git-paid 2.1.3 → 2.1.4

package/lib/engine.js

@@ -1,8 +1,10 @@
-// Core Autonomous Engine for Postbuild (postbuild.dev)
-// Handles live URL auditing, Launch Kit synthesis, 25-route Programmatic SEO generation,
-// 85-directory dispatch preparation, and Live Buyer Intent Radar.
+// Core Autonomous Engine for Postbuild (www.postbuild.dev)
+// Handles SSRF-safe live URL auditing, Launch Kit synthesis, 25-route Programmatic SEO generation,
+// 85-directory launch kit preparation + IndexNow/WebSub dispatch, and Buyer Intent Radar.
 
 import { DIRECTORIES, buildPrefilledDirectoryUrl } from "./directories.js";
+import { getBotInboxForDomain } from "./inbox.js";
+import { assertSafeUrl, safeFetch } from "./safe-fetch.js";
 
 export { DIRECTORIES };
 
@@ -34,22 +36,26 @@ function inferCategories(text) {
   return cats.slice(0, 3);
 }
 
-export async function scanTargetUrl(rawInput) {
-  let targetUrl = (rawInput || "https://postbuild.dev").trim();
+export async function scanTargetUrl(rawInput, options = {}) {
+  let targetUrl = (rawInput || "https://www.postbuild.dev").trim();
   if (!/^https?:\/\//i.test(targetUrl)) {
     targetUrl = "https://" + targetUrl;
   }
 
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(targetUrl);
-  } catch {
-    parsedUrl = new URL("https://postbuild.dev");
+  // P1-4: Validate target URL against SSRF rules (blocks loopback, RFC1918 private ranges, link-local, metadata)
+  const parsedUrl = await assertSafeUrl(targetUrl, { lookupFn: options.lookupFn });
+
+  const domain = parsedUrl.hostname.replace(/^www\./, "").toLowerCase();
+  if (["github.com", "gitlab.com", "bitbucket.org"].includes(domain)) {
+    const repoErr = new Error(
+      "Please enter your deployed live website URL rather than a code repository host (e.g. https://your-app.com)."
+    );
+    repoErr.statusCode = 422;
+    throw repoErr;
   }
 
-  const domain = parsedUrl.hostname.replace(/^www\./, "");
   const slug = domain.split(".")[0].toLowerCase().replace(/[^a-z0-9-]/g, "") || "app";
-  const botEmail = `${slug}-bot@postbuild.dev`;
+  const botEmail = getBotInboxForDomain(domain);
 
   let html = "";
   let reachable = false;
@@ -59,15 +65,13 @@ export async function scanTargetUrl(rawInput) {
   let hasSitemap = false;
 
   try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), 5500);
-    const res = await fetch(parsedUrl.toString(), {
-      signal: controller.signal,
-      headers: { "User-Agent": "PostbuildBot/1.0 (+https://postbuild.dev)" }
+    const res = await safeFetch(parsedUrl.toString(), {
+      timeoutMs: 5000,
+      headers: { "User-Agent": "PostbuildBot/2.1 (+https://www.postbuild.dev)" },
+      lookupFn: options.lookupFn
     });
-    clearTimeout(timer);
     if (res.ok) {
-      html = await res.text();
+      html = res.text();
       reachable = true;
     }
   } catch {
@@ -75,9 +79,12 @@ export async function scanTargetUrl(rawInput) {
   }
 
   try {
-    const rRes = await fetch(`${parsedUrl.origin}/robots.txt`, { signal: AbortSignal.timeout(3000) });
+    const rRes = await safeFetch(`${parsedUrl.origin}/robots.txt`, {
+      timeoutMs: 3500,
+      lookupFn: options.lookupFn
+    });
     if (rRes.ok) {
-      robotsText = await rRes.text();
+      robotsText = rRes.text();
       hasRobots = robotsText.length > 5 && !/<html/i.test(robotsText);
     }
   } catch {
@@ -85,18 +92,22 @@ export async function scanTargetUrl(rawInput) {
   }
 
   try {
-    const sRes = await fetch(`${parsedUrl.origin}/sitemap.xml`, { signal: AbortSignal.timeout(3000) });
+    const sRes = await safeFetch(`${parsedUrl.origin}/sitemap.xml`, {
+      timeoutMs: 3500,
+      lookupFn: options.lookupFn
+    });
     if (sRes.ok) {
-      sitemapText = await sRes.text();
+      sitemapText = sRes.text();
       hasSitemap = /<urlset|<sitemapindex/i.test(sitemapText);
     }
   } catch {
     hasSitemap = false;
   }
 
+  const extractedTitle = extractTag(html, /<title[^>]*>([^<]+)<\/title>/i);
   const rawTitle =
-    extractTag(html, /<title[^>]*>([^<]+)<\/title>/i) ||
-    `${slug.charAt(0).toUpperCase() + slug.slice(1)} — Modern Workflow & Automation Platform`;
+    extractedTitle ||
+    `${slug.charAt(0).toUpperCase() + slug.slice(1)} — Web Application`;
 
   const description =
     extractTag(html, /<meta[^>]+name=["']description["'][^>]+content=["']([^"']+)["']/i) ||
@@ -117,7 +128,8 @@ export async function scanTargetUrl(rawInput) {
 
   const hasJsonLd = /application\/ld\+json/i.test(html);
   const hasCheckout = /polar\.sh|lemonsqueezy\.com|paddle\.com|buy\.stripe\.com|checkout\.stripe\.com|\/api\/checkout|Launch Pass/i.test(html);
-  const hasAnalytics = /posthog|plausible|gtag|googletagmanager|umami|vercel-insights|sola/i.test(html);
+  // Fixed telemetry check: never match CSS tokens like "sola"
+  const hasAnalytics = /posthog|plausible|gtag|googletagmanager|umami|vercel-insights|_vercel\/insights|data-domain=|analytics\.js/i.test(html);
   const hasDuplicateSnapshotMeta = (html.match(/manages 5 data types/gi) || []).length > 3;
 
   const hasAiCrawlerRules = hasRobots && /OAI-SearchBot|PerplexityBot|ClaudeBot|GPTBot/i.test(robotsText);
@@ -127,9 +139,14 @@ export async function scanTargetUrl(rawInput) {
   const checks = [
     {
       id: "title",
-      label: "Title Tag & Keyword Hook",
-      passed: Boolean(rawTitle && rawTitle.length > 10),
-      detail: rawTitle || "Missing <title>"
+      label: "Title Tag & Server-Rendered H1",
+      passed: Boolean(extractedTitle && extractedTitle.length > 10 && h1List.length > 0),
+      detail:
+        extractedTitle && h1List.length > 0
+          ? `${extractedTitle} (H1: ${h1List[0].slice(0, 48)})`
+          : !extractedTitle
+            ? "Missing <title> tag in HTML"
+            : "Missing server-rendered <h1> in initial HTML response"
     },
     {
       id: "desc",
@@ -169,11 +186,11 @@ export async function scanTargetUrl(rawInput) {
     },
     {
       id: "sitemap",
-      label: "Programmatic SEO Sitemap (25+ Routes)",
+      label: "Programmatic SEO Sitemap (10+ Routes)",
       passed: hasPseoSitemap,
       detail: hasSitemap
         ? `sitemap.xml active (${sitemapUrlCount} indexed routes — ${hasPseoSitemap ? "pSEO active" : "25 pSEO routes ready to add"})`
-        : "No sitemap.xml found — 25 high-intent pSEO routes ready to deploy"
+        : "No sitemap.xml found — 25 structured pSEO routes ready to deploy"
     },
     {
       id: "paywall",
@@ -187,19 +204,19 @@ export async function scanTargetUrl(rawInput) {
       id: "analytics",
       label: "Conversion Telemetry",
       passed: hasAnalytics,
-      detail: hasAnalytics ? "Conversion telemetry active" : "No conversion pixel/analytics detected"
+      detail: hasAnalytics ? "Conversion telemetry script detected" : "No conversion pixel/analytics script detected"
     }
   ];
 
-  const passedCount = checks.filter(c => c.passed).length;
-  const readinessScore = Math.max(18, Math.round((passedCount / checks.length) * 100));
+  const passedCount = checks.filter((c) => c.passed).length;
+  const readinessScore = reachable ? Math.round((passedCount / checks.length) * 100) : 0;
 
   const titleParts = rawTitle.split(/\s*[|—–-]\s*/);
   const cleanName = (titleParts[0] || slug).trim();
   const extractedTagline =
     (titleParts[1] && titleParts[1].length >= 12 ? titleParts[1].trim() : null) ||
     (h1List[0] && h1List[0].length <= 75 ? h1List[0] : null) ||
-    (description ? description.slice(0, 60).trim() : `Automated workflow and growth engine for ${cleanName}`);
+    (description ? description.slice(0, 60).trim() : `${cleanName} (${domain})`);
 
   const launchKit = generateLaunchKit({
     origin: parsedUrl.origin,
@@ -213,10 +230,8 @@ export async function scanTargetUrl(rawInput) {
     botEmail
   });
 
-  // Generate 25 Programmatic SEO page blueprints tailored to this domain/slug
   const pseoPages = generatePseoPages(parsedUrl.origin, slug, cleanName);
 
-  // Generate ready-to-drop SEO & Paywall code artifacts (with all 25 pSEO routes in sitemap.xml)
   const artifacts = generateArtifacts(
     parsedUrl.origin,
     slug,
@@ -225,10 +240,9 @@ export async function scanTargetUrl(rawInput) {
     pseoPages
   );
 
-  // Attach prefilled submission URLs for all 85 directories
-  const enrichedDirectories = DIRECTORIES.map(dir => ({
+  const enrichedDirectories = DIRECTORIES.map((dir) => ({
     ...dir,
-    status: "Queued",
+    status: "Ready to submit",
     prefilledUrl: buildPrefilledDirectoryUrl(dir, launchKit)
   }));
 
@@ -258,7 +272,7 @@ function generateLaunchKit({ origin, domain, slug, cleanName, tagline, descripti
 
   const featureBullets =
     h2List.length >= 2
-      ? h2List.slice(0, 4).map(h => `- **${h}**`).join("\n")
+      ? h2List.slice(0, 4).map((h) => `- **${h}**`).join("\n")
       : [
           `- **Instant Setup**: Point ${cleanName} at your live workflow and start in under 60 seconds.`,
           `- **Automated Execution**: Replaces repetitive manual checklists with deterministic automation.`,
@@ -293,31 +307,31 @@ Try it live: ${utmUrl}`;
 
 function generatePseoPages(origin, slug, cleanName) {
   const templates = [
-    { path: `/use-cases/${slug}-for-solo-founders`, keyword: `best ${slug} workflow for solo founders`, volume: "1,400/mo", kd: 12, intent: "Transactional" },
-    { path: `/use-cases/${slug}-automation-guide`, keyword: `how to automate tasks with ${cleanName}`, volume: "2,100/mo", kd: 15, intent: "High Intent" },
-    { path: `/compare/${slug}-vs-manual-workflow`, keyword: `${cleanName} vs manual spreadsheets`, volume: "880/mo", kd: 8, intent: "Comparison" },
-    { path: `/templates/${slug}-starter-kit`, keyword: `free ${slug} template download`, volume: "3,200/mo", kd: 18, intent: "Lead Magnet" },
-    { path: `/alternatives/best-${slug}-alternatives-2026`, keyword: `top ${slug} tools for small teams`, volume: "1,950/mo", kd: 14, intent: "Comparison" },
-    { path: `/calculators/${slug}-roi-calculator`, keyword: `${slug} time & cost calculator`, volume: "1,150/mo", kd: 9, intent: "Interactive" },
-    { path: `/guides/${slug}-api-integration`, keyword: `connect ${cleanName} to webhook & API`, volume: "740/mo", kd: 7, intent: "Developer" },
-    { path: `/use-cases/${slug}-for-agencies`, keyword: `${slug} client reporting for agencies`, volume: "1,600/mo", kd: 16, intent: "B2B Impulse" },
-    { path: `/checklists/${slug}-launch-checklist`, keyword: `complete ${slug} setup checklist`, volume: "2,400/mo", kd: 11, intent: "Lead Magnet" },
-    { path: `/compare/${slug}-pricing-breakdown`, keyword: `is ${cleanName} worth it pricing guide`, volume: "620/mo", kd: 5, intent: "Bottom Funnel" },
-    { path: `/use-cases/${slug}-for-developers`, keyword: `${slug} CLI and developer workflow`, volume: "1,320/mo", kd: 10, intent: "Transactional" },
-    { path: `/use-cases/${slug}-for-indie-hackers`, keyword: `${cleanName} for indie SaaS launches`, volume: "1,780/mo", kd: 11, intent: "Transactional" },
-    { path: `/compare/${slug}-vs-legacy-tools`, keyword: `why switch to ${cleanName} in 2026`, volume: "540/mo", kd: 6, intent: "Comparison" },
-    { path: `/guides/${slug}-programmatic-seo-setup`, keyword: `automated seo setup with ${cleanName}`, volume: "1,490/mo", kd: 13, intent: "High Intent" },
-    { path: `/templates/${slug}-nextjs-boilerplate`, keyword: `${slug} nextjs integration template`, volume: "960/mo", kd: 9, intent: "Developer" },
-    { path: `/use-cases/${slug}-for-saas-teams`, keyword: `scale b2b saas with ${cleanName}`, volume: "1,120/mo", kd: 14, intent: "B2B Impulse" },
-    { path: `/guides/${slug}-stripe-checkout-guide`, keyword: `add self-serve checkout with ${cleanName}`, volume: "830/mo", kd: 8, intent: "Transactional" },
-    { path: `/checklists/${slug}-seo-audit-checklist`, keyword: `technical seo audit checklist ${slug}`, volume: "2,050/mo", kd: 15, intent: "Lead Magnet" },
-    { path: `/calculators/${slug}-conversion-estimator`, keyword: `saas launch conversion rate calculator`, volume: "1,280/mo", kd: 10, intent: "Interactive" },
-    { path: `/alternatives/${slug}-open-source-comparison`, keyword: `${cleanName} vs open source scripts`, volume: "690/mo", kd: 7, intent: "Comparison" },
-    { path: `/use-cases/${slug}-for-product-hunt-launch`, keyword: `prepare product hunt launch with ${cleanName}`, volume: "1,540/mo", kd: 12, intent: "High Intent" },
-    { path: `/guides/${slug}-ai-search-indexing`, keyword: `get indexed on chatgpt and perplexity with ${slug}`, volume: "2,650/mo", kd: 11, intent: "High Intent" },
-    { path: `/templates/${slug}-directory-submission-kit`, keyword: `85 startup directory submission list 2026`, volume: "3,400/mo", kd: 16, intent: "Lead Magnet" },
-    { path: `/use-cases/${slug}-for-ai-wrappers`, keyword: `monetize ai apps with ${cleanName}`, volume: "1,890/mo", kd: 13, intent: "Transactional" },
-    { path: `/compare/${slug}-roi-case-study`, keyword: `${cleanName} traffic and revenue case study`, volume: "480/mo", kd: 4, intent: "Bottom Funnel" }
+    { path: `/use-cases/${slug}-for-solo-founders`, keyword: `${slug} workflow for solo founders`, category: "Use Case", schema: "FAQPage + SoftwareApplication", intent: "Transactional" },
+    { path: `/use-cases/${slug}-automation-guide`, keyword: `how to automate tasks with ${cleanName}`, category: "Use Case", schema: "HowTo + FAQPage", intent: "High Intent" },
+    { path: `/compare/${slug}-vs-manual-workflow`, keyword: `${cleanName} vs manual workflow`, category: "Comparison", schema: "Article + FAQPage", intent: "Comparison" },
+    { path: `/templates/${slug}-starter-kit`, keyword: `${slug} starter template & configuration`, category: "Template", schema: "SoftwareSourceCode", intent: "Lead Magnet" },
+    { path: `/alternatives/best-${slug}-alternatives-2026`, keyword: `${slug} workflow comparison guide`, category: "Comparison", schema: "ItemList + FAQPage", intent: "Comparison" },
+    { path: `/calculators/${slug}-roi-calculator`, keyword: `${slug} time & cost estimator`, category: "Calculator", schema: "WebApplication", intent: "Interactive" },
+    { path: `/guides/${slug}-api-integration`, keyword: `connect ${cleanName} to webhook & API`, category: "Guide", schema: "TechArticle", intent: "Developer" },
+    { path: `/use-cases/${slug}-for-agencies`, keyword: `${slug} multi-project workflow`, category: "Use Case", schema: "FAQPage + SoftwareApplication", intent: "B2B" },
+    { path: `/checklists/${slug}-launch-checklist`, keyword: `complete ${slug} launch checklist`, category: "Checklist", schema: "HowTo + ItemList", intent: "Lead Magnet" },
+    { path: `/compare/${slug}-pricing-breakdown`, keyword: `${cleanName} pricing & plan breakdown`, category: "Comparison", schema: "Product + Offer", intent: "Bottom Funnel" },
+    { path: `/use-cases/${slug}-for-developers`, keyword: `${slug} CLI and developer workflow`, category: "Use Case", schema: "TechArticle", intent: "Transactional" },
+    { path: `/use-cases/${slug}-for-indie-hackers`, keyword: `${cleanName} for indie SaaS launches`, category: "Use Case", schema: "FAQPage + SoftwareApplication", intent: "Transactional" },
+    { path: `/compare/${slug}-vs-legacy-tools`, keyword: `migrating to ${cleanName}`, category: "Comparison", schema: "Article + FAQPage", intent: "Comparison" },
+    { path: `/guides/${slug}-programmatic-seo-setup`, keyword: `structured seo setup with ${cleanName}`, category: "Guide", schema: "TechArticle", intent: "High Intent" },
+    { path: `/templates/${slug}-nextjs-boilerplate`, keyword: `${slug} nextjs integration guide`, category: "Template", schema: "TechArticle", intent: "Developer" },
+    { path: `/use-cases/${slug}-for-saas-teams`, keyword: `${cleanName} for engineering teams`, category: "Use Case", schema: "FAQPage + SoftwareApplication", intent: "B2B" },
+    { path: `/guides/${slug}-stripe-checkout-guide`, keyword: `add self-serve checkout with ${cleanName}`, category: "Guide", schema: "HowTo + TechArticle", intent: "Transactional" },
+    { path: `/checklists/${slug}-seo-audit-checklist`, keyword: `technical seo audit checklist ${slug}`, category: "Checklist", schema: "ItemList + FAQPage", intent: "Lead Magnet" },
+    { path: `/calculators/${slug}-conversion-estimator`, keyword: `saas launch conversion estimator`, category: "Calculator", schema: "WebApplication", intent: "Interactive" },
+    { path: `/alternatives/${slug}-open-source-comparison`, keyword: `${cleanName} open source architecture`, category: "Comparison", schema: "TechArticle", intent: "Comparison" },
+    { path: `/use-cases/${slug}-for-product-hunt-launch`, keyword: `prepare product hunt launch with ${cleanName}`, category: "Use Case", schema: "HowTo + FAQPage", intent: "High Intent" },
+    { path: `/guides/${slug}-ai-search-indexing`, keyword: `configure OAI-SearchBot & PerplexityBot for ${slug}`, category: "Guide", schema: "TechArticle", intent: "High Intent" },
+    { path: `/templates/${slug}-directory-submission-kit`, keyword: `85 startup directory launch kit`, category: "Template", schema: "ItemList", intent: "Lead Magnet" },
+    { path: `/use-cases/${slug}-for-ai-wrappers`, keyword: `monetize ai apps with ${cleanName}`, category: "Use Case", schema: "FAQPage + SoftwareApplication", intent: "Transactional" },
+    { path: `/compare/${slug}-roi-case-study`, keyword: `${cleanName} technical launch breakdown`, category: "Walkthrough", schema: "Article", intent: "Bottom Funnel" }
   ];
 
   return templates.map((t, idx) => ({
@@ -325,10 +339,10 @@ function generatePseoPages(origin, slug, cleanName) {
     url: `${origin}${t.path}`,
     path: t.path,
     keyword: t.keyword,
-    volume: t.volume,
-    kd: `KD ${t.kd}`,
+    volume: t.category,
+    kd: t.schema,
     intent: t.intent,
-    status: "Generated"
+    status: "Blueprint Ready"
   }));
 }
 
@@ -337,7 +351,7 @@ function generateArtifacts(origin, slug, cleanName, description, pseoPages) {
 
   const routeEntries = pseoPages
     .map(
-      p => `  <url>
+      (p) => `  <url>
     <loc>${origin}${p.path}</loc>
     <lastmod>${today}</lastmod>
     <changefreq>weekly</changefreq>
@@ -387,116 +401,218 @@ Sitemap: ${origin}/sitemap.xml`;
 }
 </script>`;
 
-  const paywallCode = `// Postbuild Drop-In Stripe Checkout Gate (${cleanName})
-export async function triggerPostbuildCheckout(plan = "launch_pass", domain = "${slug}.com") {
+  const paywallCode = `// 1. Client Component: Drop-In Stripe Checkout Gate for ${cleanName}
+export async function startCheckout({ priceId = "price_YOUR_STRIPE_PRICE_ID", plan = "pro", email = "" } = {}) {
   const res = await fetch("/api/checkout", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ plan, domain })
+    body: JSON.stringify({ priceId, plan, email })
   });
   const data = await res.json();
   if (data.checkoutUrl) window.location.href = data.checkoutUrl;
   return data;
 }
 
-export function PostbuildCheckoutGate({ domain = "${slug}.com" }) {
+export function CheckoutGate({ priceId = "price_YOUR_STRIPE_PRICE_ID", label = "Get ${cleanName} Pro — $29" }) {
   return (
     <button
       type="button"
-      onClick={() => triggerPostbuildCheckout("launch_pass", domain)}
+      onClick={() => startCheckout({ priceId })}
       style={{
         display: "inline-flex",
         alignItems: "center",
         gap: "8px",
         padding: "10px 18px",
         borderRadius: "8px",
-        background: "#09090b",
+        background: "#059669",
         color: "#ffffff",
         fontWeight: 600,
         fontSize: "13px",
-        border: "1px solid #09090b",
+        border: "1px solid #047857",
         cursor: "pointer"
       }}
     >
-      <span>Get Launch Pass — $29</span>
+      <span>{label}</span>
     </button>
   );
-}`;
+}
+
+// 2. Server Route (/api/checkout.js): Self-Serve Stripe Checkout Session
+// import Stripe from "stripe";
+// const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
+// export default async function handler(req, res) {
+//   const { priceId, email } = req.body || {};
+//   const session = await stripe.checkout.sessions.create({
+//     mode: "payment",
+//     line_items: [{ price: priceId, quantity: 1 }],
+//     customer_email: email || undefined,
+//     allow_promotion_codes: true,
+//     success_url: "${origin}/?checkout=success&session_id={CHECKOUT_SESSION_ID}",
+//     cancel_url: "${origin}/?checkout=cancelled"
+//   });
+//   res.status(200).json({ ok: true, checkoutUrl: session.url });
+// }`;
 
   return { sitemapXml, robotsTxt, jsonLd, paywallCode };
 }
 
-export async function dispatchDirectories({ targetUrl = "https://postbuild.dev", directoryIds = [] }) {
-  const scan = await scanTargetUrl(targetUrl);
+export const INDEXNOW_KEY = "pb7f9a2e4c8b1d6f3a5e0c9b2d4f6a8e";
+
+export async function dispatchDirectories({ targetUrl = "https://www.postbuild.dev", directoryIds = [], lookupFn }) {
+  const scan = await scanTargetUrl(targetUrl, { lookupFn });
   const selected =
     Array.isArray(directoryIds) && directoryIds.length > 0
-      ? scan.directories.filter(d => directoryIds.includes(d.id))
+      ? scan.directories.filter((d) => directoryIds.includes(d.id))
       : scan.directories;
 
+  const origin = scan.targetUrl.replace(/\/$/, "");
+  const parsedHost = new URL(origin).hostname;
+  const allSeoUrls = [`${origin}/`, ...scan.pseoPages.map((p) => `${origin}${p.path}`)];
+
+  // 1. Live IndexNow API Ping (Bing, Yandex, Seznam, Naver, ChatGPT Search / OAI-SearchBot index)
+  let indexNowResult = {
+    dispatched: false,
+    status: 0,
+    urlsSubmitted: allSeoUrls.length,
+    endpoint: "https://api.indexnow.org/indexnow"
+  };
+  try {
+    const idxResp = await fetch("https://api.indexnow.org/indexnow", {
+      method: "POST",
+      headers: { "Content-Type": "application/json; charset=utf-8" },
+      body: JSON.stringify({
+        host: parsedHost,
+        key: INDEXNOW_KEY,
+        keyLocation: `${origin}/${INDEXNOW_KEY}.txt`,
+        urlList: allSeoUrls
+      }),
+      signal: AbortSignal.timeout(4500)
+    });
+    indexNowResult = {
+      dispatched: idxResp.ok || idxResp.status === 202,
+      status: idxResp.status,
+      urlsSubmitted: allSeoUrls.length,
+      endpoint: "https://api.indexnow.org/indexnow"
+    };
+  } catch (err) {
+    indexNowResult.error = err.message;
+  }
+
+  // 2. Live Google WebSub / PubSubHubbub Sitemap Feed Notification
+  let webSubResult = {
+    dispatched: false,
+    status: 0,
+    sitemapUrl: `${origin}/sitemap.xml`,
+    endpoint: "https://pubsubhubbub.appspot.com/"
+  };
+  try {
+    const bodyParams = new URLSearchParams({
+      "hub.mode": "publish",
+      "hub.url": `${origin}/sitemap.xml`
+    });
+    const wsResp = await fetch("https://pubsubhubbub.appspot.com/", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: bodyParams.toString(),
+      signal: AbortSignal.timeout(4500)
+    });
+    webSubResult = {
+      dispatched: wsResp.status === 204 || wsResp.ok,
+      status: wsResp.status,
+      sitemapUrl: `${origin}/sitemap.xml`,
+      endpoint: "https://pubsubhubbub.appspot.com/"
+    };
+  } catch (err) {
+    webSubResult.error = err.message;
+  }
+
   const timestamp = new Date().toISOString();
-  const results = selected.map(dir => ({
+  const results = selected.map((dir) => ({
     id: dir.id,
     name: dir.name,
     category: dir.category,
     dr: dir.dr,
     authType: dir.authType,
+    autoSubmit: Boolean(dir.autoSubmit),
     submissionUrl: dir.url,
     prefilledUrl: dir.prefilledUrl,
     botEmail: scan.botEmail,
-    status: "Dispatched",
+    status: "Prepared",
     dispatchedAt: timestamp
   }));
 
+  const summary = {
+    totalPrepared: results.length,
+    directFormCount: results.filter((r) => r.autoSubmit).length,
+    prefilledPortalCount: results.filter((r) => !r.autoSubmit).length,
+    seoUrlsSubmitted: allSeoUrls.length,
+    indexNowStatus: indexNowResult.status,
+    webSubStatus: webSubResult.status
+  };
+
   return {
     ok: true,
     domain: scan.domain,
     botEmail: scan.botEmail,
     launchKit: scan.launchKit,
+    seoDispatch: {
+      indexNow: indexNowResult,
+      webSub: webSubResult,
+      urlsSubmitted: allSeoUrls.length
+    },
+    summary,
     totalDispatched: results.length,
     results
   };
 }
 
-export async function searchBuyerIntentRadar(query) {
-  const searchTerms = (query || "marketing automation seo indie hacker").trim();
-  const url = `https://hn.algolia.com/api/v1/search_by_date?query=${encodeURIComponent(searchTerms)}&tags=story&hitsPerPage=8`;
-
-  try {
+export async function searchBuyerIntentRadar(query, targetDomain = "") {
+  const searchTerms = (query || "Show HN").trim();
+  const thirtyDaysAgo = Math.floor(Date.now() / 1000) - 30 * 86400;
+  const cleanTarget = String(targetDomain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0];
+  const hasRealDomain = Boolean(cleanTarget && cleanTarget.includes(".") && cleanTarget !== "postbuild.dev");
+
+  async function queryAlgolia(q, minTimestamp) {
+    const filter = minTimestamp ? `&numericFilters=created_at_i>${minTimestamp}` : "";
+    const url = `https://hn.algolia.com/api/v1/search_by_date?query=${encodeURIComponent(q)}&tags=story&hitsPerPage=8${filter}`;
     const res = await fetch(url, { signal: AbortSignal.timeout(5000) });
     if (!res.ok) throw new Error("HN API status " + res.status);
     const data = await res.json();
-    const hits = (data.hits || []).map((h, idx) => ({
+    return (data.hits || []).filter((h) => h && h.title);
+  }
+
+  try {
+    let rawHits = await queryAlgolia(searchTerms, thirtyDaysAgo);
+    if (rawHits.length < 3 && searchTerms.includes(" ")) {
+      const firstKeyword = searchTerms.split(/\s+/)[0];
+      rawHits = await queryAlgolia(firstKeyword, thirtyDaysAgo);
+    }
+    if (rawHits.length === 0) {
+      rawHits = await queryAlgolia("Show HN", thirtyDaysAgo);
+    }
+
+    return rawHits.map((h, idx) => ({
       id: h.objectID || `hn-${idx}`,
       source: "Hacker News",
-      title: h.title || "Discussion thread",
-      author: h.author || "founder",
+      title: h.title,
+      author: h.author || "author",
       createdAt: h.created_at ? h.created_at.split("T")[0] : "Recent",
       url: h.url || `https://news.ycombinator.com/item?id=${h.objectID}`,
       discussionUrl: `https://news.ycombinator.com/item?id=${h.objectID}`,
       points: h.points || 1,
       comments: h.num_comments || 0,
       locked: idx >= 3,
-      draftReply: `Hey @${h.author || "there"} — ran into this exact bottleneck after finishing a build. I ended up running \`git paid\` (https://postbuild.dev) to auto-generate 25 programmatic SEO routes, provision a @postbuild.dev verification inbox, and dispatch to 85 directories.`
+      draftReply: hasRealDomain
+        ? `Hi @${h.author || "there"}, I'm the maker of ${cleanTarget} (disclosure). If it helps with this, here's how we approach it: https://${cleanTarget}. Happy to answer questions.`
+        : ""
     }));
-
-    if (hits.length > 0) return hits;
   } catch {
-    // Fallback if offline
+    return [];
   }
-
-  return [
-    {
-      id: "fallback-1",
-      source: "Hacker News",
-      title: "Ask HN: How are solo devs handling SEO and directory launches after building?",
-      author: "dev_minimalist",
-      createdAt: "Today",
-      url: "https://news.ycombinator.com/ask",
-      discussionUrl: "https://news.ycombinator.com/ask",
-      points: 42,
-      comments: 29,
-      locked: false,
-      draftReply: "I built Postbuild (https://postbuild.dev) for this exact reason — you run `git paid` after `git push` and it provisions a @postbuild.dev bot email, generates 25 programmatic SEO pages, and dispatches to 85 directories."
-    }
-  ];
 }
+

package/lib/fixer.js

@@ -73,6 +73,59 @@ ${report.artifacts?.jsonLd || ""}
 `;
 }
 
+export function buildStartHereMd(report) {
+  const domain = report.domain || "your-project.com";
+  const brand = report.launchKit?.brandName || report.launchKit?.productName || domain;
+  const botEmail = report.botEmail || `${domain.replace(/\./g, "-")}-bot@postbuild.dev`;
+  return `# START HERE — 3-Step Launch Guide for ${brand} (${domain})
+
+Built with **Lovable, Bolt, v0, Replit, Cursor, or Claude**? You do **not** need to know how to code or configure SEO manually. Follow these 3 quick steps:
+
+---
+
+## Step 1: Drop the SEO & AI Crawler Files Into Your App (60 Seconds)
+
+Upload or drag this folder into your AI builder (Lovable, Bolt, Replit, Cursor, Claude Code) and paste this exact prompt:
+
+> **Copy & Paste Prompt for Your AI Builder:**
+> \`\`\`text
+> Please add the Postbuild SEO & AI Launch files to my project:
+> 1. Place robots.txt, sitemap.xml, and llms.txt into my static public/ folder so they are served at /robots.txt, /sitemap.xml, and /llms.txt.
+> 2. Copy the meta tags, canonical link, OpenGraph tags, and JSON-LD structured data from head-seo-snippet.html into my main HTML <head> (or root layout metadata).
+> 3. Place the 25 pre-rendered static HTML guides (under guides/, comparisons/, use-cases/, checklists/) into public/ so those routes resolve cleanly.
+> \`\`\`
+
+---
+
+## Step 2: Submit to Curated Startup & AI Directories (No Personal Inbox Spam)
+
+1. Open \`directories-85.csv\` (or the **85 Directories** tab on \`https://www.postbuild.dev\`).
+2. Click any **Prefilled Launch URL** — your product name, URL, UTM tags, and description are already pre-populated in the link parameters.
+3. For directories with custom form fields, drag the **1-Click Auto-Fill Bookmarklet** on the Postbuild **85 Directories** tab to your browser bookmarks bar and click it on any directory page to fill the form automatically.
+4. **Always use your dedicated verification email** when a directory asks for an email address:
+   \`${botEmail}\`
+
+---
+
+## Step 3: Verify Directory Emails in 1 Click
+
+1. Every confirmation email or 6-digit OTP code sent to \`${botEmail}\` arrives in your **Account & Verification Inbox** on \`https://www.postbuild.dev\`.
+2. Click **Auto-Verify Links** (or copy the 1-click OTP badge) to confirm your listings without cluttering your personal inbox.
+
+---
+
+### Files Included in This Bundle
+- \`START_HERE.md\` — This 3-step quickstart guide + copy-paste AI builder prompt
+- \`public/robots.txt\` — Search & AI crawler rules (GPTBot, ClaudeBot, PerplexityBot)
+- \`public/sitemap.xml\` — XML Sitemap indexing your main URL + 25 programmatic SEO guides
+- \`public/llms.txt\` — Structured markdown manifest for ChatGPT Search, Claude, and Perplexity
+- \`head-seo-snippet.html\` — Title, meta description, OpenGraph social tags, and Schema.org JSON-LD
+- \`launch-kit.md\` — Ready-to-post copy for Show HN, Product Hunt, and startup directories
+- \`directories-85.csv\` — All 85 curated directories ranked by Domain Rating (DR) with prefilled URLs
+- \`public/{use-cases,comparisons,guides,checklists}/*.html\` — 25 static HTML SEO landing pages
+`;
+}
+
 export function applyLocalSeoFixes(report, options = {}) {
   const cwd = options.cwd || process.cwd();
   const overwritePublic = Boolean(options.overwritePublic);
@@ -84,6 +137,11 @@ export function applyLocalSeoFixes(report, options = {}) {
 
   const writtenFiles = [];
 
+  // 0. START_HERE.md in .postbuild/
+  const startHerePath = path.join(outDir, "START_HERE.md");
+  fs.writeFileSync(startHerePath, buildStartHereMd(report), "utf8");
+  writtenFiles.push({ path: path.relative(cwd, startHerePath), role: "3-Step Non-Technical Quickstart & AI Builder Prompt (START_HERE.md)" });
+
   // 1. robots.txt in public/ (if missing or overwritePublic)
   const robotsPath = path.join(publicDir, "robots.txt");
   if (!fs.existsSync(robotsPath) || overwritePublic) {