shippingszn 0.9.3 → 0.9.5

package/README.md

@@ -12,13 +12,15 @@ pnpm dlx shippingszn@latest
 ```
 
 The CLI **never writes, modifies, or deletes** any files - it only reads.
-Normal runs send one anonymous report-card summary with score, severity counts,
-files scanned, scanner version, and safe stack tags. It never uploads source
-code, paths, filenames, repo URLs, project names, secrets, handles, emails, or
-finding-level details. This Wall signal is automatic and not user-configurable.
-
-Human output starts with a Launch Readiness Score, scope covered, and severity
-counts. Run with `--json` to get the same score-and-counts summary in a
+Normal runs create a locked scan handoff for checkout and send one anonymous
+Wall report-card summary with score, severity counts, files scanned, scanner
+version, and safe stack tags. It never uploads source code, repo URLs, project
+names, secrets, handles, or emails. Finding-level detail stays out of public
+CLI/Wall output and opens inside the paid Launch Fix Kit.
+
+Human output starts with a Launch Debt Score, severity counts, a short
+plain-English launch-risk explanation, completed checks, and the locked Fix Kit
+handoff. Run with `--json` to get the same score-and-counts summary in a
 machine-readable shape:
 
 ```json
@@ -27,13 +29,20 @@ machine-readable shape:
   "band": "no_go",
   "counts": { "critical": 1, "high": 3, "medium": 4, "lower": 2 },
   "filesScanned": 128,
+  "coverage": { "checksCompleted": 19, "checklistAreas": 46 },
   "detailsLocked": true,
-  "unlockUrl": "https://shippingszn.com/fix-kit"
+  "unlockUrl": "https://shippingszn.com/fix-kit?scanResultId=00000000-0000-4000-8000-000000000123",
+  "scanHandoff": {
+    "status": "uploaded",
+    "resultId": "00000000-0000-4000-8000-000000000123",
+    "unlockUrl": "https://shippingszn.com/fix-kit?scanResultId=00000000-0000-4000-8000-000000000123"
+  }
 }
 ```
 
 Finding titles, files, evidence, fix prompts, and verification steps are paid.
-They unlock inside the Launch Fix Kit.
+The free CLI explains why the score matters, but the actual fixes unlock inside
+the Launch Fix Kit.
 
 ## Aggregate summary
 
@@ -41,10 +50,10 @@ Plain `npx shippingszn@latest` sends the Wall summary automatically. The stored
 row is anonymous and intentionally small: score, launch label, files scanned,
 finding counts by severity, detected stack tags, scanner version, and timestamp.
 
-For a scan-specific paid-report handoff, run `npx shippingszn@latest --proof`.
-That uploads the canonical scan result, returns a proof URL plus a
-`/fix-kit?scanResultId=...` URL, and gives the paid Launch Fix Kit the evidence
-it needs after checkout.
+The same run also creates a scan-specific paid-report handoff. The terminal
+prints a `/fix-kit?scanResultId=...` URL so checkout can carry that scan into
+the Launch Fix Kit after purchase. `--proof` is still accepted for old docs, but
+it is no longer required.
 
 ## What gets checked
 
@@ -123,8 +132,8 @@ shippingszn [path] [options]
 
 Options:
   --json                Output a machine-readable JSON summary.
-  --proof               Upload full scan evidence and return a scan-specific
-                        Launch Fix Kit URL.
+  --proof               Backward-compatible alias. Normal runs already return
+                        a scan-specific Launch Fix Kit URL.
   --base-url <url>      Base URL used to build checkout and Fix Kit links.
   --cwd <path>          Directory to scan. Default: current working directory.
   --no-color            Disable ANSI colors in the human-readable summary.
@@ -151,12 +160,12 @@ summary as a comment: score, severity counts, and unlock URL.
 ## Privacy
 
 `shippingszn` reads files on your machine. It never uploads source code. By
-default it makes one best-effort outbound request to post an anonymous aggregate
-summary: score, launch label, files scanned count, finding counts by severity,
-detected stack tags, scanner version, and timestamp. It never uploads source
-code, file paths, filenames, project names, repo URLs, secrets, emails, handles,
-finding titles, evidence, or report contents. The aggregate summary is automatic
-and not user-configurable.
+default it creates a locked scan handoff for checkout and makes one best-effort
+outbound request to post anonymous Wall stats: score, launch label, files
+scanned count, finding counts by severity, detected stack tags, scanner version,
+and timestamp. Wall stats never include source code, file paths, filenames,
+project names, repo URLs, secrets, emails, handles, finding titles, evidence, or
+report contents. The Wall summary is automatic and not user-configurable.
 
 ## License
 

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import * as path19 from "node:path";
-import * as process2 from "node:process";
+import * as path18 from "node:path";
+import * as process from "node:process";
 import { createRequire } from "node:module";
 
 // src/checks/secrets.ts
@@ -3685,13 +3685,8 @@ async function publishScan(totals, filesScanned, opts) {
 }
 
 // src/proof.ts
-import * as path18 from "node:path";
 var PROOF_TIMEOUT_MS = 5e3;
 var MAX_FINDINGS = 100;
-function shouldUploadProof() {
-  const v = process.env["SHIPPINGSZN_PROOF"] ?? "";
-  return v === "1" || v.toLowerCase() === "true" || v === "yes";
-}
 function clampText(value, max, fallback = "") {
   const text = value ?? fallback;
   return text.length > max ? text.slice(0, max - 3) + "..." : text;
@@ -3705,8 +3700,8 @@ function buildBadgeMarkdown(baseUrl, id, score) {
     scanResultId: id,
     theme: "dark"
   });
-  const proofUrl = `${baseUrl}/proof/${encodeURIComponent(id)}`;
-  return `[![shippingszn scan proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
+  const fixKitUrl = `${baseUrl}/fix-kit?${new URLSearchParams({ scanResultId: id }).toString()}`;
+  return `[![shippingszn scan score: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${fixKitUrl})`;
 }
 function buildProofPayload(report, scannerVersion) {
   const counts = {
@@ -3719,7 +3714,7 @@ function buildProofPayload(report, scannerVersion) {
     version: 1,
     source: report.source ?? "cli",
     scanner: "shippingszn",
-    targetName: path18.basename(report.cwd) || "CLI scan",
+    targetName: "Anonymous CLI scan",
     score: report.launchReadiness.score,
     label: report.launchReadiness.label,
     decision: report.launchReadiness.decision,
@@ -4376,13 +4371,13 @@ var PKG_VERSION = (() => {
 })();
 function parseArgs(argv2) {
   const opts = {
-    cwd: process2.cwd(),
+    cwd: process.cwd(),
     json: false,
-    baseUrl: process2.env.SHIPPINGSZN_BASE_URL ?? process2.env.VIBE_LAUNCH_CHECK_BASE_URL ?? DEFAULT_BASE_URL2,
+    baseUrl: process.env.SHIPPINGSZN_BASE_URL ?? process.env.VIBE_LAUNCH_CHECK_BASE_URL ?? DEFAULT_BASE_URL2,
     help: false,
     version: false,
-    noColor: !!process2.env.NO_COLOR,
-    proof: shouldUploadProof()
+    noColor: !!process.env.NO_COLOR,
+    proof: true
   };
   for (let i = 0; i < argv2.length; i++) {
     const a = argv2[i];
@@ -4394,8 +4389,8 @@ function parseArgs(argv2) {
     else if (a === "--no-publish" || a === "--publish")
       opts.unsupportedWallFlag = a;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
-    else if (a === "--cwd") opts.cwd = path19.resolve(argv2[++i] ?? opts.cwd);
-    else if (!a.startsWith("-")) opts.cwd = path19.resolve(a);
+    else if (a === "--cwd") opts.cwd = path18.resolve(argv2[++i] ?? opts.cwd);
+    else if (!a.startsWith("-")) opts.cwd = path18.resolve(a);
   }
   return opts;
 }
@@ -4414,8 +4409,14 @@ function color(enabled) {
   };
 }
 var SEVERITY_ORDER = ["critical", "high", "medium", "lower"];
+function pluralize(count, singular, plural = `${singular}s`) {
+  return count === 1 ? singular : plural;
+}
+function findingVerb(count) {
+  return count === 1 ? "is" : "are";
+}
 function printHelp() {
-  process2.stdout.write(
+  process.stdout.write(
     `shippingszn v${PKG_VERSION}
 
 Read-only scanner that checks the current project against a small set of
@@ -4426,8 +4427,8 @@ Usage:
 
 Options:
   --json                Output a machine-readable JSON summary.
-  --proof               Upload full scan evidence and return a scan-specific
-                        Launch Fix Kit URL.
+  --proof               Backward-compatible alias. Normal runs already return
+                        a scan-specific Launch Fix Kit URL.
   --base-url <url>      Base URL used to build checkout and Fix Kit links.
                         (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
@@ -4438,35 +4439,36 @@ Options:
 This is the FREE preflight. It tells you launch debt exists. It does NOT tell
 you what's broken or how to fix it \u2014 that's gated behind the $49 Launch Fix Kit
 (unlocks full findings + 46-item workbook + paste-ready AI-builder prompts +
-verification steps + red-flag checks). Read-only on disk. Anonymous Wall stats
-(score, severity counts, file count, scanner version \u2014 no project name, no
-paths, no finding-level detail) are sent on every normal run; there is no
-publish opt-in or opt-out flag. Exit code non-zero if any critical findings.
+verification steps + red-flag checks). Read-only on disk. Normal runs create a
+locked scan handoff for checkout and send anonymous Wall stats (score, severity
+counts, file count, scanner version \u2014 no project name, no paths, no
+finding-level detail); there is no Wall publish opt-in or opt-out flag. Exit
+code non-zero if any critical findings.
 `
   );
 }
 function scanSource() {
-  return process2.env.GITHUB_ACTIONS === "true" ? "github" : "cli";
+  return process.env.GITHUB_ACTIONS === "true" ? "github" : "cli";
 }
 async function run() {
-  const opts = parseArgs(process2.argv.slice(2));
+  const opts = parseArgs(process.argv.slice(2));
   if (opts.help) {
     printHelp();
     return 0;
   }
   if (opts.version) {
-    process2.stdout.write(`${PKG_VERSION}
+    process.stdout.write(`${PKG_VERSION}
 `);
     return 0;
   }
   if (opts.unsupportedWallFlag) {
-    process2.stderr.write(
+    process.stderr.write(
       `${opts.unsupportedWallFlag} is not supported. shippingszn sends anonymous Wall stats on normal runs: score, severity counts, file count, scanner version, and safe stack tags. It never uploads code, file paths, finding-level details, project names, repo URLs, secrets, emails, or handles.
 `
     );
     return 2;
   }
-  const c = color(!opts.noColor && process2.stdout.isTTY === true && !opts.json);
+  const c = color(!opts.noColor && process.stdout.isTTY === true && !opts.json);
   const files = await listFiles(opts.cwd);
   const tracked = getTrackedFiles(opts.cwd);
   const ctx = { rootDir: opts.cwd, files };
@@ -4489,7 +4491,7 @@ async function run() {
   const fixKitUrl = `${trimmedBaseUrl}/fix-kit`;
   const reportUrl = fixKitUrl;
   const proofCreatePath = `${trimmedBaseUrl}/scan`;
-  const proofUploadHint = "Run `npx shippingszn@latest --proof` to generate a scan-specific Launch Fix Kit URL.";
+  const proofUploadHint = "Normal runs automatically generate a scan-specific Launch Fix Kit URL.";
   const tracked_aware = applyTrackingAwareSeverity(all, tracked);
   const source = scanSource();
   const enriched = tracked_aware.map((f) => {
@@ -4635,9 +4637,6 @@ async function run() {
   const automatedAreas = CHECKLIST.filter(
     (item) => item.cliCoverage === "automated"
   ).length;
-  const ownerVerifyAreas = CHECKLIST.filter(
-    (item) => item.cliCoverage === "manual_only"
-  ).length;
   const SCORE_BAND_LABEL = {
     blocked: "NO-GO",
     fix_first: "FIX FIRST",
@@ -4668,9 +4667,8 @@ async function run() {
       counts: { ...totals },
       filesScanned: files.length,
       coverage: {
-        automatedAreas,
-        ownerVerifyAreas,
-        totalAreas: CHECKLIST.length
+        checksCompleted: automatedAreas,
+        checklistAreas: CHECKLIST.length
       },
       scannerVersion: PKG_VERSION,
       detailsLocked: true,
@@ -4680,112 +4678,153 @@ async function run() {
         ...wallUrl ? { url: wallUrl } : {},
         ...wallError ? { error: wallError } : {}
       },
-      proof: {
+      scanHandoff: {
         status: proofResult.status,
         ...proofResult.status === "uploaded" ? {
-          url: proofResult.proofUrl,
           resultId: proofResult.id,
-          reportUrl: proofResult.reportUrl
+          unlockUrl: proofResult.reportUrl
         } : {},
         ...proofResult.status === "failed" && proofResult.error ? { error: proofResult.error } : {}
       }
     };
-    process2.stdout.write(JSON.stringify(scoreSummary, null, 2) + "\n");
+    process.stdout.write(JSON.stringify(scoreSummary, null, 2) + "\n");
     return totals.critical > 0 ? 1 : 0;
   }
   const bandColor = band === "no_go" ? c.red : band === "fix_first" ? c.yellow : band === "verify_before_launch" ? c.blue : c.green;
-  process2.stdout.write(
+  process.stdout.write(
     `
 ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
   );
-  process2.stdout.write(c.dim(`Scanned ${files.length} files.
+  process.stdout.write(c.dim(`Scanned ${files.length} files.
 
 `));
-  process2.stdout.write(
+  process.stdout.write(
     `${c.bold("Launch Debt Score:")} ${launchReadiness.score}/100  \u2014  ${bandColor(c.bold(bandLabel))}
 
 `
   );
-  process2.stdout.write(`${c.bold("Findings detected:")}
+  process.stdout.write(`${c.bold("Findings detected:")}
 `);
-  process2.stdout.write(`  ${c.red(`${totals.critical} critical`)}
+  process.stdout.write(`  ${c.red(`${totals.critical} critical`)}
 `);
-  process2.stdout.write(`  ${c.yellow(`${totals.high} high`)}
+  process.stdout.write(`  ${c.yellow(`${totals.high} high`)}
 `);
-  process2.stdout.write(`  ${c.blue(`${totals.medium} medium`)}
+  process.stdout.write(`  ${c.blue(`${totals.medium} medium`)}
 `);
-  process2.stdout.write(`  ${c.gray(`${totals.lower} lower`)}
+  process.stdout.write(`  ${c.gray(`${totals.lower} lower`)}
 
 `);
-  process2.stdout.write(`${c.bold("Coverage:")}
+  const totalFindings = totals.critical + totals.high + totals.medium + totals.lower;
+  if (totalFindings > 0) {
+    if (totals.critical > 0) {
+      process.stdout.write(c.red("Critical launch blocker found.\n"));
+      process.stdout.write(
+        `This scan found ${totalFindings} ${pluralize(totalFindings, "issue")} that should be fixed before launch.
+
+`
+      );
+      process.stdout.write(`${c.bold("What that means:")}
 `);
-  process2.stdout.write(
-    c.dim(
-      `  ${automatedAreas} of ${CHECKLIST.length} launch-readiness areas checked by the scanner
+      process.stdout.write(
+        c.dim(
+          "Critical launch debt can expose users, break signup or payment paths, or make the launch unsafe until fixed.\n\n"
+        )
+      );
+    } else {
+      process.stdout.write("No critical blockers found.\n");
+      if (totals.high === 0) {
+        process.stdout.write("No high blockers found.\n");
+      }
+      process.stdout.write(
+        `But ${totalFindings} ${pluralize(totalFindings, "issue")} ${findingVerb(totalFindings)} still holding this back from a clean launch.
+
 `
-    )
-  );
-  process2.stdout.write(
-    c.dim(`  ${ownerVerifyAreas} require owner verification
+      );
+      process.stdout.write(`${c.bold("What that means:")}
+`);
+      if (totals.high > 0) {
+        process.stdout.write(
+          c.dim(
+            "High and medium launch debt can expose trust gaps, break conversion moments, or make the project feel unfinished.\n\n"
+          )
+        );
+      } else if (totals.medium > 0) {
+        process.stdout.write(
+          c.dim(
+            "Medium launch debt usually will not crash the app, but it can make users hesitate, miss conversion moments, or make the project feel unfinished.\n\n"
+          )
+        );
+      } else {
+        process.stdout.write(
+          c.dim(
+            "Lower launch debt usually is not launch-blocking, but it can still make the project feel rough or unfinished.\n\n"
+          )
+        );
+      }
+    }
+  }
+  process.stdout.write(`${c.bold("Coverage:")}
+`);
+  process.stdout.write(
+    c.dim(`  ${automatedAreas} launch-readiness checks completed
 
 `)
   );
-  if (totals.critical + totals.high + totals.medium + totals.lower > 0) {
+  if (totalFindings > 0) {
     if (scanSpecificUnlockUrl) {
-      process2.stdout.write(c.bold("Unlock this exact scan:\n"));
-      process2.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
+      process.stdout.write(c.bold("Unlock this exact scan:\n"));
+      process.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
 `);
-      process2.stdout.write(
+      process.stdout.write(
         c.dim(
-          "  Full findings, file evidence, and AI-builder prompts stay locked until purchase.\n\n"
+          `  Includes the ${totalFindings} specific ${pluralize(totalFindings, "finding")}, file evidence, and AI-builder fix prompts.
+
+`
         )
       );
     } else {
-      process2.stdout.write(c.bold("Full findings are locked:\n"));
-      process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+      process.stdout.write(c.bold("Full findings are locked:\n"));
+      process.stdout.write(`  ${c.cyan(fixKitUrl)}
 `);
-      process2.stdout.write(
+      process.stdout.write(
         c.dim(
-          "  For a scan-specific Fix Kit link, rerun: npx shippingszn@latest --proof\n\n"
+          "  This run could not attach scan evidence. The full report stays locked until purchase.\n\n"
         )
       );
     }
   } else {
     if (scanSpecificUnlockUrl) {
-      process2.stdout.write(
+      process.stdout.write(
         c.green("No automated findings detected for this scan.\n")
       );
-      process2.stdout.write(c.bold("Unlock the owner-verification Fix Kit:\n"));
-      process2.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
+      process.stdout.write(c.bold("Unlock this exact scan:\n"));
+      process.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
 
 `);
     } else {
-      process2.stdout.write(
+      process.stdout.write(
         c.green(
-          "No automated findings detected. The Launch Fix Kit covers the 27 owner-verify areas the scanner can't reach:\n"
+          "No automated findings detected. Unlock the Launch Fix Kit for the full checklist and written launch report:\n"
         )
       );
-      process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+      process.stdout.write(`  ${c.cyan(fixKitUrl)}
 `);
-      process2.stdout.write(
+      process.stdout.write(
         c.dim(
-          "  For a scan-specific Fix Kit link, rerun: npx shippingszn@latest --proof\n\n"
+          "  This run could not attach scan evidence. The full report stays locked until purchase.\n\n"
         )
       );
     }
   }
-  if (proofResult.status === "uploaded" && proofResult.proofUrl) {
-    process2.stdout.write(c.dim(`Share score proof: ${proofResult.proofUrl}
-`));
-  } else if (proofResult.status === "failed") {
-    process2.stdout.write(
-      c.dim(`(Proof upload failed: ${proofResult.error ?? "unknown"})
+  if (proofResult.status === "failed") {
+    process.stdout.write(
+      c.dim(`(Scan handoff failed: ${proofResult.error ?? "unknown"})
 `)
     );
   }
   if (publishResult === "published") {
-    process2.stdout.write(
+    process.stdout.write(
       c.dim("(Anonymous Wall stats sent: score + severity counts.)\n")
     );
   }
@@ -4795,12 +4834,12 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
   return 0;
 }
 run().then(
-  (code) => process2.exit(code),
+  (code) => process.exit(code),
   (err) => {
-    process2.stderr.write(
+    process.stderr.write(
       `shippingszn failed: ${err instanceof Error ? err.message : String(err)}
 `
     );
-    process2.exit(2);
+    process.exit(2);
   }
 );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",