v11y-check 0.0.0 → 0.7.0

package/dist/esm/format-actions.js

@@ -0,0 +1,34 @@
+const HINT_ADD = "Run `v11y sync` to add the listed vulnerabilities to the allowlist.";
+const HINT_REMOVE = "Run `v11y sync` to remove stale allowlist entries.";
+const HINT_BOTH = "Run `v11y sync` to add the listed vulnerabilities to the allowlist and remove stale entries.";
+function buildVerboseFlag(scopes) {
+  if (scopes.length === 1) {
+    return `--${scopes[0]} --verbose`;
+  }
+  return "--verbose";
+}
+function selectSyncHint(hasUnallowed, hasStale) {
+  if (hasUnallowed && hasStale) return HINT_BOTH;
+  if (hasUnallowed) return HINT_ADD;
+  return HINT_REMOVE;
+}
+function formatActionHints(result, scopes) {
+  const hasUnallowed = scopes.some((scope) => result[scope].unallowed.length > 0);
+  const hasAllowed = scopes.some((scope) => result[scope].allowed.length > 0);
+  const hasStale = scopes.some((scope) => result[scope].stale.length > 0);
+  const hasVulns = hasUnallowed || hasAllowed;
+  const needsSync = hasUnallowed || hasStale;
+  if (!hasVulns && !needsSync) return "";
+  const bullets = [];
+  if (hasVulns) {
+    bullets.push(`  \u2022 Run \`v11y check ${buildVerboseFlag(scopes)}\` for full report`);
+  }
+  if (needsSync) {
+    bullets.push(`  \u2022 ${selectSyncHint(hasUnallowed, hasStale)}`);
+  }
+  return `  Actions:
+${bullets.join("\n")}`;
+}
+export {
+  formatActionHints
+};

package/dist/esm/format-check.d.ts

@@ -0,0 +1,38 @@
+import type { AuditResult, AuditScope, SeverityThreshold } from './types.ts';
+export interface AllowedVuln {
+    addedAt?: string | undefined;
+    cvss?: {
+        score?: number;
+        vectorString?: string;
+    } | undefined;
+    description?: string | undefined;
+    ghsaId?: string | undefined;
+    id: string;
+    path: string;
+    paths: string[];
+    reason?: string | undefined;
+    severity?: string | undefined;
+    title?: string | undefined;
+    url: string;
+}
+export interface StaleEntry {
+    id: string;
+}
+export interface ScopeCheckResult {
+    allowed: AllowedVuln[];
+    belowThreshold: AuditResult[];
+    stale: StaleEntry[];
+    unallowed: AuditResult[];
+}
+export interface CheckResult {
+    dev: ScopeCheckResult;
+    prod: ScopeCheckResult;
+}
+export declare function severityIndicator(severity: string | undefined): string;
+export declare function displayId(vuln: {
+    ghsaId?: string | undefined;
+    id: string;
+}): string;
+export declare function formatSeveritySuffix(severity: string | undefined): string;
+export declare function formatCheckText(result: CheckResult, scopes: AuditScope[], now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;
+export declare function formatCheckJson(result: CheckResult, scopes: AuditScope[]): string;

package/dist/esm/format-check.js

@@ -0,0 +1,134 @@
+import { formatActionHints } from "./format-actions.js";
+import { deriveSummary } from "./format-summary.js";
+import { formatRelativeTime } from "./format-time.js";
+const SEVERITY_INDICATORS = {
+  critical: "\u{1F534}",
+  high: "\u{1F534}",
+  info: "\u{1F7E1}",
+  low: "\u{1F7E1}",
+  moderate: "\u{1F7E0}"
+};
+function severityIndicator(severity) {
+  if (severity === void 0) return "";
+  return SEVERITY_INDICATORS[severity] ?? "";
+}
+function displayId(vuln) {
+  return vuln.ghsaId ?? vuln.id;
+}
+const SCOPE_LABELS = {
+  dev: "  \u{1F527} dev:",
+  prod: "  \u{1F4E6} prod:"
+};
+const SCOPE_NAMES = {
+  dev: "dev",
+  prod: "prod"
+};
+function formatThresholdAnnotation(threshold) {
+  if (threshold === void 0 || threshold === "low") return "";
+  const indicator = severityIndicator(threshold);
+  const indicatorPart = indicator.length > 0 ? `${indicator} ` : "";
+  return `(threshold: ${indicatorPart}${threshold})`;
+}
+function formatIntroBanner(scopes, thresholds) {
+  const first = scopes[0];
+  if (scopes.length === 1 && first !== void 0) {
+    const annotation = formatThresholdAnnotation(thresholds?.[first]);
+    return `\u{1F52C} Auditing ${SCOPE_NAMES[first]} dependencies${annotation && ` ${annotation}`} ...`;
+  }
+  return "\u{1F52C} Auditing dependencies ...";
+}
+function formatSeveritySuffix(severity) {
+  if (severity === void 0 || severity === "") return "";
+  const emoji = severityIndicator(severity);
+  const emojiPart = emoji.length > 0 ? `${emoji} ` : "";
+  return `  ${emojiPart}${severity}`;
+}
+function formatAllowedSuffix(addedAt, now) {
+  const relative = formatRelativeTime(addedAt, now);
+  if (relative.length === 0) return ` \u2022 \u2705 allowed (${addedAt})`;
+  return ` \u2022 \u2705 allowed since ${relative} (${addedAt})`;
+}
+function formatUnallowedLine(vuln) {
+  return `  \u2022 \u{1F6A8} ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)}`;
+}
+function formatAllowedLine(vuln, now) {
+  const suffix = vuln.addedAt !== void 0 ? formatAllowedSuffix(vuln.addedAt, now) : "";
+  return `  \u2022 \u26A0\uFE0F ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)}${suffix}`;
+}
+function formatStaleLine(entry) {
+  return `  \u2022 \u{1F5D1}\uFE0F ${entry.id} \u2022 not needed`;
+}
+function formatBelowThresholdLine(vuln) {
+  return `  \u2022 \u2139\uFE0F ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)} \u2022 \u{1F6AB} ignored`;
+}
+function hasFindings(result) {
+  return result.unallowed.length > 0 || result.allowed.length > 0 || result.stale.length > 0 || result.belowThreshold.length > 0;
+}
+function formatScopeFindings(result, now) {
+  const lines = [];
+  for (const vuln of result.unallowed) {
+    lines.push(formatUnallowedLine(vuln));
+  }
+  for (const vuln of result.allowed) {
+    lines.push(formatAllowedLine(vuln, now));
+  }
+  for (const entry of result.stale) {
+    lines.push(formatStaleLine(entry));
+  }
+  for (const vuln of result.belowThreshold) {
+    lines.push(formatBelowThresholdLine(vuln));
+  }
+  return lines;
+}
+function formatCheckText(result, scopes, now, thresholds) {
+  const effectiveNow = now ?? /* @__PURE__ */ new Date();
+  const lines = [formatIntroBanner(scopes, thresholds)];
+  const anyFindings = scopes.some((scope) => hasFindings(result[scope]));
+  if (!anyFindings) {
+    lines.push("No known vulnerabilities found.");
+    return lines.join("\n") + "\n";
+  }
+  const singleScope = scopes.length === 1 ? scopes[0] : void 0;
+  if (singleScope !== void 0) {
+    const scope = singleScope;
+    const scopeResult = result[scope];
+    lines.push(...formatScopeFindings(scopeResult, effectiveNow));
+    const actions2 = formatActionHints(result, scopes);
+    if (actions2.length > 0) {
+      lines.push("", ...actions2.split("\n").filter((l) => l.length > 0));
+    }
+    return lines.join("\n") + "\n";
+  }
+  for (const scope of scopes) {
+    const scopeResult = result[scope];
+    const annotation = formatThresholdAnnotation(thresholds?.[scope]);
+    const header = `${SCOPE_LABELS[scope]}${annotation && ` ${annotation}`}`;
+    lines.push(header);
+    if (hasFindings(scopeResult)) {
+      lines.push(...formatScopeFindings(scopeResult, effectiveNow));
+    } else {
+      lines.push("  No known vulnerabilities found.");
+    }
+    lines.push("");
+  }
+  const actions = formatActionHints(result, scopes);
+  if (actions.length > 0) {
+    lines.push(...actions.split("\n").filter((l) => l.length > 0));
+  }
+  return lines.join("\n") + "\n";
+}
+function formatCheckJson(result, scopes) {
+  const output = {};
+  for (const scope of scopes) {
+    output[scope] = result[scope];
+  }
+  output.summary = deriveSummary(result, scopes);
+  return JSON.stringify(output, null, 2) + "\n";
+}
+export {
+  displayId,
+  formatCheckJson,
+  formatCheckText,
+  formatSeveritySuffix,
+  severityIndicator
+};

package/dist/esm/format-summary.d.ts

@@ -0,0 +1,8 @@
+import type { CheckResult } from './format-check.ts';
+import type { AuditScope } from './types.ts';
+export type CheckSummaryStatus = 'vulnerabilities-found' | 'suppressed-vulnerabilities' | 'stale-overrides' | 'none';
+export interface CheckSummary {
+    status: CheckSummaryStatus;
+    count: number;
+}
+export declare function deriveSummary(result: CheckResult, scopes: AuditScope[]): CheckSummary;

package/dist/esm/format-summary.js

@@ -0,0 +1,12 @@
+function deriveSummary(result, scopes) {
+  const unallowed = scopes.reduce((total, scope) => total + result[scope].unallowed.length, 0);
+  if (unallowed > 0) return { status: "vulnerabilities-found", count: unallowed };
+  const allowed = scopes.reduce((total, scope) => total + result[scope].allowed.length, 0);
+  if (allowed > 0) return { status: "suppressed-vulnerabilities", count: allowed };
+  const stale = scopes.reduce((total, scope) => total + result[scope].stale.length, 0);
+  if (stale > 0) return { status: "stale-overrides", count: stale };
+  return { status: "none", count: 0 };
+}
+export {
+  deriveSummary
+};

package/dist/esm/format-time.d.ts

@@ -0,0 +1 @@
+export declare function formatRelativeTime(fromIso: string, now: Date): string;

package/dist/esm/format-time.js

@@ -0,0 +1,36 @@
+function formatRelativeTime(fromIso, now) {
+  const from = parseDateUtc(fromIso);
+  if (from === void 0) return "";
+  const deltaMs = now.getTime() - from.getTime();
+  if (deltaMs < 6e4) return "just now";
+  const minutes = Math.floor(deltaMs / 6e4);
+  if (minutes < 60) return pluralize(minutes, "minute");
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return pluralize(hours, "hour");
+  const days = Math.floor(hours / 24);
+  if (days === 1) return "yesterday";
+  if (days < 7) return pluralize(days, "day");
+  const weeks = Math.floor(days / 7);
+  if (weeks < 5) return pluralize(weeks, "week");
+  const months = diffMonthsUtc(from, now);
+  if (months < 12) return pluralize(months, "month");
+  const years = Math.floor(months / 12);
+  return pluralize(years, "year");
+}
+function parseDateUtc(iso) {
+  const parsed = new Date(iso);
+  return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+}
+function diffMonthsUtc(from, now) {
+  let months = (now.getUTCFullYear() - from.getUTCFullYear()) * 12 + (now.getUTCMonth() - from.getUTCMonth());
+  if (now.getUTCDate() < from.getUTCDate()) {
+    months -= 1;
+  }
+  return Math.max(0, months);
+}
+function pluralize(count, unit) {
+  return `${count} ${unit}${count === 1 ? "" : "s"} ago`;
+}
+export {
+  formatRelativeTime
+};

package/dist/esm/format-verbose.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from './format-check.ts';
+import type { AuditScope, SeverityThreshold } from './types.ts';
+export declare function formatCheckVerboseText(result: CheckResult, scopes: AuditScope[], now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;

package/dist/esm/format-verbose.js

@@ -0,0 +1,144 @@
+import { formatActionHints } from "./format-actions.js";
+import { displayId, formatSeveritySuffix, severityIndicator } from "./format-check.js";
+import { formatRelativeTime } from "./format-time.js";
+const STATUS_UNALLOWED = "\u{1F6A8}";
+const STATUS_ALLOWED = "\u26A0\uFE0F";
+const STATUS_BELOW_THRESHOLD = "\u2139\uFE0F";
+const STATUS_STALE = "\u{1F5D1}\uFE0F";
+const SCOPE_HEADERS = {
+  prod: "-- \u{1F4E6} prod --",
+  dev: "-- \u{1F527} dev --"
+};
+const DETAIL_INDENT = "     ";
+const WRAP_COLUMNS = 72;
+function formatCheckVerboseText(result, scopes, now, thresholds) {
+  const effectiveNow = now ?? /* @__PURE__ */ new Date();
+  const sections = [];
+  for (const scope of scopes) {
+    sections.push(formatScopeVerbose(scope, result[scope], effectiveNow, thresholds?.[scope]));
+  }
+  const actions = formatActionHints(result, scopes);
+  const body = sections.join("\n\n") + "\n";
+  if (actions.length === 0) return body;
+  return body + "\n" + actions + "\n";
+}
+function formatThresholdSuffix(threshold) {
+  if (threshold === void 0 || threshold === "low") return "";
+  const indicator = severityIndicator(threshold);
+  const indicatorPart = indicator.length > 0 ? `${indicator} ` : "";
+  return ` (threshold: ${indicatorPart}${threshold})`;
+}
+function formatScopeVerbose(scope, result, now, threshold) {
+  const thresholdSuffix = formatThresholdSuffix(threshold);
+  const lines = [`${SCOPE_HEADERS[scope]}${thresholdSuffix}`];
+  const hasFindings = result.unallowed.length > 0 || result.allowed.length > 0 || result.stale.length > 0 || result.belowThreshold.length > 0;
+  if (!hasFindings) {
+    lines.push("  (none)");
+    return lines.join("\n");
+  }
+  const blocks = [];
+  for (const vuln of result.unallowed) {
+    blocks.push(formatUnallowedBlock(vuln));
+  }
+  for (const vuln of result.allowed) {
+    blocks.push(formatAllowedBlock(vuln, now));
+  }
+  for (const entry of result.stale) {
+    blocks.push(formatStaleLine(entry));
+  }
+  for (const vuln of result.belowThreshold) {
+    blocks.push(formatBelowThresholdBlock(vuln));
+  }
+  return lines.concat(blocks.join("\n\n")).join("\n");
+}
+function formatUnallowedBlock(vuln) {
+  const headerLine = `  ${STATUS_UNALLOWED} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}`;
+  const detail = formatAdvisoryDetail(vuln);
+  return [headerLine, ...detail].join("\n");
+}
+function formatAllowedBlock(vuln, now) {
+  const allowedSuffix = vuln.addedAt !== void 0 ? formatAllowedSuffix(vuln.addedAt, now) : "";
+  const headerLine = `  ${STATUS_ALLOWED} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}${allowedSuffix}`;
+  const hasTitle = vuln.title !== void 0;
+  const detail = formatAdvisoryDetail(vuln);
+  if (vuln.reason !== void 0) {
+    const reasonLineIndex = findReasonInsertionIndex(hasTitle);
+    detail.splice(reasonLineIndex, 0, `${DETAIL_INDENT}reason: ${vuln.reason}`);
+  }
+  return [headerLine, ...detail].join("\n");
+}
+function formatStaleLine(entry) {
+  return `  ${STATUS_STALE} ${entry.id}  not needed`;
+}
+function formatBelowThresholdBlock(vuln) {
+  const headerLine = `  ${STATUS_BELOW_THRESHOLD} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}  ignored (below threshold)`;
+  const detail = formatAdvisoryDetail(vuln);
+  return [headerLine, ...detail].join("\n");
+}
+function formatAdvisoryDetail(vuln) {
+  const lines = [];
+  if (vuln.title !== void 0) {
+    lines.push(`${DETAIL_INDENT}${vuln.title}`);
+  }
+  lines.push(...formatPathsLines(vuln.paths), `${DETAIL_INDENT}link: ${vuln.url}`);
+  if (vuln.description !== void 0) {
+    lines.push("", ...formatDescriptionLines(vuln.description));
+  }
+  return lines;
+}
+function findReasonInsertionIndex(hasTitle) {
+  return hasTitle ? 1 : 0;
+}
+function formatPathsLines(paths) {
+  if (paths.length === 0) return [];
+  if (paths.length === 1) {
+    return [`${DETAIL_INDENT}path: ${paths[0]}`];
+  }
+  const lines = [`${DETAIL_INDENT}paths:`];
+  for (const pathValue of paths) {
+    lines.push(`${DETAIL_INDENT}  - ${pathValue}`);
+  }
+  return lines;
+}
+function formatAllowedSuffix(addedAt, now) {
+  const relative = formatRelativeTime(addedAt, now);
+  if (relative.length === 0) return `  allowed (${addedAt})`;
+  return `  allowed ${relative} (${addedAt})`;
+}
+function formatDescriptionLines(description) {
+  const paragraphs = description.split(/\n\s*\n/);
+  const lines = [];
+  let needsSeparator = false;
+  for (const paragraph of paragraphs) {
+    if (needsSeparator) lines.push("");
+    const wrapped = wrapParagraph(paragraph.trim(), WRAP_COLUMNS);
+    for (const wrappedLine of wrapped) {
+      lines.push(`${DETAIL_INDENT}${wrappedLine}`);
+    }
+    needsSeparator = true;
+  }
+  return lines;
+}
+function wrapParagraph(paragraph, columns) {
+  if (paragraph.length === 0) return [];
+  const words = paragraph.split(/\s+/);
+  const lines = [];
+  let current = "";
+  for (const word of words) {
+    if (current === "") {
+      current = word;
+      continue;
+    }
+    if (current.length + 1 + word.length > columns) {
+      lines.push(current);
+      current = word;
+    } else {
+      current = `${current} ${word}`;
+    }
+  }
+  if (current !== "") lines.push(current);
+  return lines;
+}
+export {
+  formatCheckVerboseText
+};

package/dist/esm/generate.d.ts

@@ -0,0 +1,9 @@
+import type { AuditScope, ScopeConfig } from './types.ts';
+interface AuditCiFlatConfig {
+    allowlist: string[];
+    'show-not-found'?: boolean;
+    [key: string]: boolean | string | string[] | undefined;
+}
+export declare function buildFlatConfig(scopeConfig: ScopeConfig, scope: AuditScope): AuditCiFlatConfig;
+export declare function generateAuditCiConfig(scopeConfig: ScopeConfig, scope: AuditScope, outputDir: string): Promise<string>;
+export {};

package/dist/esm/generate.js

@@ -0,0 +1,28 @@
+import { writeFile } from "node:fs/promises";
+import path from "node:path";
+function buildFlatConfig(scopeConfig, scope) {
+  const flat = {
+    allowlist: scopeConfig.allowlist.map((entry) => entry.id),
+    "show-not-found": true
+  };
+  if (scopeConfig.severityThreshold !== void 0) {
+    flat[scopeConfig.severityThreshold] = true;
+  }
+  if (scope === "prod") {
+    flat["skip-dev"] = true;
+  } else {
+    flat["extra-args"] = ["--dev"];
+  }
+  return flat;
+}
+async function generateAuditCiConfig(scopeConfig, scope, outputDir) {
+  const outputPath = path.join(outputDir, `audit-ci.${scope}.json`);
+  const flat = buildFlatConfig(scopeConfig, scope);
+  const content = JSON.stringify(flat, null, 2) + "\n";
+  await writeFile(outputPath, content, "utf8");
+  return outputPath;
+}
+export {
+  buildFlatConfig,
+  generateAuditCiConfig
+};

package/dist/esm/index.d.ts

@@ -0,0 +1,5 @@
+export type { AllowlistEntry, AuditResult, AuditScope, CommandOptions, ScopeConfig, SeverityThreshold, V11yCheckConfig, } from './types.ts';
+export { allowlistEntrySchema, AUDIT_SCOPES, DEFAULT_CONFIG, scopeConfigSchema, SEVERITY_THRESHOLDS, v11yCheckConfigSchema, } from './types.ts';
+export type { ConfigSource, LoadConfigResult } from './config.ts';
+export { loadConfig } from './config.ts';
+export { syncAllowlist } from './sync.ts';

package/dist/esm/index.js

@@ -0,0 +1,20 @@
+import {
+  allowlistEntrySchema,
+  AUDIT_SCOPES,
+  DEFAULT_CONFIG,
+  scopeConfigSchema,
+  SEVERITY_THRESHOLDS,
+  v11yCheckConfigSchema
+} from "./types.js";
+import { loadConfig } from "./config.js";
+import { syncAllowlist } from "./sync.js";
+export {
+  AUDIT_SCOPES,
+  DEFAULT_CONFIG,
+  SEVERITY_THRESHOLDS,
+  allowlistEntrySchema,
+  loadConfig,
+  scopeConfigSchema,
+  syncAllowlist,
+  v11yCheckConfigSchema
+};

package/dist/esm/init/initCommand.d.ts

@@ -0,0 +1,6 @@
+interface InitOptions {
+    dryRun: boolean;
+    force: boolean;
+}
+export declare function initCommand({ dryRun, force }: InitOptions): number;
+export {};

package/dist/esm/init/initCommand.js

@@ -0,0 +1,34 @@
+import { printError, printStep, reportWriteResult } from "@williamthorsen/nmr-core";
+import { extractMessage } from "../cli.js";
+import { scaffoldFiles } from "./scaffold.js";
+function initCommand({ dryRun, force }) {
+  if (dryRun) {
+    console.info("[dry-run mode]");
+  }
+  printStep("Scaffolding files");
+  let results;
+  try {
+    results = scaffoldFiles({ dryRun, force });
+  } catch (error) {
+    printError(`Failed to scaffold files: ${extractMessage(error)}`);
+    return 1;
+  }
+  for (const result of results) {
+    reportWriteResult(result, dryRun);
+  }
+  if (results.some((r) => r.outcome === "failed")) {
+    return 1;
+  }
+  if (!dryRun) {
+    printStep("Next steps");
+    console.info(`
+  1. Customize .config/v11y-check.config.json with your severity thresholds.
+  2. Commit the scaffolded .github/workflows/audit.yaml alongside your config.
+  3. Run: v11y check
+`);
+  }
+  return 0;
+}
+export {
+  initCommand
+};

package/dist/esm/init/scaffold.d.ts

@@ -0,0 +1,13 @@
+import type { WriteResult } from '@williamthorsen/nmr-core';
+interface ScaffoldOptions {
+    dryRun: boolean;
+    force: boolean;
+}
+interface ScaffoldResult {
+    configResult: WriteResult;
+}
+export declare function scaffoldConfig({ dryRun, force }: ScaffoldOptions): ScaffoldResult;
+export declare function copyWorkflowTemplate(dryRun: boolean, overwrite: boolean): WriteResult;
+export declare function scaffoldWorkflow(dryRun: boolean, overwrite: boolean): WriteResult;
+export declare function scaffoldFiles({ dryRun, force }: ScaffoldOptions): WriteResult[];
+export {};

package/dist/esm/init/scaffold.js

@@ -0,0 +1,45 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { findPackageRoot, writeFileWithCheck } from "@williamthorsen/nmr-core";
+import { v11yCheckConfigTemplate } from "./templates.js";
+const CONFIG_PATH = ".config/v11y-check.config.json";
+const WORKFLOW_PATH = ".github/workflows/audit.yaml";
+function scaffoldConfig({ dryRun, force }) {
+  const configResult = writeFileWithCheck(CONFIG_PATH, v11yCheckConfigTemplate, { dryRun, overwrite: force });
+  return { configResult };
+}
+function copyWorkflowTemplate(dryRun, overwrite) {
+  let root;
+  try {
+    root = findPackageRoot(import.meta.url);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { filePath: WORKFLOW_PATH, outcome: "failed", error: `Failed to resolve package root: ${message}` };
+  }
+  const templatePath = resolve(root, "templates", "audit.yaml.template");
+  if (!existsSync(templatePath)) {
+    return { filePath: WORKFLOW_PATH, outcome: "failed", error: `Could not find bundled template at ${templatePath}` };
+  }
+  let content;
+  try {
+    content = readFileSync(templatePath, "utf8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { filePath: WORKFLOW_PATH, outcome: "failed", error: `Failed to read template ${templatePath}: ${message}` };
+  }
+  return writeFileWithCheck(WORKFLOW_PATH, content, { dryRun, overwrite });
+}
+function scaffoldWorkflow(dryRun, overwrite) {
+  return copyWorkflowTemplate(dryRun, overwrite);
+}
+function scaffoldFiles({ dryRun, force }) {
+  const { configResult } = scaffoldConfig({ dryRun, force });
+  const workflowResult = scaffoldWorkflow(dryRun, force);
+  return [configResult, workflowResult];
+}
+export {
+  copyWorkflowTemplate,
+  scaffoldConfig,
+  scaffoldFiles,
+  scaffoldWorkflow
+};

package/dist/esm/init/templates.d.ts

@@ -0,0 +1 @@
+export declare const v11yCheckConfigTemplate: string;

package/dist/esm/init/templates.js

@@ -0,0 +1,23 @@
+import { readPackageVersion } from "@williamthorsen/nmr-core";
+const VERSION = readPackageVersion(import.meta.url);
+function buildSchemaUrl() {
+  return `https://github.com/williamthorsen/node-monorepo-tools/raw/v11y-check-v${VERSION}/packages/v11y-check/schemas/config.json`;
+}
+const v11yCheckConfigTemplate = JSON.stringify(
+  {
+    $schema: buildSchemaUrl(),
+    dev: {
+      severityThreshold: "moderate",
+      allowlist: []
+    },
+    prod: {
+      severityThreshold: "low",
+      allowlist: []
+    }
+  },
+  null,
+  2
+) + "\n";
+export {
+  v11yCheckConfigTemplate
+};

package/dist/esm/run-audit.d.ts

@@ -0,0 +1,34 @@
+import type { AuditResult } from './types.ts';
+export declare function resolveAuditCiBin(): string;
+export interface ParseResult {
+    results: AuditResult[];
+    warnings: string[];
+}
+export declare function parseAuditCiOutput(jsonString: string): ParseResult;
+export interface StaleEntriesResult {
+    entries: string[];
+    warnings: string[];
+}
+export declare function extractStaleEntries(jsonString: string): StaleEntriesResult;
+interface RunAuditOptions {
+    configPath: string;
+    cwd?: string;
+    json?: boolean;
+    reportType?: 'full';
+}
+export interface AuditRunResult {
+    exitCode: number;
+    staleEntries: string[];
+    stdout: string;
+    stderr: string;
+    warnings: string[];
+}
+export declare function runAudit({ configPath, cwd, json }: RunAuditOptions): AuditRunResult;
+export interface ReportResult {
+    results: AuditResult[];
+    stdout: string;
+    stderr: string;
+    warnings: string[];
+}
+export declare function runReport({ configPath, cwd, reportType }: Omit<RunAuditOptions, 'json'>): ReportResult;
+export {};