shippingszn 0.8.2 → 0.8.3

package/dist/index.js

@@ -1,104 +1,2114 @@
 #!/usr/bin/env node
-import * as path from "node:path";
-import * as process from "node:process";
+
+// src/index.ts
+import * as path11 from "node:path";
+import * as process2 from "node:process";
 import { createRequire } from "node:module";
-import { ALL_CHECKS } from "./checks.js";
-import { listFiles, getTrackedFiles } from "./scan.js";
-import { CHECKLIST_ITEMS, permalinkFor } from "./items.js";
-import { publishScan } from "./publish.js";
-import { shouldUploadProof, uploadProof, } from "./proof.js";
-import { buildRemediationPrompt, } from "./remediation.js";
-import { assessLaunchReadiness, normalizeLaunchFinding, } from "@workspace/launch-readiness";
-const UNTRACKED_DOWNGRADE = {
-    critical: "lower",
-    high: "lower",
-    medium: "lower",
-    lower: "lower",
+
+// src/checks/secrets.ts
+import * as path3 from "node:path";
+
+// src/scan.ts
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+function getTrackedFiles(rootDir) {
+  const result = spawnSync("git", ["-C", rootDir, "ls-files", "-z"], {
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (result.status !== 0 || !result.stdout) return null;
+  const out = /* @__PURE__ */ new Set();
+  for (const rel of result.stdout.split("\0")) {
+    if (rel) out.add(rel);
+  }
+  return out;
+}
+function getNotIgnoredFiles(rootDir) {
+  const result = spawnSync(
+    "git",
+    ["-C", rootDir, "ls-files", "-co", "--exclude-standard", "-z"],
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+  );
+  if (result.status !== 0 || !result.stdout) return null;
+  const out = /* @__PURE__ */ new Set();
+  for (const rel of result.stdout.split("\0")) {
+    if (rel) out.add(rel);
+  }
+  return out;
+}
+var DEFAULT_IGNORES = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  ".next",
+  ".nuxt",
+  ".turbo",
+  ".cache",
+  ".vercel",
+  ".netlify",
+  "out",
+  "coverage",
+  ".pnpm-store",
+  ".yarn",
+  ".expo",
+  ".local",
+  "attached_assets",
+  "vendor"
+]);
+var TEXT_EXT = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".json",
+  ".md",
+  ".mdx",
+  ".html",
+  ".htm",
+  ".css",
+  ".scss",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".py",
+  ".rb",
+  ".go",
+  ".rs",
+  ".java",
+  ".kt",
+  ".swift",
+  ".php",
+  ".cs",
+  ".env",
+  ".example",
+  ".sample",
+  ".local",
+  ".yaml",
+  ".yml",
+  ".toml",
+  ".ini",
+  ".conf",
+  ".sh"
+]);
+var MAX_FILE_BYTES = 512 * 1024;
+var MAX_DEPTH = 24;
+var MAX_FILES = 5e4;
+async function listFiles(rootDir) {
+  const out = [];
+  const visited = /* @__PURE__ */ new Set();
+  const rootResolved = path.resolve(rootDir);
+  const allowed = getNotIgnoredFiles(rootDir);
+  async function walk(dir, depth) {
+    if (depth > MAX_DEPTH) return;
+    if (out.length >= MAX_FILES) return;
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (out.length >= MAX_FILES) return;
+      if (entry.name.startsWith(".") && DEFAULT_IGNORES.has(entry.name))
+        continue;
+      if (DEFAULT_IGNORES.has(entry.name)) continue;
+      const abs = path.join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        if (entry.name === "fixtures") {
+          const parentBase = path.basename(dir);
+          if (parentBase === "test" || parentBase === "tests" || parentBase === "__tests__") {
+            continue;
+          }
+        }
+        let real;
+        try {
+          real = await fs.realpath(abs);
+        } catch {
+          continue;
+        }
+        const relFromRoot = path.relative(rootResolved, real);
+        if (relFromRoot.startsWith("..") || path.isAbsolute(relFromRoot)) {
+          continue;
+        }
+        if (visited.has(real)) continue;
+        visited.add(real);
+        await walk(abs, depth + 1);
+      } else if (entry.isFile()) {
+        const rel = path.relative(rootDir, abs);
+        if (allowed) {
+          const relPosixPath = rel.split(path.sep).join("/");
+          if (!allowed.has(relPosixPath)) continue;
+        }
+        let size = 0;
+        try {
+          const st = await fs.stat(abs);
+          size = st.size;
+        } catch {
+          continue;
+        }
+        out.push({ absPath: abs, relPath: rel, size });
+      }
+    }
+  }
+  await walk(rootDir, 0);
+  return out;
+}
+function isTextFile(file) {
+  const base = path.basename(file.relPath).toLowerCase();
+  if (base.startsWith(".env")) return true;
+  if (base === "dockerfile" || base === "makefile" || base === "procfile")
+    return true;
+  const ext = path.extname(file.relPath).toLowerCase();
+  if (TEXT_EXT.has(ext)) return true;
+  return false;
+}
+async function readFileSafe(file) {
+  if (file.size > MAX_FILE_BYTES) return null;
+  try {
+    return await fs.readFile(file.absPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function fileExists(p) {
+  try {
+    await fs.stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/checks/helpers.ts
+import * as path2 from "node:path";
+function relPosix(p) {
+  return p.split(path2.sep).join("/");
+}
+function findLine(content, idx) {
+  let line = 1;
+  for (let i = 0; i < idx; i++) if (content.charCodeAt(i) === 10) line++;
+  return line;
+}
+var IGNORE_MARKER = "shippingszn:ignore";
+var IGNORE_NEXT_LINE_MARKER = "shippingszn:ignore-next-line";
+function getLine(content, charIndex) {
+  const lineStart = content.lastIndexOf("\n", charIndex - 1) + 1;
+  const lineEnd = content.indexOf("\n", charIndex);
+  return content.slice(lineStart, lineEnd === -1 ? void 0 : lineEnd);
+}
+function getPreviousLine(content, charIndex) {
+  const lineStart = content.lastIndexOf("\n", charIndex - 1) + 1;
+  if (lineStart === 0) return null;
+  const prevEnd = lineStart - 1;
+  const prevStart = content.lastIndexOf("\n", prevEnd - 1) + 1;
+  return content.slice(prevStart, prevEnd);
+}
+function lineContainsIgnoreMarker(content, charIndex) {
+  if (getLine(content, charIndex).includes(IGNORE_MARKER)) return true;
+  const prev = getPreviousLine(content, charIndex);
+  return prev !== null && prev.includes(IGNORE_NEXT_LINE_MARKER);
+}
+var PUBLIC_DIR_CANDIDATES = [
+  "public",
+  "static",
+  "www",
+  "dist",
+  "build",
+  "out"
+];
+async function findPublicDirs(ctx) {
+  const dirs = [];
+  for (const cand of PUBLIC_DIR_CANDIDATES) {
+    const p = path2.join(ctx.rootDir, cand);
+    if (await fileExists(p)) dirs.push(cand);
+  }
+  const seen = new Set(dirs);
+  for (const f of ctx.files) {
+    const parts = f.relPath.split("/");
+    for (let i = 0; i < parts.length - 1; i++) {
+      if (parts[i] === "public" || parts[i] === "static") {
+        const dir = parts.slice(0, i + 1).join("/");
+        if (!seen.has(dir)) {
+          seen.add(dir);
+          dirs.push(dir);
+        }
+      }
+    }
+  }
+  return dirs;
+}
+var PATTERN_DEFINITION_FILES = /* @__PURE__ */ new Set([
+  "tools/cli/src/checks/dangerous.ts",
+  "tools/cli/src/checks/quality.ts",
+  "tools/cli/src/checks/language.ts",
+  "tools/cli/README.md",
+  // Test fixture for the redaction module: contains intentional fake
+  // secret patterns whose whole purpose is to verify the redactor scrubs
+  // them. Functionally identical to tools/cli/test/fixtures/, just lives
+  // in a different package.
+  "artifacts/api-server/src/lib/__tests__/redaction.test.ts"
+]);
+var PATTERN_DEFINITION_PREFIXES = [
+  "tools/cli/test/fixtures/",
+  "artifacts/checklist/src/data/checklist/"
+];
+function isScanExempt(relPath) {
+  const p = relPosix(relPath);
+  if (PATTERN_DEFINITION_FILES.has(p)) return true;
+  for (const prefix of PATTERN_DEFINITION_PREFIXES) {
+    if (p.startsWith(prefix) || p.includes("/" + prefix)) return true;
+  }
+  return false;
+}
+var SERVE_INDICATORS = [
+  "emitFile",
+  "setHeader",
+  "res.end",
+  "res.send",
+  "configureServer",
+  "configurePreviewServer",
+  "app.get",
+  "app.use",
+  "router.get",
+  "router.use"
+];
+var DYNAMIC_ASSET_SOURCE_EXTS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+async function isAssetEmittedDynamically(ctx, assetName) {
+  const literalPatterns = [`"${assetName}"`, `'${assetName}'`, `/${assetName}`];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    const ext = path2.extname(file.relPath).toLowerCase();
+    if (!DYNAMIC_ASSET_SOURCE_EXTS.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    if (!literalPatterns.some((p) => content.includes(p))) continue;
+    if (!SERVE_INDICATORS.some((s) => content.includes(s))) continue;
+    return true;
+  }
+  return false;
+}
+
+// src/checks/secrets.ts
+var SECRET_PATTERNS = [
+  {
+    id: "openai-key",
+    name: "OpenAI API key",
+    regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/,
+    severity: "critical"
+  },
+  {
+    id: "anthropic-key",
+    name: "Anthropic API key",
+    regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/,
+    severity: "critical"
+  },
+  {
+    id: "stripe-live-secret",
+    name: "Stripe live secret key",
+    regex: /\bsk_live_[A-Za-z0-9]{16,}\b/,
+    severity: "critical"
+  },
+  {
+    id: "stripe-live-publishable",
+    name: "Stripe live publishable key",
+    regex: /\bpk_live_[A-Za-z0-9]{16,}\b/,
+    severity: "high"
+  },
+  {
+    id: "aws-access-key",
+    name: "AWS access key id",
+    regex: /\bAKIA[0-9A-Z]{16}\b/,
+    severity: "critical"
+  },
+  {
+    id: "google-api-key",
+    name: "Google API key",
+    regex: /\bAIza[0-9A-Za-z_-]{35}\b/,
+    severity: "critical"
+  },
+  {
+    id: "github-token",
+    name: "GitHub personal access token",
+    regex: /\bghp_[A-Za-z0-9]{30,}\b/,
+    severity: "critical"
+  },
+  {
+    id: "slack-token",
+    name: "Slack token",
+    regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/,
+    severity: "high"
+  },
+  {
+    id: "private-key-block",
+    name: "Private key block",
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/,
+    severity: "critical"
+  },
+  {
+    id: "notion-token",
+    name: "Notion integration token",
+    regex: /\bsecret_[A-Za-z0-9]{43}\b/,
+    severity: "critical"
+  },
+  {
+    id: "vercel-token",
+    name: "Vercel token",
+    regex: /\b(?:VERCEL_TOKEN|vercel_token|vercelToken)\b\s*[:=]\s*['"]?[A-Za-z0-9]{24}['"]?/,
+    severity: "critical"
+  },
+  {
+    id: "sendgrid-api-key",
+    name: "SendGrid API key",
+    regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/,
+    severity: "critical"
+  },
+  {
+    id: "twilio-account-sid",
+    name: "Twilio Account SID",
+    regex: /\bAC[a-f0-9]{32}\b/,
+    severity: "high"
+  }
+];
+var JWT_REGEX = /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+function tryDecodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  let b = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  while (b.length % 4 !== 0) b += "=";
+  try {
+    return Buffer.from(b, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+var SECRET_SCAN_SKIP_NAMES = /* @__PURE__ */ new Set([
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lockb"
+]);
+async function checkHardcodedSecrets(ctx) {
+  const findings = [];
+  for (const file of ctx.files) {
+    const base = path3.basename(file.relPath);
+    if (SECRET_SCAN_SKIP_NAMES.has(base)) continue;
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const isEnvExample = /\.example$|\.sample$|\.template$/i.test(base) || base === ".env.example";
+    if (isEnvExample) continue;
+    const matchedRanges = [];
+    for (const pat of SECRET_PATTERNS) {
+      const m = pat.regex.exec(content);
+      if (!m) continue;
+      const start = m.index;
+      const end = m.index + m[0].length;
+      if (matchedRanges.some(([s, e]) => start < e && end > s)) continue;
+      matchedRanges.push([start, end]);
+      const line = findLine(content, start);
+      findings.push({
+        checkId: `secret-${pat.id}`,
+        itemId: "secrets",
+        severity: pat.severity,
+        message: `Possible ${pat.name} hardcoded in source.`,
+        file: relPosix(file.relPath),
+        line,
+        evidence: `${m[0].slice(0, 6)}\u2026${m[0].slice(-4)} (${m[0].length} chars)`
+      });
+    }
+    JWT_REGEX.lastIndex = 0;
+    let jm;
+    while ((jm = JWT_REGEX.exec(content)) !== null) {
+      const start = jm.index;
+      const end = jm.index + jm[0].length;
+      if (matchedRanges.some(([s, e]) => start < e && end > s)) continue;
+      matchedRanges.push([start, end]);
+      const payload = tryDecodeJwtPayload(jm[0]);
+      const isServiceRole = !!payload && /"role"\s*:\s*"service_role"/.test(payload);
+      const line = findLine(content, start);
+      if (isServiceRole) {
+        findings.push({
+          checkId: "secret-supabase-service-role-jwt",
+          itemId: "secrets",
+          severity: "critical",
+          message: "Possible Supabase service-role JWT hardcoded in source.",
+          file: relPosix(file.relPath),
+          line,
+          evidence: `${jm[0].slice(0, 6)}\u2026${jm[0].slice(-4)} (${jm[0].length} chars)`
+        });
+      } else {
+        findings.push({
+          checkId: "secret-jwt",
+          itemId: "secrets",
+          severity: "high",
+          message: "Possible JWT hardcoded in source.",
+          file: relPosix(file.relPath),
+          line,
+          evidence: `${jm[0].slice(0, 6)}\u2026${jm[0].slice(-4)} (${jm[0].length} chars)`
+        });
+      }
+      break;
+    }
+  }
+  return findings;
+}
+var CONFIG_FILE_BASENAMES = /* @__PURE__ */ new Set([
+  ".env",
+  ".env.local",
+  ".env.production"
+]);
+var CONFIG_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".toml"]);
+function looksLikeConfigFile(relPath) {
+  const base = path3.basename(relPath);
+  if (CONFIG_FILE_BASENAMES.has(base)) return true;
+  const ext = path3.extname(base).toLowerCase();
+  if (CONFIG_FILE_EXTENSIONS.has(ext)) return true;
+  return false;
+}
+var CONFIG_ASSIGNMENT_REGEX = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(?:"([^"\n]+)"|'([^'\n]+)'|([^\s#"'][^\s#]*))/gm;
+var VITE_SECRET_KEY_REGEX = /^VITE_[A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|CREDENTIAL|PRIVATE)$/;
+var HEX_SECRET_REGEX = /^[A-Fa-f0-9]{32,}$/;
+var BASE64_SECRET_REGEX = /^[A-Za-z0-9+/_-]{40,}={0,2}$/;
+var TEMPLATED_VALUE_REGEX = /\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*/;
+var CONFIG_KEY_ALLOWLIST = /* @__PURE__ */ new Set([
+  "DATABASE_URL"
+  // contains URL/host fragments, handled by other rules
+]);
+async function checkConfigSecretLeaks(ctx) {
+  const findings = [];
+  for (const file of ctx.files) {
+    if (!looksLikeConfigFile(file.relPath)) continue;
+    if (!isTextFile(file)) continue;
+    const base = path3.basename(file.relPath);
+    if (/\.example$|\.sample$|\.template$/i.test(base)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    CONFIG_ASSIGNMENT_REGEX.lastIndex = 0;
+    let m;
+    while ((m = CONFIG_ASSIGNMENT_REGEX.exec(content)) !== null) {
+      const key = m[1];
+      const value = (m[2] ?? m[3] ?? m[4] ?? "").trim();
+      if (!value) continue;
+      if (TEMPLATED_VALUE_REGEX.test(value)) continue;
+      const line = findLine(content, m.index);
+      if (VITE_SECRET_KEY_REGEX.test(key)) {
+        findings.push({
+          checkId: "config-vite-prefixed-secret",
+          itemId: "secrets",
+          severity: "high",
+          message: `${key} is set in ${relPosix(file.relPath)}. Variables prefixed with VITE_ are baked into the browser bundle by Vite at build time and are readable by every visitor \u2014 they are not secrets. Rename the variable (drop VITE_) and access it server-side only, or move the signing/auth flow behind a backend endpoint.`,
+          file: relPosix(file.relPath),
+          line,
+          evidence: `${key}=${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`
+        });
+        continue;
+      }
+      if (CONFIG_KEY_ALLOWLIST.has(key)) continue;
+      const isHex = HEX_SECRET_REGEX.test(value);
+      const isBase64 = BASE64_SECRET_REGEX.test(value);
+      if (!isHex && !isBase64) continue;
+      findings.push({
+        checkId: "config-hardcoded-credential",
+        itemId: "secrets",
+        severity: "critical",
+        message: `${key} in ${relPosix(file.relPath)} looks like a hardcoded credential (${value.length}-char ${isHex ? "hex" : "base64-shaped"} value). Move it to your platform's secret store (Railway / Vercel / Fly env vars, or a dedicated vault) and reference it from there. Rotate the leaked value at the source.`,
+        file: relPosix(file.relPath),
+        line,
+        evidence: `${key}=${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`
+      });
+    }
+  }
+  return findings;
+}
+
+// src/checks/env.ts
+import * as path4 from "node:path";
+async function checkEnvCommitted(ctx) {
+  const findings = [];
+  const gitignorePath = path4.join(ctx.rootDir, ".gitignore");
+  let gitignore = "";
+  if (await fileExists(gitignorePath)) {
+    gitignore = await readFileSafe({ absPath: gitignorePath, relPath: ".gitignore", size: 0 }) ?? "";
+  }
+  const ignoresEnv = /^\s*\.env(\s|$)/m.test(gitignore) || /^\s*\*\.env(\s|$)/m.test(gitignore);
+  for (const file of ctx.files) {
+    const base = path4.basename(file.relPath);
+    if (base !== ".env" && base !== ".env.local" && base !== ".env.production") continue;
+    if (!ignoresEnv) {
+      findings.push({
+        checkId: "env-not-ignored",
+        itemId: "secrets",
+        severity: "high",
+        message: `${base} found and your .gitignore does not appear to ignore .env files.`,
+        file: relPosix(file.relPath)
+      });
+    }
+  }
+  return findings;
+}
+async function checkEnvExample(ctx) {
+  const hasEnv = ctx.files.some((f) => path4.basename(f.relPath) === ".env");
+  const hasExample = ctx.files.some((f) => {
+    const b = path4.basename(f.relPath);
+    return b === ".env.example" || b === ".env.sample" || b === ".env.template";
+  });
+  if (hasEnv && !hasExample) {
+    return [
+      {
+        checkId: "missing-env-example",
+        itemId: "secrets",
+        severity: "medium",
+        message: "Found a .env file but no .env.example. Add a sanitized .env.example so collaborators know which variables are required."
+      }
+    ];
+  }
+  return [];
+}
+async function checkGitignore(ctx) {
+  const gitignorePath = path4.join(ctx.rootDir, ".gitignore");
+  if (!await fileExists(gitignorePath)) {
+    return [
+      {
+        checkId: "missing-gitignore",
+        itemId: "github",
+        severity: "high",
+        message: "No .gitignore at the project root. Add one tuned to your stack so you don't accidentally commit secrets, local DBs, or build artifacts."
+      }
+    ];
+  }
+  return [];
+}
+
+// src/checks/public-assets.ts
+function robotsDisallowsAll(content) {
+  const lines = content.split(/\r?\n/);
+  let inWildcardBlock = false;
+  let sawWildcardBlock = false;
+  for (const raw of lines) {
+    const line = raw.replace(/#.*$/, "").trim();
+    if (line === "") {
+      inWildcardBlock = false;
+      continue;
+    }
+    const match = line.match(/^([A-Za-z-]+)\s*:\s*(.*)$/);
+    if (!match) continue;
+    const directive = match[1].toLowerCase();
+    const value = match[2].trim();
+    if (directive === "user-agent") {
+      inWildcardBlock = value === "*";
+      if (inWildcardBlock) sawWildcardBlock = true;
+      continue;
+    }
+    if (inWildcardBlock && directive === "disallow" && value === "/") {
+      return true;
+    }
+  }
+  void sawWildcardBlock;
+  return false;
+}
+async function hasDisallowAllRobots(ctx) {
+  const robotsFiles = ctx.files.filter(
+    (f) => /(^|\/)robots\.txt$/i.test(f.relPath)
+  );
+  for (const file of robotsFiles) {
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    if (robotsDisallowsAll(content)) return true;
+  }
+  return false;
+}
+async function checkRobotsTxt(ctx) {
+  const has = ctx.files.some((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
+  if (has) return [];
+  if (await isAssetEmittedDynamically(ctx, "robots.txt")) return [];
+  const dirs = await findPublicDirs(ctx);
+  if (dirs.length === 0) return [];
+  return [
+    {
+      checkId: "missing-robots-txt",
+      itemId: "seo",
+      severity: "medium",
+      message: `No robots.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so search engines know what to crawl.`
+    }
+  ];
+}
+async function checkSitemapXml(ctx) {
+  const has = ctx.files.some((f) => /(^|\/)sitemap\.xml$/i.test(f.relPath));
+  if (has) return [];
+  if (await isAssetEmittedDynamically(ctx, "sitemap.xml")) return [];
+  const dirs = await findPublicDirs(ctx);
+  if (dirs.length === 0) return [];
+  if (await hasDisallowAllRobots(ctx)) return [];
+  return [
+    {
+      checkId: "missing-sitemap-xml",
+      itemId: "seo",
+      severity: "medium",
+      message: `No sitemap.xml found in any public directory (looked in: ${dirs.join(", ")}). Add one to help search engines index your pages.`
+    }
+  ];
+}
+async function checkFavicon(ctx) {
+  const dirs = await findPublicDirs(ctx);
+  if (dirs.length === 0) return [];
+  const faviconRegex = /(^|\/)(favicon\.(ico|png|svg)|apple-touch-icon\.png|icon\.svg)$/i;
+  const has = ctx.files.some((f) => faviconRegex.test(f.relPath));
+  if (has) return [];
+  return [
+    {
+      checkId: "missing-favicon",
+      itemId: "launch-polish",
+      severity: "lower",
+      message: "No custom favicon found in your public directory. The default browser favicon (or the framework starter one) tells visitors this is an unfinished AI-built project."
+    }
+  ];
+}
+async function checkLlmsTxt(ctx) {
+  const has = ctx.files.some((f) => /(^|\/)llms\.txt$/i.test(f.relPath));
+  if (has) return [];
+  if (await isAssetEmittedDynamically(ctx, "llms.txt")) return [];
+  const dirs = await findPublicDirs(ctx);
+  if (dirs.length === 0) return [];
+  return [
+    {
+      checkId: "missing-llms-txt",
+      itemId: "aeo",
+      severity: "lower",
+      message: `No llms.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so AI crawlers (ChatGPT, Perplexity, Claude) can understand your site.`
+    }
+  ];
+}
+async function checkPwaManifest(ctx) {
+  const dirs = await findPublicDirs(ctx);
+  if (dirs.length === 0) return [];
+  const manifestRegex = /(^|\/)(manifest\.(json|webmanifest)|site\.webmanifest)$/i;
+  const has = ctx.files.some((f) => manifestRegex.test(f.relPath));
+  if (has) return [];
+  return [
+    {
+      checkId: "missing-pwa-manifest",
+      itemId: "installable-app",
+      severity: "lower",
+      message: `No PWA manifest found in any public directory (looked in: ${dirs.join(", ")}). Add manifest.json (or site.webmanifest) so users can install your app to their phone's home screen.`
+    }
+  ];
+}
+
+// src/checks/headers.ts
+import * as path5 from "node:path";
+var SECURITY_HEADER_NAMES = [
+  "Strict-Transport-Security",
+  "Content-Security-Policy",
+  "X-Content-Type-Options",
+  "X-Frame-Options",
+  "Referrer-Policy"
+];
+var CANDIDATE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts",
+  ".json",
+  ".toml"
+]);
+var CANDIDATE_BASENAMES = /* @__PURE__ */ new Set([
+  "vite.config.ts",
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.cjs",
+  "next.config.js",
+  "next.config.mjs",
+  "next.config.ts",
+  "nuxt.config.ts",
+  "svelte.config.js",
+  "astro.config.mjs",
+  "astro.config.ts",
+  "vercel.json",
+  "netlify.toml"
+]);
+var CANDIDATE_DIR_SEGMENTS = [
+  "server/",
+  "api/",
+  "backend/",
+  "middleware/",
+  "middlewares/",
+  "lib/server/",
+  "src/server/",
+  "src/api/",
+  "src/middleware/",
+  "src/middlewares/",
+  "apps/server/",
+  "apps/api/",
+  "packages/server/",
+  "packages/api/",
+  "artifacts/server/",
+  "artifacts/api-server/"
+];
+function isCandidateFile(relPath) {
+  const lower = relPath.replace(/\\/g, "/").toLowerCase();
+  if (lower.includes("/node_modules/") || lower.includes("/dist/") || lower.includes("/build/") || lower.includes("/.next/") || lower.endsWith(".test.ts") || lower.endsWith(".spec.ts") || lower.endsWith(".test.tsx") || lower.endsWith(".spec.tsx") || lower.endsWith(".test.js") || lower.endsWith(".spec.js")) {
+    return false;
+  }
+  const base = path5.basename(lower);
+  if (CANDIDATE_BASENAMES.has(base)) return true;
+  const ext = path5.extname(lower);
+  if (!CANDIDATE_EXTENSIONS.has(ext)) return false;
+  if (/\b(?:server|index|app|main|bootstrap|middleware|security)\.(?:t|j|m|c)?sx?$/.test(
+    base
+  )) {
+    return true;
+  }
+  for (const seg of CANDIDATE_DIR_SEGMENTS) {
+    if (lower.includes("/" + seg) || lower.startsWith(seg)) return true;
+  }
+  return false;
+}
+async function checkSecurityHeaders(ctx) {
+  const candidates = ctx.files.filter((f) => isCandidateFile(f.relPath));
+  if (candidates.length === 0) return [];
+  for (const file of candidates) {
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const lower = content.toLowerCase();
+    for (const h of SECURITY_HEADER_NAMES) {
+      if (lower.includes(h.toLowerCase())) return [];
+    }
+    if (lower.includes("helmet(") || lower.includes('require("helmet")') || lower.includes('from "helmet"') || lower.includes("from 'helmet'")) {
+      return [];
+    }
+  }
+  return [
+    {
+      checkId: "missing-security-headers",
+      itemId: "https-headers",
+      severity: "high",
+      message: "Couldn't find any common security headers (CSP, HSTS, X-Frame-Options, etc.) or helmet() middleware in your server/host configs. Add them so the browser enforces baseline defenses."
+    }
+  ];
+}
+
+// src/checks/dangerous.ts
+import * as path6 from "node:path";
+var DANGEROUS_PATTERNS = [
+  {
+    id: "dangerously-set-inner-html",
+    regex: /dangerouslySetInnerHTML/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "Use of dangerouslySetInnerHTML \u2014 make sure the content is sanitized or comes from a trusted source."
+  },
+  {
+    id: "eval-call",
+    regex: /(^|[^A-Za-z0-9_$])eval\s*\(/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "Use of eval() \u2014 almost always avoidable and a common path to remote code execution if any input is user-controlled."
+  },
+  {
+    id: "cors-wildcard",
+    regex: /Access-Control-Allow-Origin\s*[:=]\s*['"`]\*['"`]/i,
+    itemId: "common-attacks",
+    severity: "medium",
+    message: "Wildcard CORS (Access-Control-Allow-Origin: *). Lock this down to specific origins for any authenticated endpoint."
+  },
+  {
+    id: "shell-exec-call",
+    regex: /(^|[^A-Za-z0-9_$.])(exec|execSync)\s*\(/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "Shell execution via exec/execSync \u2014 if any argument includes user input, this is a command-injection path. Prefer execFile with an argument array, or validate input strictly against an allowlist."
+  }
+];
+async function checkDangerousPatterns(ctx) {
+  const findings = [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    const ext = path6.extname(file.relPath).toLowerCase();
+    if (![
+      ".ts",
+      ".tsx",
+      ".js",
+      ".jsx",
+      ".mjs",
+      ".cjs",
+      ".json",
+      ".html"
+    ].includes(ext))
+      continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    for (const pat of DANGEROUS_PATTERNS) {
+      const m = pat.regex.exec(content);
+      if (!m) continue;
+      if (lineContainsIgnoreMarker(content, m.index)) continue;
+      const line = findLine(content, m.index);
+      findings.push({
+        checkId: pat.id,
+        itemId: pat.itemId,
+        severity: pat.severity,
+        message: pat.message,
+        file: relPosix(file.relPath),
+        line
+      });
+    }
+  }
+  return findings;
+}
+
+// src/checks/language.ts
+import * as path7 from "node:path";
+var PYTHON_PATTERNS = [
+  {
+    id: "py-pickle-loads",
+    regex: /\bpickle\s*\.\s*loads?\s*\(/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "Use of pickle.loads / pickle.load \u2014 deserializing pickle data from untrusted sources allows arbitrary code execution. Use json or another safe format."
+  },
+  {
+    id: "py-subprocess-shell-true",
+    regex: /\bshell\s*=\s*True\b/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "subprocess call with shell=True \u2014 if any argument is user-controlled this is a shell injection. Pass an argv list instead."
+  },
+  {
+    id: "py-flask-debug-true",
+    regex: /\.run\s*\([^)]*\bdebug\s*=\s*True/,
+    itemId: "dev-prod-data",
+    severity: "high",
+    message: "Flask app.run(debug=True) \u2014 Werkzeug's debugger exposes a remote Python shell. Never enable this in production; gate on an env var."
+  },
+  {
+    id: "py-django-debug-true",
+    regex: /^\s*DEBUG\s*=\s*True\b/m,
+    itemId: "dev-prod-data",
+    severity: "high",
+    message: "Django DEBUG = True at module scope \u2014 leaks stack traces, settings, and SQL to anyone who hits an error page in production. Read it from an env var."
+  },
+  {
+    id: "py-hardcoded-secret-key",
+    regex: /^\s*SECRET_KEY\s*=\s*['"][^'"\n]{8,}['"]/m,
+    itemId: "secrets",
+    severity: "critical",
+    message: "Hardcoded SECRET_KEY in a Django/Flask settings file. Load it from os.environ / os.getenv instead and keep the real value out of source control."
+  }
+];
+var RUBY_PATTERNS = [
+  {
+    id: "rb-eval",
+    regex: /(^|[^A-Za-z0-9_])eval\s*\(/,
+    itemId: "common-attacks",
+    severity: "high",
+    message: "Use of eval in Ruby \u2014 executes arbitrary code and is almost always avoidable. Replace with safer alternatives like send, public_send, or a hash lookup."
+  },
+  {
+    id: "rb-html-safe",
+    regex: /\.html_safe\b/,
+    itemId: "common-attacks",
+    severity: "medium",
+    message: "Call to .html_safe in Ruby/Rails \u2014 bypasses ERB's automatic HTML escaping. Make sure the string isn't user-controlled or you'll have an XSS hole."
+  },
+  {
+    id: "rb-hardcoded-secret-key-base",
+    regex: /^\s*secret_key_base\s*:\s*['"]?[A-Za-z0-9]{16,}['"]?/m,
+    itemId: "secrets",
+    severity: "critical",
+    message: "Hardcoded secret_key_base in a Rails config/credentials file. Move it to ENV['SECRET_KEY_BASE'] or Rails' encrypted credentials."
+  }
+];
+var GO_PATTERNS = [
+  {
+    id: "go-listen-and-serve-no-tls",
+    regex: /\bhttp\s*\.\s*ListenAndServe\s*\(/,
+    itemId: "https-headers",
+    severity: "high",
+    message: "http.ListenAndServe \u2014 serves plain HTTP with no TLS. Use http.ListenAndServeTLS, terminate TLS at a proxy, or run behind a managed host that does."
+  },
+  {
+    id: "go-hardcoded-token-literal",
+    regex: /\b(?:token|apiKey|api_key|secret)\s*(?::=|=)\s*"[A-Za-z0-9_\-]{20,}"/i,
+    itemId: "secrets",
+    severity: "high",
+    message: "Hardcoded token/secret literal in Go source. Read it from os.Getenv or a secret manager instead of compiling it into the binary."
+  }
+];
+var RAILS_YAML_PATTERNS = [
+  RUBY_PATTERNS.find((p) => p.id === "rb-hardcoded-secret-key-base")
+];
+var LANG_PATTERN_SETS = [
+  { exts: [".py"], patterns: PYTHON_PATTERNS },
+  { exts: [".rb", ".erb"], patterns: RUBY_PATTERNS },
+  { exts: [".yml", ".yaml"], patterns: RAILS_YAML_PATTERNS },
+  { exts: [".go"], patterns: GO_PATTERNS }
+];
+async function checkLanguagePatterns(ctx) {
+  const findings = [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    const ext = path7.extname(file.relPath).toLowerCase();
+    const set = LANG_PATTERN_SETS.find((s) => s.exts.includes(ext));
+    if (!set) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    for (const pat of set.patterns) {
+      const m = pat.regex.exec(content);
+      if (!m) continue;
+      const line = findLine(content, m.index);
+      findings.push({
+        checkId: pat.id,
+        itemId: pat.itemId,
+        severity: pat.severity,
+        message: pat.message,
+        file: relPosix(file.relPath),
+        line
+      });
+    }
+  }
+  return findings;
+}
+function isPythonSettingsLike(relPath, content) {
+  const base = path7.basename(relPath).toLowerCase();
+  if (base === "settings.py" || base === "config.py" || base === "app.py" || base === "wsgi.py" || base === "asgi.py") {
+    return true;
+  }
+  if (/\bfrom\s+django\b/.test(content) || /\bimport\s+django\b/.test(content)) return true;
+  if (/\bfrom\s+flask\s+import\b/.test(content) || /\bFlask\s*\(/.test(content)) return true;
+  return false;
+}
+function pythonReadsSecretKeyFromEnv(content) {
+  const envRefs = [
+    /SECRET_KEY\s*=\s*os\.environ(?:\.get)?\b/,
+    /SECRET_KEY\s*=\s*os\.getenv\b/,
+    /SECRET_KEY\s*=\s*environ(?:\.get)?\b/,
+    /SECRET_KEY\s*=\s*getenv\b/,
+    /SECRET_KEY\s*=\s*config\s*\(/,
+    /SECRET_KEY\s*=\s*decouple\.config\s*\(/,
+    /SECRET_KEY\s*=\s*env\s*\(/,
+    /SECRET_KEY\s*=\s*env\.str\s*\(/,
+    /app\.config\[\s*['"]SECRET_KEY['"]\s*\]\s*=\s*os\.(?:environ|getenv)\b/
+  ];
+  return envRefs.some((r) => r.test(content));
+}
+async function checkPythonSecretKeyEnv(ctx) {
+  const candidates = [];
+  let anyPython = false;
+  for (const file of ctx.files) {
+    if (path7.extname(file.relPath).toLowerCase() !== ".py") continue;
+    anyPython = true;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    if (isPythonSettingsLike(file.relPath, content)) {
+      candidates.push({ file, content });
+    }
+  }
+  if (!anyPython || candidates.length === 0) return [];
+  let mentionsSecretKey = false;
+  let envBacked = false;
+  let firstMention = null;
+  for (const { file, content } of candidates) {
+    const m = /\bSECRET_KEY\b/.exec(content);
+    if (m) {
+      mentionsSecretKey = true;
+      if (!firstMention) firstMention = { file, line: findLine(content, m.index) };
+    }
+    if (pythonReadsSecretKeyFromEnv(content)) {
+      envBacked = true;
+      break;
+    }
+  }
+  if (envBacked) return [];
+  if (!mentionsSecretKey) {
+    return [
+      {
+        checkId: "py-missing-secret-key-env",
+        itemId: "secrets",
+        severity: "high",
+        message: "Detected a Django/Flask project but couldn't find SECRET_KEY anywhere in your settings. Configure it from an env var (e.g. os.environ['SECRET_KEY']) before deploying.",
+        file: relPosix(candidates[0].file.relPath)
+      }
+    ];
+  }
+  return [
+    {
+      checkId: "py-secret-key-not-from-env",
+      itemId: "secrets",
+      severity: "high",
+      message: "Django/Flask SECRET_KEY is set in source but not read from an environment variable. Pull it from os.environ / os.getenv (or python-decouple / django-environ) so the real value stays out of the repo.",
+      file: firstMention ? relPosix(firstMention.file.relPath) : void 0,
+      line: firstMention?.line
+    }
+  ];
+}
+function isRailsProject(_ctx, files) {
+  for (const f of files) {
+    const rel = f.relPath.split(path7.sep).join("/");
+    if (/(^|\/)config\/application\.rb$/.test(rel)) return true;
+    if (/(^|\/)config\/environments\/[a-z]+\.rb$/.test(rel)) return true;
+  }
+  return false;
+}
+async function gemfileMentionsRails(ctx) {
+  const gemfile = ctx.files.find((f) => path7.basename(f.relPath) === "Gemfile");
+  if (!gemfile) return false;
+  const content = await readFileSafe(gemfile);
+  if (!content) return false;
+  return /\bgem\s+['"]rails['"]/m.test(content);
+}
+async function checkRubySecretKeyBaseEnv(ctx) {
+  const isRails = isRailsProject(ctx, ctx.files) || await gemfileMentionsRails(ctx);
+  if (!isRails) return [];
+  const configFiles = [];
+  for (const file of ctx.files) {
+    const rel = file.relPath.split(path7.sep).join("/");
+    const ext = path7.extname(rel).toLowerCase();
+    const inConfig = /(^|\/)config\//.test(rel);
+    if (!inConfig) continue;
+    if (![".rb", ".yml", ".yaml"].includes(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    configFiles.push({ file, content });
+  }
+  if (configFiles.length === 0) return [];
+  let mentionsSecret = false;
+  let envBacked = false;
+  let firstMention = null;
+  for (const { file, content } of configFiles) {
+    const m = /\bsecret_key_base\b/.exec(content);
+    if (m) {
+      mentionsSecret = true;
+      if (!firstMention) firstMention = { file, line: findLine(content, m.index) };
+    }
+    if (/ENV\[\s*['"]SECRET_KEY_BASE['"]\s*\]/.test(content) || /ENV\.fetch\(\s*['"]SECRET_KEY_BASE['"]/.test(content) || /Rails\.application\.credentials/.test(content)) {
+      envBacked = true;
+    }
+  }
+  if (envBacked) return [];
+  if (!mentionsSecret) {
+    return [
+      {
+        checkId: "rb-missing-secret-key-base-env",
+        itemId: "secrets",
+        severity: "high",
+        message: "Detected a Rails project but couldn't find secret_key_base wired up to ENV['SECRET_KEY_BASE'] or Rails.application.credentials anywhere in config/. Configure it before deploying."
+      }
+    ];
+  }
+  return [
+    {
+      checkId: "rb-secret-key-base-not-from-env",
+      itemId: "secrets",
+      severity: "high",
+      message: "Rails secret_key_base is referenced in config/ but not pulled from ENV['SECRET_KEY_BASE'] or Rails.application.credentials. Move the real value out of source.",
+      file: firstMention ? relPosix(firstMention.file.relPath) : void 0,
+      line: firstMention?.line
+    }
+  ];
+}
+
+// src/checks/quality.ts
+import * as path8 from "node:path";
+var TODO_REGEX = /\b(?:TODO|FIXME|XXX|HACK)\b/;
+var PLACEHOLDER_REGEX = /\b(lorem ipsum|placeholder text|john doe|jane doe|test@example\.com)\b/i;
+async function checkPlaceholderContent(ctx) {
+  const findings = [];
+  let todoCount = 0;
+  const placeholderHits = [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    const ext = path8.extname(file.relPath).toLowerCase();
+    if (![".ts", ".tsx", ".js", ".jsx", ".html", ".md", ".mdx"].includes(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const todoMatch = TODO_REGEX.exec(content);
+    if (todoMatch && !lineContainsIgnoreMarker(content, todoMatch.index)) todoCount++;
+    const phMatch = PLACEHOLDER_REGEX.exec(content);
+    if (phMatch && !lineContainsIgnoreMarker(content, phMatch.index)) {
+      placeholderHits.push({
+        checkId: "placeholder-content",
+        itemId: "ai-audit",
+        severity: "medium",
+        message: `Placeholder content "${phMatch[0]}" found \u2014 make sure it isn't shown to real users.`,
+        file: relPosix(file.relPath),
+        line: findLine(content, phMatch.index)
+      });
+    }
+  }
+  if (todoCount > 0) {
+    findings.push({
+      checkId: "todo-comments",
+      itemId: "ai-audit",
+      severity: "lower",
+      message: `Found ${todoCount} file(s) with TODO/FIXME/XXX/HACK comments. Walk through them before launch and decide which are real work.`
+    });
+  }
+  return findings.concat(placeholderHits.slice(0, 25));
+}
+
+// src/checks/index.ts
+var ALL_CHECKS = [
+  { id: "hardcoded-secrets", run: checkHardcodedSecrets },
+  { id: "config-secret-leaks", run: checkConfigSecretLeaks },
+  { id: "env-committed", run: checkEnvCommitted },
+  { id: "env-example", run: checkEnvExample },
+  { id: "gitignore", run: checkGitignore },
+  { id: "robots-txt", run: checkRobotsTxt },
+  { id: "sitemap-xml", run: checkSitemapXml },
+  { id: "favicon", run: checkFavicon },
+  { id: "llms-txt", run: checkLlmsTxt },
+  { id: "pwa-manifest", run: checkPwaManifest },
+  { id: "security-headers", run: checkSecurityHeaders },
+  { id: "dangerous-patterns", run: checkDangerousPatterns },
+  { id: "language-patterns", run: checkLanguagePatterns },
+  { id: "python-secret-key-env", run: checkPythonSecretKeyEnv },
+  { id: "ruby-secret-key-base-env", run: checkRubySecretKeyBaseEnv },
+  { id: "placeholder-content", run: checkPlaceholderContent }
+];
+
+// src/items.ts
+var CHECKLIST_ITEMS = {
+  secrets: {
+    id: "secrets",
+    title: "Lock up your API keys and passwords",
+    priority: "critical"
+  },
+  "common-attacks": {
+    id: "common-attacks",
+    title: "Block the most common automated attacks",
+    priority: "critical"
+  },
+  "https-headers": {
+    id: "https-headers",
+    title: "Force HTTPS and add browser-level defenses",
+    priority: "critical"
+  },
+  "dev-prod-data": {
+    id: "dev-prod-data",
+    title: "Keep your test data away from real users",
+    priority: "critical"
+  },
+  github: {
+    id: "github",
+    title: "Get your code into GitHub safely",
+    priority: "high"
+  },
+  seo: {
+    id: "seo",
+    title: "Make sure search engines and link previews work",
+    priority: "medium"
+  },
+  "launch-polish": {
+    id: "launch-polish",
+    title: "Last-mile launch polish",
+    priority: "medium"
+  },
+  "ai-audit": {
+    id: "ai-audit",
+    title: "Audit what your AI builder actually shipped",
+    priority: "critical"
+  },
+  aeo: {
+    id: "aeo",
+    title: "Make AI assistants able to recommend you",
+    priority: "lower"
+  },
+  "installable-app": {
+    id: "installable-app",
+    title: "Make your app installable on phones",
+    priority: "lower"
+  }
 };
-const UNTRACKED_SUFFIX = " (Note: this file is not tracked in git — it can't leak through a repo push, so severity is softened. If you ever commit it or ship it in a public artifact, re-scan.)";
-function applyTrackingAwareSeverity(findings, tracked) {
-    if (!tracked)
-        return findings;
-    return findings.map((f) => {
-        if (!f.file)
-            return f;
-        if (tracked.has(f.file))
-            return f;
-        const nextSeverity = UNTRACKED_DOWNGRADE[f.severity];
-        if (nextSeverity === f.severity)
-            return f;
-        return {
-            ...f,
-            severity: nextSeverity,
-            message: f.message + UNTRACKED_SUFFIX,
-        };
+function permalinkFor(itemId, baseUrl) {
+  const trimmed = baseUrl.replace(/\/+$/, "");
+  return `${trimmed}/i/${itemId}`;
+}
+
+// src/publish.ts
+import { promises as fs2 } from "node:fs";
+import * as path9 from "node:path";
+var DEFAULT_BASE_URL = "https://shippingszn.com";
+var PUBLISH_TIMEOUT_MS = 3e3;
+function shouldPublish() {
+  const v = process.env["SHIPPINGSZN_PUBLISH"] ?? "";
+  return v === "1" || v.toLowerCase() === "true" || v === "yes";
+}
+async function detectStack(cwd2) {
+  const tags = /* @__PURE__ */ new Set();
+  try {
+    const raw = await fs2.readFile(path9.join(cwd2, "package.json"), "utf8");
+    const pkg = JSON.parse(raw);
+    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const has = (n) => n in deps;
+    if (has("react")) tags.add("react");
+    if (has("next")) tags.add("next");
+    if (has("vue") || has("nuxt")) tags.add("vue");
+    if (has("svelte") || has("@sveltejs/kit")) tags.add("svelte");
+    if (has("astro")) tags.add("astro");
+    if (has("express")) tags.add("express");
+    if (has("fastify")) tags.add("fastify");
+    if (has("hono")) tags.add("hono");
+    if (has("drizzle-orm")) tags.add("drizzle");
+    if (has("prisma")) tags.add("prisma");
+    if (has("@supabase/supabase-js")) tags.add("supabase");
+    if (has("firebase")) tags.add("firebase");
+    if (has("stripe")) tags.add("stripe");
+    if (has("typescript")) tags.add("ts");
+    if (has("vite")) tags.add("vite");
+    if (has("expo")) tags.add("expo");
+    if (has("react-native")) tags.add("react-native");
+  } catch {
+  }
+  const checks = [
+    ["requirements.txt", "python"],
+    ["pyproject.toml", "python"],
+    ["Gemfile", "ruby"],
+    ["go.mod", "go"],
+    ["Cargo.toml", "rust"],
+    ["composer.json", "php"],
+    ["pom.xml", "java"],
+    ["build.gradle", "java"]
+  ];
+  for (const [file, tag] of checks) {
+    try {
+      await fs2.access(path9.join(cwd2, file));
+      tags.add(tag);
+    } catch {
+    }
+  }
+  return [...tags].slice(0, 12);
+}
+function buildPayload(totals, filesScanned, stack, scannerVersion) {
+  const out = {
+    filesScanned,
+    findingsCritical: totals.critical ?? 0,
+    findingsHigh: totals.high ?? 0,
+    findingsMedium: totals.medium ?? 0,
+    findingsLower: totals.lower ?? 0,
+    scannerVersion
+  };
+  if (stack.length > 0) out.stack = stack;
+  return out;
+}
+async function publishScan(totals, filesScanned, opts) {
+  if (!shouldPublish()) return "skipped";
+  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+  const stack = await detectStack(opts.cwd);
+  const payload = buildPayload(
+    totals,
+    filesScanned,
+    stack,
+    opts.scannerVersion
+  );
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PUBLISH_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl}/api/wall`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: controller.signal
     });
+    clearTimeout(timer);
+    return res.ok ? "published" : "failed";
+  } catch {
+    clearTimeout(timer);
+    return "failed";
+  }
 }
-const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = (() => {
-    const require = createRequire(import.meta.url);
-    const pkg = require("../package.json");
-    return pkg.version;
-})();
-function parseArgs(argv) {
-    const opts = {
-        cwd: process.cwd(),
-        json: false,
-        baseUrl: process.env.SHIPPINGSZN_BASE_URL ??
-            process.env.VIBE_LAUNCH_CHECK_BASE_URL ??
-            DEFAULT_BASE_URL,
-        help: false,
-        version: false,
-        noColor: !!process.env.NO_COLOR,
-        publish: false,
-        proof: shouldUploadProof(),
+
+// src/proof.ts
+import * as path10 from "node:path";
+var PROOF_TIMEOUT_MS = 5e3;
+var MAX_FINDINGS = 100;
+function shouldUploadProof() {
+  const v = process.env["SHIPPINGSZN_PROOF"] ?? "";
+  return v === "1" || v.toLowerCase() === "true" || v === "yes";
+}
+function clampText(value, max, fallback = "") {
+  const text = value ?? fallback;
+  return text.length > max ? text.slice(0, max - 3) + "..." : text;
+}
+function locationFromFinding(finding) {
+  if (!finding.file) return void 0;
+  return finding.line ? `${finding.file}:${finding.line}` : finding.file;
+}
+function buildBadgeMarkdown(baseUrl, id, score) {
+  const params = new URLSearchParams({
+    scanResultId: id,
+    theme: "dark"
+  });
+  const proofUrl = `${baseUrl}/proof/${encodeURIComponent(id)}`;
+  return `[![Launch readiness proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
+}
+function buildProofPayload(report, scannerVersion) {
+  const counts = {
+    critical: report.totals.critical,
+    high: report.totals.high,
+    medium: report.totals.medium,
+    lower: report.totals.lower
+  };
+  return {
+    version: 1,
+    source: report.source ?? "cli",
+    scanner: "shippingszn",
+    targetName: path10.basename(report.cwd) || "CLI scan",
+    score: report.launchReadiness.score,
+    label: report.launchReadiness.label,
+    decision: report.launchReadiness.decision,
+    decisionLabel: report.launchReadiness.decisionLabel,
+    goNoGoLabel: report.launchReadiness.goNoGoLabel,
+    confidence: report.launchReadiness.confidence,
+    checkedAt: report.generatedAt,
+    counts,
+    findings: report.findings.slice(0, MAX_FINDINGS).map((finding) => ({
+      severity: finding.severity,
+      title: clampText(finding.itemTitle || finding.checkId, 160),
+      body: clampText(finding.message, 3e3),
+      whatFailed: clampText(finding.whatFailed, 3e3),
+      whyItBlocksLaunch: clampText(finding.whyItBlocksLaunch, 3e3),
+      fixInstructions: clampText(finding.fixInstructions, 4e3),
+      aiBuilderPrompt: clampText(finding.aiBuilderPrompt, 4e3),
+      evidence: clampText(finding.evidence, 3e3),
+      confidence: finding.confidence,
+      fixPrompt: clampText(finding.aiBuilderPrompt, 4e3),
+      verify: clampText(finding.verificationStep, 3e3),
+      verificationStep: clampText(finding.verificationStep, 3e3),
+      ...locationFromFinding(finding) ? { location: clampText(locationFromFinding(finding), 500) } : {},
+      permalink: finding.permalink,
+      itemTitle: clampText(finding.itemTitle, 160)
+    })),
+    filesScanned: report.filesScanned,
+    topNextStep: clampText(report.launchReadiness.topNextStep, 1e3),
+    reportRecommended: report.launchReadiness.reportRecommended,
+    ...report.launchReadiness.reportUrl ? { reportUrl: report.launchReadiness.reportUrl } : {},
+    scannerVersion
+  };
+}
+function buildWallPayload(report, scanResultId, scannerVersion) {
+  return {
+    source: "cli",
+    scanResultId,
+    score: report.launchReadiness.score,
+    label: report.launchReadiness.label,
+    filesScanned: report.filesScanned,
+    findingsCritical: report.totals.critical,
+    findingsHigh: report.totals.high,
+    findingsMedium: report.totals.medium,
+    findingsLower: report.totals.lower,
+    scannerVersion
+  };
+}
+async function publishProofToWall(baseUrl, report, scanResultId, scannerVersion) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROOF_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl}/api/wall`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "user-agent": `shippingszn-cli/${scannerVersion}`
+      },
+      body: JSON.stringify(
+        buildWallPayload(report, scanResultId, scannerVersion)
+      ),
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!res.ok) {
+      return { error: `Wall publish failed with HTTP ${res.status}.` };
+    }
+    return { wallUrl: `${baseUrl}/wall` };
+  } catch (err) {
+    clearTimeout(timer);
+    return {
+      error: `Wall publish failed: ${err instanceof Error ? err.message : String(err)}`
     };
-    for (let i = 0; i < argv.length; i++) {
-        const a = argv[i];
-        if (a === "--help" || a === "-h")
-            opts.help = true;
-        else if (a === "--version" || a === "-v")
-            opts.version = true;
-        else if (a === "--json")
-            opts.json = true;
-        else if (a === "--publish")
-            opts.publish = true;
-        else if (a === "--proof")
-            opts.proof = true;
-        else if (a === "--no-color")
-            opts.noColor = true;
-        else if (a === "--base-url")
-            opts.baseUrl = argv[++i] ?? opts.baseUrl;
-        else if (a === "--cwd")
-            opts.cwd = path.resolve(argv[++i] ?? opts.cwd);
-        else if (!a.startsWith("-"))
-            opts.cwd = path.resolve(a);
-    }
-    return opts;
+  }
 }
-function color(enabled) {
-    const wrap = (codes) => (s) => enabled ? `\x1b[${codes}m${s}\x1b[0m` : s;
+async function uploadProof(report, opts) {
+  const baseUrl = opts.baseUrl.replace(/\/$/, "");
+  const payload = buildProofPayload(report, opts.scannerVersion);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROOF_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${baseUrl}/api/scan-results`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "user-agent": `shippingszn-cli/${opts.scannerVersion}`
+      },
+      body: JSON.stringify(payload),
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!res.ok) {
+      return {
+        status: "failed",
+        error: `Proof upload failed with HTTP ${res.status}.`
+      };
+    }
+    const body = await res.json();
+    const id = typeof body.id === "string" ? body.id : "";
+    if (!id) {
+      return {
+        status: "failed",
+        error: "Proof upload succeeded but the response did not include an id."
+      };
+    }
+    const wall = await publishProofToWall(
+      baseUrl,
+      report,
+      id,
+      opts.scannerVersion
+    );
     return {
-        bold: wrap("1"),
-        dim: wrap("2"),
-        red: wrap("31"),
-        yellow: wrap("33"),
-        blue: wrap("34"),
-        cyan: wrap("36"),
-        green: wrap("32"),
-        magenta: wrap("35"),
-        gray: wrap("90"),
+      status: "uploaded",
+      id,
+      proofUrl: `${baseUrl}/proof/${encodeURIComponent(id)}`,
+      reportUrl: `${baseUrl}/report?${new URLSearchParams({ scanResultId: id }).toString()}`,
+      badgeMarkdown: buildBadgeMarkdown(
+        baseUrl,
+        id,
+        report.launchReadiness.score
+      ),
+      ...wall.wallUrl ? { wallUrl: wall.wallUrl } : {},
+      ...wall.error ? { wallPublishError: wall.error } : {}
     };
+  } catch (err) {
+    clearTimeout(timer);
+    return {
+      status: "failed",
+      error: `Proof upload failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
 }
-const SEVERITY_ORDER = ["critical", "high", "medium", "lower"];
-const SEVERITY_LABEL = {
-    critical: "CRITICAL",
-    high: "HIGH",
-    medium: "MEDIUM",
-    lower: "LOWER",
+
+// src/remediation.ts
+var SEVERITY_INTENT = {
+  critical: "Treat this as launch-blocking until fixed.",
+  high: "Fix this before public traffic or paid acquisition.",
+  medium: "Fix this before announcing or indexing the launch.",
+  lower: "Fix this when polishing the launch artifact."
+};
+var ESCALATION = {
+  critical: "Escalate before launch if this touches secrets, auth, payments, customer data, production infrastructure, or anything already exposed publicly.",
+  high: "Escalate if the fix affects auth, payments, deploy config, browser security, or a user-visible production path.",
+  medium: "Escalate only if the fix changes routing, indexing, analytics, or public launch messaging.",
+  lower: "Escalation is usually unnecessary unless this blocks installability, branding, or a promised launch surface."
+};
+function locationForPrompt(finding) {
+  if (!finding.file) return "No specific file was attached to the finding.";
+  const line = finding.line ? `:${finding.line}` : "";
+  return `Likely location: ${finding.file}${line}.`;
+}
+function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
+  const proofStep = `After the fix verifies clean, run npx shippingszn --json and paste or upload the JSON at ${proofCreatePath} to create launch proof.`;
+  if (severity === "critical" || severity === "high") {
+    return `${proofStep} If this app has users, revenue, client trust, or paid API exposure, attach the clean scan to a paid launch-readiness report at ${reportUrl}.`;
+  }
+  return proofStep;
+}
+function buildRemediationPrompt({
+  finding,
+  item,
+  proofCreatePath,
+  reportUrl
+}) {
+  const itemTitle = item?.title ?? finding.itemId;
+  const location = locationForPrompt(finding);
+  const intent = SEVERITY_INTENT[finding.severity];
+  return {
+    fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding.severity}. Checklist area: ${itemTitle}. Finding: ${finding.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
+    verify: "Re-run npx shippingszn --json and confirm this exact finding is gone. Also run the app's normal typecheck/test/build command when the fix changes code, config, routing, security behavior, or public assets.",
+    escalation: ESCALATION[finding.severity],
+    proofNextStep: proofStepForSeverity(
+      finding.severity,
+      proofCreatePath,
+      reportUrl
+    )
+  };
+}
+
+// ../../lib/launch-readiness/src/index.ts
+var SEVERITY_WEIGHTS = {
+  critical: 35,
+  high: 22,
+  medium: 10,
+  lower: 5
+};
+var SCORE_BANDS = [
+  {
+    id: "blocked",
+    minScore: 0,
+    maxScore: 59,
+    label: "No-go: launch blocked",
+    decision: "no-go",
+    goNoGoLabel: "No-go"
+  },
+  {
+    id: "fix_first",
+    minScore: 60,
+    maxScore: 79,
+    label: "Fix-first",
+    decision: "fix-first",
+    goNoGoLabel: "Fix first"
+  },
+  {
+    id: "verify_first",
+    minScore: 80,
+    maxScore: 89,
+    label: "Verify before launch",
+    decision: "verify-first",
+    goNoGoLabel: "Verify first"
+  },
+  {
+    id: "launchable",
+    minScore: 90,
+    maxScore: 100,
+    label: "Launchable with proof",
+    decision: "go",
+    goNoGoLabel: "Go"
+  }
+];
+var SOURCE_SCORE_CAP = {
+  url: 88,
+  cli: 100,
+  github: 100,
+  manual: 72
+};
+var COVERAGE_LABELS = {
+  public_surface: "Public launch surface",
+  repo_static: "Repository static scan",
+  secrets: "Secrets and config exposure",
+  auth: "Auth and private surfaces",
+  paid_api: "Paid API and abuse risk",
+  deployment: "Deployment and runtime config",
+  content: "Launch content and metadata",
+  proof: "Proof/report handoff"
+};
+var SEVERITY_RANK = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  lower: 3
+};
+function clampText2(value, fallback, max = 4e3) {
+  const trimmed = value?.trim();
+  const out = trimmed || fallback;
+  return out.length > max ? `${out.slice(0, max - 3)}...` : out;
+}
+function clampCount(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+  return Math.max(0, Math.round(value));
+}
+function clampScore(value) {
+  return Math.max(0, Math.min(100, Math.round(value)));
+}
+function canonicalSeverity(value) {
+  if (value === "fatal" || value === "error" || value === "critical") {
+    return "critical";
+  }
+  if (value === "high") return "high";
+  if (value === "medium" || value === "warning") return "medium";
+  return "lower";
+}
+function emptyLaunchReadinessCounts() {
+  return { critical: 0, high: 0, medium: 0, lower: 0 };
+}
+function normalizeLaunchCounts(counts) {
+  return {
+    critical: clampCount(counts?.critical),
+    high: clampCount(counts?.high),
+    medium: clampCount(counts?.medium),
+    lower: clampCount(counts?.lower)
+  };
+}
+function countLaunchFindings(findings) {
+  const counts = emptyLaunchReadinessCounts();
+  for (const finding of findings) {
+    counts[canonicalSeverity(finding.severity)] += 1;
+  }
+  return counts;
+}
+function confidenceForSource(source) {
+  if (source === "url") return "medium";
+  if (source === "manual") return "low";
+  return "high";
+}
+function normalizeConfidence(value, fallback) {
+  return value === "low" || value === "medium" || value === "high" ? value : fallback;
+}
+function sourceLabel(source) {
+  if (source === "github") return "GitHub Action scan";
+  if (source === "cli") return "CLI scan";
+  if (source === "url") return "public URL scan";
+  return "manual intake";
+}
+function coverageArea(id, status, evidence, confidence) {
+  return {
+    id,
+    label: COVERAGE_LABELS[id],
+    status,
+    evidence,
+    confidence: confidence ?? (status === "checked" ? "high" : status === "partial" ? "medium" : "low")
+  };
+}
+function coverageForSource(source) {
+  if (source === "url") {
+    return [
+      coverageArea(
+        "public_surface",
+        "checked",
+        "Fetched the public URL and evaluated launch-page basics.",
+        "medium"
+      ),
+      coverageArea(
+        "repo_static",
+        "not_checked",
+        "No repository files were scanned from the public URL path."
+      ),
+      coverageArea(
+        "secrets",
+        "not_checked",
+        "Secrets, committed env files, and config leaks require the CLI or GitHub Action."
+      ),
+      coverageArea(
+        "auth",
+        "not_checked",
+        "Private routes and role guards cannot be proven from a public unauthenticated fetch."
+      ),
+      coverageArea(
+        "paid_api",
+        "not_checked",
+        "Spend caps, rate limits, and provider abuse controls require repository or operator context."
+      ),
+      coverageArea(
+        "deployment",
+        "partial",
+        "HTTPS and response behavior were checked; runtime env and deploy config were not."
+      ),
+      coverageArea(
+        "content",
+        "checked",
+        "Public metadata, placeholder copy, and launch-page signals were checked.",
+        "medium"
+      ),
+      coverageArea(
+        "proof",
+        "checked",
+        "The result can be saved as proof and used to generate a report handoff.",
+        "medium"
+      )
+    ];
+  }
+  if (source === "cli" || source === "github") {
+    const isGithub = source === "github";
+    return [
+      coverageArea(
+        "public_surface",
+        "partial",
+        "Repository signals were scanned; live production behavior still needs a URL scan."
+      ),
+      coverageArea(
+        "repo_static",
+        "checked",
+        isGithub ? "GitHub Actions scanned checked-out repository files." : "The local CLI scanned repository files from the project root."
+      ),
+      coverageArea(
+        "secrets",
+        "checked",
+        "Common committed secret and config exposure patterns were scanned."
+      ),
+      coverageArea(
+        "auth",
+        "partial",
+        "Static auth-risk signals were checked; runtime role behavior still needs verification."
+      ),
+      coverageArea(
+        "paid_api",
+        "partial",
+        "Static paid-provider and limiter signals were checked; real spend caps still need owner verification."
+      ),
+      coverageArea(
+        "deployment",
+        "partial",
+        "Deploy-facing files and config signals were scanned; hosted environment settings may still be outside the repo."
+      ),
+      coverageArea(
+        "content",
+        "checked",
+        "Launch metadata, public assets, placeholder content, and checklist-backed file signals were scanned."
+      ),
+      coverageArea(
+        "proof",
+        "checked",
+        "The result can create proof, badge, Wall, and report handoff artifacts."
+      )
+    ];
+  }
+  return [
+    coverageArea(
+      "public_surface",
+      "partial",
+      "Manual intake may include public URL context, but no automated URL scan is guaranteed.",
+      "low"
+    ),
+    coverageArea(
+      "repo_static",
+      "partial",
+      "Manual evidence can describe repository risks, but the scanner has not verified them.",
+      "low"
+    ),
+    coverageArea(
+      "secrets",
+      "partial",
+      "Manual evidence can mention secrets; run the CLI or GitHub Action for proof.",
+      "low"
+    ),
+    coverageArea(
+      "auth",
+      "partial",
+      "Manual evidence can mention auth risk; runtime verification is still required.",
+      "low"
+    ),
+    coverageArea(
+      "paid_api",
+      "partial",
+      "Manual evidence can mention paid API risk; provider-side spend controls are still unverified.",
+      "low"
+    ),
+    coverageArea(
+      "deployment",
+      "partial",
+      "Manual evidence can mention deployment risk; hosted settings are not automatically checked.",
+      "low"
+    ),
+    coverageArea(
+      "content",
+      "partial",
+      "Manual evidence can mention content polish; run a URL scan for public-page proof.",
+      "low"
+    ),
+    coverageArea(
+      "proof",
+      "checked",
+      "The result can still be packaged into a report handoff.",
+      "low"
+    )
+  ];
+}
+function coverageSummary(source, coverage) {
+  const checked = coverage.filter((area) => area.status === "checked").length;
+  const partial = coverage.filter((area) => area.status === "partial").length;
+  const missing = coverage.filter((area) => area.status === "not_checked");
+  if (missing.length === 0) {
+    return `${sourceLabel(source)} covered ${checked} readiness areas with ${partial} areas requiring owner verification.`;
+  }
+  return `${sourceLabel(source)} covered ${checked} readiness areas, partially covered ${partial}, and left ${missing.map((area) => area.label).join(", ")} unverified.`;
+}
+function defaultWhy(severity, source) {
+  if (severity === "critical") {
+    return `This is treated as launch-blocking evidence from the ${sourceLabel(source)} because it can expose users, secrets, revenue, or the primary launch surface.`;
+  }
+  if (severity === "high") {
+    return `This can turn a launch into a trust, security, cost, or conversion problem even if the app appears to work.`;
+  }
+  if (severity === "medium") {
+    return `This weakens launch readiness and should be fixed before public announcement, indexing, or paid traffic.`;
+  }
+  return `This is lower-priority readiness polish, but it still belongs in the fix queue before the launch proof is treated as clean.`;
+}
+function locationLine(finding) {
+  if (finding.location?.trim()) return finding.location.trim();
+  if (!finding.file?.trim()) return "";
+  return finding.line ? `${finding.file.trim()}:${finding.line}` : finding.file.trim();
+}
+function defaultPrompt(input) {
+  const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
+  return [
+    "You are fixing a shippingszn launch-readiness blocker in an AI-built app.",
+    `Severity: ${input.severity}.`,
+    `Finding: ${input.title}.`,
+    `What failed: ${input.whatFailed}`,
+    `Why it blocks launch: ${input.whyItBlocksLaunch}`,
+    where,
+    `Fix exactly this: ${input.fixInstructions}`,
+    `Verification required: ${input.verificationStep}`,
+    "Make the smallest production-safe change, preserve existing behavior, list files changed, and do not suppress the scanner unless you prove a false positive."
+  ].join(" ");
+}
+function normalizeLaunchFinding(finding, source = "manual") {
+  const severity = canonicalSeverity(finding.severity);
+  const title = clampText2(
+    finding.title ?? finding.itemTitle,
+    "Launch-readiness finding",
+    160
+  );
+  const body = clampText2(
+    finding.body ?? finding.message,
+    "The scan flagged this as a launch-readiness risk.",
+    3e3
+  );
+  const whatFailed = clampText2(finding.whatFailed, body, 3e3);
+  const whyItBlocksLaunch = clampText2(
+    finding.whyItBlocksLaunch,
+    body || defaultWhy(severity, source),
+    3e3
+  );
+  const fixInstructions = clampText2(
+    finding.fixInstructions ?? finding.fixPrompt,
+    `Fix the underlying ${severity} launch-readiness risk and keep the app behavior intact.`,
+    4e3
+  );
+  const verificationStep = clampText2(
+    finding.verificationStep ?? finding.verify,
+    "Run the same scan again and confirm this finding is gone before launch.",
+    3e3
+  );
+  const location = locationLine(finding);
+  const aiBuilderPrompt = clampText2(
+    finding.aiBuilderPrompt,
+    defaultPrompt({
+      severity,
+      title,
+      whatFailed,
+      whyItBlocksLaunch,
+      fixInstructions,
+      verificationStep,
+      location
+    }),
+    4e3
+  );
+  const evidence = clampText2(
+    finding.evidence,
+    location ? `Observed at ${location}.` : body,
+    3e3
+  );
+  const confidence = normalizeConfidence(
+    finding.confidence,
+    confidenceForSource(source)
+  );
+  return {
+    severity,
+    title,
+    whatFailed,
+    whyItBlocksLaunch,
+    fixInstructions,
+    aiBuilderPrompt,
+    verificationStep,
+    evidence,
+    confidence,
+    body,
+    message: body,
+    fixPrompt: aiBuilderPrompt,
+    verify: verificationStep,
+    ...location ? { location } : {},
+    ...finding.file ? { file: finding.file } : {},
+    ...finding.line ? { line: finding.line } : {},
+    ...finding.permalink ? { permalink: finding.permalink } : {},
+    ...finding.itemTitle ? { itemTitle: finding.itemTitle } : {}
+  };
+}
+function prioritizeLaunchFindings(findings, source = "manual") {
+  return findings.map((finding) => normalizeLaunchFinding(finding, source)).sort((a, b) => {
+    const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
+    if (bySeverity !== 0) return bySeverity;
+    return a.title.localeCompare(b.title);
+  });
+}
+function scoreFromCounts(counts, source) {
+  const weightedPenalty = counts.critical * SEVERITY_WEIGHTS.critical + counts.high * SEVERITY_WEIGHTS.high + counts.medium * SEVERITY_WEIGHTS.medium + counts.lower * SEVERITY_WEIGHTS.lower;
+  const rawScore = clampScore(100 - weightedPenalty);
+  const scoreCap = SOURCE_SCORE_CAP[source];
+  const score = Math.min(rawScore, scoreCap);
+  return {
+    score,
+    rawScore,
+    weightedPenalty,
+    coveragePenalty: Math.max(0, rawScore - score)
+  };
+}
+function scoreBandFor(score) {
+  return SCORE_BANDS.find(
+    (band) => score >= band.minScore && score <= band.maxScore
+  ) ?? SCORE_BANDS[0];
+}
+function bandFor(score, counts) {
+  if (counts.critical > 0) return SCORE_BANDS[0];
+  if (counts.high > 0) return SCORE_BANDS[1];
+  return scoreBandFor(score);
+}
+function decisionText(band, counts, source) {
+  if (counts.critical > 0) {
+    return `Do not launch yet. ${counts.critical} critical blocker${counts.critical === 1 ? "" : "s"} must be fixed and rescanned before public traffic.`;
+  }
+  if (counts.high > 0) {
+    return `Fix the high-risk launch gaps before a real campaign, customer demo, or paid traffic.`;
+  }
+  if (counts.medium > 0 || counts.lower > 0) {
+    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as clean proof.`;
+  }
+  if (source === "url") {
+    return "No public-page blockers were found. Run the CLI or GitHub Action before calling the app launch-ready.";
+  }
+  return `${band.goNoGoLabel}: no scan-detected blockers were found. Keep the proof attached to the launch record.`;
+}
+function topNextStep(blockers, counts, source) {
+  const top = blockers[0];
+  if (top) {
+    return `Fix ${top.title}: ${top.whatFailed}`;
+  }
+  if (source === "url") {
+    return "Run the repo scan next so secrets, auth, API routes, and generated-code risks are checked before launch.";
+  }
+  if (counts.medium > 0 || counts.lower > 0) {
+    return "Fix the remaining readiness gaps and rescan before publishing proof.";
+  }
+  return "Attach this clean scan proof to the launch record and keep monitoring the first production traffic.";
+}
+function aggregateConfidence(source, findings) {
+  if (findings.some((finding) => finding.confidence === "low")) return "low";
+  if (source === "url") return "medium";
+  return "high";
+}
+function assessLaunchReadiness(input) {
+  const source = input.source ?? "manual";
+  const findings = prioritizeLaunchFindings(input.findings ?? [], source);
+  const counts = input.counts ? normalizeLaunchCounts(input.counts) : countLaunchFindings(findings);
+  const { score, rawScore, weightedPenalty, coveragePenalty } = scoreFromCounts(
+    counts,
+    source
+  );
+  const band = bandFor(score, counts);
+  const coverage = coverageForSource(source);
+  const checkedAreas = coverage.filter((area) => area.status === "checked");
+  const uncheckedAreas = coverage.filter((area) => area.status !== "checked");
+  const blockers = findings.filter(
+    (finding) => finding.severity === "critical" || finding.severity === "high"
+  );
+  const decision = decisionText(band, counts, source);
+  const reportRecommended = counts.critical > 0 || counts.high > 0 || coveragePenalty > 0;
+  return {
+    score,
+    rawScore,
+    label: band.label,
+    decision,
+    decisionLabel: band.label,
+    launchDecision: band.decision,
+    goNoGoLabel: band.goNoGoLabel,
+    band,
+    counts,
+    severityWeights: SEVERITY_WEIGHTS,
+    weightedPenalty,
+    coveragePenalty,
+    coverage,
+    coverageSummary: coverageSummary(source, coverage),
+    checkedAreas,
+    uncheckedAreas,
+    topNextStep: topNextStep(blockers.length ? blockers : findings, counts, source),
+    reportRecommended,
+    confidence: aggregateConfidence(source, findings),
+    blockers,
+    findings
+  };
+}
+
+// src/index.ts
+var UNTRACKED_DOWNGRADE = {
+  critical: "lower",
+  high: "lower",
+  medium: "lower",
+  lower: "lower"
+};
+var UNTRACKED_SUFFIX = " (Note: this file is not tracked in git \u2014 it can't leak through a repo push, so severity is softened. If you ever commit it or ship it in a public artifact, re-scan.)";
+function applyTrackingAwareSeverity(findings, tracked) {
+  if (!tracked) return findings;
+  return findings.map((f) => {
+    if (!f.file) return f;
+    if (tracked.has(f.file)) return f;
+    const nextSeverity = UNTRACKED_DOWNGRADE[f.severity];
+    if (nextSeverity === f.severity) return f;
+    return {
+      ...f,
+      severity: nextSeverity,
+      message: f.message + UNTRACKED_SUFFIX
+    };
+  });
+}
+var DEFAULT_BASE_URL2 = "https://shippingszn.com";
+var PKG_VERSION = (() => {
+  const require2 = createRequire(import.meta.url);
+  const pkg = require2("../package.json");
+  return pkg.version;
+})();
+function parseArgs(argv2) {
+  const opts = {
+    cwd: process2.cwd(),
+    json: false,
+    baseUrl: process2.env.SHIPPINGSZN_BASE_URL ?? process2.env.VIBE_LAUNCH_CHECK_BASE_URL ?? DEFAULT_BASE_URL2,
+    help: false,
+    version: false,
+    noColor: !!process2.env.NO_COLOR,
+    publish: false,
+    proof: shouldUploadProof()
+  };
+  for (let i = 0; i < argv2.length; i++) {
+    const a = argv2[i];
+    if (a === "--help" || a === "-h") opts.help = true;
+    else if (a === "--version" || a === "-v") opts.version = true;
+    else if (a === "--json") opts.json = true;
+    else if (a === "--publish") opts.publish = true;
+    else if (a === "--proof") opts.proof = true;
+    else if (a === "--no-color") opts.noColor = true;
+    else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
+    else if (a === "--cwd") opts.cwd = path11.resolve(argv2[++i] ?? opts.cwd);
+    else if (!a.startsWith("-")) opts.cwd = path11.resolve(a);
+  }
+  return opts;
+}
+function color(enabled) {
+  const wrap = (codes) => (s) => enabled ? `\x1B[${codes}m${s}\x1B[0m` : s;
+  return {
+    bold: wrap("1"),
+    dim: wrap("2"),
+    red: wrap("31"),
+    yellow: wrap("33"),
+    blue: wrap("34"),
+    cyan: wrap("36"),
+    green: wrap("32"),
+    magenta: wrap("35"),
+    gray: wrap("90")
+  };
+}
+var SEVERITY_ORDER = ["critical", "high", "medium", "lower"];
+var SEVERITY_LABEL = {
+  critical: "CRITICAL",
+  high: "HIGH",
+  medium: "MEDIUM",
+  lower: "LOWER"
 };
 function printHelp() {
-    process.stdout.write(`shippingszn v${PKG_VERSION}
+  process2.stdout.write(
+    `shippingszn v${PKG_VERSION}
 
 Read-only scanner that checks the current project against a small set of
 high-signal launch-readiness items from shippingszn.
@@ -115,7 +2125,7 @@ Options:
                         printing a proof URL, Wall URL, report URL, and badge.
                         Can also be enabled with SHIPPINGSZN_PROOF=1.
   --base-url <url>      Base URL used to build links back to checklist items.
-                        (default: ${DEFAULT_BASE_URL})
+                        (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable report.
   -h, --help            Show this help.
@@ -124,255 +2134,312 @@ Options:
 The scanner only reads files. It never writes, modifies, deletes, or makes
 network requests unless you explicitly opt in with --publish or --proof.
 Exit code is non-zero if any Critical findings are detected.
-`);
-}
-function buildTopNextStep(findings) {
-    const top = findings[0];
-    if (!top) {
-        return "Attach this clean repo scan proof to the launch record, then monitor first production traffic.";
-    }
-    return `Fix ${top.itemTitle}: ${top.message}`;
+`
+  );
 }
 function scanSource() {
-    return process.env.GITHUB_ACTIONS === "true" ? "github" : "cli";
+  return process2.env.GITHUB_ACTIONS === "true" ? "github" : "cli";
 }
 async function run() {
-    const opts = parseArgs(process.argv.slice(2));
-    if (opts.help) {
-        printHelp();
-        return 0;
-    }
-    if (opts.version) {
-        process.stdout.write(`${PKG_VERSION}\n`);
-        return 0;
-    }
-    const c = color(!opts.noColor && process.stdout.isTTY === true && !opts.json);
-    const files = await listFiles(opts.cwd);
-    const tracked = getTrackedFiles(opts.cwd);
-    const ctx = { rootDir: opts.cwd, files };
-    const all = [];
-    for (const check of ALL_CHECKS) {
-        try {
-            const out = await check.run(ctx);
-            all.push(...out);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            all.push({
-                checkId: `${check.id}:error`,
-                itemId: "ai-audit",
-                severity: "lower",
-                message: `Check ${check.id} crashed: ${msg}`,
-            });
-        }
+  const opts = parseArgs(process2.argv.slice(2));
+  if (opts.help) {
+    printHelp();
+    return 0;
+  }
+  if (opts.version) {
+    process2.stdout.write(`${PKG_VERSION}
+`);
+    return 0;
+  }
+  const c = color(!opts.noColor && process2.stdout.isTTY === true && !opts.json);
+  const files = await listFiles(opts.cwd);
+  const tracked = getTrackedFiles(opts.cwd);
+  const ctx = { rootDir: opts.cwd, files };
+  const all = [];
+  for (const check of ALL_CHECKS) {
+    try {
+      const out = await check.run(ctx);
+      all.push(...out);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      all.push({
+        checkId: `${check.id}:error`,
+        itemId: "ai-audit",
+        severity: "lower",
+        message: `Check ${check.id} crashed: ${msg}`
+      });
     }
-    const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
-    const reportUrl = `${trimmedBaseUrl}/report`;
-    const proofCreatePath = `${trimmedBaseUrl}/scan`;
-    const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.";
-    const tracked_aware = applyTrackingAwareSeverity(all, tracked);
-    const source = scanSource();
-    const enriched = tracked_aware.map((f) => {
-        const item = CHECKLIST_ITEMS[f.itemId];
-        const remediation = buildRemediationPrompt({
-            finding: f,
-            item,
-            proofCreatePath,
-            reportUrl,
-        });
-        const itemTitle = item?.title ?? f.itemId;
-        const normalized = normalizeLaunchFinding({
-            severity: f.severity,
-            title: itemTitle,
-            body: f.message,
-            message: f.message,
-            evidence: f.evidence,
-            file: f.file,
-            line: f.line,
-            permalink: permalinkFor(f.itemId, opts.baseUrl),
-            itemTitle,
-            fixInstructions: remediation.fixPrompt,
-            aiBuilderPrompt: remediation.fixPrompt,
-            verificationStep: remediation.verify,
-            fixPrompt: remediation.fixPrompt,
-            verify: remediation.verify,
-        }, source);
-        return {
-            ...f,
-            ...normalized,
-            itemTitle,
-            permalink: permalinkFor(f.itemId, opts.baseUrl),
-            remediation,
-        };
+  }
+  const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
+  const reportUrl = `${trimmedBaseUrl}/report`;
+  const proofCreatePath = `${trimmedBaseUrl}/scan`;
+  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.";
+  const tracked_aware = applyTrackingAwareSeverity(all, tracked);
+  const source = scanSource();
+  const enriched = tracked_aware.map((f) => {
+    const item = CHECKLIST_ITEMS[f.itemId];
+    const remediation = buildRemediationPrompt({
+      finding: f,
+      item,
+      proofCreatePath,
+      reportUrl
     });
-    enriched.sort((a, b) => {
-        const sa = SEVERITY_ORDER.indexOf(a.severity);
-        const sb = SEVERITY_ORDER.indexOf(b.severity);
-        if (sa !== sb)
-            return sa - sb;
-        if (a.itemId !== b.itemId)
-            return a.itemId.localeCompare(b.itemId);
-        return a.checkId.localeCompare(b.checkId);
-    });
-    const totals = {
-        critical: 0,
-        high: 0,
-        medium: 0,
-        lower: 0,
+    const itemTitle = item?.title ?? f.itemId;
+    const normalized = normalizeLaunchFinding(
+      {
+        severity: f.severity,
+        title: itemTitle,
+        body: f.message,
+        message: f.message,
+        evidence: f.evidence,
+        file: f.file,
+        line: f.line,
+        permalink: permalinkFor(f.itemId, opts.baseUrl),
+        itemTitle,
+        fixInstructions: remediation.fixPrompt,
+        aiBuilderPrompt: remediation.fixPrompt,
+        verificationStep: remediation.verify,
+        fixPrompt: remediation.fixPrompt,
+        verify: remediation.verify
+      },
+      source
+    );
+    return {
+      ...f,
+      ...normalized,
+      itemTitle,
+      permalink: permalinkFor(f.itemId, opts.baseUrl),
+      remediation
     };
-    for (const f of enriched)
-        totals[f.severity]++;
-    const assessment = assessLaunchReadiness({
-        source,
-        findings: enriched,
-        counts: totals,
+  });
+  enriched.sort((a, b) => {
+    const sa = SEVERITY_ORDER.indexOf(a.severity);
+    const sb = SEVERITY_ORDER.indexOf(b.severity);
+    if (sa !== sb) return sa - sb;
+    if (a.itemId !== b.itemId) return a.itemId.localeCompare(b.itemId);
+    return a.checkId.localeCompare(b.checkId);
+  });
+  const totals = {
+    critical: 0,
+    high: 0,
+    medium: 0,
+    lower: 0
+  };
+  for (const f of enriched) totals[f.severity]++;
+  const assessment = assessLaunchReadiness({
+    source,
+    findings: enriched,
+    counts: totals
+  });
+  const launchReadiness = {
+    score: assessment.score,
+    rawScore: assessment.rawScore,
+    label: assessment.label,
+    decision: assessment.decision,
+    decisionLabel: assessment.decisionLabel,
+    goNoGoLabel: assessment.goNoGoLabel,
+    confidence: assessment.confidence,
+    coveragePenalty: assessment.coveragePenalty,
+    coverageSummary: assessment.coverageSummary,
+    topNextStep: assessment.topNextStep,
+    proofCreatePath,
+    proofUploadHint,
+    reportRecommended: assessment.reportRecommended,
+    ...assessment.reportRecommended ? { reportUrl } : {}
+  };
+  const report = {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source,
+    baseUrl: opts.baseUrl,
+    cwd: opts.cwd,
+    filesScanned: files.length,
+    totals,
+    launchReadiness,
+    findings: enriched
+  };
+  let proofResult = { status: "skipped" };
+  if (opts.proof) {
+    proofResult = await uploadProof(report, {
+      baseUrl: opts.baseUrl,
+      scannerVersion: PKG_VERSION
     });
-    const launchReadiness = {
-        score: assessment.score,
-        rawScore: assessment.rawScore,
-        label: assessment.label,
-        decision: assessment.decision,
-        decisionLabel: assessment.decisionLabel,
-        goNoGoLabel: assessment.goNoGoLabel,
-        confidence: assessment.confidence,
-        coveragePenalty: assessment.coveragePenalty,
-        coverageSummary: assessment.coverageSummary,
-        topNextStep: assessment.topNextStep,
-        proofCreatePath,
-        proofUploadHint,
-        reportRecommended: assessment.reportRecommended,
-        ...(assessment.reportRecommended ? { reportUrl } : {}),
-    };
-    const report = {
-        generatedAt: new Date().toISOString(),
-        source,
-        baseUrl: opts.baseUrl,
-        cwd: opts.cwd,
-        filesScanned: files.length,
-        totals,
-        launchReadiness,
-        findings: enriched,
-    };
-    let proofResult = { status: "skipped" };
-    if (opts.proof) {
-        proofResult = await uploadProof(report, {
-            baseUrl: opts.baseUrl,
-            scannerVersion: PKG_VERSION,
-        });
-        if (proofResult.status === "uploaded") {
-            report.launchReadiness.proofUrl = proofResult.proofUrl;
-            report.launchReadiness.proofResultId = proofResult.id;
-            report.launchReadiness.badgeMarkdown = proofResult.badgeMarkdown;
-            report.launchReadiness.reportUrl = proofResult.reportUrl;
-            report.launchReadiness.wallUrl = proofResult.wallUrl;
-            report.launchReadiness.wallPublishError = proofResult.wallPublishError;
-        }
-        else if (proofResult.status === "failed") {
-            report.launchReadiness.proofUploadError =
-                proofResult.error ?? "Proof upload failed.";
-        }
-    }
-    // Best-effort anonymous publish to the Wall of Launches. This is explicit
-    // opt-in because shippingszn is a trust product; scanning must stay local
-    // unless the user asks to publish proof.
-    let publishResult = "skipped";
-    try {
-        if (opts.publish) {
-            process.env["SHIPPINGSZN_PUBLISH"] = "1";
-        }
-        const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
-        if (!proofAlreadyPublishedWall) {
-            publishResult = await publishScan(totals, files.length, {
-                cwd: opts.cwd,
-                baseUrl: opts.baseUrl,
-                scannerVersion: PKG_VERSION,
-            });
-        }
-    }
-    catch {
-        /* never block on wall publish */
-    }
-    if (opts.json) {
-        process.stdout.write(JSON.stringify(report, null, 2) + "\n");
-        return totals.critical > 0 ? 1 : 0;
-    }
-    // Human-readable report
-    const sevColor = (s) => {
-        if (s === "critical")
-            return c.red;
-        if (s === "high")
-            return c.yellow;
-        if (s === "medium")
-            return c.blue;
-        return c.gray;
-    };
-    // Strip ASCII control characters (including ESC) so a maliciously-named
-    // file or matched secret slice cannot inject ANSI escape sequences into
-    // the operator's terminal.
-    const safe = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?");
-    process.stdout.write(`\n${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}\n`);
-    process.stdout.write(c.dim(`Scanned ${files.length} files in ${opts.cwd}\n\n`));
-    process.stdout.write(`${c.bold("Launch Readiness Score:")} ${launchReadiness.score}/100 ${c.dim(`(${launchReadiness.label})`)}\n`);
-    process.stdout.write(`${c.bold("Scope:")} ${safe(launchReadiness.coverageSummary)}\n`);
-    process.stdout.write(`${c.bold("Top next step:")} ${safe(launchReadiness.topNextStep)}\n`);
-    process.stdout.write(`${c.bold("Fix prompts:")} ${c.dim("Run with --json for copy/paste AI-builder remediation prompts.")}\n`);
-    if (launchReadiness.reportUrl) {
-        process.stdout.write(`${c.bold("Need paid confidence?")} ${c.dim(`Get a launch-readiness report: ${launchReadiness.reportUrl}`)}\n`);
-    }
     if (proofResult.status === "uploaded") {
-        process.stdout.write(`${c.bold("Proof URL:")} ${c.dim(proofResult.proofUrl ?? "")}\n`);
-        process.stdout.write(`${c.bold("Report URL:")} ${c.dim(proofResult.reportUrl ?? "")}\n`);
-        if (proofResult.wallUrl) {
-            process.stdout.write(`${c.bold("Wall URL:")} ${c.dim(proofResult.wallUrl)}\n`);
-        }
-        process.stdout.write(`${c.bold("Badge Markdown:")} ${c.dim(proofResult.badgeMarkdown ?? "")}\n`);
-        if (proofResult.wallPublishError) {
-            process.stdout.write(`${c.bold("Wall publish failed:")} ${c.dim(proofResult.wallPublishError)}\n`);
-        }
+      report.launchReadiness.proofUrl = proofResult.proofUrl;
+      report.launchReadiness.proofResultId = proofResult.id;
+      report.launchReadiness.badgeMarkdown = proofResult.badgeMarkdown;
+      report.launchReadiness.reportUrl = proofResult.reportUrl;
+      report.launchReadiness.wallUrl = proofResult.wallUrl;
+      report.launchReadiness.wallPublishError = proofResult.wallPublishError;
+    } else if (proofResult.status === "failed") {
+      report.launchReadiness.proofUploadError = proofResult.error ?? "Proof upload failed.";
     }
-    else if (proofResult.status === "failed") {
-        process.stdout.write(`${c.bold("Proof upload failed:")} ${c.dim(proofResult.error ?? "Unknown upload error.")}\n`);
+  }
+  let publishResult = "skipped";
+  try {
+    if (opts.publish) {
+      process2.env["SHIPPINGSZN_PUBLISH"] = "1";
     }
-    else {
-        process.stdout.write(`${c.bold("Share proof:")} ${c.dim("Run with --proof to publish this scan to a public proof URL.")}\n`);
+    const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
+    if (!proofAlreadyPublishedWall) {
+      publishResult = await publishScan(totals, files.length, {
+        cwd: opts.cwd,
+        baseUrl: opts.baseUrl,
+        scannerVersion: PKG_VERSION
+      });
     }
-    process.stdout.write("\n");
-    if (enriched.length === 0) {
-        process.stdout.write(c.green("No findings. Attach the clean scan proof to the launch record before shipping.\n\n"));
-        if (publishResult === "published") {
-            process.stdout.write(c.dim(`Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n`));
-        }
-        return 0;
+  } catch {
+  }
+  if (opts.json) {
+    process2.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    return totals.critical > 0 ? 1 : 0;
+  }
+  const sevColor = (s) => {
+    if (s === "critical") return c.red;
+    if (s === "high") return c.yellow;
+    if (s === "medium") return c.blue;
+    return c.gray;
+  };
+  const safe = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?");
+  process2.stdout.write(
+    `
+${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
+`
+  );
+  process2.stdout.write(
+    c.dim(`Scanned ${files.length} files in ${opts.cwd}
+
+`)
+  );
+  process2.stdout.write(
+    `${c.bold("Launch Readiness Score:")} ${launchReadiness.score}/100 ${c.dim(`(${launchReadiness.label})`)}
+`
+  );
+  process2.stdout.write(
+    `${c.bold("Scope:")} ${safe(launchReadiness.coverageSummary)}
+`
+  );
+  process2.stdout.write(
+    `${c.bold("Top next step:")} ${safe(launchReadiness.topNextStep)}
+`
+  );
+  process2.stdout.write(
+    `${c.bold("Fix prompts:")} ${c.dim("Run with --json for copy/paste AI-builder remediation prompts.")}
+`
+  );
+  if (launchReadiness.reportUrl) {
+    process2.stdout.write(
+      `${c.bold("Need paid confidence?")} ${c.dim(`Get a launch-readiness report: ${launchReadiness.reportUrl}`)}
+`
+    );
+  }
+  if (proofResult.status === "uploaded") {
+    process2.stdout.write(
+      `${c.bold("Proof URL:")} ${c.dim(proofResult.proofUrl ?? "")}
+`
+    );
+    process2.stdout.write(
+      `${c.bold("Report URL:")} ${c.dim(proofResult.reportUrl ?? "")}
+`
+    );
+    if (proofResult.wallUrl) {
+      process2.stdout.write(
+        `${c.bold("Wall URL:")} ${c.dim(proofResult.wallUrl)}
+`
+      );
     }
-    for (const sev of SEVERITY_ORDER) {
-        const group = enriched.filter((f) => f.severity === sev);
-        if (group.length === 0)
-            continue;
-        process.stdout.write(`${sevColor(sev)(c.bold(`${SEVERITY_LABEL[sev]} (${group.length})`))}\n`);
-        for (const f of group) {
-            const loc = f.file
-                ? ` ${c.dim(`— ${safe(f.file)}${f.line ? `:${f.line}` : ""}`)}`
-                : "";
-            process.stdout.write(`  ${c.bold("•")} ${safe(f.message)}${loc}\n`);
-            if (f.evidence) {
-                process.stdout.write(`    ${c.dim(`evidence: ${safe(f.evidence)}`)}\n`);
-            }
-            process.stdout.write(`    ${c.cyan(`→ ${safe(f.itemTitle)}`)} ${c.dim(f.permalink)}\n`);
-        }
-        process.stdout.write("\n");
+    process2.stdout.write(
+      `${c.bold("Badge Markdown:")} ${c.dim(proofResult.badgeMarkdown ?? "")}
+`
+    );
+    if (proofResult.wallPublishError) {
+      process2.stdout.write(
+        `${c.bold("Wall publish failed:")} ${c.dim(proofResult.wallPublishError)}
+`
+      );
     }
-    process.stdout.write(`${c.bold("Summary:")} ${c.red(`${totals.critical} critical`)}, ${c.yellow(`${totals.high} high`)}, ${c.blue(`${totals.medium} medium`)}, ${c.gray(`${totals.lower} lower`)}\n`);
+  } else if (proofResult.status === "failed") {
+    process2.stdout.write(
+      `${c.bold("Proof upload failed:")} ${c.dim(proofResult.error ?? "Unknown upload error.")}
+`
+    );
+  } else {
+    process2.stdout.write(
+      `${c.bold("Share proof:")} ${c.dim("Run with --proof to publish this scan to a public proof URL.")}
+`
+    );
+  }
+  process2.stdout.write("\n");
+  if (enriched.length === 0) {
+    process2.stdout.write(
+      c.green(
+        "No findings. Attach the clean scan proof to the launch record before shipping.\n\n"
+      )
+    );
     if (publishResult === "published") {
-        process.stdout.write(c.dim(`\nPosted an anonymous summary to the Wall: ${opts.baseUrl}/wall\n`));
-    }
-    if (totals.critical > 0) {
-        process.stdout.write(c.red("\nCritical findings detected. Exiting with code 1.\n"));
-        return 1;
+      process2.stdout.write(
+        c.dim(
+          `Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall
+`
+        )
+      );
     }
-    process.stdout.write(c.dim("\nNo critical findings. Open the linked checklist items to dig deeper.\n"));
     return 0;
+  }
+  for (const sev of SEVERITY_ORDER) {
+    const group = enriched.filter((f) => f.severity === sev);
+    if (group.length === 0) continue;
+    process2.stdout.write(
+      `${sevColor(sev)(c.bold(`${SEVERITY_LABEL[sev]} (${group.length})`))}
+`
+    );
+    for (const f of group) {
+      const loc = f.file ? ` ${c.dim(`\u2014 ${safe(f.file)}${f.line ? `:${f.line}` : ""}`)}` : "";
+      process2.stdout.write(`  ${c.bold("\u2022")} ${safe(f.message)}${loc}
+`);
+      if (f.evidence) {
+        process2.stdout.write(`    ${c.dim(`evidence: ${safe(f.evidence)}`)}
+`);
+      }
+      process2.stdout.write(
+        `    ${c.cyan(`\u2192 ${safe(f.itemTitle)}`)} ${c.dim(f.permalink)}
+`
+      );
+    }
+    process2.stdout.write("\n");
+  }
+  process2.stdout.write(
+    `${c.bold("Summary:")} ${c.red(`${totals.critical} critical`)}, ${c.yellow(`${totals.high} high`)}, ${c.blue(`${totals.medium} medium`)}, ${c.gray(`${totals.lower} lower`)}
+`
+  );
+  if (publishResult === "published") {
+    process2.stdout.write(
+      c.dim(
+        `
+Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall
+`
+      )
+    );
+  }
+  if (totals.critical > 0) {
+    process2.stdout.write(
+      c.red("\nCritical findings detected. Exiting with code 1.\n")
+    );
+    return 1;
+  }
+  process2.stdout.write(
+    c.dim(
+      "\nNo critical findings. Open the linked checklist items to dig deeper.\n"
+    )
+  );
+  return 0;
 }
-run().then((code) => process.exit(code), (err) => {
-    process.stderr.write(`shippingszn failed: ${err instanceof Error ? err.message : String(err)}\n`);
-    process.exit(2);
-});
+run().then(
+  (code) => process2.exit(code),
+  (err) => {
+    process2.stderr.write(
+      `shippingszn failed: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    process2.exit(2);
+  }
+);