git-paid 2.1.3 → 2.1.4

package/lib/safe-fetch.js

@@ -0,0 +1,239 @@
+/**
+ * SSRF-Safe Outbound HTTP Fetcher for Postbuild (postbuild.dev)
+ *
+ * Enforces:
+ * 1. Protocol allowlist: http: and https: only
+ * 2. Pre-request DNS resolution and private/loopback/link-local/metadata IP blocking
+ * 3. Manual redirect following (max 3 hops) with full SSRF validation on every hop
+ * 4. Strict 5-second timeout and 2 MB response body cap
+ */
+
+import dns from "node:dns";
+import net from "node:net";
+
+const MAX_REDIRECTS = 3;
+const DEFAULT_TIMEOUT_MS = 5000;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024; // 2 MB
+
+export function isPrivateOrReservedIp(ip) {
+  if (!ip || typeof ip !== "string") return true;
+  const trimmed = ip.trim().toLowerCase().replace(/^\[|\]$/g, "");
+
+  // Handle IPv4-mapped IPv6 addresses in dotted-quad (::ffff:127.0.0.1) or hex-quartet (::ffff:7f00:1) form
+  const v4MappedPrefix = /^(?:::ffff:|0:0:0:0:0:ffff:)/i;
+  if (v4MappedPrefix.test(trimmed)) {
+    const suffix = trimmed.replace(v4MappedPrefix, "");
+    if (net.isIPv4(suffix)) {
+      return isPrivateOrReservedIp(suffix);
+    }
+    const hexMatch = suffix.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (hexMatch) {
+      const hi = parseInt(hexMatch[1], 16);
+      const lo = parseInt(hexMatch[2], 16);
+      const dotted = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+      return isPrivateOrReservedIp(dotted);
+    }
+    return true;
+  }
+
+  if (net.isIPv4(trimmed)) {
+    const parts = trimmed.split(".").map((n) => Number(n));
+    if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
+      return true;
+    }
+    const [a, b, c] = parts;
+    if (a === 0) return true; // 0.0.0.0/8
+    if (a === 10) return true; // 10.0.0.0/8 (RFC1918)
+    if (a === 127) return true; // 127.0.0.0/8 (Loopback)
+    if (a === 169 && b === 254) return true; // 169.254.0.0/16 (Link-local / AWS & GCP metadata)
+    if (a === 172 && b >= 16 && b <= 31) return true; // 172.16.0.0/12 (RFC1918)
+    if (a === 192 && b === 168) return true; // 192.168.0.0/16 (RFC1918)
+    if (a === 100 && b >= 64 && b <= 127) return true; // 100.64.0.0/10 (Carrier-grade NAT / Tailscale)
+    if (a === 192 && b === 0 && (c === 0 || c === 2)) return true; // IETF Protocol Assignments & TEST-NET-1
+    if (a === 198 && (b === 18 || b === 19)) return true; // Benchmarking (198.18.0.0/15)
+    if (a === 198 && b === 51 && c === 100) return true; // TEST-NET-2
+    if (a === 203 && b === 0 && c === 113) return true; // TEST-NET-3
+    if (a >= 224) return true; // Multicast & Reserved (224.0.0.0/4+)
+    return false;
+  }
+
+  if (net.isIPv6(trimmed)) {
+    if (trimmed === "::" || trimmed === "::1" || trimmed === "0:0:0:0:0:0:0:1" || trimmed === "0:0:0:0:0:0:0:0") {
+      return true; // Unspecified or loopback
+    }
+    if (trimmed.startsWith("fc") || trimmed.startsWith("fd")) return true; // Unique local fc00::/7
+    if (
+      trimmed.startsWith("fe8") ||
+      trimmed.startsWith("fe9") ||
+      trimmed.startsWith("fea") ||
+      trimmed.startsWith("feb")
+    ) {
+      return true; // Link-local fe80::/10
+    }
+    if (trimmed.startsWith("ff")) return true; // Multicast ff00::/8
+    if (trimmed.startsWith("64:ff9b:")) return true; // NAT64 well-known prefix 64:ff9b::/96
+    if (trimmed.startsWith("2001:db8:")) return true; // Documentation prefix 2001:db8::/32
+    if (trimmed.startsWith("2001:0:") || trimmed.startsWith("2001::")) return true; // Teredo 2001::/32
+    if (trimmed.startsWith("2002:")) return true; // 6to4 2002::/16
+    return false;
+  }
+
+  return true;
+}
+
+function ssrfError(message) {
+  const err = new Error(message);
+  err.statusCode = 422;
+  return err;
+}
+
+export async function assertSafeUrl(rawUrl, options = {}) {
+  let parsed;
+  try {
+    parsed = rawUrl instanceof URL ? rawUrl : new URL(String(rawUrl));
+  } catch {
+    throw ssrfError("Invalid URL format");
+  }
+
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw ssrfError(`Disallowed protocol: ${parsed.protocol}`);
+  }
+
+  if (parsed.username || parsed.password) {
+    throw ssrfError("URLs with embedded credentials are not allowed");
+  }
+
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (
+    !hostname ||
+    hostname === "localhost" ||
+    hostname.endsWith(".localhost") ||
+    hostname.endsWith(".local") ||
+    hostname.endsWith(".internal") ||
+    hostname === "metadata.google.internal"
+  ) {
+    throw ssrfError(`Blocked internal hostname: ${hostname}`);
+  }
+
+  if (net.isIP(hostname)) {
+    if (isPrivateOrReservedIp(hostname)) {
+      throw ssrfError(`Blocked private or reserved IP address: ${hostname}`);
+    }
+    return parsed;
+  }
+
+  const lookupFn = options.lookupFn || ((host) => dns.promises.lookup(host, { all: true }));
+  let records;
+  try {
+    records = await lookupFn(hostname);
+  } catch {
+    throw ssrfError(`Unable to resolve hostname: ${hostname}`);
+  }
+
+  const list = Array.isArray(records) ? records : [records];
+  if (list.length === 0) {
+    throw ssrfError(`No DNS records resolved for hostname: ${hostname}`);
+  }
+
+  for (const rec of list) {
+    const addr = typeof rec === "string" ? rec : rec?.address;
+    if (!addr || isPrivateOrReservedIp(addr)) {
+      throw ssrfError(`Blocked hostname resolving to private/reserved IP (${addr || "unknown"})`);
+    }
+  }
+
+  return parsed;
+}
+
+async function readResponseWithCap(response, maxBytes = MAX_RESPONSE_BYTES) {
+  if (!response.body) {
+    return Buffer.alloc(0);
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    const buf = Buffer.from(value);
+    total += buf.length;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new Error(`Response exceeded maximum size limit of ${maxBytes} bytes`);
+    }
+    chunks.push(buf);
+  }
+
+  return Buffer.concat(chunks);
+}
+
+export async function safeFetch(rawUrl, options = {}) {
+  const {
+    method = "GET",
+    headers = {},
+    body,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxRedirects = MAX_REDIRECTS,
+    maxBytes = MAX_RESPONSE_BYTES,
+    allowedDomains = null,
+    lookupFn
+  } = options;
+
+  let currentUrl = String(rawUrl);
+
+  for (let hop = 0; hop <= maxRedirects; hop++) {
+    const validatedUrl = await assertSafeUrl(currentUrl, { lookupFn });
+
+    if (Array.isArray(allowedDomains) && allowedDomains.length > 0) {
+      const host = validatedUrl.hostname.replace(/^www\./i, "").toLowerCase();
+      const allowed = allowedDomains.some((d) => {
+        const cleanD = String(d).replace(/^www\./i, "").toLowerCase();
+        return host === cleanD || host.endsWith(`.${cleanD}`);
+      });
+      if (!allowed) {
+        throw new Error(`Domain ${host} is not in the allowed outbound verification list`);
+      }
+    }
+
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+    try {
+      const resp = await fetch(validatedUrl.toString(), {
+        method: hop === 0 ? method : "GET",
+        headers,
+        body: hop === 0 ? body : undefined,
+        redirect: "manual",
+        signal: controller.signal
+      });
+
+      if ([301, 302, 303, 307, 308].includes(resp.status)) {
+        const location = resp.headers.get("location");
+        if (!location) {
+          throw new Error(`Redirect response (${resp.status}) missing Location header`);
+        }
+        if (hop === maxRedirects) {
+          throw new Error(`Maximum redirect limit (${maxRedirects}) exceeded`);
+        }
+        currentUrl = new URL(location, validatedUrl).toString();
+        continue;
+      }
+
+      const bodyBuffer = await readResponseWithCap(resp, maxBytes);
+      return {
+        ok: resp.ok,
+        status: resp.status,
+        url: validatedUrl.toString(),
+        headers: resp.headers,
+        bodyBuffer,
+        text: () => bodyBuffer.toString("utf8"),
+        json: () => JSON.parse(bodyBuffer.toString("utf8"))
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  throw new Error("Redirect loop terminated");
+}

package/lib/stateful-mcp.js

@@ -12,9 +12,21 @@
 
 import crypto from "node:crypto";
 
-const DEFAULT_SECRET =
-  process.env.POSTBUILD_SECRET ||
-  "postbuild_mcp_stateful_occ_hmac_secret";
+const EPHEMERAL_MCP_SECRET = crypto.randomBytes(32).toString("hex");
+
+export function requireMcpSecret() {
+  const value = (process.env.POSTBUILD_SECRET || process.env.POSTBUILD_AUTH_SECRET || "").trim();
+  if (value.length < 32) {
+    throw new Error("POSTBUILD_SECRET or POSTBUILD_AUTH_SECRET is missing or too short (minimum 32 characters required)");
+  }
+  return value;
+}
+
+function getMcpSecret() {
+  const configured = (process.env.POSTBUILD_SECRET || process.env.POSTBUILD_AUTH_SECRET || "").trim();
+  if (configured.length >= 32) return configured;
+  return EPHEMERAL_MCP_SECRET;
+}
 
 export function spotlightUntrustedText(value) {
   if (value === null || value === undefined) return value;
@@ -369,7 +381,7 @@ export function withStatefulMcp(options = {}) {
         const nonce = crypto.randomBytes(6).toString("hex");
         const rawPayload = `${sessionId}|${principalId}|${entityId}|${liveWatermark}|${changeHash}|${nonce}`;
         const sig = crypto
-          .createHmac("sha256", DEFAULT_SECRET)
+          .createHmac("sha256", getMcpSecret())
           .update(rawPayload)
           .digest("hex")
           .slice(0, 20);

package/lib/submitter.js

@@ -1,6 +1,6 @@
 /**
- * Local Headless Directory Form Submitter & Auto-Verification Pipeline
- * (`git paid submit <url>` / `postbuild_submit` MCP tool)
+ * Local Headless Directory Form Inspector & Launch Submitter
+ * (`npx git-paid submit <url>`)
  */
 
 import fs from "node:fs";
@@ -9,6 +9,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { scanTargetUrl, dispatchDirectories, DIRECTORIES } from "./engine.js";
 import { autoVerifyInboxLinks } from "./mcp.js";
+import { assertSafeUrl, safeFetch } from "./safe-fetch.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -34,9 +35,11 @@ export function detectHeadlessBrowser() {
 
 /**
  * Inspects a directory submission URL using Headless Chromium/Edge (`--headless=new --dump-dom`)
- * or HTTP fetch to detect form inputs (`url`, `name`, `email`, `description`) and submit/prefill.
+ * or SSRF-safe HTTP fetch to detect form inputs (`url`, `name`, `email`, `description`) and prefill.
  */
-async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHeadless = true) {
+export async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHeadless = true, options = {}) {
+  await assertSafeUrl(dir.url, { lookupFn: options.lookupFn });
+
   const payload = {
     product_name: launchKit.productName,
     url: launchKit.utmUrl || launchKit.targetUrl,
@@ -56,7 +59,6 @@ async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHea
         [
           "--headless=new",
           "--disable-gpu",
-          "--no-sandbox",
           "--virtual-time-budget=2500",
           "--dump-dom",
           dir.url
@@ -72,23 +74,20 @@ async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHea
 
   if (!html) {
     try {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), 3500);
-      const resp = await fetch(dir.url, {
+      const resp = await safeFetch(dir.url, {
+        timeoutMs: 3500,
         headers: {
           "User-Agent":
             "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36"
         },
-        signal: controller.signal
+        lookupFn: options.lookupFn
       });
-      clearTimeout(timer);
       if (resp.ok) {
-        html = await resp.text();
+        html = resp.text();
       }
     } catch {}
   }
 
-  // Parse detected <input>, <textarea>, and <form> elements from the live DOM
   const inputNames = [];
   const inputRegex = /<(?:input|textarea|select)\b[^>]*?(?:name|id|placeholder)=["']([^"']+)["'][^>]*>/gi;
   let m;
@@ -100,7 +99,54 @@ async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHea
   }
 
   const formActionMatch = html.match(/<form\b[^>]*?action=["']([^"']+)["']/i);
-  const detectedAction = formActionMatch ? formActionMatch[1] : dir.url;
+  let detectedAction = formActionMatch ? formActionMatch[1] : dir.url;
+  if (detectedAction && detectedAction.startsWith("/")) {
+    try {
+      detectedAction = new URL(detectedAction, dir.url).toString();
+    } catch {
+      detectedAction = dir.url;
+    }
+  }
+
+  const hasCaptcha =
+    /cf-turnstile|g-recaptcha|hcaptcha/i.test(html) ||
+    inputNames.some((n) => /turnstile|captcha/i.test(n));
+  let httpSubmitStatus = null;
+  let submissionMode = hasCaptcha ? "prefilled_launch_url (captcha_gated)" : "prefilled_launch_url";
+
+  if (!hasCaptcha && formActionMatch && /^https?:\/\//i.test(detectedAction) && !process.env.VERCEL && options.allowFormPost !== false) {
+    try {
+      const formBody = new URLSearchParams();
+      for (const f of inputNames) {
+        const lower = f.toLowerCase();
+        if (lower.includes("email")) formBody.set(f, payload.email);
+        else if (lower.includes("url") || lower.includes("link") || lower.includes("website")) formBody.set(f, payload.url);
+        else if (lower.includes("tag") || lower.includes("headline") || lower.includes("short")) formBody.set(f, payload.tagline);
+        else if (lower.includes("desc") || lower.includes("about") || lower.includes("pitch")) formBody.set(f, payload.description);
+        else if (lower.includes("name") || lower.includes("title")) formBody.set(f, payload.product_name);
+      }
+      for (const [k, v] of Object.entries(payload)) {
+        if (!formBody.has(k)) formBody.set(k, v);
+      }
+
+      const postResp = await safeFetch(detectedAction, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "User-Agent": "Postbuild-Form-Inspector/2.1 (+https://www.postbuild.dev)"
+        },
+        body: formBody.toString(),
+        maxRedirects: 0,
+        timeoutMs: 4000,
+        lookupFn: options.lookupFn
+      });
+      httpSubmitStatus = postResp.status;
+      submissionMode = `form_post_attempted (HTTP ${postResp.status})`;
+    } catch {}
+  }
+
+  // Only count 2xx responses as submitted; 3xx redirects (e.g. to login pages) require manual confirmation
+  const postSucceeded = Boolean(httpSubmitStatus && httpSubmitStatus >= 200 && httpSubmitStatus < 300);
 
   return {
     id: dir.id,
@@ -112,34 +158,44 @@ async function inspectAndSubmitDirectoryForm(dir, launchKit, browserPath, useHea
     prefilledUrl: dir.prefilledUrl,
     engineUsed,
     detectedFormAction: detectedAction,
+    hasCaptcha,
+    httpSubmitStatus,
+    submissionMode,
     mappedFields: inputNames.length
       ? inputNames
       : ["name", "url", "tagline", "description", "maker_email"],
     submittedPayload: payload,
-    status: "dispatched_and_queued_for_otp",
+    status: hasCaptcha
+      ? "prefilled_ready_captcha_protected"
+      : postSucceeded
+        ? "submitted_awaiting_verification"
+        : "prefilled_ready_manual_confirm",
     timestamp: new Date().toISOString()
   };
 }
 
 /**
- * Runs the end-to-end Headless Directory Submitter + Inbox Auto-Verification pipeline.
+ * Runs the Headless Directory Form Inspector + optional Inbox Verification pipeline.
  */
 export async function runHeadlessDirectorySubmit({
-  targetUrl = "https://postbuild.dev",
+  targetUrl = "https://www.postbuild.dev",
   limit = 6,
   useHeadless = true,
-  cwd = process.cwd()
+  autoVerify = false,
+  cwd = process.cwd(),
+  lookupFn
 } = {}) {
-  const report = await scanTargetUrl(targetUrl);
+  const report = await scanTargetUrl(targetUrl, { lookupFn });
   const browserPath = detectHeadlessBrowser();
 
-  // 1. Fire IndexNow, Sitemap & WebSub API dispatches across all 85 directories
+  // 1. Fire IndexNow & WebSub dispatches across all 85 directories
   const dispatchSummary = await dispatchDirectories({
     targetUrl: report.targetUrl,
-    directoryIds: []
+    directoryIds: [],
+    lookupFn
   });
 
-  // 2. Run live Headless DOM Form Inspection & Prefill on the top direct-form directories
+  // 2. Run Headless DOM Form Inspection & Prefill on the top direct-form directories
   const directFormDirs = (report.directories || DIRECTORIES)
     .filter((d) => d.autoSubmit)
     .slice(0, Math.max(1, Math.min(Number(limit) || 6, 15)));
@@ -150,13 +206,17 @@ export async function runHeadlessDirectorySubmit({
       dir,
       report.launchKit,
       browserPath,
-      useHeadless
+      useHeadless,
+      { lookupFn }
     );
     formReceipts.push(receipt);
   }
 
-  // 3. Poll <slug>-bot@postbuild.dev and auto-verify any confirmation links / extract OTPs
-  const inboxVerification = await autoVerifyInboxLinks(report.botEmail);
+  // 3. Check dedicated @postbuild.dev inbox (auto-verify is opt-in only)
+  const inboxVerification = await autoVerifyInboxLinks(report.botEmail, {
+    autoVerify: Boolean(autoVerify),
+    lookupFn
+  });
 
   const result = {
     ok: true,
@@ -164,7 +224,7 @@ export async function runHeadlessDirectorySubmit({
     targetUrl: report.targetUrl,
     botEmail: report.botEmail,
     headlessBrowser: browserPath ? path.basename(browserPath) : "http-fallback",
-    totalDirectoriesDispatched: DIRECTORIES.length,
+    totalDirectoriesPrepared: DIRECTORIES.length,
     headlessInspectedCount: formReceipts.length,
     dispatchSummary: dispatchSummary.summary,
     formReceipts,
@@ -177,10 +237,11 @@ export async function runHeadlessDirectorySubmit({
     completedAt: new Date().toISOString()
   };
 
-  // Save local receipt log if running inside a project workspace
+  // P1-7: Always save local receipt log to .postbuild/ (never public/)
   try {
-    const outDir = fs.existsSync(path.join(cwd, "public")) ? path.join(cwd, "public") : cwd;
-    const receiptPath = path.join(outDir, "postbuild-submissions.json");
+    const pbDir = path.join(cwd, ".postbuild");
+    fs.mkdirSync(pbDir, { recursive: true });
+    const receiptPath = path.join(pbDir, "postbuild-submissions.json");
     fs.writeFileSync(receiptPath, JSON.stringify(result, null, 2), "utf8");
     result.receiptFile = receiptPath;
   } catch {}

package/package.json

@@ -1,44 +1,53 @@
-{
-  "name": "git-paid",
-  "version": "2.1.3",
-  "description": "git push ships your code. git paid sells it. Autonomous SEO, Paywall, MCP & Directory Launch Agent (postbuild.dev).",
-  "type": "module",
-  "main": "bin/git-paid.js",
-  "bin": {
-    "git-paid": "bin/git-paid.js",
-    "postbuild": "bin/git-paid.js"
-  },
-  "files": [
-    "bin/",
-    "lib/",
-    "brand/",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "start": "node server.js",
-    "dev": "node server.js",
-    "sola:build": "node scripts/build-sola.mjs",
-    "cli": "node ./bin/git-paid.js"
-  },
-  "keywords": [
-    "postbuild",
-    "git-paid",
-    "mcp",
-    "seo",
-    "programmatic-seo",
-    "stripe",
-    "monetization",
-    "directory-submission"
-  ],
-  "author": "Bennett Moore (https://postbuild.dev)",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Rbm3267/postbuild.git"
-  },
-  "homepage": "https://postbuild.dev",
-  "license": "Apache-2.0",
-  "dependencies": {
-    "stripe": "^23.1.0"
-  }
-}
+{
+  "name": "git-paid",
+  "version": "2.1.4",
+  "description": "git push ships your code. git paid sells it. Autonomous SEO, Paywall, MCP & Directory Launch Agent (www.postbuild.dev).",
+  "type": "module",
+  "main": "bin/git-paid.js",
+  "bin": {
+    "git-paid": "bin/git-paid.js"
+  },
+  "files": [
+    "bin/",
+    "lib/auth.js",
+    "lib/directories.js",
+    "lib/engine.js",
+    "lib/fixer.js",
+    "lib/inbox.js",
+    "lib/mcp.js",
+    "lib/pseo.js",
+    "lib/safe-fetch.js",
+    "lib/stateful-mcp.js",
+    "lib/submitter.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "start": "node server.js",
+    "dev": "node server.js",
+    "sola:build": "node scripts/build-sola.mjs",
+    "cli": "node ./bin/git-paid.js",
+    "test": "node --test test/security.test.js test/smoke.test.js",
+    "smoke": "node scripts/smoke.mjs"
+  },
+  "keywords": [
+    "postbuild",
+    "git-paid",
+    "mcp",
+    "seo",
+    "programmatic-seo",
+    "stripe",
+    "monetization",
+    "directory-submission"
+  ],
+  "author": "Bennett Moore (https://www.postbuild.dev)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Rbm3267/postbuild.git"
+  },
+  "homepage": "https://www.postbuild.dev",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "stripe": "^23.1.0"
+  }
+}

package/brand/README.md

@@ -1,54 +0,0 @@
-# `postbuild` (`git paid`) — Official Brand Kit
-
-> **`git push` ships your code. `git paid` sells it.**
-
-## 1. Brand Assets
-
-All assets are available in both `/brand/` (repository root) and `/public/brand/` (served live at `https://postbuild.dev/brand/...`):
-
-| Asset | File | Dimensions | Format | Usage |
-| :--- | :--- | :--- | :--- | :--- |
-| **Brand Icon (PNG)** | [`postbuild-icon.png`](./postbuild-icon.png) | `512 × 512 px` | PNG | Stripe Icon, App Store / Directory listings, OAuth apps |
-| **Horizontal Logo (PNG)** | [`postbuild-logo.png`](./postbuild-logo.png) | `1000 × 260 px` | PNG | Stripe Checkout Header Logo, Invoices, Receipts, Press Kits |
-| **Brand Icon (SVG)** | [`postbuild-icon.svg`](./postbuild-icon.svg) | Vector (`64 × 64`) | SVG | Web UI, Favicons, Scalable vector contexts |
-| **Horizontal Logo (SVG)** | [`postbuild-logo.svg`](./postbuild-logo.svg) | Vector (`1000 × 260`) | SVG | High-DPI headers, documentation, print |
-
----
-
-## 2. Visual Symbolism (`2 × 2` Grid)
-
-The `postbuild` mark represents the two-stage developer lifecycle inside a clean `2 × 2` architectural grid:
-1. **Top Row (`git push` — Ship the build)**: Deep Slate build module (`#0F172A`) on the left pushing outward into the Sky Blue deployment arrow (`#0284C7`) on the right.
-2. **Bottom Row (`git paid` — Monetize & distribute)**: Muted Slate post-build artifact (`#64748B`) on the left converting into the Emerald Green revenue badge (`$`, `#10B981`) on the right.
-
----
-
-## 3. Color Palette
-
-| Role | Color Name | Hex Code | RGB | Usage |
-| :--- | :--- | :--- | :--- | :--- |
-| **Primary / Brand** | Deep Slate | `#0F172A` | `rgb(15, 23, 42)` | Wordmark, primary CTAs, Stripe **Brand Color** |
-| **Accent (`git paid`)** | Emerald Green | `#10B981` | `rgb(16, 185, 129)` | `$` revenue badge, `git paid` pill, Stripe **Accent Color** |
-| **Secondary (`git push`)** | Sky Blue | `#0284C7` | `rgb(2, 132, 199)` | Deployment arrow (`→`), technical indicators |
-| **Structural Muted** | Slate Gray | `#64748B` | `rgb(100, 116, 139)` | Secondary build block, supporting labels |
-| **Surface / Canvas** | Crisp Alabaster | `#F8FAFC` | `rgb(248, 250, 252)` | App background, card surfaces |
-| **Pure White** | White | `#FFFFFF` | `rgb(255, 255, 255)` | Icon & Logo container surface |
-
----
-
-## 4. Typography
-
-- **Wordmark (`postbuild`)**: Always lowercase (`postbuild`), set in **Plus Jakarta Sans / Inter ExtraBold (`800`)** with `-0.045em` letter-spacing.
-- **CLI Companion (`git paid`)**: Always lowercase (`git paid`), set in **JetBrains Mono Bold (`700`)** inside an emerald tint pill (`#ECFDF5` fill, `#A7F3D0` border, `#047857` text).
-
----
-
-## 5. Official Stripe & Directory Copy
-
-- **Business Name**: `postbuild`
-- **Website**: `https://postbuild.dev`
-- **Statement Descriptor**: `POSTBUILD.DEV` (Shortened: `POSTBUILD`)
-- **One-Line Tagline**:
-  > Automated post-build technical SEO, programmatic metadata, and directory launch kits for software developers.
-- **Full Business Description**:
-  > `postbuild` (`https://postbuild.dev`) is a developer SaaS platform and CLI tool (`git paid` / `npx postbuild`) that automates post-build technical SEO audits, structured metadata (JSON-LD, OpenGraph, robots.txt, sitemaps), programmatic SEO route packs, and curated SaaS directory launch kits for software developers and product teams.

package/brand/postbuild-icon.svg

@@ -1,14 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 64 64" fill="none">
-  <rect width="64" height="64" rx="14" fill="#FFFFFF"/>
-  
-  <!-- Top-left build block (git push source) -->
-  <rect x="7" y="7" width="20" height="20" rx="5.5" stroke="#0F172A" stroke-width="5" fill="#F8FAFC"/>
-  <!-- Bottom-left build block (git paid source) -->
-  <rect x="7" y="37" width="20" height="20" rx="5.5" stroke="#64748B" stroke-width="5" fill="#F8FAFC"/>
-  <!-- Top-right arrow (git push) -->
-  <path d="M36 17H56M56 17L47.5 8.5M56 17L47.5 25.5" stroke="#0284C7" stroke-width="5.2" stroke-linecap="round" stroke-linejoin="round" fill="none"/>
-  <!-- Bottom-right emerald badge + crisp typographic $ (git paid) -->
-  <rect x="35" y="35" width="22" height="22" rx="6.5" fill="#10B981"/>
-  <text x="46" y="52.5" text-anchor="middle" fill="#FFFFFF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif" font-size="18.5" font-weight="800">$</text>
-
-</svg>