shippingszn 0.9.4 → 0.9.6

package/README.md

@@ -1,7 +1,7 @@
 # shippingszn
 
 Primary local scanner for shippingszn launch readiness. Run it inside the app
-you are about to ship to catch the launch blockers AI builders commonly miss:
+you are about to ship to catch the launch debt AI builders commonly miss:
 leaked API keys, missing crawl assets, weak browser defenses, dangerous code
 patterns, and last-mile polish gaps.
 
@@ -18,8 +18,9 @@ version, and safe stack tags. It never uploads source code, repo URLs, project
 names, secrets, handles, or emails. Finding-level detail stays out of public
 CLI/Wall output and opens inside the paid Launch Fix Kit.
 
-Human output starts with a Launch Debt Score, completed checks, and severity
-counts. Run with `--json` to get the same score-and-counts summary in a
+Human output starts with a Launch Debt Score, severity counts, a short
+plain-English launch-risk explanation, completed checks, and the locked Fix Kit
+handoff. Run with `--json` to get the same score-and-counts summary in a
 machine-readable shape:
 
 ```json
@@ -40,7 +41,8 @@ machine-readable shape:
 ```
 
 Finding titles, files, evidence, fix prompts, and verification steps are paid.
-They unlock inside the Launch Fix Kit.
+The free CLI explains why the score matters, but the actual fixes unlock inside
+the Launch Fix Kit.
 
 ## Aggregate summary
 

package/dist/index.js

@@ -3854,9 +3854,9 @@ var SCORE_BANDS = [
     id: "blocked",
     minScore: 0,
     maxScore: 59,
-    label: "No-go: launch blocked",
+    label: "Fix now",
     decision: "no-go",
-    goNoGoLabel: "No-go"
+    goNoGoLabel: "Fix now"
   },
   {
     id: "fix_first",
@@ -4121,7 +4121,7 @@ function coverageSummary(source, coverage) {
 }
 function defaultWhy(severity, source) {
   if (severity === "critical") {
-    return `This is treated as launch-blocking evidence from the ${sourceLabel(source)} because it can expose users, secrets, revenue, or the primary launch surface.`;
+    return `This is treated as critical launch debt from the ${sourceLabel(source)} because it can expose users, secrets, revenue, or the primary launch surface.`;
   }
   if (severity === "high") {
     return `This can turn a launch into a trust, security, cost, or conversion problem even if the app appears to work.`;
@@ -4240,18 +4240,18 @@ function bandFor(score, counts) {
 }
 function decisionText(band, counts, source) {
   if (counts.critical > 0) {
-    return `Do not launch yet. ${counts.critical} critical blocker${counts.critical === 1 ? "" : "s"} must be fixed and rescanned before public traffic.`;
+    return `Fix now. ${counts.critical} critical finding${counts.critical === 1 ? "" : "s"} should be fixed and rescanned before more public traffic.`;
   }
   if (counts.high > 0) {
     return `Fix the high-risk launch gaps before a real campaign, customer demo, or paid traffic.`;
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return `No critical or high blocker was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as launchable.`;
+    return `No critical or high finding was detected, but the remaining readiness gaps should be fixed and verified before treating the ${sourceLabel(source)} as day-1 ready.`;
   }
   if (source === "url") {
-    return "No public-page blockers were found. Run the CLI or GitHub Action before calling the app launch-ready.";
+    return "No public-page critical findings were found. Run the CLI or GitHub Action before calling the app day-1 ready.";
   }
-  return `${band.goNoGoLabel}: no scan-detected blockers were found. Monitor first production traffic.`;
+  return `${band.goNoGoLabel}: no scan-detected critical findings were found. Monitor first production traffic.`;
 }
 function topNextStep(blockers, counts, source) {
   const top = blockers[0];
@@ -4262,9 +4262,9 @@ function topNextStep(blockers, counts, source) {
     return "Run the repo scan next so secrets, auth, API routes, and generated-code risks are checked before launch.";
   }
   if (counts.medium > 0 || counts.lower > 0) {
-    return "Fix the remaining readiness gaps and rescan before launch.";
+    return "Fix the remaining readiness gaps and rescan before the next launch push.";
   }
-  return "No obvious launch blockers caught. Monitor first production traffic and keep the paid report for higher-stakes launches.";
+  return "No obvious critical launch debt caught. Monitor first production traffic and keep the paid report for higher-stakes launches.";
 }
 function aggregateConfidence(source, findings) {
   if (findings.some((finding2) => finding2.confidence === "low")) return "low";
@@ -4325,11 +4325,11 @@ function assessLaunchReadiness(input, promptBuilder) {
 var defaultPrompt = (input) => {
   const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
   return [
-    "You are fixing a shippingszn launch-readiness blocker in an AI-built app.",
+    "You are fixing a shippingszn launch-readiness finding in an AI-built app.",
     `Severity: ${input.severity}.`,
     `Finding: ${input.title}.`,
     `What failed: ${input.whatFailed}`,
-    `Why it blocks launch: ${input.whyItBlocksLaunch}`,
+    `Why it matters now: ${input.whyItBlocksLaunch}`,
     where,
     `Fix exactly this: ${input.fixInstructions}`,
     `Verification required: ${input.verificationStep}`,
@@ -4409,6 +4409,12 @@ function color(enabled) {
   };
 }
 var SEVERITY_ORDER = ["critical", "high", "medium", "lower"];
+function pluralize(count, singular, plural = `${singular}s`) {
+  return count === 1 ? singular : plural;
+}
+function findingVerb(count) {
+  return count === 1 ? "is" : "are";
+}
 function printHelp() {
   process.stdout.write(
     `shippingszn v${PKG_VERSION}
@@ -4632,7 +4638,7 @@ async function run() {
     (item) => item.cliCoverage === "automated"
   ).length;
   const SCORE_BAND_LABEL = {
-    blocked: "NO-GO",
+    blocked: "FIX NOW",
     fix_first: "FIX FIRST",
     verify_first: "VERIFY BEFORE LAUNCH",
     launchable: "LAUNCHABLE"
@@ -4709,6 +4715,55 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
   process.stdout.write(`  ${c.gray(`${totals.lower} lower`)}
 
 `);
+  const totalFindings = totals.critical + totals.high + totals.medium + totals.lower;
+  if (totalFindings > 0) {
+    if (totals.critical > 0) {
+      process.stdout.write(c.red("Critical launch debt found.\n"));
+      process.stdout.write(
+        `This scan found ${totalFindings} ${pluralize(totalFindings, "issue")} that should be fixed before more public traffic.
+
+`
+      );
+      process.stdout.write(`${c.bold("What that means:")}
+`);
+      process.stdout.write(
+        c.dim(
+          "Critical launch debt can expose users, break signup or payment paths, or make the launch unsafe until fixed.\n\n"
+        )
+      );
+    } else {
+      process.stdout.write("No critical findings found.\n");
+      if (totals.high === 0) {
+        process.stdout.write("No high findings found.\n");
+      }
+      process.stdout.write(
+        `But ${totalFindings} ${pluralize(totalFindings, "issue")} ${findingVerb(totalFindings)} still holding this back from a clean day-1 posture.
+
+`
+      );
+      process.stdout.write(`${c.bold("What that means:")}
+`);
+      if (totals.high > 0) {
+        process.stdout.write(
+          c.dim(
+            "High and medium launch debt can expose trust gaps, break conversion moments, or make the project feel unfinished.\n\n"
+          )
+        );
+      } else if (totals.medium > 0) {
+        process.stdout.write(
+          c.dim(
+            "Medium launch debt usually will not crash the app, but it can make users hesitate, miss conversion moments, or make the project feel unfinished.\n\n"
+          )
+        );
+      } else {
+        process.stdout.write(
+          c.dim(
+            "Lower launch debt usually will not break the app, but it can still make the project feel rough or unfinished.\n\n"
+          )
+        );
+      }
+    }
+  }
   process.stdout.write(`${c.bold("Coverage:")}
 `);
   process.stdout.write(
@@ -4716,14 +4771,16 @@ ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 
 `)
   );
-  if (totals.critical + totals.high + totals.medium + totals.lower > 0) {
+  if (totalFindings > 0) {
     if (scanSpecificUnlockUrl) {
       process.stdout.write(c.bold("Unlock this exact scan:\n"));
       process.stdout.write(`  ${c.cyan(scanSpecificUnlockUrl)}
 `);
       process.stdout.write(
         c.dim(
-          "  Full findings, file evidence, and AI-builder prompts stay locked until purchase.\n\n"
+          `  Includes the ${totalFindings} specific ${pluralize(totalFindings, "finding")}, file evidence, and AI-builder fix prompts.
+
+`
         )
       );
     } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",