git-paid 2.1.5 → 2.1.7

package/bin/git-paid.js

@@ -26,7 +26,10 @@ if (subcmd === "mcp" || args.includes("--mcp")) {
 }
 
 function printProGateBanner(licenseCheck, featureName) {
-  console.log(`  [LOCKED] ${featureName} requires an active postbuild Launch Pass ($29) or Studio ($49/mo) license.`);
+  console.log(`  [LOCKED] ${featureName} requires an active postbuild Launch Pass ($29) license.`);
+  if (licenseCheck && licenseCheck.reason === "DOMAIN_MISMATCH") {
+    console.log(`  [SCOPE]  Your active license covers ${licenseCheck.licensedDomain}, not ${licenseCheck.requestedDomain}.`);
+  }
   console.log(`  [UNLOCK] Instant Stripe Checkout ($29 Launch Pass):`);
   console.log(`           ${licenseCheck.checkoutUrl}\n`);
   console.log(`  [LOGIN]  Already purchased? Authenticate your CLI & MCP server:`);
@@ -42,11 +45,11 @@ async function runCli() {
   if (subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
     console.log("  Usage:");
     console.log("    npx git-paid <url>             Run free 8-point SEO/paywall audit & 5-directory preview");
-    console.log("    git paid login <pb_live_key>   Authenticate CLI & MCP with your Launch Pass / Studio license");
-    console.log("    git paid fix [url]             [PRO] Write 25 pSEO HTML pages, robots.txt, sitemap.xml & llms.txt");
+    console.log("    git paid login <pb_live_key>   Authenticate CLI & MCP with your Launch Pass license");
+    console.log("    git paid fix [url]             [PRO] Write starter pSEO pages (.postbuild/pseo), robots.txt, sitemap.xml & llms.txt");
     console.log("    git paid submit [url]          [PRO] Headless 85-directory form submitter + OTP auto-verifier");
-    console.log("    git paid inbox [bot-email]     [PRO] Check & auto-verify <domain-tld>-bot@postbuild.dev (e.g. acme-com-bot@) links & OTPs");
-    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.5)");
+    console.log("    git paid inbox [bot-email]     [PRO] Check <domain-tld>-bot@postbuild.dev inbox (pass --verify to auto-click links)");
+    console.log("    git paid mcp                   Start Postbuild MCP Server (postbuild-mcp v2.1.7)");
     console.log("    git paid init-agent            Scaffold .agent/skills/postbuild/SKILL.md & MCP config");
     console.log("    git paid vault [path]          [PRO] Sync live telemetry & Bento dashboard to Obsidian VaultOS\n");
     process.exit(0);
@@ -150,7 +153,7 @@ async function runCli() {
   if (subcmd === "init-agent" || subcmd === "agent" || subcmd === "skill") {
     const res = installAgentSkillFiles({ cwd: process.cwd() });
     console.log(`  [+] Scaffolded Agent Skill: ${res.skillMdPath}`);
-    console.log(`  [+] Powered by:             postbuild-mcp@2.1.5 (Stateful Delta Compaction)\n`);
+    console.log(`  [+] Powered by:             postbuild-mcp@2.1.7 (Stateful Delta Compaction)\n`);
     console.log("  Add this to your Claude Code / Cursor / Antigravity MCP config:\n");
     console.log(JSON.stringify(res.mcpConfigSnippet, null, 2));
     console.log("");
@@ -158,7 +161,7 @@ async function runCli() {
   }
 
   if (subcmd === "vault" || subcmd === "vaultos") {
-    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    const license = await verifyCliLicense({ domain: "" });
     if (!license.valid) {
       printProGateBanner(license, "Markdown / Docs & Telemetry Sync");
       process.exit(1);
@@ -168,7 +171,7 @@ async function runCli() {
       args.find((a, i) => i > 0 && !a.startsWith("--") && !/^https?:\/\//i.test(a)) ||
       process.cwd();
     const urlArgs = args.filter((a, i) => i > 0 && /^https?:\/\//i.test(a));
-    const targetUrls = urlArgs.length ? urlArgs : ["https://postbuild.dev"];
+    const targetUrls = urlArgs.length ? urlArgs : [license.domain ? `https://${license.domain}` : "https://postbuild.dev"];
 
     console.log(`  [*] Syncing Postbuild MCP Telemetry & Launch Status...`);
     console.log(`  [*] Target Directory: ${vaultArg}`);
@@ -200,17 +203,25 @@ async function runCli() {
   }
 
   if (subcmd === "inbox") {
-    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || "postbuild-bot@postbuild.dev";
-    const license = await verifyCliLicense({ domain: "postbuild.dev" });
+    const license = await verifyCliLicense({ domain: "" });
     if (!license.valid) {
       printProGateBanner(license, "Dedicated @postbuild.dev Verification Inbox & OTP Auto-Verifier");
       process.exit(1);
     }
+    const inboxAddr = args.find((a, i) => i > 0 && !a.startsWith("--")) || license.inbox || "postbuild-bot@postbuild.dev";
 
     if (args.includes("--test")) {
       await sendTestVerificationEmail(inboxAddr, "postbuild.dev");
     }
-    const res = await autoVerifyInboxLinks(inboxAddr, { autoVerify: !args.includes("--no-verify") });
+    const res = await autoVerifyInboxLinks(inboxAddr, {
+      autoVerify: args.includes("--verify"),
+      bearerToken: license.token
+    });
+    if (res.requiresDomainVerification) {
+      console.log(`  [!] Domain ownership verification required for ${license.domain || inboxAddr}:`);
+      console.log(`      ${res.error || "Verify ownership on https://www.postbuild.dev/?tab=account to unlock your inbox."}\n`);
+      process.exit(1);
+    }
     console.log(
       `  [*] Verification Inbox: ${res.inboxAddress} (${res.totalMessages} messages, ${res.verifiedCount} auto-verified)\n`
     );
@@ -274,7 +285,9 @@ async function runCli() {
 
   const fixResult = applyLocalSeoFixes(report, {
     cwd: process.cwd(),
-    overwritePublic: isFixMode || args.includes("--force")
+    overwritePublic: args.includes("--force"),
+    publishPseoToPublic: args.includes("--publish-pages"),
+    verificationToken: license.verificationToken || ""
   });
 
   console.log(`\n  --- Local Repository Auto-Fix (${fixResult.framework} — Licensed to ${license.email}) ---`);

package/lib/auth.js

@@ -10,19 +10,178 @@ const otpChallengeState = new Map(); // cid -> { attempts: number, used: boolean
 const memoryEntitlements = new Map(); // key (jti or email) -> { jti, email, customerId, plan, domain, inbox, status, expiresAt }
 const processedWebhookEvents = new Set(); // stripe_event_id idempotency set
 
+export const FREE_EMAIL_PROVIDERS = new Set([
+  "gmail.com",
+  "googlemail.com",
+  "outlook.com",
+  "outlook.de",
+  "outlook.fr",
+  "outlook.es",
+  "outlook.co.uk",
+  "hotmail.com",
+  "hotmail.co.uk",
+  "hotmail.fr",
+  "hotmail.de",
+  "hotmail.es",
+  "hotmail.it",
+  "live.com",
+  "live.co.uk",
+  "live.fr",
+  "live.de",
+  "msn.com",
+  "yahoo.com",
+  "yahoo.co.uk",
+  "yahoo.ca",
+  "yahoo.co.jp",
+  "yahoo.fr",
+  "yahoo.de",
+  "yahoo.es",
+  "yahoo.it",
+  "yahoo.com.au",
+  "yahoo.com.br",
+  "yahoo.co.in",
+  "ymail.com",
+  "icloud.com",
+  "me.com",
+  "mac.com",
+  "aol.com",
+  "proton.me",
+  "protonmail.com",
+  "protonmail.ch",
+  "pm.me",
+  "zoho.com",
+  "gmx.com",
+  "gmx.de",
+  "gmx.net",
+  "gmx.at",
+  "gmx.ch",
+  "web.de",
+  "t-online.de",
+  "freenet.de",
+  "mail.com",
+  "fastmail.com",
+  "hey.com",
+  "yandex.com",
+  "yandex.ru",
+  "duck.com",
+  "tuta.com",
+  "tutanota.com",
+  "qq.com",
+  "163.com",
+  "126.com",
+  "sina.com",
+  "sohu.com",
+  "foxmail.com",
+  "naver.com",
+  "daum.net",
+  "hanmail.net",
+  "mail.ru",
+  "bk.ru",
+  "inbox.ru",
+  "list.ru",
+  "rambler.ru",
+  "seznam.cz",
+  "wp.pl",
+  "onet.pl",
+  "interia.pl",
+  "o2.pl",
+  "libero.it",
+  "virgilio.it",
+  "alice.it",
+  "orange.fr",
+  "wanadoo.fr",
+  "free.fr",
+  "sfr.fr",
+  "laposte.net"
+]);
+
+export function isFreeEmailDomain(emailDomain = "") {
+  const clean = String(emailDomain || "").toLowerCase().trim();
+  if (!clean) return true;
+  if (FREE_EMAIL_PROVIDERS.has(clean)) return true;
+  if (/^(gmail|googlemail|yahoo|ymail|hotmail|outlook|live|msn|icloud|aol|proton|protonmail|zoho|gmx|yandex|tuta|tutanota|fastmail)\.[a-z.]{2,6}$/i.test(clean)) {
+    return true;
+  }
+  return false;
+}
+
 export function requireAuthSecret() {
   const explicit = (process.env.POSTBUILD_AUTH_SECRET || process.env.POSTBUILD_SECRET || "").trim();
   if (explicit.length >= 32) {
     return explicit;
   }
-  // Safe domain-separated derivation on Vercel if POSTBUILD_AUTH_SECRET has not been added to project env yet
-  const resendSeed = (process.env.RESEND_API_KEY || "").trim();
-  if (process.env.VERCEL && resendSeed.length >= 24 && !process.env.POSTBUILD_STRICT_SECRET_TEST) {
-    return crypto.createHmac("sha256", resendSeed).update("postbuild:auth:v2:hmac-signing-key").digest("hex");
-  }
   throw new Error("POSTBUILD_SECRET or POSTBUILD_AUTH_SECRET is missing or too short (minimum 32 characters required)");
 }
 
+export function getDomainVerificationToken(domain = "", email = "") {
+  const cleanDomain = String(domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  const cleanEmail = String(email || "").toLowerCase().trim();
+  const verifyKey = (process.env.POSTBUILD_VERIFY_SECRET || "").trim();
+  const secret = verifyKey.length >= 16 ? verifyKey : requireAuthSecret();
+  const digest = crypto
+    .createHmac("sha256", secret)
+    .update(`domain-verify:${cleanDomain}:${cleanEmail}`)
+    .digest("hex")
+    .slice(0, 32);
+  return `postbuild-verify=${digest}`;
+}
+
+export function getCandidateVerificationTokens(domain = "", email = "") {
+  const cleanDomain = String(domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  const cleanEmail = String(email || "").toLowerCase().trim();
+  const secrets = [
+    (process.env.POSTBUILD_VERIFY_SECRET || "").trim(),
+    (() => {
+      try {
+        return requireAuthSecret();
+      } catch {
+        return "";
+      }
+    })()
+  ].filter((s) => s.length >= 16);
+  const tokens = new Set([getDomainVerificationToken(cleanDomain, cleanEmail)]);
+  for (const s of secrets) {
+    const digest = crypto
+      .createHmac("sha256", s)
+      .update(`domain-verify:${cleanDomain}:${cleanEmail}`)
+      .digest("hex")
+      .slice(0, 32);
+    tokens.add(`postbuild-verify=${digest}`);
+  }
+  return Array.from(tokens);
+}
+
+export function isSameDomainVerifiedEmail(email = "", domain = "", emailVerified = false) {
+  const cleanEmail = String(email || "").toLowerCase().trim();
+  const cleanDomain = String(domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^www\./, "")
+    .split("/")[0]
+    .split(":")[0];
+  if (!cleanEmail || !cleanDomain || !cleanDomain.includes(".")) return false;
+  if (getFounderEmailsSet().has(cleanEmail) && cleanDomain === "postbuild.dev") {
+    return true;
+  }
+  if (!emailVerified) return false;
+  const emailDomain = cleanEmail.includes("@") ? cleanEmail.split("@")[1] : "";
+  if (!emailDomain || isFreeEmailDomain(emailDomain)) return false;
+  return cleanDomain === emailDomain || cleanDomain.endsWith(`.${emailDomain}`);
+}
+
 function timingSafeStringEqual(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
   const bufA = Buffer.from(a, "utf8");
@@ -207,18 +366,44 @@ export function loadLocalCredentials() {
 
 export async function verifyCliLicense({ domain = "postbuild.dev", token = "" } = {}) {
   const candidateToken = (token || "").trim() || loadLocalCredentials()?.token || "";
+  const cleanReqDomain = String(domain || "")
+    .toLowerCase()
+    .trim()
+    .replace(/^https?:\/\//, "")
+    .replace(/^(www\.)+/, "")
+    .split("/")[0]
+    .split(":")[0];
 
   if (candidateToken && candidateToken.startsWith("pb_live_")) {
     // 1. If running on the server (where signing secret is present), verify signature & revocation directly
     try {
       const localCheck = verifyLicenseToken(candidateToken);
       if (localCheck.valid) {
+        const licDomain = String(localCheck.domain || "")
+          .toLowerCase()
+          .trim()
+          .replace(/^https?:\/\//, "")
+          .replace(/^(www\.)+/, "")
+          .split("/")[0]
+          .split(":")[0];
+        if (cleanReqDomain && licDomain && licDomain !== "*" && cleanReqDomain !== licDomain) {
+          return {
+            valid: false,
+            reason: "DOMAIN_MISMATCH",
+            licensedDomain: licDomain,
+            requestedDomain: cleanReqDomain,
+            checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+            webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+            message: `Your Launch Pass license key is scoped to ${licDomain} and does not cover ${cleanReqDomain}.`
+          };
+        }
         return {
           valid: true,
           email: localCheck.email,
           plan: localCheck.plan,
           domain: localCheck.domain,
           inbox: localCheck.inbox,
+          verificationToken: getDomainVerificationToken(localCheck.domain, localCheck.email),
           jti: localCheck.jti,
           token: candidateToken
         };
@@ -226,8 +411,8 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
       return {
         valid: false,
         reason: localCheck.error || "INVALID_OR_REVOKED_LICENSE",
-        checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
-        webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+        checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
+        webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
         message: localCheck.error || "Invalid or revoked pb_live_ license key."
       };
     } catch {
@@ -245,12 +430,31 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
         if (resp.ok) {
           const data = await resp.json();
           if (data && data.ok && data.authenticated) {
+            const licDomain = String(data.domain || "")
+              .toLowerCase()
+              .trim()
+              .replace(/^https?:\/\//, "")
+              .replace(/^(www\.)+/, "")
+              .split("/")[0]
+              .split(":")[0];
+            if (cleanReqDomain && licDomain && licDomain !== "*" && cleanReqDomain !== licDomain) {
+              return {
+                valid: false,
+                reason: "DOMAIN_MISMATCH",
+                licensedDomain: licDomain,
+                requestedDomain: cleanReqDomain,
+                checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+                webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain)}`,
+                message: `Your Launch Pass license key is scoped to ${licDomain} and does not cover ${cleanReqDomain}.`
+              };
+            }
             return {
               valid: true,
               email: data.email,
               plan: data.plan,
               domain: data.domain,
               inbox: data.inbox,
+              verificationToken: data.verificationToken || "",
               token: candidateToken
             };
           }
@@ -262,10 +466,10 @@ export async function verifyCliLicense({ domain = "postbuild.dev", token = "" }
   return {
     valid: false,
     reason: "PRO_LICENSE_REQUIRED",
-    checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
-    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(domain)}`,
+    checkoutUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
+    webUrl: `https://www.postbuild.dev/?domain=${encodeURIComponent(cleanReqDomain || domain)}`,
     message:
-      "A verified postbuild Launch Pass ($29) or Studio ($49/mo) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox verification."
+      "A verified postbuild Launch Pass ($29) license (pb_live_...) is required to unlock 25 Programmatic SEO HTML pages, 85-directory dispatch, and @postbuild.dev inbox verification."
   };
 }
 
@@ -277,6 +481,7 @@ export function signLicenseToken({
   domain = "postbuild.dev",
   jti = "",
   customerId = null,
+  emailVerified = true,
   ttlSeconds = 365 * 24 * 3600
 }) {
   const secret = requireAuthSecret();
@@ -310,6 +515,7 @@ export function signLicenseToken({
     plan,
     domain: cleanDomain,
     inbox,
+    emailVerified: Boolean(emailVerified),
     iat: now,
     exp
   };
@@ -360,7 +566,7 @@ export function verifyLicenseToken(token) {
     if (!payload.inbox && payload.domain) {
       payload.inbox = getBotInboxForDomain(payload.domain, payload.email);
     }
-    return { valid: true, ...payload };
+    return { valid: true, ...payload, emailVerified: Boolean(payload.emailVerified) };
   } catch {
     return { valid: false };
   }
@@ -523,13 +729,17 @@ async function sendLoginOtpViaResend(email, otpCode) {
       },
       body: JSON.stringify({
         from: "postbuild <login@postbuild.dev>",
+        reply_to: "support@postbuild.dev",
         to: recipients,
         subject: `${otpCode} is your postbuild verification code`,
-        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 520px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
-          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · Account Verification</h2>
-          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Enter this 6-digit verification code on <strong>www.postbuild.dev</strong> within 10 minutes to issue your license key and manage your billing:</p>
-          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 18px 0;">${otpCode}</div>
-          <p style="color: #64748b; font-size: 12px; line-height: 1.5;">For security, your <code>pb_live_</code> license key is issued only after you enter this code.</p>
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, Roboto, sans-serif; max-width: 520px; margin: 0 auto; padding: 24px; border: 1px solid #e2e8f0; border-radius: 14px; background: #ffffff; color: #0f172a;">
+          <div style="margin-bottom: 16px;">
+            <span style="display: inline-block; background: #ecfdf5; color: #047857; border: 1px solid #a7f3d0; font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.05em; padding: 3px 8px; border-radius: 999px;">Security Code</span>
+          </div>
+          <h2 style="margin: 0 0 8px; font-size: 20px; font-weight: 700; color: #0f172a;">Verify your postbuild sign-in</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6; margin: 0 0 18px;">Enter this 6-digit verification code on <strong>postbuild.dev</strong> within 10 minutes to access your license key, verification inbox, and receipts:</p>
+          <div style="background: #ecfdf5; border: 1px solid #6ee7b7; color: #047857; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 28px; font-weight: 800; letter-spacing: 6px; text-align: center; padding: 14px; border-radius: 10px; margin: 0 0 18px;">${otpCode}</div>
+          <p style="color: #64748b; font-size: 12px; line-height: 1.5; margin: 0;">If you did not request this code, you can safely ignore this email.</p>
         </div>`
       })
     });
@@ -556,9 +766,16 @@ function escapeHtml(str) {
 export async function sendLicenseFulfillmentEmail({ email, licenseToken, planId, targetDomain }) {
   const resendKey = (process.env.RESEND_API_KEY || "").trim();
   if (!resendKey || !email) return { sent: false };
-  const safeDomain = escapeHtml(targetDomain || "postbuild.dev");
-  const inbox = escapeHtml(getBotInboxForDomain(targetDomain, email));
+  const rawDomain = targetDomain || "postbuild.dev";
+  const safeDomain = escapeHtml(rawDomain);
+  const inbox = escapeHtml(getBotInboxForDomain(rawDomain, email));
   const safeToken = escapeHtml(licenseToken);
+  const planName = planId === "studio_monthly" ? "postbuild Studio" : "postbuild Launch Pass";
+  const badgeLabel = planId === "studio_monthly" ? "Studio Active" : "Launch Pass Active";
+  const autoVerifiedByEmail = isSameDomainVerifiedEmail(email, rawDomain, true);
+  const inboxStatusNote = autoVerifiedByEmail
+    ? "Confirm your email on Account tab (or use key below) to open"
+    : "Opens after domain check on Account tab";
   try {
     const resp = await fetch("https://api.resend.com/emails", {
       method: "POST",
@@ -568,15 +785,49 @@ export async function sendLicenseFulfillmentEmail({ email, licenseToken, planId,
       },
       body: JSON.stringify({
         from: "postbuild <login@postbuild.dev>",
+        reply_to: "support@postbuild.dev",
         to: [email],
-        subject: `Your postbuild (${planId === "studio_monthly" ? "Studio" : "Launch Pass"}) License Key for ${targetDomain}`,
-        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; max-width: 540px; margin: 0 auto; padding: 28px; border: 1px solid #e2e8f0; border-radius: 14px; color: #0f172a;">
-          <h2 style="margin: 0 0 8px; font-size: 20px;">postbuild · License Activated</h2>
-          <p style="color: #475569; font-size: 14px; line-height: 1.6;">Your <strong>${planId === "studio_monthly" ? "postbuild Studio" : "postbuild Launch Pass"}</strong> for <strong>${safeDomain}</strong> is active.</p>
-          <p style="color: #475569; font-size: 13px; margin-bottom: 6px;"><strong>Dedicated Verification Inbox:</strong> <code>${inbox}</code></p>
-          <p style="color: #475569; font-size: 13px; margin-bottom: 6px;"><strong>CLI &amp; Web License Key:</strong></p>
-          <pre style="background: #f8fafc; border: 1px solid #e2e8f0; padding: 12px; border-radius: 8px; font-size: 11px; overflow-x: auto;">${safeToken}</pre>
-          <p style="color: #475569; font-size: 13px; margin-top: 12px;">Authenticate your CLI with: <code>npx git-paid login ${safeToken}</code></p>
+        subject: `Your ${planName} for ${rawDomain} is active`,
+        html: `<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, Roboto, sans-serif; max-width: 540px; margin: 0 auto; padding: 24px; border: 1px solid #e2e8f0; border-radius: 14px; background: #ffffff; color: #0f172a;">
+          <div style="margin-bottom: 14px;">
+            <span style="display: inline-block; background: #ecfdf5; color: #047857; border: 1px solid #a7f3d0; font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.05em; padding: 3px 9px; border-radius: 999px;">${escapeHtml(badgeLabel)}</span>
+          </div>
+          <h2 style="margin: 0 0 8px; font-size: 20px; font-weight: 700; color: #0f172a;">Your ${escapeHtml(planName)} for ${safeDomain} is ready</h2>
+          <p style="color: #475569; font-size: 14px; line-height: 1.6; margin: 0 0 18px;">All 85 startup &amp; AI directories, your SEO Launch Bundle (<code>.zip</code>), and your verification inbox (<code>${inbox}</code>) are included.${autoVerifiedByEmail ? ` Confirm your <strong>@${safeDomain}</strong> email once on your Account tab (or sign in with the license key below) to open <code>${inbox}</code>.` : ` Because your checkout email is not on <strong>@${safeDomain}</strong>, complete the domain ownership check on your Account tab (and keep the verification file or meta tag in place) before submitting to directories so you can read incoming confirmation codes.`}</p>
+
+          <div style="margin: 0 0 20px;">
+            <a href="https://www.postbuild.dev/?tab=account" style="display: inline-block; background: #047857; color: #ffffff; text-decoration: none; font-weight: 600; font-size: 14px; padding: 11px 18px; border-radius: 8px;">Open Account &amp; Download .zip Bundle &rarr;</a>
+          </div>
+
+          <table role="presentation" style="width: 100%; border-collapse: collapse; margin: 0 0 18px; background: #f8fafc; border: 1px solid #e2e8f0; border-radius: 10px;">
+            <tr>
+              <td style="padding: 10px 14px; border-bottom: 1px solid #e2e8f0; font-size: 12px; color: #64748b; font-weight: 600;">Licensed Domain</td>
+              <td style="padding: 10px 14px; border-bottom: 1px solid #e2e8f0; font-size: 13px; color: #0f172a; font-weight: 700; text-align: right;">${safeDomain}</td>
+            </tr>
+            <tr>
+              <td style="padding: 10px 14px; font-size: 12px; color: #64748b; font-weight: 600;">Verification Inbox</td>
+              <td style="padding: 10px 14px; font-size: 12px; color: #047857; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-weight: 600; text-align: right; word-break: break-all;">${inbox}<div style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Inter, sans-serif; font-size: 11px; color: #64748b; font-weight: 500; margin-top: 2px; word-break: normal; overflow-wrap: break-word;">${escapeHtml(inboxStatusNote)}</div></td>
+            </tr>
+          </table>
+
+          <div style="border-top: 1px solid #e2e8f0; padding-top: 16px; margin-bottom: 18px;">
+            <div style="font-size: 13px; font-weight: 700; color: #0f172a; margin-bottom: 8px;">3-Step Quickstart</div>
+            <ol style="margin: 0; padding-left: 18px; color: #475569; font-size: 13px; line-height: 1.6;">
+              <li style="margin-bottom: 6px;"><strong>Deploy Your .zip Launch Bundle:</strong> Click <em>Download .zip</em> on your Account tab (includes <code>START_HERE.md</code>, <code>public/.well-known/postbuild-verify.txt</code>, starter HTML SEO pages, and <code>directories-85.csv</code>) and deploy to <code>${safeDomain}</code>.</li>
+              <li style="margin-bottom: 6px;"><strong>Verify Domain Ownership:</strong> ${autoVerifiedByEmail ? `Confirm your <code>@${safeDomain}</code> email once on your Account tab (or paste the license key below) to open <code>${inbox}</code>.` : `Click <em>Verify Domain Now</em> on your Account tab after deploying your bundle (or adding the meta tag / DNS TXT record) and keep it in place to unlock <code>${inbox}</code>.`}</li>
+              <li><strong>Submit to 85 Directories:</strong> Launch prefilled directory links from the Dispatch tab or <code>directories-85.csv</code> using <code>${inbox}</code> — 6-digit OTPs and confirmation links arrive in your Account Inbox.</li>
+            </ol>
+          </div>
+
+          <div style="margin: 0 0 18px;">
+            <div style="font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: 0.04em; color: #64748b; margin-bottom: 4px;">CLI &amp; MCP License Key</div>
+            <div style="font-size: 12px; color: #64748b; margin-bottom: 6px;">Most buyers never need this — you can sign in with your email at <strong>postbuild.dev</strong>, or copy this key for <code>npx git-paid login</code>:</div>
+            <div style="background: #f8fafc; border: 1px solid #cbd5e1; padding: 12px; border-radius: 8px; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 11px; line-height: 1.5; color: #0f172a; word-break: break-all;">${safeToken}</div>
+          </div>
+
+          <div style="border-top: 1px solid #e2e8f0; padding-top: 12px; font-size: 12px; color: #64748b; line-height: 1.5;">
+            Covered by our 14-day refund guarantee. Questions? Reply to this email or contact <a href="mailto:support@postbuild.dev" style="color: #047857; text-decoration: none; font-weight: 600;">support@postbuild.dev</a>.
+          </div>
         </div>`
       })
     });
@@ -662,10 +913,13 @@ export async function authenticateUser({ email, token, sessionId, otpCode, chall
         ok: true,
         authenticated: true,
         email: verified.email,
+        emailVerified: Boolean(verified.emailVerified),
+        domainVerified: isSameDomainVerifiedEmail(verified.email, verified.domain, verified.emailVerified),
         customerId: verified.customerId || null,
         plan: verified.plan,
         domain: verified.domain,
         inbox: verified.inbox,
+        verificationToken: getDomainVerificationToken(verified.domain, verified.email),
         isFounder: founderEmails.has(String(verified.email || "").toLowerCase().trim()),
         token
       };
@@ -686,15 +940,18 @@ export async function authenticateUser({ email, token, sessionId, otpCode, chall
     const plan = existingEnt?.plan || check.plan || "launch_pass";
     const domain = existingEnt?.domain || check.domain || "postbuild.dev";
     const customerId = existingEnt?.customerId || check.customerId || null;
-    const issued = signLicenseToken({ email: check.email, plan, domain, customerId });
+    const issued = signLicenseToken({ email: check.email, plan, domain, customerId, emailVerified: true });
     return {
       ok: true,
       authenticated: true,
       email: check.email,
+      emailVerified: true,
+      domainVerified: isSameDomainVerifiedEmail(check.email, domain, true),
       customerId,
       plan,
       domain,
       inbox: getBotInboxForDomain(domain, check.email),
+      verificationToken: getDomainVerificationToken(domain, check.email),
       isFounder: founderEmails.has(String(check.email || "").toLowerCase().trim()),
       token: issued
     };
@@ -706,7 +963,7 @@ export async function authenticateUser({ email, token, sessionId, otpCode, chall
     stripe = stripeMod.getStripeClient();
   } catch {}
 
-  // 3. Stripe Checkout return session_id verification
+  // 3. Stripe Checkout return session_id verification (checkout email is NOT verified by Stripe)
   if (sessionId && stripe) {
     const session = await stripe.checkout.sessions.retrieve(sessionId, { expand: ["customer"] });
     if (session && session.payment_status !== "unpaid") {
@@ -734,15 +991,18 @@ export async function authenticateUser({ email, token, sessionId, otpCode, chall
       if (custStatus !== "active" || isEntitlementRevoked({ email: custEmail, customerId, plan })) {
         return { ok: false, authenticated: false, error: "This license entitlement has been revoked or refunded." };
       }
-      const newToken = signLicenseToken({ email: custEmail, plan, domain, customerId });
+      const newToken = signLicenseToken({ email: custEmail, plan, domain, customerId, emailVerified: false });
       return {
         ok: true,
         authenticated: true,
         email: custEmail,
+        emailVerified: false,
+        domainVerified: false,
         customerId,
         plan,
         domain,
         inbox: getBotInboxForDomain(domain, custEmail),
+        verificationToken: getDomainVerificationToken(domain, custEmail),
         isFounder: false,
         token: newToken
       };