git-paid 2.1.5 → 2.1.6

package/bin/git-paid.js

@@ -26,7 +26,10 @@ if (subcmd === "mcp" || args.includes("--mcp")) {
 }
 
 function printProGateBanner(licenseCheck, featureName) {
-  console.log(`  [LOCKED] ${featureName} requires an active postbuild Launch Pass ($29) or Studio ($49/mo) license.`);
+  console.log(`  [LOCKED] ${featureName} requires an active postbuild Launch Pass ($29) license.`);
+  if (licenseCheck && licenseCheck.reason === "DOMAIN_MISMATCH") {
+    console.log(`  [SCOPE]  Your active license covers ${licenseCheck.licensedDomain}, not ${licenseCheck.requestedDomain}.`);
+  }
   console.log(`  [UNLOCK] Instant Stripe Checkout ($29 Launch Pass):`);
   console.log(`           ${licenseCheck.checkoutUrl}\n`);
   console.log(`  [LOGIN]  Already purchased? Authenticate your CLI & MCP server:`);
@@ -42,11 +45,11 @@ async function runCli() {
   if (subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
     console.log("  Usage:");
     console.log("    npx git-paid <url>             Run free 8-point SEO/paywall audit & 5-directory preview");
-    console.log("    git paid login <pb_live_key>   Authenticate CLI & MCP with your Launch Pass / Studio license");
+    console.log("    git paid login <pb_live_key>   Authenticate CLI & MCP with your Launch Pass license");
     console.log("    git paid fix [url]             [PRO] Write 25 pSEO HTML pages, robots.txt, sitemap.xml & llms.txt");
     console.log("    git paid submit [url]          [PRO] Headless 85-directory form submitter + OTP auto-verifier");
     console.log("    git paid inbox [bot-email]     [PRO] Check & auto-verify <domain-tld>-bot@postbuild.dev (e.g. acme-com-bot@) links & OTPs");
-    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.5)");
+    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.6)");
     console.log("    git paid init-agent            Scaffold .agent/skills/postbuild/SKILL.md & MCP config");
     console.log("    git paid vault [path]          [PRO] Sync live telemetry & Bento dashboard to Obsidian VaultOS\n");
     process.exit(0);
@@ -150,7 +153,7 @@ async function runCli() {
   if (subcmd === "init-agent" || subcmd === "agent" || subcmd === "skill") {
     const res = installAgentSkillFiles({ cwd: process.cwd() });
     console.log(`  [+] Scaffolded Agent Skill: ${res.skillMdPath}`);
-    console.log(`  [+] Powered by:             postbuild-mcp@2.1.5 (Stateful Delta Compaction)\n`);
+    console.log(`  [+] Powered by:             postbuild-mcp@2.1.6 (Stateful Delta Compaction)\n`);
     console.log("  Add this to your Claude Code / Cursor / Antigravity MCP config:\n");
     console.log(JSON.stringify(res.mcpConfigSnippet, null, 2));
     console.log("");
@@ -158,7 +161,7 @@ async function runCli() {
   }
 
   if (subcmd === "vault" || subcmd === "vaultos") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    const license = await verifyCliLicense({ domain: "" });
     if (!license.valid) {
       printProGateBanner(license, "Markdown / Docs & Telemetry Sync");
       process.exit(1);
@@ -168,7 +171,7 @@ async function runCli() {
       args.find((a, i) => i > 0 && !a.startsWith("--") && !/^https?:\/\//i.test(a)) ||
       process.cwd();
     const urlArgs = args.filter((a, i) => i > 0 && /^https?:\/\//i.test(a));
-    const targetUrls = urlArgs.length ? urlArgs : ["https://postbuild.dev"];
+    const targetUrls = urlArgs.length ? urlArgs : [license.domain ? `https://${license.domain}` : "https://postbuild.dev"];
 
     console.log(`  [*] Syncing Postbuild MCP Telemetry & Launch Status...`);
     console.log(`  [*] Target Directory: ${vaultArg}`);
@@ -200,12 +203,12 @@ async function runCli() {
   }
 
   if (subcmd === "inbox") {
-    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
-    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    const license = await verifyCliLicense({ domain: "" });
     if (!license.valid) {
       printProGateBanner(license, "Dedicated @postbuild.dev Verification Inbox & OTP Auto-Verifier");
       process.exit(1);
     }
+    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || license.inbox || "postbuild-bot@postbuild.dev";
 
     if (args.includes("--test")) {
       await sendTestVerificationEmail(inboxAddr, "postbuild.dev");

package/lib/auth.js

@@ -207,12 +207,37 @@ export function loadLocalCredentials() {
 
 export async function verifyCliLicense({ domain = "postbuild.dev", token = "" } = {}) {
   const candidateToken = (token || "").trim() || loadLocalCredentials()?.token || "";
+  const cleanReqDomain = String(domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^(www\.)+/, "")
+    .split("/")[0]
+    .split(":")[0];
 
   if (candidateToken && candidateToken.startsWith("pb_live_")) {
     // 1. If running on the server (where signing secret is present), verify signature & revocation directly
     try {
       const localCheck = verifyLicenseToken(candidateToken);
       if (localCheck.valid) {
+        const licDomain = String(localCheck.domain || "")
+          .toLowerCase()
+          .trim()
+          .replace(/^https?:\/\//, "")
+          .replace(/^(www\.)+/, "")
+          .split("/")[0]
+          .split(":")[0];
+        if (cleanReqDomain && licDomain && licDomain !== "*" && cleanReqDomain !== licDomain) {
+          return {
+            valid: false,
+            reason: "DOMAIN_MISMATCH",
+            licensedDomain: licDomain,
+            requestedDomain: cleanReqDomain,
+            checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+            webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+            message: `Your Launch Pass license key is scoped to ${licDomain} and does not cover ${cleanReqDomain}.`
+          };
+        }
         return {
           valid: true,
           email: localCheck.email,
@@ -226,8 +251,8 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
       return {
         valid: false,
         reason: localCheck.error || "INVALID_OR_REVOKED_LICENSE",
-        checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
-        webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+        checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
+        webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
         message: localCheck.error || "Invalid or revoked pb_live_ license key."
       };
     } catch {
@@ -245,6 +270,24 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
         if (resp.ok) {
           const data = await resp.json();
           if (data && data.ok && data.authenticated) {
+            const licDomain = String(data.domain || "")
+              .toLowerCase()
+              .trim()
+              .replace(/^https?:\/\//, "")
+              .replace(/^(www\.)+/, "")
+              .split("/")[0]
+              .split(":")[0];
+            if (cleanReqDomain && licDomain && licDomain !== "*" && cleanReqDomain !== licDomain) {
+              return {
+                valid: false,
+                reason: "DOMAIN_MISMATCH",
+                licensedDomain: licDomain,
+                requestedDomain: cleanReqDomain,
+                checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+                webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+                message: `Your Launch Pass license key is scoped to ${licDomain} and does not cover ${cleanReqDomain}.`
+              };
+            }
             return {
               valid: true,
               email: data.email,
@@ -262,10 +305,10 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
   return {
     valid: false,
     reason: "PRO_LICENSE_REQUIRED",
-    checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
-    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+    checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
+    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
     message:
-      "A verified postbuild Launch Pass ($29) or Studio ($49/mo) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox verification."
+      "A verified postbuild Launch Pass ($29) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox verification."
   };
 }
 

package/lib/engine.js

@@ -384,6 +384,11 @@ Allow: /
 
 Sitemap: ${origin}/sitemap.xml`;
 
+  const isPostbuildSelf = origin.includes("postbuild.dev");
+  const offersBlock = isPostbuildSelf
+    ? `,\n  "offers": {\n    "@type": "Offer",\n    "price": "29.00",\n    "priceCurrency": "USD"\n  }`
+    : "";
+
   const jsonLd = `<script type="application/ld+json">
 {
   "@context": "https://schema.org",
@@ -392,12 +397,7 @@ Sitemap: ${origin}/sitemap.xml`;
   "url": "${origin}",
   "applicationCategory": "BusinessApplication",
   "operatingSystem": "Web",
-  "description": "${description.replace(/"/g, '\\"')}",
-  "offers": {
-    "@type": "Offer",
-    "price": "29.00",
-    "priceCurrency": "USD"
-  }
+  "description": "${description.replace(/"/g, '\\"')}"${offersBlock}
 }
 </script>`;
 

package/lib/fixer.js

@@ -53,6 +53,7 @@ export function buildHeadSeoSnippet(report) {
     ? `${report.launchKit.brandName || report.launchKit.productName || report.domain} — ${report.launchKit.tagline}`
     : report.meta?.title || report.domain;
   const desc = report.launchKit?.shortPitch || report.meta?.description || "";
+  const cleanOrigin = String(report.targetUrl || `https://${report.domain}`).replace(/\/$/, "");
   return `<!-- Generated by postbuild (git paid fix) for ${report.domain} -->
 <title>${title}</title>
 <meta name="description" content="${desc.replace(/"/g, "&quot;")}" />
@@ -64,9 +65,11 @@ export function buildHeadSeoSnippet(report) {
 <meta property="og:title" content="${title.replace(/"/g, "&quot;")}" />
 <meta property="og:description" content="${desc.replace(/"/g, "&quot;")}" />
 <meta property="og:url" content="${report.targetUrl}" />
+<meta property="og:image" content="${cleanOrigin}/og-card.png" />
 <meta name="twitter:card" content="summary_large_image" />
 <meta name="twitter:title" content="${title.replace(/"/g, "&quot;")}" />
 <meta name="twitter:description" content="${desc.replace(/"/g, "&quot;")}" />
+<meta name="twitter:image" content="${cleanOrigin}/og-card.png" />
 
 <!-- Structured Data (JSON-LD) -->
 ${report.artifacts?.jsonLd || ""}

package/lib/guard.js

@@ -0,0 +1,200 @@
+/**
+ * Unified Authentication, Inbox Ownership, Admin Guard, CORS & Rate Limiting for Postbuild API Routes
+ */
+
+import crypto from "node:crypto";
+import { verifyLicenseToken, checkStripeCustomerStatusCached, getFounderEmailsSet } from "./auth.js";
+import { getBotInboxForDomain, normalizeInboxInput } from "./inbox.js";
+
+const rateLimitBuckets = new Map(); // `${bucket}:${ip}` -> { count: number, resetAt: number }
+
+const ALLOWED_ORIGINS = new Set([
+  "https://www.postbuild.dev",
+  "https://postbuild.dev"
+]);
+
+export function applyCorsHeaders(req, res) {
+  const origin = req.headers?.origin || "";
+  if (ALLOWED_ORIGINS.has(origin)) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+  } else {
+    res.setHeader("Access-Control-Allow-Origin", "https://www.postbuild.dev");
+  }
+  res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Admin-Secret");
+}
+
+export function extractBearerToken(req, body = null) {
+  const header = req.headers?.authorization || req.headers?.Authorization || "";
+  if (typeof header === "string" && header.startsWith("Bearer ")) {
+    return header.slice(7).trim();
+  }
+  if (body && typeof body === "object" && typeof body.token === "string") {
+    return body.token.trim();
+  }
+  return "";
+}
+
+export function requireLicense(req, body = null) {
+  const token = extractBearerToken(req, body);
+  if (!token) return null;
+  try {
+    const verified = verifyLicenseToken(token);
+    return verified && verified.valid && verified.email ? { ...verified, token } : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function requireLicenseAsync(req, body = null) {
+  const verified = requireLicense(req, body);
+  if (!verified) return null;
+  const remoteStatus = await checkStripeCustomerStatusCached(verified);
+  if (remoteStatus !== "active") {
+    return null;
+  }
+  return verified;
+}
+
+export function isValidProjectDomain(rawDomain = "", allowPostbuildOperator = false) {
+  const clean = String(rawDomain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^(www\.)+/, "")
+    .split("/")[0]
+    .split("?")[0]
+    .split("#")[0]
+    .split(":")[0];
+
+  if (!clean || !clean.includes(".") || clean.length < 4 || clean.length > 253) {
+    return { valid: false, domain: "" };
+  }
+  if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/.test(clean)) {
+    return { valid: false, domain: "" };
+  }
+  const labels = clean.split(".");
+  const tld = labels[labels.length - 1];
+  if (tld.length < 2 || /^\d+$/.test(tld)) {
+    return { valid: false, domain: "" };
+  }
+  if (
+    clean === "example.com" ||
+    clean.endsWith(".invalid") ||
+    clean.endsWith(".localhost") ||
+    clean.endsWith(".local") ||
+    clean.endsWith(".internal")
+  ) {
+    return { valid: false, domain: "" };
+  }
+  if (!allowPostbuildOperator && (clean === "postbuild.dev" || clean.endsWith(".postbuild.dev"))) {
+    return { valid: false, domain: "" };
+  }
+  return { valid: true, domain: clean };
+}
+
+export function requireAdmin(req) {
+  const givenStr = String(req.headers?.["x-admin-secret"] || "").trim();
+  const expectedStr = String(process.env.POSTBUILD_ADMIN_SECRET || "").trim();
+  if (expectedStr.length < 32 || givenStr.length !== expectedStr.length) {
+    return false;
+  }
+  const given = Buffer.from(givenStr, "utf8");
+  const expected = Buffer.from(expectedStr, "utf8");
+  return crypto.timingSafeEqual(given, expected);
+}
+
+/**
+ * Verifies that the authenticated license holder owns the requested inbox and domain.
+ * Every license is strictly bound to its own verified domain and inbox.
+ */
+export function isInboxOwnedByLicense(verified, requestedInbox = "", requestedDomain = "") {
+  if (!verified || !verified.valid) return false;
+
+  const licenseDomain = String(verified.domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  const licenseEmail = String(verified.email || "").toLowerCase().trim();
+  if (!licenseDomain || !licenseDomain.includes(".")) return false;
+
+  const isPostbuildOperator = getFounderEmailsSet().has(licenseEmail);
+
+  // Only an explicit operator may access the postbuild.dev inbox
+  if (licenseDomain === "postbuild.dev" && !isPostbuildOperator) {
+    return false;
+  }
+
+  if (requestedDomain) {
+    const cleanReqDomain = String(requestedDomain)
+      .toLowerCase()
+      .trim()
+      .replace(/^https?:\/\//, "")
+      .replace(/^www\./, "")
+      .split("/")[0]
+      .split(":")[0];
+    if (!cleanReqDomain || cleanReqDomain !== licenseDomain) {
+      return false;
+    }
+  }
+
+  const targetInbox = normalizeInboxInput(requestedInbox || requestedDomain || verified.inbox || licenseDomain);
+  if (!targetInbox || targetInbox === "unassigned-bot@postbuild.dev") return false;
+  if (targetInbox === "postbuild-bot@postbuild.dev" && !isPostbuildOperator) return false;
+
+  const expectedInboxWithEmail = getBotInboxForDomain(licenseDomain, licenseEmail);
+  const expectedInboxDomainOnly = getBotInboxForDomain(licenseDomain);
+
+  return (
+    targetInbox === verified.inbox ||
+    targetInbox === expectedInboxWithEmail ||
+    targetInbox === expectedInboxDomainOnly
+  );
+}
+
+export function getClientIp(req) {
+  const xff = req.headers?.["x-forwarded-for"];
+  if (typeof xff === "string" && xff.trim()) {
+    return xff.split(",")[0].trim();
+  }
+  return req.socket?.remoteAddress || "127.0.0.1";
+}
+
+export function checkRateLimit(req, bucket = "default", limitPerMinute = 20) {
+  if (process.env.POSTBUILD_DISABLE_RATE_LIMIT === "1") {
+    return { allowed: true, remaining: limitPerMinute };
+  }
+  const ip = getClientIp(req);
+  const key = `${bucket}:${ip}`;
+  const now = Date.now();
+  const windowMs = 60 * 1000;
+
+  let entry = rateLimitBuckets.get(key);
+  if (!entry || now >= entry.resetAt) {
+    entry = { count: 0, resetAt: now + windowMs };
+    rateLimitBuckets.set(key, entry);
+  }
+
+  entry.count += 1;
+  if (entry.count > limitPerMinute) {
+    return {
+      allowed: false,
+      remaining: 0,
+      retryAfterSeconds: Math.max(1, Math.ceil((entry.resetAt - now) / 1000))
+    };
+  }
+
+  return {
+    allowed: true,
+    remaining: Math.max(0, limitPerMinute - entry.count),
+    retryAfterSeconds: 0
+  };
+}
+
+export function resetRateLimitsForTests() {
+  rateLimitBuckets.clear();
+}

package/lib/inbox.js

@@ -232,7 +232,7 @@ async function syncFromResendReceivingApi(targetInbox = "") {
   const normalizedTarget = targetInbox.trim().toLowerCase();
 
   try {
-    const resp = await fetch("https://api.resend.com/emails/receiving?limit=25", {
+    const resp = await fetch("https://api.resend.com/emails/receiving?limit=100", {
       headers: { Authorization: `Bearer ${resendApiKey}` },
       signal: AbortSignal.timeout(3500)
     });
@@ -241,15 +241,16 @@ async function syncFromResendReceivingApi(targetInbox = "") {
     const data = await resp.json();
     const items = Array.isArray(data?.data) ? data.data : Array.isArray(data) ? data : [];
 
-    for (const item of items.slice(0, 15)) {
-      const id = item.id || item.email_id;
-      if (!id || memoryInboxMessages.has(id)) continue;
-
+    const matchingItems = items.filter((item) => {
       const recipients = (Array.isArray(item.to) ? item.to : [item.to])
         .filter(Boolean)
         .map((r) => String(r).replace(/^.*<([^>]+)>.*$/, "$1").trim().toLowerCase());
+      return recipients.includes(normalizedTarget);
+    });
 
-      if (!recipients.includes(normalizedTarget)) continue;
+    for (const item of matchingItems.slice(0, 15)) {
+      const id = item.id || item.email_id;
+      if (!id || memoryInboxMessages.has(id)) continue;
 
       let fullItem = item;
       if (!item.text && !item.html) {

package/lib/mcp.js

@@ -1,6 +1,6 @@
 /**
  * Postbuild Stateful MCP Server & Obsidian VaultOS Sync Engine
- * Powered by Postbuild MCP Middleware (postbuild-mcp v2.1.0)
+ * Powered by Postbuild MCP Middleware (postbuild-mcp v2.1.6)
  */
 
 import fs from "node:fs";
@@ -8,6 +8,7 @@ import path from "node:path";
 import readline from "node:readline";
 import { scanTargetUrl, searchBuyerIntentRadar, dispatchDirectories, DIRECTORIES } from "./engine.js";
 import { verifyCliLicense } from "./auth.js";
+import { isInboxOwnedByLicense } from "./guard.js";
 import { applyLocalSeoFixes } from "./fixer.js";
 import { listInboxMessages, sendTestVerificationEmail, getBotInboxForDomain, markMessageVerified } from "./inbox.js";
 import { withStatefulMcp, createGenericEntityAdapter, spotlightUntrustedText } from "./stateful-mcp.js";
@@ -238,7 +239,7 @@ export async function runStatefulMcpSimulation({
   });
 
   return {
-    server: "postbuild-mcp@2.1.0",
+    server: "postbuild-mcp@2.1.6",
     domain: state.domain,
     readinessScore: report.readinessScore,
     botEmail: report.botEmail,
@@ -317,9 +318,9 @@ export async function syncPostbuildToVault({
 
   const telemetryPayload = {
     generatedAt: new Date().toISOString(),
-    engine: "postbuild-mcp@2.1.0",
+    engine: "postbuild-mcp@2.1.6",
     mcpTelemetry: {
-      server: "postbuild-mcp@2.1.0",
+      server: "postbuild-mcp@2.1.6",
       tokenReductionPct: projectsData[0]?.mcpReductionPct || "-75.4%",
       supersetCacheHits: mcpStats.supersetCacheHits,
       deltasEmitted: mcpStats.deltasEmitted,
@@ -424,7 +425,7 @@ try {
 
 const projects = pb && pb.projects ? pb.projects : [];
 const radar = pb && pb.radarThreads ? pb.radarThreads : [];
-const mcp = pb && pb.mcpTelemetry ? pb.mcpTelemetry : { server: 'postbuild-mcp@2.1.0', tokenReductionPct: '-75.4%', supersetCacheHits: 4 };
+const mcp = pb && pb.mcpTelemetry ? pb.mcpTelemetry : { server: 'postbuild-mcp@2.1.6', tokenReductionPct: '-75.4%', supersetCacheHits: 4 };
 
 root.innerHTML = \`
   <div class="meta-bar">
@@ -865,7 +866,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_inbox") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    const license = await verifyCliLicense({ domain: "", token: authToken });
     if (!license.valid) {
       return {
         isError: true,
@@ -876,7 +877,16 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
       };
     }
 
-    const inboxAddr = args.inbox || license.inbox || getBotInboxForDomain(license.domain || "postbuild.dev", license.email);
+    const defaultInbox = license.inbox || getBotInboxForDomain(license.domain || "postbuild.dev", license.email);
+    const inboxAddr = args.inbox || defaultInbox;
+    if (args.inbox && !isInboxOwnedByLicense({ email: license.email, domain: license.domain, inbox: defaultInbox }, inboxAddr, "")) {
+      return {
+        isError: true,
+        status: "FORBIDDEN_INBOX",
+        message: `Your license covers ${defaultInbox}. You cannot read ${inboxAddr}.`
+      };
+    }
+
     const autoVerify = Boolean(args.auto_verify);
     const result = await autoVerifyInboxLinks(inboxAddr, {
       autoVerify,
@@ -919,7 +929,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
   }
 
   if (name === "postbuild_vault_sync") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev", token: authToken });
+    const license = await verifyCliLicense({ domain: "", token: authToken });
     if (!license.valid) {
       return {
         isError: true,
@@ -932,7 +942,7 @@ export async function executeMcpToolCall(name, args = {}, sessionId = "mcp-stdio
 
     return await syncPostbuildToVault({
       vaultPath: args.vault_path || process.cwd(),
-      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : ["https://www.postbuild.dev"],
+      urls: Array.isArray(args.urls) && args.urls.length ? args.urls : [license.domain ? `https://${license.domain}` : "https://www.postbuild.dev"],
       sessionId,
       bearerToken: license.token
     });
@@ -975,7 +985,7 @@ export function startPostbuildMcpServer() {
             },
             serverInfo: {
               name: "postbuild-mcp",
-              version: "2.1.0"
+              version: "2.1.6"
             }
           }
         });

package/lib/pseo.js

@@ -68,19 +68,19 @@ function renderTopicSpecificSection(pageSlug, cleanName, domain) {
                 <td><strong>Free Audit &amp; Preview</strong></td>
                 <td><strong>$0</strong></td>
                 <td>Any public URL</td>
-                <td>8-point SEO &amp; AI crawler readiness scan, copy-paste <code>robots.txt</code> / <code>llms.txt</code> / JSON-LD snippets, and 5-directory preview.</td>
+                <td>8-point SEO &amp; AI crawler readiness scan, copy-paste <code>robots.txt</code> / <code>llms.txt</code> / JSON-LD snippets, Auto-Fill Bookmarklet, and 5-directory preview.</td>
               </tr>
               <tr>
                 <td><strong>Launch Pass</strong> <span class="pill emerald" style="margin-left:6px;">Recommended</span></td>
                 <td><strong>$29</strong> (one-time)</td>
                 <td>1 project domain</td>
-                <td>All 85 prefilled directory launch links + CSV export, 25 static HTML SEO route generators (<code>npx git-paid fix</code>), dedicated <code>&lt;domain&gt;-bot@postbuild.dev</code> verification inbox (30-day retention), and CLI/MCP key.</td>
+                <td>All 85 prefilled directory launch links + CSV export, 1-click <code>.zip</code> Launch Bundle with 25 static HTML SEO routes (<code>npx git-paid fix</code>), dedicated <code>&lt;domain&gt;-bot@postbuild.dev</code> verification inbox (30-day retention), and CLI/MCP key.</td>
               </tr>
               <tr>
-                <td><strong>Studio</strong></td>
-                <td><strong>$49 / month</strong></td>
-                <td>Multi-project</td>
-                <td>Everything in Launch Pass across multiple domains, IndexNow &amp; WebSub batch pinging, and Stripe Customer Portal billing management.</td>
+                <td><strong>Done-For-You &amp; Studio</strong></td>
+                <td><strong>Waitlist</strong></td>
+                <td>Multi-project / Concierge</td>
+                <td>Done-for-you manual &amp; CAPTCHA directory submissions, weekly AI search visibility checks, and Buyer Intent Radar alerts (contact <code>support@postbuild.dev</code>).</td>
               </tr>
             </tbody>
           </table>
@@ -91,39 +91,39 @@ function renderTopicSpecificSection(pageSlug, cleanName, domain) {
   if (pageSlug.includes("roi-case-study")) {
     return `
       <section class="card" style="margin-bottom:28px;">
-        <h2>Dogfooding Case Study: Launching <code>www.postbuild.dev</code> with <code>npx git-paid</code></h2>
+        <h2>Live Self-Audit Walkthrough: How <code>www.postbuild.dev</code> Uses <code>npx git-paid</code></h2>
         <p style="font-size:14px;color:var(--muted);margin-top:4px;">
-          We built and launched <code>www.postbuild.dev</code> using our own CLI and MCP server. Here is the exact baseline vs. post-build output measured on our own repository:
+          Every deliverable generated for <code>www.postbuild.dev</code> is publicly deployed and verifiable via live HTTP inspection:
         </p>
-        <div class="table-wrap" role="region" aria-label="Dogfooding launch metrics" tabindex="0">
+        <div class="table-wrap" role="region" aria-label="Live self-audit verification" tabindex="0">
           <table>
             <thead>
               <tr>
                 <th>Deliverable</th>
-                <th>Before <code>npx git-paid fix</code></th>
-                <th>After <code>npx git-paid fix</code></th>
+                <th>Without Postbuild</th>
+                <th>Live on <code>www.postbuild.dev</code> (Verifiable Now)</th>
               </tr>
             </thead>
             <tbody>
               <tr>
-                <td><strong>Technical Readiness Score</strong></td>
-                <td>38 / 100 (missing <code>llms.txt</code>, <code>sitemap.xml</code>, and AI crawler rules)</td>
-                <td>100 / 100 (all 8 SEO, JSON-LD, OpenGraph, and telemetry checks passing)</td>
+                <td><strong>8-Point Technical Audit</strong></td>
+                <td>Manual inspection of headers, schema, and crawler rules</td>
+                <td><strong>100 / 100</strong> across all 8 checks (run <code>npx git-paid https://www.postbuild.dev</code> to verify live)</td>
               </tr>
               <tr>
                 <td><strong>Static SEO Landing Pages</strong></td>
-                <td>1 route (<code>/</code> only)</td>
-                <td>26 routes indexed in <code>sitemap.xml</code> (<code>/</code> + 25 pre-rendered guides &amp; comparisons)</td>
+                <td>Single-page app root (<code>/</code>) only</td>
+                <td>26 routes indexed in <a href="/sitemap.xml"><code>/sitemap.xml</code></a> (<code>/</code> + 25 pre-rendered static HTML guides)</td>
               </tr>
               <tr>
-                <td><strong>Directory Submission Prep</strong></td>
-                <td>Manual spreadsheet tracking</td>
-                <td>85 prefilled submission URLs with UTM parameters + dedicated <code>postbuild-bot@postbuild.dev</code> inbox</td>
+                <td><strong>AI Search Crawler Manifest</strong></td>
+                <td>No <code>llms.txt</code> or explicit AI bot rules</td>
+                <td>Live <a href="/llms.txt"><code>/llms.txt</code></a> and <a href="/robots.txt"><code>/robots.txt</code></a> allowing <code>OAI-SearchBot</code>, <code>PerplexityBot</code>, and <code>ClaudeBot</code></td>
               </tr>
               <tr>
-                <td><strong>Setup Time</strong></td>
-                <td>~28 hours estimated manual work</td>
-                <td>Under 5 minutes via CLI + Vercel deploy</td>
+                <td><strong>Directory Launch Queue</strong></td>
+                <td>Manual spreadsheet copy-pasting &amp; personal inbox clutter</td>
+                <td>85 curated directories ranked by DR with prefilled UTM links + dedicated <code>postbuild-bot@postbuild.dev</code> inbox</td>
               </tr>
             </tbody>
           </table>
@@ -151,7 +151,7 @@ function renderTopicSpecificSection(pageSlug, cleanName, domain) {
             <tbody>
               <tr>
                 <td><strong>Manual Spreadsheets</strong></td>
-                <td>$0 (14–28 hrs founder time)</td>
+                <td>$0 (manual form entry)</td>
                 <td>Clutters personal email</td>
                 <td>Manual authoring required</td>
               </tr>
@@ -192,22 +192,28 @@ export function renderSinglePseoPage(page, allPages = [], options = {}) {
   const relatedPages = allPages.filter((p) => p.path !== page.path).slice(0, 8);
   const topicSection = renderTopicSpecificSection(pageSlug, cleanName, domain);
 
+  const softwareAppNode = {
+    "@type": "SoftwareApplication",
+    name: cleanName,
+    url: origin,
+    applicationCategory: "DeveloperApplication",
+    operatingSystem: "Web, macOS, Windows, Linux",
+    description: metaDescription,
+    ...(domain === "postbuild.dev"
+      ? {
+          offers: {
+            "@type": "Offer",
+            price: "29.00",
+            priceCurrency: "USD"
+          }
+        }
+      : {})
+  };
+
   const jsonLd = {
     "@context": "https://schema.org",
     "@graph": [
-      {
-        "@type": "SoftwareApplication",
-        name: cleanName,
-        url: origin,
-        applicationCategory: "DeveloperApplication",
-        operatingSystem: "Web, macOS, Windows, Linux",
-        description: metaDescription,
-        offers: {
-          "@type": "Offer",
-          price: "29.00",
-          priceCurrency: "USD"
-        }
-      },
+      softwareAppNode,
       {
         "@type": "BreadcrumbList",
         itemListElement: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-paid",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "git push ships your code. git paid sells it. Autonomous SEO, Paywall, MCP & Directory Launch Agent (www.postbuild.dev).",
   "type": "module",
   "main": "bin/git-paid.js",
@@ -13,6 +13,7 @@
     "lib/directories.js",
     "lib/engine.js",
     "lib/fixer.js",
+    "lib/guard.js",
     "lib/inbox.js",
     "lib/mcp.js",
     "lib/pseo.js",