shippingszn 0.9.0 → 0.9.2

package/README.md

@@ -6,65 +6,45 @@ leaked API keys, missing crawl assets, weak browser defenses, dangerous code
 patterns, and last-mile polish gaps.
 
 ```bash
-npx shippingszn
+npx shippingszn@latest
 # or
-pnpm dlx shippingszn
+pnpm dlx shippingszn@latest
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-By default it posts one anonymous Wall of Launches entry with score, severity
-counts, files scanned, scanner version, and safe stack tags. It never uploads
-source code, paths, filenames, repo URLs, project names, secrets, handles, or
-emails. Use `--no-publish` for a private local run.
+Normal runs send one anonymous aggregate summary with score, severity counts,
+files scanned, scanner version, and safe stack tags. It never uploads source
+code, paths, filenames, repo URLs, project names, secrets, handles, or emails.
+This aggregate signal is automatic and not user-configurable.
 
-Human output starts with a Launch Readiness Score, scope covered, the top next
-step to fix, and severity counts. Run with `--json` to get machine-readable
-findings plus the Wall/report handoff fields:
+Human output starts with a Launch Readiness Score, scope covered, and severity
+counts. Run with `--json` to get the same score-and-counts summary in a
+machine-readable shape:
 
 ```json
 {
-  "launchReadiness": {
-    "score": 43,
-    "rawScore": 43,
-    "label": "No-go: launch blocked",
-    "decisionLabel": "No-go: launch blocked",
-    "goNoGoLabel": "No-go",
-    "confidence": "high",
-    "coveragePenalty": 0,
-    "coverageSummary": "CLI scan covered 4 readiness areas with 4 areas requiring owner verification.",
-    "topNextStep": "Fix Lock up your API keys and passwords: Possible OpenAI API key hardcoded in source.",
-    "wallUrl": "https://shippingszn.com/wall",
-    "reportUrl": "https://shippingszn.com/report"
-  },
-  "findings": [
-    {
-      "severity": "critical",
-      "message": "Possible OpenAI API key hardcoded in source.",
-      "whatFailed": "A secret-like token appears in a scanned file.",
-      "whyItBlocksLaunch": "A leaked key can spend money or expose customer data before you notice."
-    }
-  ]
+  "score": 43,
+  "band": "no_go",
+  "counts": { "critical": 1, "high": 3, "medium": 4, "lower": 2 },
+  "filesScanned": 128,
+  "detailsLocked": true,
+  "unlockUrl": "https://shippingszn.com/fix-kit"
 }
 ```
 
-When Critical or High findings make paid confidence relevant, the summary also
-includes a `/report` link. Clean scans and lower-risk findings do not push the
-paid report CTA.
+Finding titles, files, evidence, fix prompts, and verification steps are paid.
+They unlock inside the Launch Fix Kit.
 
-## Wall publishing
+## Aggregate summary
 
-Plain `npx shippingszn` feeds the Wall automatically. The public row is
-anonymous and intentionally small: score, launch label, files scanned, finding
-counts, detected stack tags, scanner version, and timestamp.
+Plain `npx shippingszn@latest` sends the aggregate summary automatically. The
+stored row is anonymous and intentionally small: score, launch label, files
+scanned, finding counts, detected stack tags, scanner version, and timestamp.
 
-Use this when you want a completely private local run:
-
-```bash
-npx shippingszn --no-publish
-```
-
-For a paid-report handoff, run `npx shippingszn --json > shippingszn-scan.json`
-and paste or upload the file at `https://shippingszn.com/scan`.
+For a scan-specific paid-report handoff, run `npx shippingszn@latest --proof`.
+That uploads the canonical scan result, returns a proof URL plus a
+`/fix-kit?scanResultId=...` URL, and gives the paid Launch Fix Kit the evidence
+it needs after checkout.
 
 ## What gets checked
 
@@ -90,8 +70,9 @@ maps back to one of the items on the checklist.
 - Placeholder content (`lorem ipsum`, `John Doe`, `test@example.com`) and
   `TODO` / `FIXME` / `XXX` / `HACK` comments.
 
-Each finding is tagged Critical, High, Medium, or Lower and links back to the
-relevant checklist item on shippingszn.com.
+Internally each finding is tagged Critical, High, Medium, or Lower and maps to
+the relevant checklist item. The free CLI output keeps that finding-level detail
+locked.
 
 ## Suppressing false positives
 
@@ -141,12 +122,12 @@ ship.
 shippingszn [path] [options]
 
 Options:
-  --json                Output a machine-readable JSON report.
-  --publish             Legacy alias. Anonymous Wall stats publish by default.
-  --no-publish          Disable the anonymous Wall post for this run.
-  --base-url <url>      Base URL used to build links back to checklist items.
+  --json                Output a machine-readable JSON summary.
+  --proof               Upload full scan evidence and return a scan-specific
+                        Launch Fix Kit URL.
+  --base-url <url>      Base URL used to build checkout and Fix Kit links.
   --cwd <path>          Directory to scan. Default: current working directory.
-  --no-color            Disable ANSI colors in the human-readable report.
+  --no-color            Disable ANSI colors in the human-readable summary.
   -h, --help            Show help.
   -v, --version         Print version.
 ```
@@ -161,22 +142,20 @@ This makes the CLI suitable for CI:
 
 ```yaml
 # .github/workflows/launch-check.yml
-- run: npx shippingszn --json > launch-check.json
+- run: npx shippingszn@latest --json > launch-check.json
 ```
 
 For PR scan signal, have GitHub Actions run the scanner and post the JSON
-summary as a comment: score, severity counts, top next step, Wall URL, report
-URL, and worst Critical/High findings.
+summary as a comment: score, severity counts, and unlock URL.
 
 ## Privacy
 
 `shippingszn` reads files on your machine. It never uploads source code. By
-default it makes one best-effort outbound request to post anonymous Wall stats:
-score, launch label, files scanned count, finding counts by severity, detected
-stack tags, scanner version, and timestamp. It never uploads source code, file
-paths, filenames, project names, repo URLs, secrets, emails, handles, or report
-contents. Use `--no-publish` or `SHIPPINGSZN_DISABLE_PUBLISH=1` to disable that
-request.
+default it makes one best-effort outbound request to post an anonymous aggregate
+summary: score, launch label, files scanned count, finding counts by severity,
+detected stack tags, scanner version, and timestamp. It never uploads source
+code, file paths, filenames, project names, repo URLs, secrets, emails, handles,
+or report contents. The aggregate summary is automatic and not user-configurable.
 
 ## License
 

package/dist/index.js

@@ -3598,7 +3598,10 @@ async function detectStack(cwd2) {
   try {
     const raw = await fs2.readFile(path17.join(cwd2, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
-    const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
+    const deps = {
+      ...pkg.dependencies ?? {},
+      ...pkg.devDependencies ?? {}
+    };
     const has = (n) => n in deps;
     if (has("react")) tags.add("react");
     if (has("next")) tags.add("next");
@@ -3726,6 +3729,7 @@ function buildProofPayload(report, scannerVersion) {
     checkedAt: report.generatedAt,
     counts,
     findings: report.findings.slice(0, MAX_FINDINGS).map((finding2) => ({
+      itemId: finding2.itemId,
       severity: finding2.severity,
       title: clampText(finding2.itemTitle || finding2.checkId, 160),
       body: clampText(finding2.message, 3e3),
@@ -3825,7 +3829,7 @@ async function uploadProof(report, opts) {
       status: "uploaded",
       id,
       proofUrl: `${baseUrl}/proof/${encodeURIComponent(id)}`,
-      reportUrl: `${baseUrl}/report?${new URLSearchParams({ scanResultId: id }).toString()}`,
+      reportUrl: `${baseUrl}/fix-kit?${new URLSearchParams({ scanResultId: id }).toString()}`,
       badgeMarkdown: buildBadgeMarkdown(
         baseUrl,
         id,
@@ -4137,21 +4141,7 @@ function locationLine(finding2) {
   if (!finding2.file?.trim()) return "";
   return finding2.line ? `${finding2.file.trim()}:${finding2.line}` : finding2.file.trim();
 }
-function defaultPrompt(input) {
-  const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
-  return [
-    "You are fixing a shippingszn launch-readiness blocker in an AI-built app.",
-    `Severity: ${input.severity}.`,
-    `Finding: ${input.title}.`,
-    `What failed: ${input.whatFailed}`,
-    `Why it blocks launch: ${input.whyItBlocksLaunch}`,
-    where,
-    `Fix exactly this: ${input.fixInstructions}`,
-    `Verification required: ${input.verificationStep}`,
-    "Make the smallest production-safe change, preserve existing behavior, list files changed, and do not suppress the scanner unless you prove a false positive."
-  ].join(" ");
-}
-function normalizeLaunchFinding(finding2, source = "manual") {
+function normalizeLaunchFinding(finding2, source = "manual", promptBuilder) {
   const severity = canonicalSeverity(finding2.severity);
   const title = clampText2(
     finding2.title ?? finding2.itemTitle,
@@ -4182,7 +4172,7 @@ function normalizeLaunchFinding(finding2, source = "manual") {
   const location = locationLine(finding2);
   const aiBuilderPrompt = clampText2(
     finding2.aiBuilderPrompt,
-    defaultPrompt({
+    promptBuilder ? promptBuilder({
       severity,
       title,
       whatFailed,
@@ -4190,7 +4180,7 @@ function normalizeLaunchFinding(finding2, source = "manual") {
       fixInstructions,
       verificationStep,
       location
-    }),
+    }) : "",
     4e3
   );
   const evidence2 = clampText2(
@@ -4224,8 +4214,8 @@ function normalizeLaunchFinding(finding2, source = "manual") {
     ...finding2.itemTitle ? { itemTitle: finding2.itemTitle } : {}
   };
 }
-function prioritizeLaunchFindings(findings, source = "manual") {
-  return findings.map((finding2) => normalizeLaunchFinding(finding2, source)).sort((a, b) => {
+function prioritizeLaunchFindings(findings, source = "manual", promptBuilder) {
+  return findings.map((finding2) => normalizeLaunchFinding(finding2, source, promptBuilder)).sort((a, b) => {
     const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
     if (bySeverity !== 0) return bySeverity;
     return a.title.localeCompare(b.title);
@@ -4286,9 +4276,13 @@ function aggregateConfidence(source, findings) {
   if (source === "url") return "medium";
   return "high";
 }
-function assessLaunchReadiness(input) {
+function assessLaunchReadiness(input, promptBuilder) {
   const source = input.source ?? "manual";
-  const findings = prioritizeLaunchFindings(input.findings ?? [], source);
+  const findings = prioritizeLaunchFindings(
+    input.findings ?? [],
+    source,
+    promptBuilder
+  );
   const counts = input.counts ? normalizeLaunchCounts(input.counts) : countLaunchFindings(findings);
   const { score, rawScore, weightedPenalty, coveragePenalty } = scoreFromCounts(
     counts,
@@ -4320,7 +4314,11 @@ function assessLaunchReadiness(input) {
     coverageSummary: coverageSummary(source, coverage),
     checkedAreas,
     uncheckedAreas,
-    topNextStep: topNextStep(blockers.length ? blockers : findings, counts, source),
+    topNextStep: topNextStep(
+      blockers.length ? blockers : findings,
+      counts,
+      source
+    ),
     reportRecommended,
     confidence: aggregateConfidence(source, findings),
     blockers,
@@ -4328,6 +4326,26 @@ function assessLaunchReadiness(input) {
   };
 }
 
+// ../../lib/launch-readiness/src/server-prompts.ts
+var defaultPrompt = (input) => {
+  const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
+  return [
+    "You are fixing a shippingszn launch-readiness blocker in an AI-built app.",
+    `Severity: ${input.severity}.`,
+    `Finding: ${input.title}.`,
+    `What failed: ${input.whatFailed}`,
+    `Why it blocks launch: ${input.whyItBlocksLaunch}`,
+    where,
+    `Fix exactly this: ${input.fixInstructions}`,
+    `Verification required: ${input.verificationStep}`,
+    "Make the smallest production-safe change, preserve existing behavior, list files changed, and do not suppress the scanner unless you prove a false positive."
+  ].join(" ");
+};
+
+// ../../lib/launch-readiness/src/server.ts
+var normalizeLaunchFinding2 = (finding2, source, promptBuilder) => normalizeLaunchFinding(finding2, source, promptBuilder ?? defaultPrompt);
+var assessLaunchReadiness2 = (input, promptBuilder) => assessLaunchReadiness(input, promptBuilder ?? defaultPrompt);
+
 // src/index.ts
 var UNTRACKED_DOWNGRADE = {
   critical: "lower",
@@ -4364,7 +4382,6 @@ function parseArgs(argv2) {
     help: false,
     version: false,
     noColor: !!process2.env.NO_COLOR,
-    publish: !publishDisabledByEnv(),
     proof: shouldUploadProof()
   };
   for (let i = 0; i < argv2.length; i++) {
@@ -4372,31 +4389,16 @@ function parseArgs(argv2) {
     if (a === "--help" || a === "-h") opts.help = true;
     else if (a === "--version" || a === "-v") opts.version = true;
     else if (a === "--json") opts.json = true;
-    else if (a === "--publish") opts.publish = true;
-    else if (a === "--no-publish") opts.publish = false;
     else if (a === "--proof") opts.proof = true;
     else if (a === "--no-color") opts.noColor = true;
+    else if (a === "--no-publish" || a === "--publish")
+      opts.unsupportedWallFlag = a;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
     else if (a === "--cwd") opts.cwd = path19.resolve(argv2[++i] ?? opts.cwd);
     else if (!a.startsWith("-")) opts.cwd = path19.resolve(a);
   }
   return opts;
 }
-function envTruthy(value) {
-  if (!value) return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized === "1" || normalized === "true" || normalized === "yes";
-}
-function envFalsey(value) {
-  if (!value) return false;
-  const normalized = value.trim().toLowerCase();
-  return normalized === "0" || normalized === "false" || normalized === "no";
-}
-function publishDisabledByEnv() {
-  if (envTruthy(process2.env.SHIPPINGSZN_DISABLE_PUBLISH)) return true;
-  if (envFalsey(process2.env.SHIPPINGSZN_PUBLISH)) return true;
-  return false;
-}
 function color(enabled) {
   const wrap = (codes) => (s) => enabled ? `\x1B[${codes}m${s}\x1B[0m` : s;
   return {
@@ -4420,13 +4422,13 @@ Read-only scanner that checks the current project against a small set of
 high-signal launch-readiness items from shippingszn.
 
 Usage:
-  npx shippingszn [path] [options]
+  npx shippingszn@latest [path] [options]
 
 Options:
   --json                Output a machine-readable JSON summary.
-  --publish             Legacy alias. Anonymous Wall stats publish by default.
-  --no-publish          Disable the anonymous Wall post for this run.
-  --base-url <url>      Base URL used to build links back to the Launch Fix Kit.
+  --proof               Upload full scan evidence and return a scan-specific
+                        Launch Fix Kit URL.
+  --base-url <url>      Base URL used to build checkout and Fix Kit links.
                         (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable summary.
@@ -4437,7 +4439,9 @@ This is the FREE preflight. It tells you launch debt exists. It does NOT tell
 you what's broken or how to fix it \u2014 that's gated behind the $49 Launch Fix Kit
 (unlocks full findings + 46-item workbook + paste-ready AI-builder prompts +
 verification steps + red-flag checks). Read-only on disk. Anonymous aggregate
-counts post to the Wall by default. Exit code non-zero if any critical findings.
+counts (score, severity counts, file count, scanner version \u2014 no project name,
+no paths, no findings) are sent on every normal run; there is no publish opt-in
+or opt-out flag. Exit code non-zero if any critical findings.
 `
   );
 }
@@ -4455,6 +4459,13 @@ async function run() {
 `);
     return 0;
   }
+  if (opts.unsupportedWallFlag) {
+    process2.stderr.write(
+      `${opts.unsupportedWallFlag} is not supported. shippingszn sends anonymous score and severity counts on normal runs; it never uploads code, file paths, findings, project names, repo URLs, secrets, emails, or handles.
+`
+    );
+    return 2;
+  }
   const c = color(!opts.noColor && process2.stdout.isTTY === true && !opts.json);
   const files = await listFiles(opts.cwd);
   const tracked = getTrackedFiles(opts.cwd);
@@ -4478,14 +4489,14 @@ async function run() {
   const fixKitUrl = `${trimmedBaseUrl}/fix-kit`;
   const reportUrl = fixKitUrl;
   const proofCreatePath = `${trimmedBaseUrl}/scan`;
-  const proofUploadHint = "Run `npx shippingszn --proof` if you want to publish a proof URL with this scan.";
+  const proofUploadHint = "Run `npx shippingszn@latest --proof` to generate a scan-specific Launch Fix Kit URL.";
   const tracked_aware = applyTrackingAwareSeverity(all, tracked);
   const source = scanSource();
   const enriched = tracked_aware.map((f) => {
     const item = CHECKLIST_ITEMS[f.itemId];
     const itemTitle = item?.title ?? f.itemId;
     const permalink = permalinkFor(f.itemId, opts.baseUrl);
-    const normalized = normalizeLaunchFinding(
+    const normalized = normalizeLaunchFinding2(
       {
         severity: f.severity,
         title: itemTitle,
@@ -4550,7 +4561,7 @@ async function run() {
     lower: 0
   };
   for (const f of enriched) totals[f.severity]++;
-  const assessment = assessLaunchReadiness({
+  const assessment = assessLaunchReadiness2({
     source,
     findings: enriched,
     counts: totals
@@ -4607,7 +4618,7 @@ async function run() {
   let publishResult = "skipped";
   try {
     const proofAlreadyPublishedWall = proofResult.status === "uploaded" && !!proofResult.wallUrl;
-    if (opts.publish && !proofAlreadyPublishedWall) {
+    if (!proofAlreadyPublishedWall) {
       publishResult = await publishScan(totals, files.length, {
         cwd: opts.cwd,
         baseUrl: opts.baseUrl,
@@ -4627,19 +4638,31 @@ async function run() {
   const ownerVerifyAreas = CHECKLIST.filter(
     (item) => item.cliCoverage === "manual_only"
   ).length;
-  const band = totals.critical > 0 ? "no_go" : totals.high > 0 ? "fix_first" : launchReadiness.score >= 90 ? "launchable" : launchReadiness.score >= 70 ? "verify_before_launch" : "fix_first";
-  const bandLabel = {
-    no_go: "NO-GO",
+  const SCORE_BAND_LABEL = {
+    blocked: "NO-GO",
     fix_first: "FIX FIRST",
-    verify_before_launch: "VERIFY BEFORE LAUNCH",
+    verify_first: "VERIFY BEFORE LAUNCH",
     launchable: "LAUNCHABLE"
-  }[band];
+  };
+  const CLI_BAND_ID = {
+    blocked: "no_go",
+    fix_first: "fix_first",
+    verify_first: "verify_before_launch",
+    launchable: "launchable"
+  };
+  const canonicalBand = SCORE_BANDS.find(
+    (b) => launchReadiness.score >= b.minScore && launchReadiness.score <= b.maxScore
+  ) ?? SCORE_BANDS[0];
+  const band = CLI_BAND_ID[canonicalBand.id];
+  const bandLabel = SCORE_BAND_LABEL[canonicalBand.id];
   const wallPublishedViaProof = proofResult.status === "uploaded" && !!proofResult.wallUrl;
   const wallStatus = wallPublishedViaProof ? "published" : proofResult.status === "uploaded" && proofResult.wallPublishError ? "failed" : publishResult;
   const wallUrl = wallPublishedViaProof ? proofResult.wallUrl : publishResult === "published" ? `${trimmedBaseUrl}/wall` : void 0;
   const wallError = proofResult.wallPublishError;
+  const scanSpecificUnlockUrl = proofResult.status === "uploaded" && proofResult.reportUrl ? proofResult.reportUrl : void 0;
+  const unlockUrl = scanSpecificUnlockUrl ?? fixKitUrl;
   if (opts.json) {
-    const panicSummary = {
+    const scoreSummary = {
       score: launchReadiness.score,
       band,
       counts: { ...totals },
@@ -4651,7 +4674,7 @@ async function run() {
       },
       scannerVersion: PKG_VERSION,
       detailsLocked: true,
-      unlockUrl: fixKitUrl,
+      unlockUrl,
       wall: {
         status: wallStatus,
         ...wallUrl ? { url: wallUrl } : {},
@@ -4661,12 +4684,13 @@ async function run() {
         status: proofResult.status,
         ...proofResult.status === "uploaded" ? {
           url: proofResult.proofUrl,
-          resultId: proofResult.id
+          resultId: proofResult.id,
+          reportUrl: proofResult.reportUrl
         } : {},
         ...proofResult.status === "failed" && proofResult.error ? { error: proofResult.error } : {}
       }
     };
-    process2.stdout.write(JSON.stringify(panicSummary, null, 2) + "\n");
+    process2.stdout.write(JSON.stringify(scoreSummary, null, 2) + "\n");
     return totals.critical > 0 ? 1 : 0;
   }
   const bandColor = band === "no_go" ? c.red : band === "fix_first" ? c.yellow : band === "verify_before_launch" ? c.blue : c.green;
@@ -4708,26 +4732,51 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `)
   );
   if (totals.critical + totals.high + totals.medium + totals.lower > 0) {
-    process2.stdout.write(
-      c.bold(
-        "Unlock the Launch Fix Kit to see exactly what's broken and how to fix it:\n"
-      )
-    );
-    process2.stdout.write(`  ${c.cyan(fixKitUrl)}
-
+    if (scanSpecificUnlockUrl) {
+      process2.stdout.write(c.bold("Unlock this exact scan:\n"));
+      process2.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
+`);
+      process2.stdout.write(
+        c.dim(
+          "  Full findings, file evidence, and AI-builder prompts stay locked until purchase.\n\n"
+        )
+      );
+    } else {
+      process2.stdout.write(c.bold("Full findings are locked:\n"));
+      process2.stdout.write(`  ${c.cyan(fixKitUrl)}
 `);
+      process2.stdout.write(
+        c.dim(
+          "  For a scan-specific Fix Kit link, rerun: npx shippingszn@latest --proof\n\n"
+        )
+      );
+    }
   } else {
-    process2.stdout.write(
-      c.green(
-        "No findings detected. The Launch Fix Kit covers the 27 owner-verify areas the scanner can't reach:\n"
-      )
-    );
-    process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+    if (scanSpecificUnlockUrl) {
+      process2.stdout.write(
+        c.green("No automated findings detected for this scan.\n")
+      );
+      process2.stdout.write(c.bold("Unlock the owner-verification Fix Kit:\n"));
+      process2.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
 
 `);
+    } else {
+      process2.stdout.write(
+        c.green(
+          "No automated findings detected. The Launch Fix Kit covers the 27 owner-verify areas the scanner can't reach:\n"
+        )
+      );
+      process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+`);
+      process2.stdout.write(
+        c.dim(
+          "  For a scan-specific Fix Kit link, rerun: npx shippingszn@latest --proof\n\n"
+        )
+      );
+    }
   }
   if (proofResult.status === "uploaded" && proofResult.proofUrl) {
-    process2.stdout.write(c.dim(`Proof URL: ${proofResult.proofUrl}
+    process2.stdout.write(c.dim(`Share score proof: ${proofResult.proofUrl}
 `));
   } else if (proofResult.status === "failed") {
     process2.stdout.write(
@@ -4737,8 +4786,7 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
   }
   if (publishResult === "published") {
     process2.stdout.write(
-      c.dim(`(Anonymous score posted to ${trimmedBaseUrl}/wall)
-`)
+      c.dim("(Anonymous aggregate score sent to shippingszn.)\n")
     );
   }
   if (totals.critical > 0) {

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "shippingszn",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",
   "bin": {
-    "shippingszn": "./dist/index.js"
+    "shippingszn": "dist/index.js"
   },
   "files": [
     "dist",
@@ -30,7 +30,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/keeptahoeblueish/shippingszn-cli.git"
+    "url": "git+https://github.com/keeptahoeblueish/shippingszn-cli.git"
   },
   "engines": {
     "node": ">=18"