v11y-check 0.0.0 → 0.7.0

package/LICENSE

@@ -0,0 +1,7 @@
+ISC License
+
+Copyright (c) 2026 William Thorsen
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
+
+The software is provided "as is" and the author disclaims all warranties with regard to this software including all implied warranties of merchantability and fitness. In no event shall the author be liable for any special, direct, indirect, or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use or performance of this software.

package/README.md

@@ -1 +1,148 @@
-Placeholder for `v11y-check` — awaiting first release.
+# v11y-check
+
+Wraps [audit-ci](https://github.com/IBM/audit-ci) with a richer config model, typed JSON source of truth, and a sync workflow that automates allowlist management.
+
+<!-- section:release-notes -->
+## Release notes — v0.7.0 (2026-05-10)
+
+### 🎉 Features
+
+- Rename audit-deps to v11y-check (#383)
+
+  The package previously published as `@williamthorsen/audit-deps` has been renamed to `v11y-check`. The CLI command is now `v11y-check`, and the default config file is `.config/v11y-check.config.json`. Existing users should install `v11y-check` in place of `@williamthorsen/audit-deps`, rename their config file, and update any scripts that invoke `audit-deps`. Behavior is unchanged.
+<!-- /section:release-notes -->
+
+## Installation
+
+```shell
+pnpm add -D v11y-check
+```
+
+The package is `v11y-check`; the bin is `v11y`. The package also ships `v11y-check` as a bin alias, so `pnpm exec v11y-check` and `npx v11y-check` continue to work.
+
+## Quick start
+
+```shell
+# Run a vulnerability check with sensible defaults (no config needed)
+npx v11y-check check
+
+# Scaffold a starter config and GitHub Actions workflow
+npx v11y-check init
+
+# Sync allowlists with current findings
+npx v11y-check sync
+
+# Raw audit-ci passthrough
+npx v11y-check --raw
+```
+
+No config file is required. When `.config/v11y-check.config.json` is absent, the tool uses built-in defaults: `severityThreshold: 'moderate'` for dev, `severityThreshold: 'low'` for prod, and empty allowlists.
+
+## Configuration
+
+The source-of-truth config lives at `.config/v11y-check.config.json`:
+
+```json
+{
+  "$schema": "https://github.com/williamthorsen/node-monorepo-tools/raw/v11y-check-v<version>/packages/v11y-check/schemas/config.json",
+  "dev": {
+    "severityThreshold": "moderate",
+    "allowlist": [
+      {
+        "addedAt": "2026-04-15T09:30:00.000Z",
+        "id": "GHSA-1234-5678-abcd",
+        "path": "lodash",
+        "reason": "Accepted risk: no user input reaches this path",
+        "url": "https://github.com/advisories/GHSA-1234-5678-abcd"
+      }
+    ]
+  },
+  "prod": {
+    "severityThreshold": "low",
+    "allowlist": []
+  }
+}
+```
+
+### Fields
+
+- **`$schema`** (optional) — JSON Schema URL for editor autocomplete and validation. Automatically included by `init` and `sync`.
+- **`dev`** / **`prod`** — Scope-specific settings:
+  - **`severityThreshold`** (optional) — Fail on advisories at or above this severity. Valid values: `'low'`, `'moderate'`, `'high'`, `'critical'`. When omitted, audit-ci uses its own defaults.
+  - **`allowlist`** — Typed advisory entries with `id`, `path`, `url`, and optional `reason` and `addedAt`. `addedAt` is an ISO 8601 UTC datetime (e.g., `2026-04-15T09:30:00.000Z`) populated automatically by `v11y sync` on new entries; existing entries retain whatever value they had. Older `YYYY-MM-DD` values are still accepted.
+
+## CLI reference
+
+```
+Usage: v11y [options]
+       v11y <command> [options]
+
+Commands:
+  check (default)      Grouped vulnerability check with severity indicators
+  sync                 Synchronize allowlists with current audit findings
+  init                 Scaffold a starter config file and GitHub Actions workflow
+
+Scope options:
+  --dev                Target dev dependencies only
+  --prod               Target production dependencies only
+
+Other options:
+  --config <path>      Path to config file (default: .config/v11y-check.config.json)
+  --json               Output results as JSON
+  --raw                Run raw audit-ci passthrough
+  --verbose, -v        Show detailed per-vulnerability output
+  --help, -h           Show this help message
+  --version, -V        Show version number
+```
+
+### Init options
+
+```
+  --dry-run, -n   Preview changes without writing files
+  --force, -f     Overwrite existing files
+```
+
+### JSON output shape
+
+`--json` emits one object per requested scope plus a top-level `summary` block:
+
+```jsonc
+{
+  "prod": { "allowed": [...], "belowThreshold": [...], "stale": [...], "unallowed": [...] },
+  "dev":  { "allowed": [...], "belowThreshold": [...], "stale": [...], "unallowed": [...] },
+  "summary": { "status": "vulnerabilities-found", "count": 3 }
+}
+```
+
+`summary.status` is the highest-severity finding category present across the requested scopes. Below-threshold findings never affect it.
+
+| `status`                     | When                                              |
+| ---------------------------- | ------------------------------------------------- |
+| `vulnerabilities-found`      | At least one unallowed advisory                   |
+| `suppressed-vulnerabilities` | No unallowed; at least one allowlisted advisory   |
+| `stale-overrides`            | No advisories; at least one stale allowlist entry |
+| `none`                       | No findings                                       |
+
+`summary.count` is the total across the requested scopes for the active category. It is `0` when `status` is `none`.
+
+## Scaffolded GitHub Actions workflow
+
+`v11y init` scaffolds `.github/workflows/audit.yaml` alongside the config file. The workflow is a thin caller that delegates to the versioned reusable workflow published at `williamthorsen/node-monorepo-tools/.github/workflows/audit.reusable.yaml@workflow/audit-v1`, so your repository tracks the reusable workflow at a stable version tag.
+
+The scaffolded workflow triggers on pull requests to `main`/`next`, on a daily schedule, and on manual `workflow_dispatch`. Commit the file into your repository so the caller runs in CI. If the reusable workflow's caller-side requirements change (for example, the tag bumps), re-run `v11y init --force` to refresh the file.
+
+## Migration from v0.3
+
+v0.4 introduces breaking changes to the config schema:
+
+- **`outDir` removed.** Intermediate audit-ci files are now written to a temp directory and cleaned up automatically. Remove `outDir` from your config.
+- **Severity booleans replaced by `severityThreshold`.** Replace `"moderate": true` with `"severityThreshold": "moderate"`, `"high": true` with `"severityThreshold": "high"`, etc. Only one threshold per scope is supported.
+- **`generate` subcommand removed.** The `v11y generate` command no longer exists. Flat audit-ci configs are now managed internally.
+- **Config is optional.** All commands now work without a config file, using built-in defaults.
+
+To migrate an existing config:
+
+1. Remove the `outDir` field.
+2. Replace severity booleans with `severityThreshold` in each scope.
+3. Optionally add a `$schema` field (run `v11y init --force` to regenerate, or add it manually).
+4. Delete any generated `audit-ci.*.json` files that were in your config directory.

package/bin/v11y.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+try {
+  await import('../dist/esm/bin/v11y.js');
+} catch (error) {
+  if (error.code === 'ERR_MODULE_NOT_FOUND') {
+    process.stderr.write('v11y: build output not found — run `pnpm run build` first\n');
+  } else {
+    process.stderr.write(`v11y: failed to load: ${error.message}\n`);
+  }
+  process.exit(1);
+}

package/dist/esm/.cache

@@ -0,0 +1 @@
+cc7eb157b4617c1c38c8507dc4279631b07d91e6b647199879b5724bcaa312d8

package/dist/esm/bin/route.d.ts

@@ -0,0 +1 @@
+export declare function routeCommand(args: string[]): Promise<number>;

package/dist/esm/bin/route.js

@@ -0,0 +1,170 @@
+import process from "node:process";
+import { parseArgs, readPackageVersion, translateParseError } from "@williamthorsen/nmr-core";
+import { auditCommand, checkCommand, extractMessage, syncCommand } from "../cli.js";
+import { initCommand } from "../init/initCommand.js";
+const VERSION = readPackageVersion(import.meta.url);
+const SUBCOMMANDS = ["check", "init", "sync"];
+const MIN_PREFIX_LENGTH = 3;
+function showHelp() {
+  console.info(`
+Usage: v11y [options]
+       v11y <command> [options]
+
+Commands:
+  check (default)      Grouped vulnerability check with severity indicators
+  sync                 Synchronize allowlists with current audit findings
+  init                 Scaffold a starter config file and GitHub Actions workflow
+
+Scope options:
+  --dev                Target dev dependencies only
+  --prod               Target production dependencies only
+
+Other options:
+  --config <path>      Path to config file (default: .config/v11y-check.config.json)
+  --json               Output results as JSON
+  --raw                Run raw audit-ci passthrough
+  --verbose, -v        Show detailed per-vulnerability output
+  --help, -h           Show this help message
+  --version, -V        Show version number
+`);
+}
+function showInitHelp() {
+  console.info(`
+Usage: v11y init [options]
+
+Scaffold a starter config file and GitHub Actions workflow.
+
+Options:
+  --dry-run, -n   Preview changes without writing files
+  --force, -f     Overwrite existing files
+  --help, -h      Show this help message
+`);
+}
+function showSyncHelp() {
+  console.info(`
+Usage: v11y sync [options]
+
+Synchronize allowlists with current audit findings.
+
+Scope options:
+  --dev              Target dev dependencies only
+  --prod             Target production dependencies only
+
+Other options:
+  --config <path>    Path to config file (default: .config/v11y-check.config.json)
+  --json             Output results as JSON
+  --help, -h         Show this help message
+`);
+}
+function parseSharedFlags(flags) {
+  const flagSchema = {
+    config: { long: "--config", type: "string" },
+    dev: { long: "--dev", type: "boolean" },
+    json: { long: "--json", type: "boolean", short: "-j" },
+    prod: { long: "--prod", type: "boolean" },
+    verbose: { long: "--verbose", type: "boolean", short: "-v" }
+  };
+  const { flags: parsed } = parseArgs(flags, flagSchema);
+  if (parsed.dev && parsed.prod) {
+    throw new Error("Cannot specify both --dev and --prod");
+  }
+  const scopes = [];
+  if (parsed.dev) scopes.push("dev");
+  if (parsed.prod) scopes.push("prod");
+  return {
+    configPath: parsed.config,
+    json: parsed.json,
+    scopes,
+    verbose: parsed.verbose
+  };
+}
+function findTypoMatch(input) {
+  if (input.length < MIN_PREFIX_LENGTH || input.startsWith("-")) {
+    return void 0;
+  }
+  for (const cmd of SUBCOMMANDS) {
+    if (cmd !== input && cmd.startsWith(input)) {
+      return cmd;
+    }
+  }
+  return void 0;
+}
+async function routeCommand(args) {
+  const command = args[0];
+  if (command === "--help" || command === "-h") {
+    showHelp();
+    return 0;
+  }
+  if (command === "--version" || command === "-V") {
+    console.info(VERSION);
+    return 0;
+  }
+  if (command === "check") {
+    return handleSubcommand(args.slice(1), checkCommand);
+  }
+  if (command === "init") {
+    return handleInit(args.slice(1));
+  }
+  if (command === "sync") {
+    return handleSubcommand(args.slice(1), syncCommand, showSyncHelp);
+  }
+  if (command !== void 0 && !command.startsWith("-")) {
+    const typoMatch = findTypoMatch(command);
+    if (typoMatch !== void 0) {
+      process.stderr.write(`Error: Unknown command '${command}'. Did you mean 'v11y ${typoMatch}'?
+`);
+      return 1;
+    }
+    process.stderr.write(`Error: Unknown command '${command}'.
+`);
+    return 1;
+  }
+  if (args.includes("--raw")) {
+    const filteredArgs = args.filter((a) => a !== "--raw");
+    return handleSubcommand(filteredArgs, auditCommand);
+  }
+  return handleSubcommand(args, checkCommand);
+}
+async function handleSubcommand(flags, handler, helpFn = showHelp) {
+  if (flags.some((f) => f === "--help" || f === "-h")) {
+    helpFn();
+    return 0;
+  }
+  let options;
+  try {
+    options = parseSharedFlags(flags);
+  } catch (error) {
+    process.stderr.write(`Error: ${translateParseError(error)}
+`);
+    return 1;
+  }
+  try {
+    return await handler(options);
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+}
+function handleInit(flags) {
+  if (flags.some((f) => f === "--help" || f === "-h")) {
+    showInitHelp();
+    return 0;
+  }
+  const initFlagSchema = {
+    dryRun: { long: "--dry-run", type: "boolean", short: "-n" },
+    force: { long: "--force", type: "boolean", short: "-f" }
+  };
+  let parsed;
+  try {
+    parsed = parseArgs(flags, initFlagSchema);
+  } catch (error) {
+    process.stderr.write(`Error: ${translateParseError(error)}
+`);
+    return 1;
+  }
+  return initCommand({ dryRun: parsed.flags.dryRun, force: parsed.flags.force });
+}
+export {
+  routeCommand
+};

package/dist/esm/bin/v11y.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/bin/v11y.js

@@ -0,0 +1,12 @@
+import process from "node:process";
+import { routeCommand } from "./route.js";
+let exitCode;
+try {
+  exitCode = await routeCommand(process.argv.slice(2));
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`v11y: unexpected error: ${message}
+`);
+  exitCode = 1;
+}
+process.exit(exitCode);

package/dist/esm/cli.d.ts

@@ -0,0 +1,5 @@
+import type { CommandOptions } from './types.ts';
+export declare function extractMessage(error: unknown): string;
+export declare function auditCommand(options: CommandOptions): Promise<number>;
+export declare function checkCommand(options: CommandOptions): Promise<number>;
+export declare function syncCommand(options: CommandOptions): Promise<number>;

package/dist/esm/cli.js

@@ -0,0 +1,231 @@
+import process from "node:process";
+import { loadConfig } from "./config.js";
+import { formatCheckJson, formatCheckText } from "./format-check.js";
+import { formatCheckVerboseText } from "./format-verbose.js";
+import { generateAuditCiConfig } from "./generate.js";
+import { scaffoldConfig } from "./init/scaffold.js";
+import { parseAuditCiOutput, runAudit, runReport } from "./run-audit.js";
+import { syncAllowlist } from "./sync.js";
+import { withTempDir } from "./tmp.js";
+import { AUDIT_SCOPES, isSeverityAtOrAbove } from "./types.js";
+function extractMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+async function auditCommand(options) {
+  let loaded;
+  try {
+    loaded = await loadConfig(options.configPath);
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+  const { config } = loaded;
+  const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
+  try {
+    return await withTempDir(async (tempDir) => {
+      let exitCode = 0;
+      const allResults = [];
+      for (const scope of scopes) {
+        const configPath = await generateAuditCiConfig(config[scope], scope, tempDir);
+        const result = runAudit({ configPath, json: options.json });
+        for (const warning of result.warnings) {
+          process.stderr.write(`warning: ${warning}
+`);
+        }
+        if (result.staleEntries.length > 0) {
+          process.stderr.write(`warning: stale allowlist entries in ${scope}: ${result.staleEntries.join(", ")}
+`);
+        }
+        if (options.json) {
+          const parsed = parseAuditCiOutput(result.stdout);
+          for (const warning of parsed.warnings) {
+            process.stderr.write(`warning: ${warning}
+`);
+          }
+          for (const r of parsed.results) {
+            if (!allResults.some((existing) => existing.id === r.id)) {
+              allResults.push(r);
+            }
+          }
+        } else {
+          if (result.stdout.length > 0) {
+            process.stdout.write(result.stdout);
+          }
+          if (result.stderr.length > 0) {
+            process.stderr.write(result.stderr);
+          }
+        }
+        if (result.exitCode !== 0) {
+          exitCode = result.exitCode;
+        }
+      }
+      if (options.json) {
+        process.stdout.write(JSON.stringify(allResults, null, 2) + "\n");
+      }
+      return exitCode;
+    });
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+}
+const CHECK_SCOPE_ORDER = ["prod", "dev"];
+async function checkCommand(options) {
+  let loaded;
+  try {
+    loaded = await loadConfig(options.configPath);
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+  const { config } = loaded;
+  const requestedScopes = options.scopes.length > 0 ? options.scopes : [...CHECK_SCOPE_ORDER];
+  const scopes = CHECK_SCOPE_ORDER.filter((s) => requestedScopes.includes(s));
+  try {
+    return await withTempDir(async (tempDir) => {
+      const checkResult = {
+        dev: { allowed: [], belowThreshold: [], stale: [], unallowed: [] },
+        prod: { allowed: [], belowThreshold: [], stale: [], unallowed: [] }
+      };
+      const thresholds = {};
+      for (const scope of scopes) {
+        const scopeConfig = config[scope];
+        const effectiveThreshold = scopeConfig.severityThreshold ?? "low";
+        thresholds[scope] = effectiveThreshold;
+        const strippedScope = { ...scopeConfig, allowlist: [], severityThreshold: "low" };
+        const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
+        const reportOptions = { configPath: strippedConfigPath };
+        if (options.verbose) {
+          reportOptions.reportType = "full";
+        }
+        const report = runReport(reportOptions);
+        for (const warning of report.warnings) {
+          process.stderr.write(`warning: ${warning}
+`);
+        }
+        if (report.stderr.length > 0) {
+          process.stderr.write(report.stderr);
+        }
+        const allowedIds = new Set(scopeConfig.allowlist.map((entry) => entry.id));
+        const foundIds = new Set(report.results.map((r) => r.id));
+        const allowlistById = new Map(scopeConfig.allowlist.map((entry) => [entry.id, entry]));
+        const scopeResult = { allowed: [], belowThreshold: [], stale: [], unallowed: [] };
+        for (const result of report.results) {
+          if (!isSeverityAtOrAbove(result.severity, effectiveThreshold)) {
+            scopeResult.belowThreshold.push(result);
+          } else if (allowedIds.has(result.id)) {
+            const entry = allowlistById.get(result.id);
+            scopeResult.allowed.push(buildAllowedVuln(result, entry));
+          } else {
+            scopeResult.unallowed.push(result);
+          }
+        }
+        for (const entry of scopeConfig.allowlist) {
+          if (!foundIds.has(entry.id)) {
+            scopeResult.stale.push({ id: entry.id });
+          }
+        }
+        checkResult[scope] = scopeResult;
+      }
+      if (options.verbose && !options.json) {
+        process.stdout.write(formatCheckVerboseText(checkResult, scopes, void 0, thresholds));
+      } else if (options.json) {
+        process.stdout.write(formatCheckJson(checkResult, scopes));
+      } else {
+        process.stdout.write(formatCheckText(checkResult, scopes, void 0, thresholds));
+      }
+      const hasUnallowed = scopes.some((s) => checkResult[s].unallowed.length > 0);
+      return hasUnallowed ? 1 : 0;
+    });
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+}
+async function syncCommand(options) {
+  let loaded;
+  try {
+    loaded = await loadConfig(options.configPath);
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+  const { configSource } = loaded;
+  if (configSource === "defaults") {
+    const { configResult } = scaffoldConfig({ dryRun: false, force: false });
+    if (configResult.outcome === "failed") {
+      process.stderr.write(`Error: Failed to create config file
+`);
+      return 1;
+    }
+    loaded = await loadConfig(options.configPath);
+  }
+  let { config } = loaded;
+  const { configFilePath } = loaded;
+  const scopes = options.scopes.length > 0 ? options.scopes : [...AUDIT_SCOPES];
+  try {
+    return await withTempDir(async (tempDir) => {
+      for (const scope of scopes) {
+        const strippedScope = { ...config[scope], allowlist: [] };
+        const strippedConfigPath = await generateAuditCiConfig(strippedScope, scope, tempDir);
+        const report = runReport({ configPath: strippedConfigPath });
+        for (const warning of report.warnings) {
+          process.stderr.write(`warning: ${warning}
+`);
+        }
+        const { syncResult, updatedConfig } = await syncAllowlist(config, scope, report.results, configFilePath);
+        config = updatedConfig;
+        if (options.json) {
+          process.stdout.write(JSON.stringify(syncResult, null, 2) + "\n");
+        } else {
+          process.stdout.write(`
+--- ${scope} ---
+`);
+          process.stdout.write(`  added: ${syncResult.added.length}
+`);
+          process.stdout.write(`  kept: ${syncResult.kept.length}
+`);
+          process.stdout.write(`  removed: ${syncResult.removed.length}
+`);
+        }
+      }
+      if (configSource === "defaults") {
+        const totalEntries = config.dev.allowlist.length + config.prod.allowlist.length;
+        process.stdout.write(`Created config at ${configFilePath} with ${totalEntries} allowed entries.
+`);
+      }
+      return 0;
+    });
+  } catch (error) {
+    process.stderr.write(`Error: ${extractMessage(error)}
+`);
+    return 1;
+  }
+}
+function buildAllowedVuln(result, entry) {
+  const allowed = {
+    id: result.id,
+    path: result.path,
+    paths: result.paths,
+    url: result.url
+  };
+  if (result.ghsaId !== void 0) allowed.ghsaId = result.ghsaId;
+  if (result.severity !== void 0) allowed.severity = result.severity;
+  if (result.title !== void 0) allowed.title = result.title;
+  if (result.description !== void 0) allowed.description = result.description;
+  if (result.cvss !== void 0) allowed.cvss = result.cvss;
+  if (entry?.reason !== void 0) allowed.reason = entry.reason;
+  if (entry?.addedAt !== void 0) allowed.addedAt = entry.addedAt;
+  return allowed;
+}
+export {
+  auditCommand,
+  checkCommand,
+  extractMessage,
+  syncCommand
+};

package/dist/esm/config.d.ts

@@ -0,0 +1,10 @@
+import type { V11yCheckConfig } from './types.ts';
+export declare const DEFAULT_CONFIG_PATH = ".config/v11y-check.config.json";
+export type ConfigSource = 'defaults' | 'file';
+export interface LoadConfigResult {
+    config: V11yCheckConfig;
+    configDir: string;
+    configFilePath: string;
+    configSource: ConfigSource;
+}
+export declare function loadConfig(configPath?: string, cwd?: string): Promise<LoadConfigResult>;

package/dist/esm/config.js

@@ -0,0 +1,41 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { DEFAULT_CONFIG, v11yCheckConfigSchema } from "./types.js";
+const DEFAULT_CONFIG_PATH = ".config/v11y-check.config.json";
+async function loadConfig(configPath, cwd) {
+  const resolvedCwd = cwd ?? process.cwd();
+  const filePath = path.resolve(resolvedCwd, configPath ?? DEFAULT_CONFIG_PATH);
+  const configDir = path.dirname(filePath);
+  if (configPath === void 0 && !existsSync(filePath)) {
+    return {
+      config: DEFAULT_CONFIG,
+      configDir,
+      configFilePath: filePath,
+      configSource: "defaults"
+    };
+  }
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf8");
+  } catch {
+    throw new Error(`Config file not found: ${filePath}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error(`Config file is not valid JSON: ${filePath}`);
+  }
+  const result = v11yCheckConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const issues = result.error.issues.map((issue) => `  - ${issue.path.join(".")}: ${issue.message}`).join("\n");
+    throw new Error(`Invalid config in ${filePath}:
+${issues}`);
+  }
+  return { config: result.data, configDir, configFilePath: filePath, configSource: "file" };
+}
+export {
+  DEFAULT_CONFIG_PATH,
+  loadConfig
+};

package/dist/esm/format-actions.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from './format-check.ts';
+import type { AuditScope } from './types.ts';
+export declare function formatActionHints(result: CheckResult, scopes: AuditScope[]): string;