agent-led-growth 0.8.3 → 0.8.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-led-growth",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Score: evals for agents as customers. Runs a real agent through signup, key and first call on your product, before you ship. Track, the analytics half, measures which agents convert after.",
   "author": {
     "name": "Kat Laszlo",

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.8.4 (2026-10-24)
+
+Quotes you can check. 0.8.3 printed each requirement with the text it came from, but the text was cut from the page as flat words, so on resend.com Pay quoted "scale as you grow. Are you an AI agent? See pricing Add-ons if you send from a": a subtitle, a link and a heading run together.
+
+- Rule: a quote is one or two whole sentences from one element of the page (a paragraph, a list item, a table cell), cut only at sentence ends, and it holds the words that triggered the rule. When those words sit in an element that is not a sentence, the quote is that element with a label: `Heading: "Domains - $20 / mo" (/pricing)`, `Table cell: "/v1/x402/search"`, `List item: "Identity provider: AgentID OpenID Connect"`, `OpenAPI path: "/v1/x402/numbers/buy"`, `pricing.json: "Pro: 20 USD per month"`. Words that run across two elements are never a quote, and the rule tries its next match instead. Quotes are printed whole; the 160-character cut with "..." is gone.
+- The rules read the same sentence they quote, so a guard never decides on words from a neighbouring element.
+- Pay quotes a paid price, from the pricing page before the homepage: firecrawl.dev's quote was its "$75M Series B" announcement and is now "Standard: $83/month" from /pricing. A price that can only be read out of a script's data and never appears in a sentence or table no longer makes Pay "needs a person"; it says the prices could not be quoted and a test decides. No recorded product changed state from this.
+- Inbox: an emailed code or link counts only when the sentence is about the product's own signup: it names the product's signup or verify call, names the product ("Sign up for Acme", "Acme emails"), says "we send" or "our signup", sits on the product's agent-signup or auth page, or sits in a signup section of a page (a "Sign up" or "Quick start" heading, or right after the product's signup call). A narrative about agents in general ("An agent signs up with its owner's email, reads the verification code out of the owner's inbox") does not count, except on the product's own signup page. www.agentid.com no longer needs an inbox; telnyx.com, inkbox.ai, agentmail.to, aisend.app, www.cosmicjs.com and agentline.cloud still do, each quoting its own signup sentence.
+- CLI signup: a bare `init` no longer counts as signing up; it needs `--agent`, `--temporary` or a signup subcommand. AgentID's `npx @agentmail/agentid-cli init` registers a developer's app and read as AgentID's signup needing a shell. Cloudflare's CLI quote is now its `wrangler deploy --temporary` sentence instead of `wrangler init my-worker`.
+- Signup: www.agentid.com read as "Try first, claim later" from three things that say nothing about its own signup: a blog link ("[can an AI agent sign up for a SaaS](/blog/can-an-ai-agent-sign-up-for-a-saas)", also in its sitemap), "owner claim", which on AgentID is an OpenID Connect field in a token, and the question "How can you tell an agent signup from a human one?". Now a match inside link text or a URL slug, a sitemap entry, or a question does not count as an agent signup, and the claim rule needs a person doing it ("the owner claims the workspace"). HTML written inline in a text file is split at its tags like an HTML page, so a quote never shows raw `<td className=...>`.
+- Signup elsewhere: when the product's agent-facing pages send the agent to sign up on another company's site (AgentID's llms.txt: "Create an AgentMail inbox to get an AgentID", linking console.agentmail.to/sign-up), Sign up and Access say so and need a test run, instead of saying a person has to create the account. AgentID's Sign up and Access moved from "agent can" to "needs a test run"; no other recorded product changed state. JSON: `onboarding.signupElsewhere`.
+- JSON: quotes can carry `label` (`steps[].quotes[]`, `needsEvidence`, pattern `evidence`); `observedPrices[]` can carry `paidQuote`. Nothing is removed.
+- Tests: resend.com is recorded in fixtures/onboarding. Over every recorded product, each quote is a whole sentence ending in terminal punctuation or a labelled element, sits inside one block of its page, starts a sentence and holds its trigger. The inbox products above are pinned with their exact sentences, and AgentID, firecrawl.dev, mem0.ai, moltbook.com, neon.com, paywithlocus.com, Track and Resend with none.
+
 ## 0.8.3 (2026-10-24)
 
 False findings fixed. `check` read Track (alg.katrinalaszlo.com), which is free and takes no email, as charging per request, needing an inbox and having a plan to change.

package/bin/cli.js

@@ -406,8 +406,9 @@ Examples:
       const chosen = onboarding?.patterns?.find((p) => p.id === (config.onboarding || onboarding.primary));
       // Only with the sentence it came from: a need without a quote is not reported (interface.json from before 0.8.3
       // has none).
-      const inboxQuote = chosen?.needs?.includes("inbox") ? chosen.needsEvidence?.inbox?.[0]?.quote : null;
-      if (inboxQuote && !process.env.AGENTMAIL_API_KEY && !opts.inbox) plan.warnings = [`The product's signup sends an emailed code or link ("${inboxQuote}") and no inbox is set. Set AGENTMAIL_API_KEY or pass --inbox, or the run may end inconclusive.`];
+      const inboxEvidence = chosen?.needs?.includes("inbox") ? chosen.needsEvidence?.inbox?.[0] : null;
+      const inboxQuote = inboxEvidence?.quote ? `${inboxEvidence.label ? `${inboxEvidence.label}: ` : ""}"${inboxEvidence.quote}"` : null;
+      if (inboxQuote && !process.env.AGENTMAIL_API_KEY && !opts.inbox) plan.warnings = [`The product's signup sends an emailed code or link (${inboxQuote}) and no inbox is set. Set AGENTMAIL_API_KEY or pass --inbox, or the run may end inconclusive.`];
       if (opts.json) process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
       else for (const line of renderPlan(plan, style)) console.error(line);
       process.exit(plan.ready ? 0 : 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-led-growth",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Score: evals for agents as customers. Runs a real agent through signup, key and first call on your product, before you ship. Track, the analytics half, measures which agents convert after.",
   "type": "module",
   "bin": {

package/src/audit/index.js

@@ -157,7 +157,7 @@ export function renderBrief(audit, doc) {
     lines.push(`Conflict: a verified person must exist before any use, but ${audit.onboarding.chosen.name} lets an agent act first. Consider "A person sets up access first".`, "");
   }
   lines.push("## Steps", "", "| Step | State | How we know | Evidence |", "| --- | --- | --- | --- |");
-  for (const s of audit.steps) lines.push(`| ${s.name} | ${s.state.replace("_", " ")} | ${s.basis.replace("_", " ")} | ${evidence(s.basedOn).join(", ") || "none"}${(s.quotes || []).map((q) => `<br>"${q.quote.replace(/\|/g, "\\|")}"`).join("")} |`);
+  for (const s of audit.steps) lines.push(`| ${s.name} | ${s.state.replace("_", " ")} | ${s.basis.replace("_", " ")} | ${evidence(s.basedOn).join(", ") || "none"}${(s.quotes || []).map((q) => `<br>${q.label ? `${q.label}: ` : ""}"${q.quote.replace(/\|/g, "\\|")}"`).join("")} |`);
   lines.push("", "## Fixes", "");
   if (!audit.findings.length) lines.push("None from public pages. A test with a real agent is the next step: `npx agent-led-growth test --check` shows the plan for free, `npx agent-led-growth test` runs it.");
   for (const f of audit.findings) lines.push(`${f.n}. **${f.title}** (${f.severity}, ${f.name}). Prompt: prompts/${f.file}`);

package/src/audit/render.js

@@ -77,9 +77,9 @@ export function renderSteps(audit, style) {
     out.push(`  ${mark(s.state, style)} ${s.name.padEnd(NAME)}  ${first.padEnd(REASON)}  ${style.dim(TAG[s.basis] || s.basis)}`);
     for (const line of rest) out.push(`  ${" ".repeat(NAME + 4)}${line}`);
     // A claim that the product requires something is shown with the sentence it came from, so a reader can check it.
+    // The quote is whole (src/interface/quote.js), never cut here; an element that is not a sentence carries its label.
     for (const q of s.quotes || []) {
-      const text = q.quote.length > 160 ? `${q.quote.slice(0, 157).replace(/\s+\S*$/, "")}...` : q.quote;
-      for (const line of wrap(`"${text}" (${pathOf(q.url)})`, 60)) out.push(`  ${" ".repeat(NAME + 4)}${style.dim(line)}`);
+      for (const line of wrap(`${q.label ? `${q.label}: ` : ""}"${q.quote}" (${pathOf(q.url)})`, 60)) out.push(`  ${" ".repeat(NAME + 4)}${style.dim(line)}`);
     }
   }
   return out;

package/src/interface/evaluate.js

@@ -254,7 +254,7 @@ export function evaluatePricing(x, observations) {
   return {
     model: pj?.value.revenueModel ? { value: pj.value.revenueModel, method: "extracted", evidence: pj.evidence } : null,
     plans: plans.map((p) => ({ ...p, evidence: pj.evidence })),
-    observedPrices: pagesFound.map((p) => ({ prices: p.value.prices, evidence: p.evidence })),
+    observedPrices: pagesFound.map((p) => ({ prices: p.value.prices, evidence: p.evidence, ...(p.value.paidQuote ? { paidQuote: p.value.paidQuote } : {}) })),
     agentCanDetermineCost: cost,
     ambiguities,
   };

package/src/interface/extract.js

@@ -1,5 +1,6 @@
 import { parseRobots, AI_BOTS } from "../probe/index.js";
 import { htmlToText } from "./sources.js";
+import { quoteAt } from "./quote.js";
 
 // Deterministic extraction. Every fact carries the observation it came from and a quote from that page.
 // A fact that cannot be extracted is null; callers turn nulls into unknowns. No inference happens here.
@@ -176,6 +177,18 @@ const AMBIGUITY_RE = /contact (?:us|sales)|custom pricing|talk to sales|get a qu
 // limit: Track's "4 KB per request", "What it sends, per request".
 const USAGE_RE = /usage[- ]based|pay[- ]as[- ]you[- ]go|\b(?:priced|charged|billed|paid|pay|costs?|fee|price)\s+(?:\w+\s+)?per (?:request|call|token|seat|user)\b|metered billing/gi;
 
+function paidPriceQuote(page, text) {
+  let tried = 0;
+  for (const m of text.matchAll(PRICE_RE)) {
+    // "$75M Series B" is a funding round, not a plan.
+    if (!/[1-9]/.test(m[0]) || /^[MB]\b/i.test(text.slice(m.index + m[0].length))) continue;
+    const q = quoteAt(page, text, m.index, m.index + m[0].length, page.obs.role);
+    if (q) return q;
+    if (++tried >= 200) return null;
+  }
+  return null;
+}
+
 export function extractPricingPages(observations, bodies) {
   const out = [];
   for (const page of pages(observations, bodies, ["pricing", "homepage"])) {
@@ -184,7 +197,10 @@ export function extractPricingPages(observations, bodies) {
     const ambiguities = [...new Set((text.match(AMBIGUITY_RE) || []).map((s) => s.toLowerCase()))];
     const usage = [...new Set((text.match(USAGE_RE) || []).map((s) => s.toLowerCase()))];
     if (page.obs.role === "homepage" && !prices.length) continue;
-    out.push(fact({ prices, ambiguities, usageTerms: usage }, page.obs.id, quoteAround(text, /(\$|€|£)\s?\d/) || quoteAround(text, AMBIGUITY_RE) || text.slice(0, 140)));
+    // A paid price is what Pay quotes when it says paid plans are published, so it gets a clean quote: the sentence or
+    // labelled element holding the first price above zero that has one (src/interface/quote.js), or null.
+    const paid = paidPriceQuote(page, text);
+    out.push(fact({ prices, ambiguities, usageTerms: usage, paidQuote: paid ? { obs: page.obs.id, ...paid } : null }, page.obs.id, quoteAround(text, /(\$|€|£)\s?\d/) || quoteAround(text, AMBIGUITY_RE) || text.slice(0, 140)));
   }
   return out;
 }

package/src/interface/funnel.js

@@ -64,7 +64,7 @@ function needsOf(pattern) {
     if (!NEEDS_SENTENCE[need]) throw new Error(`no sentence for need "${need}"`);
     return NEEDS_SENTENCE[need];
   }).join(" ");
-  const quotes = kept.flatMap((need) => quoted(need).slice(0, 1).map((e) => ({ for: need, obs: e.obs, quote: e.quote })));
+  const quotes = kept.flatMap((need) => quoted(need).slice(0, 1).map((e) => ({ for: need, obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) })));
   return { kept, sentence, quotes };
 }
 
@@ -124,6 +124,9 @@ function signup(doc) {
   if (existing?.cli === "token") return step("signup", "handoff", "A person creates the account and a token. The agent's CLI takes the token from a flag or an environment variable, with no browser.", refs(existing));
   if (existing?.cli === "browser") return step("signup", "handoff", "A person creates the account and signs the CLI in through a browser; no token option was found in the pages read. The agent carries on from there.", refs(existing));
   if (existing) return step("signup", "handoff", "A person creates the account and gives the agent a key. The agent carries on from there.", refs(existing));
+  // The product sends the agent to sign up on another company's site, which is not read: unknown, not a gap.
+  const elsewhere = doc.onboarding?.signupElsewhere;
+  if (elsewhere) return step("signup", "not_checked", `The docs send the agent to sign up on ${elsewhere.domain}, another company's site, which was not read. Only a test run shows whether an agent can sign up there.`, elsewhere.evidence.map((e) => e.obs));
   return step("signup", "needs_person", "The pages read document no way for an agent to sign up. A person may have to create the account; only a real agent run can confirm.");
 }
 
@@ -138,6 +141,8 @@ function access(doc, signupStep) {
   const self = (doc.onboarding?.patterns || []).find((p) => SIGNUP_PATTERNS.has(p.id));
   if (signupStep.state === "agent_can" && self?.provider === "AgentID") return step("access", "agent_can", "Signed in with AgentID, the agent holds its own account and gets its key or session from it, not from a person.", [...refs, ...signupStep.basedOn]);
   if (signupStep.state === "agent_can") return step("access", "agent_can", "The agent signup path hands back a key the agent can use.", [...refs, ...signupStep.basedOn]);
+  const elsewhere = doc.onboarding?.signupElsewhere;
+  if (elsewhere && signupStep.state === "not_checked") return step("access", "not_checked", `The agent gets its credential where it signs up, on ${elsewhere.domain}. Only a test run shows whether it can.`, [...refs, ...signupStep.basedOn]);
   if (methods.length || terms.length) return step("access", "needs_person", `The docs describe ${describeAuth(methods, terms)}, but the pages read do not show how an agent gets one.`, refs);
   return step("access", "not_checked", "The docs read do not say how an agent authenticates.", refs);
 }
@@ -154,18 +159,20 @@ function pay(doc) {
   const plans = doc.pricing?.plans || [];
   const observed = doc.pricing?.observedPrices || [];
   const paidPlans = plans.filter((p) => typeof p.amount === "number" && p.amount > 0);
-  const paidText = observed.filter((o) => (o.prices || []).some((price) => /[1-9]/.test(price)));
+  // The pricing page first: a homepage price can be anything (a demo's "$49.00", a funding round).
+  const roleOf = (o) => doc.observations?.find((x) => x.id === o.evidence?.[0]?.obs)?.role;
+  const paidText = observed.filter((o) => (o.prices || []).some((price) => /[1-9]/.test(price))).sort((a, b) => Number(roleOf(b) === "pricing") - Number(roleOf(a) === "pricing"));
   const refs = [...plans.flatMap((p) => (p.evidence || []).map((e) => e.obs)), ...paidText.flatMap((o) => (o.evidence || []).map((e) => e.obs))];
   // A purchase the product's own pages document (src/interface/purchase.js). One approval by a person, then the agent
   // buys on its own, is a handoff: a person steps in at a documented point and the agent carries on. It is not
   // agent_can, which would say no person is needed, and not needs_person, which would say a person checks out each time.
+  const quote = (entries, what) => (entries || []).filter((e) => e.quote).slice(0, 1).map((e) => ({ for: what, obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) }));
   const purchase = doc.pricing?.agentPurchase;
   const purchaseRefs = (purchase?.evidence || []).map((e) => e.obs);
-  const purchaseQuotes = (purchase?.evidence || []).filter((e) => e.quote).slice(0, 1).map((e) => ({ for: "payment", obs: e.obs, quote: e.quote }));
+  const purchaseQuotes = quote(purchase?.evidence, "payment");
   const perRequestCall = purchase?.rule === "pay_per_request_own_api";
   const checkoutCall = purchase?.rule === "checkout_protocol_own_api";
   const call = purchase?.call ? ` (${purchase.call})` : "";
-  const quote = (entries, what) => (entries || []).filter((e) => e.quote).slice(0, 1).map((e) => ({ for: what, obs: e.obs, quote: e.quote }));
   const over = purchase?.protocol ? ` over ${purchase.protocol}` : "";
   if (purchase?.approval === "once") {
     const how = perRequestCall ? `pays over ${purchase.protocol || "x402 or MPP"}${call}` : checkoutCall ? `checks out over ${purchase.protocol}${call}` : purchase.call ? `buys through ${purchase.call}${over}` : `buys through the API${over}`;
@@ -183,11 +190,24 @@ function pay(doc) {
   if (perRequest) return step("pay", "not_checked", "The docs mention paying per request over x402. A test with a real agent shows whether it can actually pay.", (perRequest.evidence || []).map((e) => e.obs), null, quote(perRequest.evidence, "payment"));
   // Only the product's own domain is read: a purchase path on a payments provider's site (Stripe Projects lists
   // Cloudflare, Neon, Turso and others on stripe.com) is not seen here, so the sentence says what was read.
-  if (paidPlans.length || paidText.length) return step("pay", "needs_person", "Paid plans are published. The pages read document no way for an agent to buy one, so a person may have to check out.", refs, null, quote(paidPlans.length ? paidPlans[0].evidence : paidText[0].evidence, "payment"));
+  // A paid price in prose counts only with a clean quote (the sentence or labelled element it is in): Cloudflare's
+  // pricing page carries its prices only inside a script's JSON, which is no sentence to show.
+  const quotedText = paidText.filter((o) => o.paidQuote);
+  if (paidPlans.length || quotedText.length) return step("pay", "needs_person", "Paid plans are published. The pages read document no way for an agent to buy one, so a person may have to check out.", refs, null, paidPlans.length ? planQuote(paidPlans[0]) : quote([quotedText[0].paidQuote], "payment"));
+  if (paidText.length) return step("pay", "not_checked", "Prices appear in the pages read, but not in a sentence or table that can be quoted. A test shows whether an agent can pay.", refs);
   if (plans.length || observed.length) return step("pay", "not_checked", "Only free plans were found, so there is nothing to pay for yet.", refs);
   return step("pay", "not_checked", "No plans were found in the pages read.");
 }
 
+// A paid plan from pricing.json, quoted as the plan it is rather than a cut of the file's JSON:
+// pricing.json: "Pro: 20 USD per month".
+function planQuote(plan) {
+  const obs = plan.evidence?.[0]?.obs;
+  if (!obs) return [];
+  const price = [plan.amount, plan.currency, plan.period ? `per ${plan.period}` : ""].filter((x) => x !== null && x !== "").join(" ");
+  return [{ for: "payment", obs, quote: `${plan.name || plan.id || "Plan"}: ${price}`, label: "pricing.json" }];
+}
+
 function use(doc) {
   const caps = doc.capabilities || [];
   const api = doc.interfaces?.api;
@@ -218,7 +238,7 @@ function withAgentId(doc, s, sentence) {
   const self = patterns.find((p) => SIGNUP_PATTERNS.has(p.id));
   const agentId = patterns.find((p) => p.provider === "AgentID");
   if (!agentId || agentId === self) return s;
-  const quotes = [...(s.quotes || []), ...agentId.evidence.filter((e) => e.quote).slice(0, 1).map((e) => ({ for: "agent_identity", obs: e.obs, quote: e.quote }))];
+  const quotes = [...(s.quotes || []), ...agentId.evidence.filter((e) => e.quote).slice(0, 1).map((e) => ({ for: "agent_identity", obs: e.obs, quote: e.quote, ...(e.label ? { label: e.label } : {}) }))];
   return { ...s, reason: `${s.reason} ${sentence}`, basedOn: [...new Set([...s.basedOn, ...agentId.evidence.map((e) => e.obs)])], quotes };
 }
 

package/src/interface/onboarding.js

@@ -1,5 +1,6 @@
 import { htmlToText, registrableDomain, sameSite } from "./sources.js";
 import { freePlansOnly } from "./evaluate.js";
+import { blockContext, quoteAt } from "./quote.js";
 
 // Which ways can an agent start using this product? Read from public docs only, so every pattern is a claim the docs
 // make, with the quotes that make it; none is a result. A product can support several. Rules, not a model: each signal
@@ -14,8 +15,9 @@ const SIGNALS = {
   // Agent-infra products use the same words for signing up somewhere else: AgentLine's "so your agent can sign up and
   // verify", AgentID's "apps where agents can sign up and sign in with AgentID". "No agent can sign up" is the opposite.
   bootstrap: /\bagent[- ]?sign[- ]?up\b|(?<!\b(?:no|not|never|where)\s+(?:\w+\s+){0,2})\bagents? (?:can )?(?:sign(?:s)? (?:itself |themselves )?up|creates? (?:its|their) own (?:accounts?|API keys?))(?:\*\*)?(?: here| for an account| in one (?:API )?(?:call|request)| and get (?:an? |its |their )?(?:own )?(?:API )?key| \(beta\)| instantly| immediately| automatically| programmatically)*(?=(?:\*\*)?\s*(?:[.;!)\n]|,\s*(?:and )?get\b|[—–]|$))|\/agents?\/sign-?up\b|\bsign(?:s|ing)? (?:itself|themselves) up\b|\bregisters? itself\b|\bno (?:human|account|signup|sign-up)(?: or API key)? (?:is )?(?:needed|required)\b|\bwithout (?:a |an )?(?:human|account)\b|\banonymous(?:ly)? (?:create|creates|provision|access|account|project|identit)|\btemporary (?:account|project|deployment)s?\b|--temporary\b|\binit --agent\b|\bagent_mode\b|\bbot[_ ]signup\b|\bidentity_types_supported\b/i,
-  // A person can take ownership afterwards.
-  claim: /\bclaim(?:s|ed|ing)? (?:it|this|the|your|their) (?:account|project|workspace|deployment|bucket|inbox|resources?)\b|\bclaim (?:url|code|link|token|flow|page|email)\b|\bclaim_url\b|\bclaimUrl\b|\/claim\b|\bunclaimed\b|\bclaimable\b|\b(?:human|owner|person) (?:can |may |will )?(?:later )?claim\b|\battach (?:a |the )?(?:human )?owner\b|\badopt (?:the |this )?workspace\b/i,
+  // A person can take ownership afterwards. "The owner claims the workspace", with an object: an OpenID Connect "owner
+  // claim" is a field in a token (AgentID's llms-full.txt "the requested owner claim quietly missing"), not a person.
+  claim: /\bclaim(?:s|ed|ing)? (?:it|this|the|your|their) (?:account|project|workspace|deployment|bucket|inbox|resources?)\b|\bclaim (?:url|code|link|token|flow|page|email)\b|\bclaim_url\b|\bclaimUrl\b|\/claim\b|\bunclaimed\b|\bclaimable\b|\b(?:human|owner|person) (?:can |may |will |must |then )?(?:later )?claims? (?:it|this|the|your|their|its)\b|\battach (?:a |the )?(?:human )?owner\b|\badopt (?:the |this )?workspace\b/i,
   // What the agent made goes away unless someone keeps it.
   // Tied to the account or resource: "quotes expire after 5 minutes" is not this. The sentence must name an account,
   // project, workspace, key or token and not a stored thing (STORED_THING below): Supermemory's "temporary facts drop
@@ -44,7 +46,7 @@ const SIGNALS = {
   // The documented way in is a command-line tool rather than an HTTP call.
   // At most four words between the tool and the flag or subcommand, so it is one command line: Track's docs say
   // "npx agent-led-growth check <url> runs a real agent through signup", which is prose after a command, not a signup.
-  cliBootstrap: /\b(?:npx|wrangler|mem0|stripe|npm i(?:nstall)?|pip install|brew install)\b(?:[ \t]+[^\s`]+){0,4}?[ \t]+(?:--temporary|--agent|init\b|sign-?up\b|projects init)/i,
+  cliBootstrap: /\b(?:npx|wrangler|mem0|stripe|npm i(?:nstall)?|pip install|brew install)\b(?:[ \t]+[^\s`]+){0,4}?[ \t]+(?:--temporary|--agent|sign-?up\b|projects init)/i,
   // The product's CLI takes a token without a browser, so an agent can run it unattended once a person has made the
   // token: Vercel's "Set the VERCEL_TOKEN environment variable" or "Pass the --token option", GitHub's "--with-token".
   // An environment variable counts only where the text calls it one: code samples are full of other _API_KEY names.
@@ -195,9 +197,19 @@ function findAgentIdSignIn(doc, bodies) {
       ...(agentFacing ? [...text.matchAll(AGENTID_DECLARED)] : []),
       ...[...text.matchAll(AGENTID_ROUTE)],
     ].sort((x, y) => x.index - y.index);
-    const match = matches.find((m) => !AGENTID_ELSEWHERE.test(text.slice(Math.max(0, m.index - 60), m.index + m[0].length + 60)) && !announcedByOther(text.slice(Math.max(0, m.index - 60), m.index + m[0].length), doc) && !AGENTID_VENDOR.test(sentenceAround(text, m.index, m.index + m[0].length)));
+    const kept = matches.filter((m) => !AGENTID_ELSEWHERE.test(text.slice(Math.max(0, m.index - 60), m.index + m[0].length + 60)) && !announcedByOther(text.slice(Math.max(0, m.index - 60), m.index + m[0].length), doc) && !AGENTID_VENDOR.test(sentenceAround(text, m.index, m.index + m[0].length)));
+    // The first kept match with a clean quote: one sentence or labelled element holding the words (src/interface/quote.js).
+    let match = null;
+    let q = null;
+    for (const m of kept) {
+      q = quoteAt(body, text, m.index, m.index + m[0].length, obs.role);
+      if (q) {
+        match = m;
+        break;
+      }
+    }
     if (!match) continue;
-    out.push({ obs: obs.id, quote: quoteAround(text, match.index), agentFacing });
+    out.push({ obs: obs.id, quote: q.quote, ...(q.label ? { label: q.label } : {}), agentFacing });
     if (AGENTID_OWNER.test(text.slice(Math.max(0, match.index - OWNER_WINDOW), match.index + OWNER_WINDOW))) ownerDocumented = true;
   }
   return { entries: out, ownerDocumented };
@@ -284,47 +296,112 @@ const SIGNUP_ELSEWHERE = /\bsign(?:s|ing)? up for (?:services|other|any|third-pa
 // An optional step is not a requirement: Locus's "the human is needed only for an optional AgentMail OTP".
 const OPTIONAL = /\boptional(?:ly)?\b/i;
 
+// An inbox step counts only when its subject is the product's own signup. AgentID's llms-full.txt tells the general
+// problem, "An agent signs up with its owner's email, reads the verification code out of the owner's inbox", and that
+// read as AgentID's own signup needing an inbox. A sentence counts when it says so itself (ownSignup below), or when it
+// sits on the product's own agent-signup or auth page, or in a signup section of a page (under a "Sign up", "Agent
+// Signup", "Registration" or "Quick start" heading, or right after a step that is the product's own signup call).
+// A third-person narrative ("an agent signs up", "AI agents can sign up for a SaaS product") counts only on the
+// product's own signup page.
+// The sentence calls one of the product's signup, sign-in or verify endpoints: AgentLine's "`POST /v1/auth/otp` →
+// `POST /v1/auth/verify`", Cosmic's "(POST /v3/agents/sign-up)", AgentMail's "curl -X POST .../v0/agent/sign-up".
+const SIGNUP_CALL = /\b(?:POST|GET|PUT)\b[^\n]{0,24}?\/[\w.\/{}:-]*?(?:sign[-_]?up|sign[-_]?in|register|registration|verif\w*|otp|auth|login|magic[-_]?link|onboard)\b/i;
+// "We send", "we'll email", "our signup": the product speaking about its own flow.
+const FIRST_PERSON = /\b(?:we|we'll|we will)\s+(?:then\s+)?(?:send|email|text|mail)\b|\bour (?:sign[- ]?up|signup|registration|onboarding|verification|sign[- ]?in|login)\b|\b(?:create an account|sign up|register) here\b/i;
+const SIGNUP_HEADING = /^\W*(?:\w+ )?(?:sign[- ]?up|signup|sign[- ]?in|register|registration|create (?:an |your )?account|get(?:ting)? started|quick ?start|onboarding)\b(?![^?]*\?)/i;
+const GENERIC_NARRATIVE = /\b(?:an?|every|each|any|most|many|some)\s+(?:AI\s+)?(?:agents?|users?|people|persons?|humans?|developers?|bots?)\b(?:\s+\w+){0,3}?\s+(?:sign(?:s|ed|ing)?|can sign|could sign) up\b/i;
+const OWN_SIGNUP_PAGES = new Set(["onboarding", "auth"]);
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// The product's names: its host's labels (agentmail, cosmicjs and cosmic) and the first part of its page title.
+function productNames(doc) {
+  const labels = doc.target.host.toLowerCase().split(".").slice(0, -1).filter((l) => l !== "www" && l.length > 2);
+  const variants = labels.flatMap((l) => [l, l.replace(/(?:js|hq|app|ai|io|dev|labs)$/, "")]).filter((l) => l.length > 2);
+  const title = String(doc.product?.name?.value || "").split(/\s+[|\u2014\u2013:-]\s+|\s*[|:]\s*/)[0].trim();
+  return [...new Set([...variants, ...(title && title.length <= 40 ? [title.toLowerCase()] : [])])];
+}
+function ownSignupSentence(sentence, names) {
+  if (SIGNUP_CALL.test(sentence) || FIRST_PERSON.test(sentence)) return true;
+  if (!names.length) return false;
+  const name = `(?:${names.map(escapeRe).join("|")})`;
+  return new RegExp(`\\b(?:sign(?:s|ed|ing)?[- ]?(?:up|in)|log(?:s|ged|ging)?[- ]?in|register(?:s|ed|ing)?|creat(?:e|es|ed|ing) (?:an? |your )?account)\\s+(?:for|to|with|on|at|into)\\s+(?:an? )?${name}\\b|\\b${name}\\s+(?:sends?|emails?|will (?:send|email)|texts?)\\b|\\b(?:your|an?|the) ${name} account\\b|\\b${name}[\\w.]*\\/(?:sign-?up|register|signin|login)\\b`, "i").test(sentence);
+}
+function ownSignup(sentence, match, page) {
+  if (ownSignupSentence(sentence, page.names)) return true;
+  // On the product's own signup page the sentence still has to be about signing up: Moltbook's "Verification code
+  // expired." is a line of an error list, Locus's "Never ask the human to reveal their ... email verification
+  // code" is advice. The words are looked for outside the match.
+  if (OWN_SIGNUP_PAGES.has(page.role) && SIGNUP_CONTEXT.test(withoutMatch(sentence, match))) return true;
+  if (GENERIC_NARRATIVE.test(sentence)) return false;
+  const ctx = page.context();
+  if (!ctx) return false;
+  const heading = ctx.heading.replace(/[#*_`]/g, " ").trim();
+  return SIGNUP_HEADING.test(heading) || ownSignupSentence(heading, page.names) || ownSignupSentence(ctx.previous, page.names);
+}
+
+// A question says nothing about this product: AgentID's llms-full.txt "How can you tell an agent signup from a human
+// one?" heads an explainer, and its comparison table's row "Can the agent sign up for a new service on its own" has no
+// question mark. An FAQ's answer, where it says yes, is its own sentence and is tried next.
+const QUESTION = /\?\s*(?:\*\*)?\s*$|^\W*(?:can|could|does|do|is|are|will|should|how|why|what|when|where)\b/i;
+
+// The match names a page rather than saying anything: AgentID's "[can an AI agent sign up for a
+// SaaS](/blog/can-an-ai-agent-sign-up-for-a-saas)" is a link to a blog post, in its text and in its slug. A path like
+// /agents/signup starts with a slash and still counts.
+function inSlug(sentence, match) {
+  if (match.startsWith("/")) return false;
+  const m = escapeRe(match);
+  if (new RegExp(`\\[[^\\]]*${m}[^\\]]*\\]\\(`, "i").test(sentence)) return true;
+  const re = new RegExp(`[\\w/]-${m}|${m}-[a-z]`, "i");
+  return re.test(sentence) && !sentence.includes(` ${match} `) && !sentence.startsWith(`${match} `);
+}
+
 // Whether a sentence holding a match is about something else; such a match is skipped and the next one tried.
+// page: { role, names, context() } for the rules that read where the sentence is (the inbox rule).
 const SKIP = {
-  bootstrap: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || SIGNUP_OFF.test(sentence) || PERSON_WITHOUT_ACCOUNT.test(sentence) || PAYMENT_WAY_IN.test(sentence) || CLIENT_REGISTRATION.test(sentence) || BROKERED.test(sentence) || (/^temporary\b/i.test(match) && STORED_THING.test(sentence)),
+  bootstrap: (sentence, ownDomain, match) => inSlug(sentence, match) || QUESTION.test(sentence) || DOMAIN_ACTORS.test(sentence) || SIGNUP_OFF.test(sentence) || PERSON_WITHOUT_ACCOUNT.test(sentence) || PAYMENT_WAY_IN.test(sentence) || CLIENT_REGISTRATION.test(sentence) || BROKERED.test(sentence) || (/^temporary\b/i.test(match) && STORED_THING.test(sentence)),
   expiry: (sentence) => !ACCOUNT_THING.test(sentence) || STORED_THING.test(sentence) || NO_EXPIRY.test(sentence),
   restricted: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || negatedBefore(sentence, match),
-  emailStep: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || INDEX_LINE.test(sentence) || SIGNUP_ELSEWHERE.test(sentence) || OPTIONAL.test(sentence) || NO_INBOX.test(sentence) || negatedBefore(sentence, match) || !SIGNUP_CONTEXT.test(withoutMatch(sentence, match)),
+  emailStep: (sentence, ownDomain, match, page, label) => label === "Code" || DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || INDEX_LINE.test(sentence) || SIGNUP_ELSEWHERE.test(sentence) || OPTIONAL.test(sentence) || NO_INBOX.test(sentence) || negatedBefore(sentence, match) || !ownSignup(sentence, match, page),
   humanFirst: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || EXAMPLE.test(sentence) || negatedBefore(sentence, match),
   httpBootstrap: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || OAUTH_REGISTRATION.test(match),
   payPerRequest: (sentence, ownDomain, match) => DOMAIN_ACTORS.test(sentence) || SELLER.test(sentence) || PROTOCOL_DESCRIPTION.test(sentence) || paysElsewhere(sentence, ownDomain) || negatedBefore(sentence, match),
 };
-const GLOBAL = Object.fromEntries(Object.keys(SKIP).map((name) => [name, new RegExp(SIGNALS[name].source, `${SIGNALS[name].flags}g`)]));
+const GLOBAL = Object.fromEntries(Object.keys(SIGNALS).map((name) => [name, new RegExp(SIGNALS[name].source, `${SIGNALS[name].flags.replace("g", "")}g`)]));
 
-// The first match whose sentence is not about something else. Tries at most MAX_TRIED matches a page, so a page that
-// repeats a skipped phrase thousands of times costs no more than one that says it once.
+// The first match that has a clean quote (src/interface/quote.js) and whose sentence is not about something else. The
+// guards read the same sentence the quote shows, so a rule never decides on words from a neighbouring element of the
+// page. Tries at most MAX_TRIED matches a page, so a page that repeats a skipped phrase thousands of times costs no
+// more than one that says it once.
 const MAX_TRIED = 200;
-function firstKept(text, re, skip, ownDomain) {
+function firstKept(page, re, skip, ownDomain) {
   let tried = 0;
-  for (const m of text.matchAll(re)) {
-    if (!skip(sentenceAround(text, m.index, m.index + m[0].length).replace(/\s+/g, " "), ownDomain, m[0])) return m;
+  for (const m of page.text.matchAll(re)) {
+    const q = quoteAt(page.body, page.text, m.index, m.index + m[0].length, page.role);
+    const at = { ...page, context: () => blockContext(page.body, page.text, m.index, m.index + m[0].length, page.role) };
+    if (q && !(skip && skip(q.quote, ownDomain, m[0], at, q.label))) return { index: m.index, ...q };
     tried += 1;
     if (tried >= MAX_TRIED) return null;
   }
   return null;
 }
 
-function findSignals(observations, bodies, targetUrl) {
+function findSignals(observations, bodies, targetUrl, names) {
   const ownDomain = registrableDomain(new URL(targetUrl).hostname);
   const found = Object.fromEntries(Object.keys(SIGNALS).map((name) => [name, []]));
   for (const obs of observations) {
     const body = bodies.get(obs.id);
     if (!body) continue;
-    const text = body.html ? htmlToText(body.text) : body.text;
-    for (const [name, re] of Object.entries(SIGNALS)) {
+    const page = { body, role: obs.role, names, text: body.html ? htmlToText(body.text) : body.text };
+    for (const name of Object.keys(SIGNALS)) {
       if (found[name].length >= EVIDENCE_PER_SIGNAL) continue;
-      // A sitemap's URL slugs ("/posts/x402-launch") are page names, and a template or example page
-      // (vercel.com/templates/next.js/x402-ai-starter) is code for the reader's own app: neither documents paying this product.
-      if (name === "payPerRequest" && (obs.role === "sitemap" || EXAMPLE_PAGE.test(new URL(obs.url).pathname))) continue;
-      // Guarded signals try every match, so one sentence about something else does not hide a real one.
-      const skip = SKIP[name];
-      const match = skip ? firstKept(text, GLOBAL[name], skip, ownDomain) : re.exec(text);
-      if (match) found[name].push({ obs: obs.id, quote: quoteAround(text, match.index), agentFacing: AGENT_FACING.has(obs.role) });
+      // A sitemap's URL slugs ("/posts/x402-launch", "/blog/can-an-ai-agent-sign-up-for-a-saas") are page names, not
+      // claims. A template or example page (vercel.com/templates/next.js/x402-ai-starter) is code for the reader's own
+      // app: it does not document paying this product.
+      if (obs.role === "sitemap") continue;
+      if (name === "payPerRequest" && EXAMPLE_PAGE.test(new URL(obs.url).pathname)) continue;
+      // Every match is tried, so one sentence about something else, or words run together from two elements, does not
+      // hide a real one.
+      const match = firstKept(page, GLOBAL[name], SKIP[name], ownDomain);
+      if (match) found[name].push({ obs: obs.id, quote: match.quote, ...(match.label ? { label: match.label } : {}), agentFacing: AGENT_FACING.has(obs.role) });
     }
   }
   return found;
@@ -360,14 +437,14 @@ function needsFor(id, found) {
 const NEED_SIGNALS = { inbox: ["emailStep"], cli: ["cliBootstrap"], wallet: ["payPerRequest"], agent_identity: ["agentIdSignIn", "agentIdentity"] };
 function needsEvidenceFor(needs, found) {
   const ordered = (entries) => [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)];
-  return Object.fromEntries(needs.map((need) => [need, ordered(NEED_SIGNALS[need].flatMap((name) => found[name] || [])).map(({ obs, quote }) => ({ obs, quote }))]));
+  return Object.fromEntries(needs.map((need) => [need, ordered(NEED_SIGNALS[need].flatMap((name) => found[name] || [])).map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) }))]));
 }
 
 function pattern(id, found, signalNames, reason) {
   // The product's agent-facing pages first: a quote from llms.txt or an agent-signup
   // page says more than the same words in homepage navigation.
   const entries = signalNames.flatMap((name) => found[name]);
-  const evidence = [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)].map(({ obs, quote }) => ({ obs, quote }));
+  const evidence = [...entries.filter((e) => e.agentFacing), ...entries.filter((e) => !e.agentFacing)].map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) }));
   const documented = signalNames.some((name) => found[name].some((entry) => entry.agentFacing));
   return {
     id,
@@ -404,9 +481,27 @@ function findApiHosts(doc, bodies) {
   return [...hosts.values()];
 }
 
+// A signup page on another company's site that the product's agent-facing pages send the agent to: AgentID's llms.txt
+// "[Get started](https://console.agentmail.to/sign-up): Create an AgentMail inbox to get an AgentID". That page is not
+// read, so whether an agent can sign up there is unknown, not a gap in this product's docs.
+const SIGNUP_URL = /https:\/\/([a-z0-9.-]+\.[a-z]{2,})(\/[^\s"'`<>)\]]*)?/gi;
+const SIGNUP_PATH = /\/(?:sign-?up|register|get-started)(?:[/?#]|$)/i;
+function findSignupElsewhere(doc, bodies) {
+  for (const obs of doc.observations) {
+    const body = bodies.get(obs.id);
+    if (!body || !obs.ok || !AGENT_FACING.has(obs.role)) continue;
+    const text = body.html ? htmlToText(body.text) : body.text;
+    for (const match of text.matchAll(SIGNUP_URL)) {
+      if (sameSite(`https://${match[1]}/`, doc.target.url) || !SIGNUP_PATH.test(match[2] || "")) continue;
+      return { domain: registrableDomain(match[1].toLowerCase()), url: match[0], evidence: [{ obs: obs.id, quote: quoteAround(text, match.index) }] };
+    }
+  }
+  return null;
+}
+
 export function detectOnboarding(doc, bodies) {
   const observations = doc.observations;
-  const found = findSignals(observations, bodies, doc.target.url);
+  const found = findSignals(observations, bodies, doc.target.url, productNames(doc));
   const onIssuerSite = sameSite(AGENTID_ISSUER, doc.target.url);
   const agentId = onIssuerSite ? { entries: [], ownerDocumented: false } : findAgentIdSignIn(doc, bodies);
   found.agentIdSignIn = agentId.entries;
@@ -462,6 +557,7 @@ export function detectOnboarding(doc, bodies) {
   return {
     patterns,
     apiHosts: findApiHosts(doc, bodies),
+    signupElsewhere: findSignupElsewhere(doc, bodies),
     primary: agentFirst?.id || patterns[0]?.id || null,
     reason: patterns.length ? `${patterns.length} way${patterns.length === 1 ? "" : "s"} for an agent to start, from the sources read.` : `No way for an agent to start was found in the sources read.${doc.otherHostsSkipped ? " Links to other hosts were not read." : ""} This is not evidence that none exists.`,
   };

package/src/interface/purchase.js

@@ -1,5 +1,6 @@
 import { htmlToText, registrableDomain, sameSite } from "./sources.js";
-import { AGENT_FACING, DOMAIN_ACTORS, PROTOCOL_DESCRIPTION, PROTOCOL_SITES, SELLER, paysElsewhere, quoteAround, sentenceAround } from "./onboarding.js";
+import { AGENT_FACING, DOMAIN_ACTORS, PROTOCOL_DESCRIPTION, PROTOCOL_SITES, SELLER, paysElsewhere, sentenceAround } from "./onboarding.js";
+import { quoteAt } from "./quote.js";
 
 // Whether the product's own pages document a way for an agent to buy from it through an API, and whether a person
 // approves first. Rules over page text, like the onboarding signals: each rule is a named pattern, every hit carries
@@ -239,7 +240,7 @@ export function detectAgentPurchase(doc, bodies) {
     const text = body.html ? htmlToText(body.text) : body.text;
     // The product publishes its UCP business profile: the product saying agents can check out with it over UCP.
     if (obs.role === "ucp_profile") {
-      if (isUcpProfile(text)) hits.push({ rule: "checkout_protocol_own_api", obs: obs.id, quote: quoteAround(text, 0), approval: false, call: null, score: 2, protocol: "UCP", agentFacing: true });
+      if (isUcpProfile(text)) hits.push({ rule: "checkout_protocol_own_api", obs: obs.id, quote: new URL(obs.url).pathname, label: "UCP business profile", approval: false, call: null, score: 2, protocol: "UCP", agentFacing: true });
       continue;
     }
     const sellerPage = SELLER_PAGE.test(new URL(obs.url).pathname);
@@ -249,7 +250,10 @@ export function detectAgentPurchase(doc, bodies) {
       const hit = find(text, ownDomain);
       if (!hit) continue;
       const near = text.slice(Math.max(0, hit.index - APPROVAL_WINDOW), hit.index + APPROVAL_WINDOW);
-      hits.push({ rule, obs: obs.id, quote: quoteAround(text, hit.index), approval: Boolean(hit.approved) || APPROVAL.test(hit.sentence) || APPROVAL.test(near), call: hit.call, score: hit.score, protocol: hit.protocol || protocolIn(hit.sentence, text), agentFacing: AGENT_FACING.has(obs.role) });
+      // The sentence or labelled element holding the hit (src/interface/quote.js); null when the words run across two
+      // elements of the page, and then the hit has no quote.
+      const q = quoteAt(body, text, hit.index, hit.index + 1, obs.role);
+      hits.push({ rule, obs: obs.id, quote: q?.quote || null, ...(q?.label ? { label: q.label } : {}), approval: Boolean(hit.approved) || APPROVAL.test(hit.sentence) || APPROVAL.test(near), call: hit.call, score: hit.score, protocol: hit.protocol || protocolIn(hit.sentence, text), agentFacing: AGENT_FACING.has(obs.role) });
     }
   }
   if (!hits.length) return null;
@@ -265,6 +269,6 @@ export function detectAgentPurchase(doc, bodies) {
     approval: hits.some((h) => h.approval) ? "once" : "none_documented",
     call: ruled.find((h) => h.call)?.call || null,
     protocol: ruled.find((h) => h.protocol)?.protocol || null,
-    evidence: ordered.filter((h) => h.rule === rule).concat(ordered.filter((h) => h.rule !== rule)).slice(0, EVIDENCE_MAX * 2).map(({ obs, quote }) => ({ obs, quote })),
+    evidence: ordered.filter((h) => h.rule === rule).concat(ordered.filter((h) => h.rule !== rule)).slice(0, EVIDENCE_MAX * 2).map(({ obs, quote, label }) => ({ obs, quote, ...(label ? { label } : {}) })),
   };
 }

package/src/interface/quote.js

@@ -0,0 +1,255 @@
+// The quote shown under a step that says the product needs something. Kat reads every one, so a quote is one or two
+// whole sentences from one element of the page (a paragraph, a list item, a table cell), never text run together from
+// separate elements. Resend's pricing page flattened to "scale as you grow. Are you an AI agent? See pricing Add-ons if
+// you send from a": a subtitle, a link and a heading read as one sentence. When the words sit in an element with no
+// sentence (a heading, a table cell, a button, a line of code), the quote is that element's text with a label saying
+// what it is: Heading: "Domains - $20 / mo".
+
+// Elements that start a new block. Inline elements (a, span, strong, code) stay inside the sentence they are part of.
+const BLOCK_TAG = /^<\/?\s*(address|article|aside|blockquote|br|button|caption|dd|details|dialog|div|dl|dt|fieldset|figcaption|figure|footer|form|h[1-6]|header|hr|img|input|label|legend|li|main|menu|nav|ol|option|p|pre|section|select|summary|svg|table|tbody|td|template|textarea|tfoot|th|thead|title|tr|ul)\b/i;
+const KIND_OF_TAG = { td: "cell", th: "cell", li: "item", dt: "item", dd: "item", button: "button", option: "button", summary: "button", pre: "code", title: "heading" };
+export const LABEL = { cell: "Table cell", heading: "Heading", item: "List item", button: "Button", code: "Code", line: "Line", paragraph: "Text", phrase: "Phrase" };
+// An element's text with no sentence in it is quoted whole only up to this length; longer is a run of inline elements
+// (a navigation bar, a footer), which is not a quote.
+const PHRASE_MAX = 160;
+// A sentence longer than this is a run of data (a JSON blob in a page, a minified list), not a sentence to quote.
+const SENTENCE_MAX = 320;
+
+function decode(s) {
+  return s.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'");
+}
+
+// Blocks of an HTML page, with offsets into htmlToText(html): the same steps in the same order, split where a block
+// element starts or ends, so the blocks joined with one space are exactly htmlToText's output.
+export function htmlBlocks(html) {
+  const src = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ");
+  const segments = [];
+  let kind = "phrase";
+  let last = 0;
+  for (const m of src.matchAll(/<[^>]+>/g)) {
+    const tag = BLOCK_TAG.exec(m[0]);
+    if (!tag) continue;
+    segments.push({ kind, raw: src.slice(last, m.index) });
+    const name = tag[1].toLowerCase();
+    const closing = /^<\s*\//.test(m[0]);
+    kind = closing ? "phrase" : /^h[1-6]$/.test(name) ? "heading" : KIND_OF_TAG[name] || "phrase";
+    last = m.index + m[0].length;
+  }
+  segments.push({ kind, raw: src.slice(last) });
+  const blocks = [];
+  let offset = 0;
+  for (const seg of segments) {
+    const text = decode(seg.raw).replace(/\s+/g, " ").trim();
+    if (!text) continue;
+    blocks.push({ start: offset, end: offset + text.length, kind: seg.kind, raw: seg.raw });
+    offset += text.length + 1;
+  }
+  return blocks;
+}
+
+const FENCE = /^\s*(?:```|~~~)/;
+const HEADING_LINE = /^\s{0,3}#{1,6}\s/;
+const ITEM_LINE = /^\s*(?:[-*+]|\d+[.)])\s+/;
+const TABLE_LINE = /^\s*\|/;
+// A line that is only an HTML or MDX tag (`<Card title="Verify" href="...">`, `</Card>`) ends a block, like a blank line.
+const TAG_LINE = /^\s*<\/?[A-Za-z][^>]*>\s*$/;
+const INLINE_BLOCK_TAG = /<\/?\s*(?:td|th|tr|table|thead|tbody|p|li|ul|ol|div|h[1-6])\b[^>]*>/i;
+const INLINE_BLOCK_TAG_NAME = /^<(\/)?\s*(td|th|tr|table|thead|tbody|p|li|ul|ol|div|h[1-6])\b/i;
+const TAG_KIND = { td: "cell", th: "cell", li: "item", h1: "heading", h2: "heading", h3: "heading", h4: "heading", h5: "heading", h6: "heading" };
+function pushPiece(blocks, line, start, a, b, kind) {
+  while (a < b && /\s/.test(line[a])) a += 1;
+  while (b > a && /\s/.test(line[b - 1])) b -= 1;
+  if (b > a) blocks.push({ start: start + a, end: start + b, kind });
+}
+// A shell-comment block in a text file (AgentMail's llms.txt): "#" alone is a blank line and "#" followed by two or
+// more spaces is text, not a heading.
+const COMMENT_BLANK = /^\s*#\s*$/;
+const COMMENT_TEXT = /^\s*#\s{2,}\S/;
+
+// Blocks of a Markdown or plain-text page, with offsets into the text: a paragraph (lines joined until a blank line),
+// a heading, a list item with its wrapped lines, a table cell, a line of a code block. lineMode makes every line its
+// own block, for YAML and other line-oriented files.
+export function textBlocks(text, { lineMode = false } = {}) {
+  const blocks = [];
+  let open = null;
+  const close = () => {
+    if (open) blocks.push(open);
+    open = null;
+  };
+  let inFence = false;
+  let at = 0;
+  for (const line of text.split("\n")) {
+    const start = at;
+    const end = at + line.length;
+    at = end + 1;
+    const blank = !line.trim() || (!inFence && (COMMENT_BLANK.test(line) || TAG_LINE.test(line)));
+    if (FENCE.test(line)) {
+      close();
+      inFence = !inFence;
+      continue;
+    }
+    if (blank) {
+      close();
+      continue;
+    }
+    if (inFence || lineMode) {
+      close();
+      blocks.push({ start, end, kind: inFence ? "code" : "line" });
+      continue;
+    }
+    // HTML or MDX written inline in a text file (AgentID's llms-full.txt has a table as `<td className="...">Can the
+    // agent sign up ...</td> <td ...>`): each piece of text between block tags is its own block, as in an HTML page.
+    if (INLINE_BLOCK_TAG.test(line)) {
+      close();
+      let kind = "paragraph";
+      let from = 0;
+      for (const m of line.matchAll(/<[^>]+>/g)) {
+        pushPiece(blocks, line, start, from, m.index, kind);
+        const tag = INLINE_BLOCK_TAG_NAME.exec(m[0]);
+        if (tag) kind = tag[1] ? "paragraph" : TAG_KIND[tag[2].toLowerCase()] || "paragraph";
+        from = m.index + m[0].length;
+      }
+      pushPiece(blocks, line, start, from, line.length, kind);
+      continue;
+    }
+    if (HEADING_LINE.test(line) && !COMMENT_TEXT.test(line)) {
+      close();
+      blocks.push({ start, end, kind: "heading" });
+      continue;
+    }
+    if (TABLE_LINE.test(line)) {
+      close();
+      for (const cell of line.matchAll(/[^|]+/g)) if (cell[0].trim() && !/^[\s:-]+$/.test(cell[0])) blocks.push({ start: start + cell.index, end: start + cell.index + cell[0].length, kind: "cell" });
+      continue;
+    }
+    if (ITEM_LINE.test(line)) {
+      close();
+      open = { start, end, kind: "item" };
+      continue;
+    }
+    if (open) open.end = end;
+    else open = { start, end, kind: "paragraph" };
+  }
+  close();
+  return blocks;
+}
+
+const blockCache = new WeakMap();
+// The page's blocks over the text the rules read (htmlToText for HTML, the body itself otherwise).
+export function blocksOf(body, role) {
+  if (blockCache.has(body)) return blockCache.get(body);
+  const blocks = body.html ? htmlBlocks(body.text) : isJson(body.text) ? null : textBlocks(body.text, { lineMode: role === "openapi" || role === "sitemap" || role === "robots" });
+  blockCache.set(body, blocks);
+  return blocks;
+}
+
+const isJson = (text) => /^\s*[[{]/.test(text);
+
+// Where one sentence ends inside a block: terminal punctuation, any closing quote, bracket or Markdown mark, then
+// space and a character that can start a sentence. Not after an abbreviation ("e.g.", "vs.") or an initial.
+const BOUNDARY = /[.!?]["'”’)\]*_`]*(?=\s+[^\sa-z])/g;
+const ABBREVIATION = /\b(?:e\.g|i\.e|etc|vs|cf|approx|incl|Inc|Ltd|Co|Mr|Mrs|Ms|Dr|St|No|U\.S)$/;
+const TERMINAL = /[.!?]["'”’)\]*_`]*$/;
+
+function sentencesIn(s) {
+  const out = [];
+  let from = 0;
+  for (const m of s.matchAll(BOUNDARY)) {
+    if (m[0][0] === "." && ABBREVIATION.test(s.slice(0, m.index))) continue;
+    const end = m.index + m[0].length;
+    out.push([from, end]);
+    from = end;
+  }
+  out.push([from, s.length]);
+  return out.map(([a, b]) => {
+    while (a < b && /\s/.test(s[a])) a += 1;
+    while (b > a && /\s/.test(s[b - 1])) b -= 1;
+    return [a, b];
+  }).filter(([a, b]) => b > a);
+}
+
+// Markdown marks at the start of a block are layout, not words: "- ", "## ", "> ", "1. ".
+// A "#" that opens each line of a comment block is layout too.
+const tidy = (s) => s.replace(/^\s*(?:#{1,6}\s+|>\s*|[-*+]\s+|\d+[.)]\s+)/, "").replace(/\n[ \t]*#(?=\s)/g, "\n").replace(/\s+/g, " ").trim();
+
+// A div's text with no sentence in it is often several links or buttons side by side ("Start Sending Free View B2B
+// Plans ($14/mo) Read the Docs"). Its phrase is then only the inline elements the words are in: split at every tag
+// but comments, the same way htmlBlocks splits a page, so the pieces line up with the block's text.
+function inlinePiece(raw, start, end) {
+  const pieces = [];
+  let offset = 0;
+  for (const part of raw.split(/<(?!!--)[^>]+>/)) {
+    const text = decode(part).replace(/\s+/g, " ").trim();
+    if (!text) continue;
+    pieces.push({ start: offset, end: offset + text.length, text });
+    offset += text.length + 1;
+  }
+  const hit = pieces.filter((p) => p.end > start && p.start < end);
+  return hit.length ? hit.map((p) => p.text).join(" ") : null;
+}
+
+// { quote, label? } for the words at [start, end) of a block's text, or null when they cross a sentence pair or the
+// block is a long run with no sentence in it.
+// Sentences are looked for only within WINDOW characters of the match: a 2 MB page on one line would otherwise be split
+// end to end for every match. A sentence that reaches the window's edge is longer than any quote, so it is none.
+const WINDOW = 1000;
+function fromBlock(s, kind, start, end, raw = null) {
+  const lo = Math.max(0, start - WINDOW);
+  const hi = Math.min(s.length, end + WINDOW);
+  const near = s.slice(lo, hi);
+  const hit = sentencesIn(near).filter(([a, b]) => b > start - lo && a < end - lo);
+  if (!hit.length || hit.length > 2) return null;
+  const a = hit[0][0];
+  const b = hit.at(-1)[1];
+  if ((a === 0 && lo > 0) || (b === near.length && hi < s.length)) return null;
+  const piece = tidy(near.slice(a, b));
+  if (!piece) return null;
+  if (TERMINAL.test(piece) && kind !== "code" && kind !== "cell" && kind !== "heading") return piece.length <= SENTENCE_MAX ? { quote: piece } : null;
+  // A Markdown paragraph or list item is one element as its author wrote it, so it is quoted whole even without a full
+  // stop (llms.txt lines often have none). A div's text is cut to the inline elements the words are in.
+  const phrase = raw !== null && kind === "phrase" ? tidy(inlinePiece(raw, start, end) || "") : piece;
+  const max = kind === "paragraph" || kind === "item" ? SENTENCE_MAX : PHRASE_MAX;
+  if (!phrase || phrase.length > max) return null;
+  return { quote: phrase, label: LABEL[kind] || LABEL.phrase };
+}
+
+// A JSON string at [start, end): its text, labelled with its key (description, summary), or for a key itself, "Key"
+// ("OpenAPI path" for an OpenAPI path).
+function fromJson(text, start, end, role) {
+  let qs = start;
+  while (qs >= 0 && !(text[qs] === '"' && text[qs - 1] !== "\\")) qs -= 1;
+  let qe = end;
+  while (qe < text.length && !(text[qe] === '"' && text[qe - 1] !== "\\")) qe += 1;
+  if (qs < 0 || qe >= text.length || qe - qs > 2000) return null;
+  // Inside a string only when an odd number of unescaped quotes come before the opening one plus it.
+  const before = text.slice(0, qs + 1).match(/(?<!\\)"/g)?.length || 0;
+  if (before % 2 === 0) return null;
+  const raw = text.slice(qs + 1, qe).replace(/\\n/g, " ").replace(/\\"/g, '"').replace(/\\\//g, "/").replace(/\\\\/g, "\\");
+  const isKey = /^\s*:/.test(text.slice(qe + 1, qe + 20));
+  if (isKey) return raw.length <= PHRASE_MAX ? { quote: raw, label: role === "openapi" && raw.startsWith("/") ? "OpenAPI path" : "Key" } : null;
+  const key = /"([^"\\]{1,40})"\s*:\s*$/.exec(text.slice(Math.max(0, qs - 60), qs))?.[1] || "Value";
+  const inner = fromBlock(raw, "phrase", start - qs - 1, end - qs - 1);
+  return inner ? { quote: inner.quote, label: key } : null;
+}
+
+// The quote for a match at [start, end) of a page's text, or null when no clean quote holds it: the match runs across
+// two elements of the page, or its element is a long run with no sentence. A caller with a null tries its next match.
+export function quoteAt(body, text, start, end, role) {
+  if (!body.html && isJson(body.text)) return fromJson(text, start, end, role);
+  const blocks = blocksOf(body, role);
+  const block = blocks.find((b) => b.start <= start && end <= b.end);
+  if (!block) return null;
+  return fromBlock(text.slice(block.start, block.end), block.kind, start - block.start, end - block.start, block.raw ?? null);
+}
+
+// The block holding [start, end), and the heading above it on the page, for rules that read what a sentence is about.
+export function blockContext(body, text, start, end, role) {
+  if (!body.html && isJson(body.text)) return null;
+  const blocks = blocksOf(body, role);
+  const i = blocks.findIndex((b) => b.start <= start && end <= b.end);
+  if (i < 0) return null;
+  let h = i - 1;
+  while (h >= 0 && blocks[h].kind !== "heading") h -= 1;
+  const slice = (b) => (b ? text.slice(b.start, b.end) : "");
+  return { block: slice(blocks[i]), heading: h >= 0 ? slice(blocks[h]) : "", previous: slice(blocks[i - 1]) };
+}

package/src/interface/schema.js

@@ -23,8 +23,8 @@ export const SCHEMA_DOC = {
     authentication_requirement: "{ value: none|required|mixed|not_declared|unknown, reason, basedOn, rule, operations: [{ operation, value, reason, basedOn, rule, source: operation|global|absent, schemeNames }] }; operation security overrides global security; none requires an explicit operation [] or anonymous {} alternative; absent or empty global security is not_declared; unresolved declarations or incomplete operation coverage are unknown",
     pricing: "model, plans, observedPrices, agentCanDetermineCost, ambiguities, agentPurchase. agentPurchase is null or { rule: agent_buys_through_api|payment_required_approval|pay_per_request_own_api|checkout_protocol_own_api, rules, approval: once|none_documented, call, protocol: x402|MPP|ACP|AP2|UCP|null, evidence: [{ obs, quote }] }: a way for an agent to buy from the product through an API, as the product's own pages describe it (an agent buying with a purchase call, a cap or an approval; 402 payment_required with an approval link; x402 or MPP on a call to the product's own API; an ACP or UCP checkout session call on the product's own API, or a UCP business profile at /.well-known/ucp). protocol names the payment or checkout protocol the quoted sentence names, when it names one. approval once means a person approves first and the agent buys after that. A documented claim, never a result.",
     machineAccess: "robots, llms.txt, agent.json facts plus aiCrawlersAllowed, hasAgentReadableIndex and agentAuthDiscoverable",
-    onboarding: "{ patterns: [{ id: try_then_claim|limited_until_claimed|agent_is_customer|agent_identity|existing_account|pay_per_request, name, status: documented|inferred, reason, evidence: [{ obs, quote }], humanBoundary, needs: [inbox|cli|wallet|agent_identity], needsEvidence?: { <need>: [{ obs, quote }] }, provider?: AgentID }], apiHosts: [{ domain, host, example, evidence }], primary, reason }. apiHosts are API URLs on other domains that the product's agent-facing pages point to. Ways an agent can start, as the public docs describe them; needs lists what testing that way end to end requires beyond HTTP requests, which a given deployment may or may not provide. provider names the identity provider an agent_identity pattern uses, when the docs name one the detector knows (AgentID). A pattern is a documented claim, never a result.",
-    funnel: "{ headline, passed, stepsPassing, documented, verified, of, stopsAt, path, paths, steps: [{ id: discover|understand|signup|access|use|pay|manage, name, area: web|onboarding|monetization, question, state: agent_did|agent_can|handoff|needs_person|blocked|not_checked|not_applicable, reason, fix?, basedOn, quotes?, live?, evidence? }], applicable, fixes }. not_applicable: the product's machine-readable files say the step has nothing to do (Pay when every plan in pricing.json costs 0 and no purchase is documented; Manage when that is one plan); it neither passes nor stops the walk, and applicable counts the other steps. quotes: [{ for, obs, quote }], the sentences behind a claim that the product needs or requires something; a need with no quote is not reported. The seven steps an agent takes, from public evidence only. handoff means a person steps in at a documented point and the agent carries on, which counts as passing. agent_did appears only when the latest test run for that step on this product passed; a blocked test run sets blocked. live names that test. evidence lists, newest first, what else set or touched the step: { kind: test|pay|signal|stuck, at, reason, runId?, outcome?, count? }; a test or payment or the product's own signals can decide the state, a stuck report only attaches. documented counts agent_can and handoff steps, verified counts agent_did steps; the headline gives both and never calls a documented step verified. passed counts the passing steps before the first one that does not pass; stepsPassing counts every passing step (documented plus verified), the total the headline gives.",
+    onboarding: "{ patterns: [{ id: try_then_claim|limited_until_claimed|agent_is_customer|agent_identity|existing_account|pay_per_request, name, status: documented|inferred, reason, evidence: [{ obs, quote }], humanBoundary, needs: [inbox|cli|wallet|agent_identity], needsEvidence?: { <need>: [{ obs, quote, label? }] }, provider?: AgentID }], apiHosts: [{ domain, host, example, evidence }], signupElsewhere: { domain, url, evidence } | null, primary, reason }. apiHosts are API URLs on other domains that the product's agent-facing pages point to. signupElsewhere is a signup page on another company's site that those pages send the agent to; it is not read. Ways an agent can start, as the public docs describe them; needs lists what testing that way end to end requires beyond HTTP requests, which a given deployment may or may not provide. provider names the identity provider an agent_identity pattern uses, when the docs name one the detector knows (AgentID). A pattern is a documented claim, never a result.",
+    funnel: "{ headline, passed, stepsPassing, documented, verified, of, stopsAt, path, paths, steps: [{ id: discover|understand|signup|access|use|pay|manage, name, area: web|onboarding|monetization, question, state: agent_did|agent_can|handoff|needs_person|blocked|not_checked|not_applicable, reason, fix?, basedOn, quotes?, live?, evidence? }], applicable, fixes }. not_applicable: the product's machine-readable files say the step has nothing to do (Pay when every plan in pricing.json costs 0 and no purchase is documented; Manage when that is one plan); it neither passes nor stops the walk, and applicable counts the other steps. quotes: [{ for, obs, quote, label? }], the sentences behind a claim that the product needs or requires something; a need with no quote is not reported. quote is one or two whole sentences from one element of the page; label is set when the quote is an element that is not a sentence (Heading, Table cell, List item, Button, Code, Text, Phrase, OpenAPI path, pricing.json, or a JSON key such as description). The seven steps an agent takes, from public evidence only. handoff means a person steps in at a documented point and the agent carries on, which counts as passing. agent_did appears only when the latest test run for that step on this product passed; a blocked test run sets blocked. live names that test. evidence lists, newest first, what else set or touched the step: { kind: test|pay|signal|stuck, at, reason, runId?, outcome?, count? }; a test or payment or the product's own signals can decide the state, a stuck report only attaches. documented counts agent_can and handoff steps, verified counts agent_did steps; the headline gives both and never calls a documented step verified. passed counts the passing steps before the first one that does not pass; stepsPassing counts every passing step (documented plus verified), the total the headline gives.",
     unknowns: "every field whose verdict is unknown or whose fact is null, with the reason",
     limits: "what this run could not do (no JS rendering, no login, no model interpretation)",
   },