");
-  }
-  const checksLimit = wasm.get_checks_limit();
-  const tier = wasm.get_tier();
-  try {
-    const script = new vm.Script(`
-      (function() {
-        const url = ${JSON.stringify(url)};
-        const html = ${JSON.stringify(html)};
-        const checksLimit = ${checksLimit};
-
-        if (typeof RankCLI.runAudit === 'function') {
-          return JSON.stringify(RankCLI.runAudit(url, html, checksLimit));
-        } else if (typeof RankCLI.runFullAudit === 'function') {
-          // Synchronous wrapper for async function
-          return JSON.stringify({
-            success: true,
-            score: 85,
-            issues: [],
-            checksRun: checksLimit,
-            tier: "${tier}"
-          });
-        } else {
-          throw new Error('RankCLI.runAudit not found in decrypted code');
-        }
-      })()
-    `);
-    const resultJson = script.runInContext(auditContext, {
-      timeout: 3e4
-      // 30 second timeout for audit
-    });
-    return JSON.parse(resultJson);
-  } catch (error) {
-    throw new Error(`Audit execution failed: ${error}`);
+  const checks = {};
+  for (const name of PREMIUM_CHECK_NAMES) {
+    checks[name] = (html, url) => callSandboxCheck(name, html, url);
   }
-}
-async function getTier() {
-  const wasm = await loadWasm();
-  return wasm.get_tier();
-}
-async function getChecksLimit() {
-  const wasm = await loadWasm();
-  return wasm.get_checks_limit();
-}
-async function validateLicense(licenseKey) {
-  const wasm = await loadWasm();
-  return wasm.validate_license(licenseKey);
+  return checks;
 }
 async function getVersion() {
   const wasm = await loadWasm();
@@ -194,11 +185,8 @@ async function isReady() {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getChecksLimit,
-  getTier,
+  getPremiumChecks,
   getVersion,
   initEngine,
-  isReady,
-  runAudit,
-  validateLicense
+  isReady
 });

package/dist/wasm-engine.mjs

@@ -1,167 +1,12 @@
 import {
-  __require
-} from "./chunk-Y6FXYEAI.mjs";
-
-// src/wasm-engine.ts
-import * as vm from "vm";
-import * as path from "path";
-import * as fs from "fs";
-var wasmModule = null;
-var auditContext = null;
-async function loadWasm() {
-  if (wasmModule) return wasmModule;
-  const possiblePaths = [
-    path.join(__dirname, "../native/pkg/rankcli_audit_engine.js"),
-    path.join(__dirname, "../wasm/rankcli_audit_engine.js"),
-    path.join(__dirname, "../../native/pkg/rankcli_audit_engine.js")
-  ];
-  for (const wasmPath of possiblePaths) {
-    if (fs.existsSync(wasmPath)) {
-      wasmModule = __require(wasmPath);
-      return wasmModule;
-    }
-  }
-  throw new Error(
-    `WASM engine not found. Run \`npm run build:wasm\` first.
-Searched: ${possiblePaths.join(", ")}`
-  );
-}
-async function initEngine(licenseKey) {
-  const wasm = await loadWasm();
-  const key = licenseKey || process.env.RANKCLI_LICENSE_KEY || "";
-  try {
-    wasm.init_engine(key);
-  } catch (error) {
-    if (error instanceof Error && error.message.includes("Invalid license")) {
-      throw new Error("Invalid license key. Get one at https://rankcli.dev/pricing");
-    }
-    throw error;
-  }
-  const jsCode = wasm.get_decrypted_code();
-  createExecutionContext(jsCode);
-}
-function createExecutionContext(jsCode) {
-  const sandbox = {
-    // Console for debugging (can be disabled in production)
-    console: {
-      log: () => {
-      },
-      warn: () => {
-      },
-      error: () => {
-      }
-    },
-    // Timers (some checks may use setTimeout)
-    setTimeout,
-    clearTimeout,
-    // JSON parsing
-    JSON,
-    // Math operations
-    Math,
-    // String/Array operations
-    String,
-    Array,
-    Object,
-    RegExp,
-    Date,
-    // URL parsing
-    URL,
-    URLSearchParams,
-    // Node.js globals needed by bundled dependencies (e.g., cheerio)
-    Buffer,
-    process: { env: {} },
-    // TextEncoder/TextDecoder for string handling
-    TextEncoder,
-    TextDecoder,
-    // The RankCLI namespace will be populated by the code
-    RankCLI: {},
-    // Global reference
-    globalThis: {}
-  };
-  sandbox.globalThis = sandbox;
-  auditContext = vm.createContext(sandbox);
-  try {
-    vm.runInContext(jsCode, auditContext, {
-      filename: "rankcli-checks.js",
-      timeout: 5e3
-      // 5 second timeout for initialization
-    });
-  } catch (error) {
-    throw new Error(`Failed to initialize audit checks: ${error}`);
-  }
-}
-async function runAudit(url, html) {
-  const wasm = await loadWasm();
-  if (!wasm.is_initialized()) {
-    throw new Error("Engine not initialized. Call initEngine() first.");
-  }
-  if (!auditContext) {
-    throw new Error("Execution context not ready");
-  }
-  const checksLimit = wasm.get_checks_limit();
-  const tier = wasm.get_tier();
-  try {
-    const script = new vm.Script(`
-      (function() {
-        const url = ${JSON.stringify(url)};
-        const html = ${JSON.stringify(html)};
-        const checksLimit = ${checksLimit};
-
-        if (typeof RankCLI.runAudit === 'function') {
-          return JSON.stringify(RankCLI.runAudit(url, html, checksLimit));
-        } else if (typeof RankCLI.runFullAudit === 'function') {
-          // Synchronous wrapper for async function
-          return JSON.stringify({
-            success: true,
-            score: 85,
-            issues: [],
-            checksRun: checksLimit,
-            tier: "${tier}"
-          });
-        } else {
-          throw new Error('RankCLI.runAudit not found in decrypted code');
-        }
-      })()
-    `);
-    const resultJson = script.runInContext(auditContext, {
-      timeout: 3e4
-      // 30 second timeout for audit
-    });
-    return JSON.parse(resultJson);
-  } catch (error) {
-    throw new Error(`Audit execution failed: ${error}`);
-  }
-}
-async function getTier() {
-  const wasm = await loadWasm();
-  return wasm.get_tier();
-}
-async function getChecksLimit() {
-  const wasm = await loadWasm();
-  return wasm.get_checks_limit();
-}
-async function validateLicense(licenseKey) {
-  const wasm = await loadWasm();
-  return wasm.validate_license(licenseKey);
-}
-async function getVersion() {
-  const wasm = await loadWasm();
-  return wasm.version();
-}
-async function isReady() {
-  try {
-    const wasm = await loadWasm();
-    return wasm.is_initialized();
-  } catch {
-    return false;
-  }
-}
+  getPremiumChecks,
+  getVersion,
+  initEngine,
+  isReady
+} from "./chunk-YX67Q5F6.mjs";
 export {
-  getChecksLimit,
-  getTier,
+  getPremiumChecks,
   getVersion,
   initEngine,
-  isReady,
-  runAudit,
-  validateLicense
+  isReady
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rankcli/cli",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "description": "RankCLI - Ship code, get ranked. SEO meets CI/CD.",
   "homepage": "https://rankcli.dev",
   "main": "dist/index.js",
@@ -36,6 +36,7 @@
     "build:wasm:dev": "cd native && wasm-pack build --target nodejs --dev && mkdir -p ../wasm && cp -r pkg/* ../wasm/",
     "prebuild:wasm": "mkdir -p wasm",
     "inject-config": "node scripts/inject-config.js",
+    "build:sea": "bash scripts/build-sea.sh",
     "prepublishOnly": "npm run build && npm run inject-config",
     "start": "node dist/index.js",
     "lint": "eslint src/",
@@ -44,7 +45,7 @@
     "update-version": "node scripts/update-version.js"
   },
   "dependencies": {
-    "@rankcli/agent-runtime": "^0.0.15",
+    "@rankcli/agent-runtime": "^0.0.16",
     "@supabase/supabase-js": "^2.45.0",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
@@ -59,6 +60,8 @@
   "devDependencies": {
     "@types/inquirer": "^9.0.0",
     "@types/node": "^20.0.0",
+    "esbuild": "^0.28.2",
+    "postject": "^1.0.0-alpha.6",
     "tsup": "^8.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.3.0",

package/dist/chunk-Y6FXYEAI.mjs

@@ -1,10 +0,0 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
-export {
-  __require
-};