v11y-check 0.17.0 → 0.18.1

package/.meta/changelog.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "0.18.0",
+    "date": "2026-09-18",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adopt output styles, shared glyphs, and column-aware wrapping (#836)",
+            "body": "- Makes `v11y-check` print `check` and `init` output without emoji, and with a word such as `PASS` or `STALE` in place of each row marker, to whichever of stdout and stderr is not a terminal, or to both when `CI` is set.\n- Adds the `V11Y_CHECK_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich`, overrides that detection, and makes any other value a usage error that exits with code 1.\n- Changes the emoji row markers of rich output: ❌ replaces 🚨 for an unallowed row, ✅ replaces ⚠️ for an allowed row, ⏩ replaces ℹ️ for a below-threshold row, 🧹 replaces 🗑️ for a stale row, and the `allowed` and `ignored` suffixes of a compact row lose their emoji.",
+            "hash": "757a884be126469f0a9ac1ff85c599f2f4895ec7"
+          },
+          {
+            "description": "Give nmr plain output in pipes and CI logs (#838)",
+            "body": "- Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.\n- Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.\n- Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.",
+            "hash": "693b3a7f57def3d299ced240c19bda90f6253bdc"
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "0.17.0",
     "date": "2026-09-15",

package/.readyup/kits/default.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.36.0";
+export const __readyupVersion = "0.38.0";
 
 
 // .readyup/kits/default.ts
@@ -63,7 +63,7 @@ var default_default = defineRdyKit({
   ]
 });
 function getMinVersion() {
-  const picked = { "version": "0.17.0" };
+  const picked = { "version": "0.18.1" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("v11y-check/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -13,7 +13,7 @@
           "path": "kits/default.ts"
         },
         {
-          "hash": "7316a587",
+          "hash": "609eb92c",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -23,10 +23,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.36.0",
+      "readyupVersion": "0.38.0",
       "source": "kits/default.ts",
       "sourceHash": "5600fe16",
-      "targetHash": "37393c2b"
+      "targetHash": "b2273259"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.18.0 — 2026-09-18
+
+### 🎉 Features
+
+- Adopt output styles, shared glyphs, and column-aware wrapping (#836)
+
+  - Makes `v11y-check` print `check` and `init` output without emoji, and with a word such as `PASS` or `STALE` in place of each row marker, to whichever of stdout and stderr is not a terminal, or to both when `CI` is set.
+  - Adds the `V11Y_CHECK_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich`, overrides that detection, and makes any other value a usage error that exits with code 1.
+  - Changes the emoji row markers of rich output: ❌ replaces 🚨 for an unallowed row, ✅ replaces ⚠️ for an allowed row, ⏩ replaces ℹ️ for a below-threshold row, 🧹 replaces 🗑️ for a stale row, and the `allowed` and `ignored` suffixes of a compact row lose their emoji.
+
+- Give nmr plain output in pipes and CI logs (#838)
+
+  - Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.
+  - Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.
+  - Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.
+
 ## 0.17.0 — 2026-09-15
 
 ### 🎉 Features

package/README.md

@@ -1,19 +1,10 @@
+<!-- readme-type: cli -->
+
 # v11y-check
 
 Wraps [audit-ci](https://github.com/IBM/audit-ci) with a richer config model, typed JSON source of truth, and a sync workflow that automates allowlist management.
 
-<!-- section:release-notes -->
-## Release notes — v0.17.0 (2026-09-15)
-
-### 🎉 Features
-
-- Fix scaffold error handling and cover every scaffolded workflow (#806)
-
-  - Adds a `create-github-release.yaml matches template` check to release-kit's ReadyUp kit, which warns when `.github/workflows/create-github-release.yaml` differs from the template for the detected repo type and skips in a repo that has not installed that workflow.
-  - Stops `v11y init --force` from replacing an existing `.config/v11y-check.config.json` with the defaults, which discarded the repo's thresholds and the allowlist maintained by `v11y sync`.
-
-  Migration: To reset `.config/v11y-check.config.json` to its defaults, delete the file and run `v11y init`, because `v11y init --force` now overwrites only `.github/workflows/audit.yaml`.
-<!-- /section:release-notes -->
+<!-- section:release-notes --><!-- /section:release-notes -->
 
 ## Installation
 
@@ -76,6 +67,12 @@ The source-of-truth config lives at `.config/v11y-check.config.json`:
   - **`severityThreshold`** (optional) — Fail on advisories at or above this severity. Valid values: `'low'`, `'moderate'`, `'high'`, `'critical'`. When omitted, audit-ci uses its own defaults.
   - **`allowlist`** — Typed advisory entries with `id`, `path`, `url`, and optional `reason` and `addedAt`. `addedAt` is an ISO 8601 UTC datetime (e.g., `2026-04-15T09:30:00.000Z`) populated automatically by `v11y sync` on new entries; existing entries retain whatever value they had. Older `YYYY-MM-DD` values are still accepted.
 
+### Output style
+
+The `V11Y_CHECK_OUTPUT_STYLE` environment variable sets the style for every command, `init` included: `rich` marks each finding with an emoji, such as ❌ or ✅, and `plain` prints a word in its place, such as `FAIL` or `PASS`, which a reader of a log can search for. `auto`, the default, defers to detection. Any other value is a usage error that exits with code 1.
+
+Detection decides stdout and stderr separately. A stream is plain when `CI` is set to anything other than an empty string or `false`, when the stream is not a terminal, or when `TERM` is `linux`; otherwise it is rich. `--json` output contains no emoji in either style.
+
 ## CLI reference
 
 ```
@@ -98,6 +95,11 @@ Other options:
   --verbose, -v        Show detailed per-vulnerability output
   --help, -h           Show this help message
   --version, -V        Show version number
+
+Environment:
+  V11Y_CHECK_OUTPUT_STYLE
+                       Output style: auto (default), plain, or rich. auto prints plain,
+                       without emoji, when CI is set or the stream is not a terminal.
 ```
 
 ### Init options

package/dist/esm/bin/route.js

@@ -1,7 +1,9 @@
+import process from 'node:process';
 import { parseArgs, readPackageVersion, reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { auditCommand, checkCommand, syncCommand } from "../cli.js";
 import { initCommand } from "../init/initCommand.js";
+import { OUTPUT_STYLE_ENV_VAR, resolveStyles } from "../resolveStyles.js";
 const VERSION = readPackageVersion(import.meta.url);
 const SUBCOMMANDS = ['check', 'init', 'sync'];
 const MIN_PREFIX_LENGTH = 3;
@@ -26,6 +28,11 @@ Other options:
   --verbose, -v        Show detailed per-vulnerability output
   --help, -h           Show this help message
   --version, -V        Show version number
+
+Environment:
+  ${OUTPUT_STYLE_ENV_VAR}
+                       Output style: auto (default), plain, or rich. auto prints plain,
+                       without emoji, when CI is set or the stream is not a terminal.
 `);
 }
 function showInitHelp() {
@@ -56,7 +63,7 @@ Other options:
   --help, -h         Show this help message
 `);
 }
-function parseSharedFlags(flags) {
+function parseSharedFlags(flags, styles) {
     const flagSchema = {
         config: { long: '--config', type: 'string' },
         dev: { long: '--dev', type: 'boolean' },
@@ -77,6 +84,7 @@ function parseSharedFlags(flags) {
         configPath: parsed.config,
         json: parsed.json,
         scopes,
+        styles,
         verbose: parsed.verbose,
     };
 }
@@ -101,14 +109,22 @@ export async function routeCommand(args) {
         console.info(VERSION);
         return 0;
     }
+    const styles = resolveStyles({
+        env: process.env,
+        stderrIsTty: process.stderr.isTTY,
+        stdoutIsTty: process.stdout.isTTY,
+    });
+    if (styles === undefined) {
+        return 1;
+    }
     if (command === 'check') {
-        return handleSubcommand(args.slice(1), checkCommand);
+        return handleSubcommand(args.slice(1), styles, checkCommand);
     }
     if (command === 'init') {
-        return handleInit(args.slice(1));
+        return handleInit(args.slice(1), styles);
     }
     if (command === 'sync') {
-        return handleSubcommand(args.slice(1), syncCommand, showSyncHelp);
+        return handleSubcommand(args.slice(1), styles, syncCommand, showSyncHelp);
     }
     if (command !== undefined && !command.startsWith('-')) {
         const typoMatch = findTypoMatch(command);
@@ -121,18 +137,18 @@ export async function routeCommand(args) {
     }
     if (args.includes('--raw')) {
         const filteredArgs = args.filter((a) => a !== '--raw');
-        return handleSubcommand(filteredArgs, auditCommand);
+        return handleSubcommand(filteredArgs, styles, auditCommand);
     }
-    return handleSubcommand(args, checkCommand);
+    return handleSubcommand(args, styles, checkCommand);
 }
-async function handleSubcommand(flags, handler, helpFn = showHelp) {
+async function handleSubcommand(flags, styles, handler, helpFn = showHelp) {
     if (flags.some((f) => f === '--help' || f === '-h')) {
         helpFn();
         return 0;
     }
     let options;
     try {
-        options = parseSharedFlags(flags);
+        options = parseSharedFlags(flags, styles);
     }
     catch (error) {
         reportError(describeError(error));
@@ -146,7 +162,7 @@ async function handleSubcommand(flags, handler, helpFn = showHelp) {
         return 1;
     }
 }
-function handleInit(flags) {
+function handleInit(flags, styles) {
     if (flags.some((f) => f === '--help' || f === '-h')) {
         showInitHelp();
         return 0;
@@ -163,5 +179,5 @@ function handleInit(flags) {
         reportError(describeError(error));
         return 1;
     }
-    return initCommand({ dryRun: parsed.flags.dryRun, force: parsed.flags.force });
+    return initCommand({ dryRun: parsed.flags.dryRun, force: parsed.flags.force, styles });
 }

package/dist/esm/cli.js

@@ -129,13 +129,13 @@ export async function checkCommand(options) {
                 checkResult[scope] = scopeResult;
             }
             if (options.verbose && !options.json) {
-                process.stdout.write(formatCheckVerboseText(checkResult, scopes, undefined, thresholds));
+                process.stdout.write(formatCheckVerboseText(checkResult, scopes, options.styles.stdout, undefined, thresholds));
             }
             else if (options.json) {
                 process.stdout.write(formatCheckJson(checkResult, scopes));
             }
             else {
-                process.stdout.write(formatCheckText(checkResult, scopes, undefined, thresholds));
+                process.stdout.write(formatCheckText(checkResult, scopes, options.styles.stdout, undefined, thresholds));
             }
             const hasUnallowed = scopes.some((s) => checkResult[s].unallowed.length > 0);
             return hasUnallowed ? 1 : 0;

package/dist/esm/format-check.d.ts

@@ -1,3 +1,4 @@
+import { type OutputStyle } from '@williamthorsen/nmr-core';
 import type { AuditResult, AuditScope, SeverityThreshold } from './types.js';
 /** Classification of an allowlist entry relative to current audit findings. */
 export interface AllowedVuln {
@@ -32,21 +33,21 @@ export interface CheckResult {
     dev: ScopeCheckResult;
     prod: ScopeCheckResult;
 }
-/** Map a severity string to a colored circle emoji. */
-export declare function severityIndicator(severity: string | undefined): string;
+/** Maps a severity string to its indicator in a style: a colored circle when rich, nothing when plain. */
+export declare function severityIndicator(severity: string | undefined, style: OutputStyle): string;
 /** Resolve the best display ID for a vulnerability: GHSA ID if available, otherwise the numeric ID. */
 export declare function displayId(vuln: {
     ghsaId?: string | undefined;
     id: string;
 }): string;
 /** Build the severity suffix for a finding line, e.g. `  🔴 critical`. */
-export declare function formatSeveritySuffix(severity: string | undefined): string;
+export declare function formatSeveritySuffix(severity: string | undefined, style: OutputStyle): string;
 /**
  * Format check results as human-readable text output.
  *
  * Produces an intro banner, scoped findings with severity labels and GHSA IDs,
  * and an action hints footer.
  */
-export declare function formatCheckText(result: CheckResult, scopes: AuditScope[], now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;
+export declare function formatCheckText(result: CheckResult, scopes: AuditScope[], style: OutputStyle, now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;
 /** Format check results as a JSON string with a top-level `summary` block derived from the result. */
 export declare function formatCheckJson(result: CheckResult, scopes: AuditScope[]): string;

package/dist/esm/format-check.js

@@ -1,69 +1,76 @@
+import { formatGlyphLine } from '@williamthorsen/nmr-core';
 import { formatActionHints } from "./format-actions.js";
 import { deriveSummary } from "./format-summary.js";
 import { formatRelativeTime } from "./format-time.js";
-const SEVERITY_INDICATORS = {
-    critical: '\u{1F534}',
-    high: '\u{1F534}',
-    info: '\u{1F7E1}',
-    low: '\u{1F7E1}',
-    moderate: '\u{1F7E0}',
+import { formatMarkedLine, V11Y_GLYPHS } from "./glyphs.js";
+const SEVERITY_GLYPH_NAMES = {
+    critical: 'severityHigh',
+    high: 'severityHigh',
+    info: 'severityLow',
+    low: 'severityLow',
+    moderate: 'severityModerate',
 };
-export function severityIndicator(severity) {
+export function severityIndicator(severity, style) {
     if (severity === undefined)
         return '';
-    return SEVERITY_INDICATORS[severity] ?? '';
+    const name = SEVERITY_GLYPH_NAMES[severity];
+    return name === undefined ? '' : V11Y_GLYPHS[style][name].text;
 }
 export function displayId(vuln) {
     return vuln.ghsaId ?? vuln.id;
 }
-const SCOPE_LABELS = {
-    dev: '  \u{1F527} dev:',
-    prod: '  \u{1F4E6} prod:',
+const SCOPE_GLYPH_NAMES = {
+    dev: 'scopeDev',
+    prod: 'scopeProd',
 };
 const SCOPE_NAMES = {
     dev: 'dev',
     prod: 'prod',
 };
-function formatThresholdAnnotation(threshold) {
+function formatThresholdAnnotation(threshold, style) {
     if (threshold === undefined || threshold === 'low')
         return '';
-    const indicator = severityIndicator(threshold);
+    const indicator = severityIndicator(threshold, style);
     const indicatorPart = indicator.length > 0 ? `${indicator} ` : '';
     return `(threshold: ${indicatorPart}${threshold})`;
 }
-function formatIntroBanner(scopes, thresholds) {
+function formatIntroBanner(scopes, style, thresholds) {
     const first = scopes[0];
     if (scopes.length === 1 && first !== undefined) {
-        const annotation = formatThresholdAnnotation(thresholds?.[first]);
-        return `\u{1F52C} Auditing ${SCOPE_NAMES[first]} dependencies${annotation && ` ${annotation}`} ...`;
+        const annotation = formatThresholdAnnotation(thresholds?.[first], style);
+        const message = `Auditing ${SCOPE_NAMES[first]} dependencies${annotation && ` ${annotation}`} ...`;
+        return formatGlyphLine(V11Y_GLYPHS, style, 'audit', message);
     }
-    return '\u{1F52C} Auditing dependencies ...';
+    return formatGlyphLine(V11Y_GLYPHS, style, 'audit', 'Auditing dependencies ...');
 }
-export function formatSeveritySuffix(severity) {
+export function formatSeveritySuffix(severity, style) {
     if (severity === undefined || severity === '')
         return '';
-    const emoji = severityIndicator(severity);
+    const emoji = severityIndicator(severity, style);
     const emojiPart = emoji.length > 0 ? `${emoji} ` : '';
     return `  ${emojiPart}${severity}`;
 }
 function formatAllowedSuffix(addedAt, now) {
     const relative = formatRelativeTime(addedAt, now);
     if (relative.length === 0)
-        return ` \u{2022} \u{2705} allowed (${addedAt})`;
-    return ` \u{2022} \u{2705} allowed since ${relative} (${addedAt})`;
+        return ` \u{2022} allowed (${addedAt})`;
+    return ` \u{2022} allowed since ${relative} (${addedAt})`;
 }
-function formatUnallowedLine(vuln) {
-    return `  \u{2022} \u{1F6A8} ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)}`;
+function formatUnallowedLine(vuln, style) {
+    const message = `${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity, style)}`;
+    return `  \u{2022} ${formatMarkedLine(style, 'failed', message)}`;
 }
-function formatAllowedLine(vuln, now) {
+function formatAllowedLine(vuln, now, style) {
     const suffix = vuln.addedAt !== undefined ? formatAllowedSuffix(vuln.addedAt, now) : '';
-    return `  \u{2022} \u{26A0}\u{FE0F} ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)}${suffix}`;
+    const message = `${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity, style)}${suffix}`;
+    return `  \u{2022} ${formatMarkedLine(style, 'passed', message)}`;
 }
-function formatStaleLine(entry) {
-    return `  \u{2022} \u{1F5D1}\u{FE0F} ${entry.id} \u{2022} not needed`;
+function formatStaleLine(entry, style) {
+    return `  \u{2022} ${formatMarkedLine(style, 'stale', `${entry.id} \u{2022} not needed`)}`;
 }
-function formatBelowThresholdLine(vuln) {
-    return `  \u{2022} \u{2139}\u{FE0F} ${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity)} \u{2022} \u{1F6AB} ignored`;
+function formatBelowThresholdLine(vuln, style) {
+    const message = `${displayId(vuln)}: ${vuln.path}${formatSeveritySuffix(vuln.severity, style)} \u{2022} ignored`;
+    return `  \u{2022} ${formatMarkedLine(style, 'skipped', message)}`;
 }
 function hasFindings(result) {
     return (result.unallowed.length > 0 ||
@@ -71,22 +78,22 @@ function hasFindings(result) {
         result.stale.length > 0 ||
         result.belowThreshold.length > 0);
 }
-function formatScopeFindings(result, now) {
-    const lines = Array.from(result.unallowed, (vuln) => formatUnallowedLine(vuln));
+function formatScopeFindings(result, now, style) {
+    const lines = Array.from(result.unallowed, (vuln) => formatUnallowedLine(vuln, style));
     for (const vuln of result.allowed) {
-        lines.push(formatAllowedLine(vuln, now));
+        lines.push(formatAllowedLine(vuln, now, style));
     }
     for (const entry of result.stale) {
-        lines.push(formatStaleLine(entry));
+        lines.push(formatStaleLine(entry, style));
     }
     for (const vuln of result.belowThreshold) {
-        lines.push(formatBelowThresholdLine(vuln));
+        lines.push(formatBelowThresholdLine(vuln, style));
     }
     return lines;
 }
-export function formatCheckText(result, scopes, now, thresholds) {
+export function formatCheckText(result, scopes, style, now, thresholds) {
     const effectiveNow = now ?? new Date();
-    const lines = [formatIntroBanner(scopes, thresholds)];
+    const lines = [formatIntroBanner(scopes, style, thresholds)];
     const anyFindings = scopes.some((scope) => hasFindings(result[scope]));
     if (!anyFindings) {
         lines.push('No known vulnerabilities found.');
@@ -96,7 +103,7 @@ export function formatCheckText(result, scopes, now, thresholds) {
     if (singleScope !== undefined) {
         const scope = singleScope;
         const scopeResult = result[scope];
-        lines.push(...formatScopeFindings(scopeResult, effectiveNow));
+        lines.push(...formatScopeFindings(scopeResult, effectiveNow, style));
         const actions = formatActionHints(result, scopes);
         if (actions.length > 0) {
             lines.push('', ...actions.split('\n').filter((l) => l.length > 0));
@@ -105,11 +112,11 @@ export function formatCheckText(result, scopes, now, thresholds) {
     }
     for (const scope of scopes) {
         const scopeResult = result[scope];
-        const annotation = formatThresholdAnnotation(thresholds?.[scope]);
-        const header = `${SCOPE_LABELS[scope]}${annotation && ` ${annotation}`}`;
-        lines.push(header);
+        const annotation = formatThresholdAnnotation(thresholds?.[scope], style);
+        const label = formatGlyphLine(V11Y_GLYPHS, style, SCOPE_GLYPH_NAMES[scope], `${SCOPE_NAMES[scope]}:`);
+        lines.push(`  ${label}${annotation && ` ${annotation}`}`);
         if (hasFindings(scopeResult)) {
-            lines.push(...formatScopeFindings(scopeResult, effectiveNow));
+            lines.push(...formatScopeFindings(scopeResult, effectiveNow, style));
         }
         else {
             lines.push('  No known vulnerabilities found.');

package/dist/esm/format-verbose.d.ts

@@ -1,4 +1,5 @@
+import { type OutputStyle } from '@williamthorsen/nmr-core';
 import { type CheckResult } from './format-check.js';
 import type { AuditScope, SeverityThreshold } from './types.js';
 /** Format the verbose per-vulnerability check output as text. */
-export declare function formatCheckVerboseText(result: CheckResult, scopes: AuditScope[], now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;
+export declare function formatCheckVerboseText(result: CheckResult, scopes: AuditScope[], style: OutputStyle, now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;

package/dist/esm/format-verbose.js

@@ -1,35 +1,35 @@
+import { formatGlyphLine, wrapToWidth } from '@williamthorsen/nmr-core';
 import { formatActionHints } from "./format-actions.js";
 import { displayId, formatSeveritySuffix, severityIndicator, } from "./format-check.js";
 import { formatRelativeTime } from "./format-time.js";
-const STATUS_UNALLOWED = '\u{1F6A8}';
-const STATUS_ALLOWED = '\u{26A0}\u{FE0F}';
-const STATUS_BELOW_THRESHOLD = '\u{2139}\u{FE0F}';
-const STATUS_STALE = '\u{1F5D1}\u{FE0F}';
-const SCOPE_HEADERS = {
-    prod: '-- \u{1F4E6} prod --',
-    dev: '-- \u{1F527} dev --',
+import { formatMarkedLine, measureRowMarkerColumn, V11Y_GLYPHS } from "./glyphs.js";
+const SCOPE_GLYPH_NAMES = {
+    dev: 'scopeDev',
+    prod: 'scopeProd',
 };
-const DETAIL_INDENT = ' '.repeat(5);
+const MARKER_INDENT = '  ';
 const WRAP_COLUMNS = 72;
-export function formatCheckVerboseText(result, scopes, now, thresholds) {
+export function formatCheckVerboseText(result, scopes, style, now, thresholds) {
     const effectiveNow = now ?? new Date();
-    const sections = Array.from(scopes, (scope) => formatScopeVerbose(scope, result[scope], effectiveNow, thresholds?.[scope]));
+    const sections = Array.from(scopes, (scope) => formatScopeVerbose(scope, result[scope], effectiveNow, style, thresholds?.[scope]));
     const actions = formatActionHints(result, scopes);
     const body = sections.join('\n\n') + '\n';
     if (actions.length === 0)
         return body;
     return body + '\n' + actions + '\n';
 }
-function formatThresholdSuffix(threshold) {
+function formatThresholdSuffix(threshold, style) {
     if (threshold === undefined || threshold === 'low')
         return '';
-    const indicator = severityIndicator(threshold);
+    const indicator = severityIndicator(threshold, style);
     const indicatorPart = indicator.length > 0 ? `${indicator} ` : '';
     return ` (threshold: ${indicatorPart}${threshold})`;
 }
-function formatScopeVerbose(scope, result, now, threshold) {
-    const thresholdSuffix = formatThresholdSuffix(threshold);
-    const lines = [`${SCOPE_HEADERS[scope]}${thresholdSuffix}`];
+function formatScopeVerbose(scope, result, now, style, threshold) {
+    const thresholdSuffix = formatThresholdSuffix(threshold, style);
+    const lines = [
+        `-- ${formatGlyphLine(V11Y_GLYPHS, style, SCOPE_GLYPH_NAMES[scope], scope)} --${thresholdSuffix}`,
+    ];
     const hasFindings = result.unallowed.length > 0 ||
         result.allowed.length > 0 ||
         result.stale.length > 0 ||
@@ -38,65 +38,72 @@ function formatScopeVerbose(scope, result, now, threshold) {
         lines.push('  (none)');
         return lines.join('\n');
     }
-    const blocks = Array.from(result.unallowed, (vuln) => formatUnallowedBlock(vuln));
+    const blocks = Array.from(result.unallowed, (vuln) => formatUnallowedBlock(vuln, style));
     for (const vuln of result.allowed) {
-        blocks.push(formatAllowedBlock(vuln, now));
+        blocks.push(formatAllowedBlock(vuln, now, style));
     }
     for (const entry of result.stale) {
-        blocks.push(formatStaleLine(entry));
+        blocks.push(formatStaleLine(entry, style));
     }
     for (const vuln of result.belowThreshold) {
-        blocks.push(formatBelowThresholdBlock(vuln));
+        blocks.push(formatBelowThresholdBlock(vuln, style));
     }
     return lines.concat(blocks.join('\n\n')).join('\n');
 }
-function formatUnallowedBlock(vuln) {
-    const headerLine = `  ${STATUS_UNALLOWED} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}`;
-    const detail = formatAdvisoryDetail(vuln);
+function formatUnallowedBlock(vuln, style) {
+    const message = `${displayId(vuln)}${formatSeveritySuffix(vuln.severity, style)}`;
+    const headerLine = `${MARKER_INDENT}${formatMarkedLine(style, 'failed', message)}`;
+    const detail = formatAdvisoryDetail(vuln, style);
     return [headerLine, ...detail].join('\n');
 }
-function formatAllowedBlock(vuln, now) {
+function formatAllowedBlock(vuln, now, style) {
     const allowedSuffix = vuln.addedAt !== undefined ? formatAllowedSuffix(vuln.addedAt, now) : '';
-    const headerLine = `  ${STATUS_ALLOWED} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}${allowedSuffix}`;
+    const message = `${displayId(vuln)}${formatSeveritySuffix(vuln.severity, style)}${allowedSuffix}`;
+    const headerLine = `${MARKER_INDENT}${formatMarkedLine(style, 'passed', message)}`;
     const hasTitle = vuln.title !== undefined;
-    const detail = formatAdvisoryDetail(vuln);
+    const detail = formatAdvisoryDetail(vuln, style);
     if (vuln.reason !== undefined) {
         const reasonLineIndex = findReasonInsertionIndex(hasTitle);
-        detail.splice(reasonLineIndex, 0, `${DETAIL_INDENT}reason: ${vuln.reason}`);
+        detail.splice(reasonLineIndex, 0, `${buildDetailIndent(style)}reason: ${vuln.reason}`);
     }
     return [headerLine, ...detail].join('\n');
 }
-function formatStaleLine(entry) {
-    return `  ${STATUS_STALE} ${entry.id}  not needed`;
+function formatStaleLine(entry, style) {
+    return `${MARKER_INDENT}${formatMarkedLine(style, 'stale', `${entry.id}  not needed`)}`;
 }
-function formatBelowThresholdBlock(vuln) {
-    const headerLine = `  ${STATUS_BELOW_THRESHOLD} ${displayId(vuln)}${formatSeveritySuffix(vuln.severity)}  ignored (below threshold)`;
-    const detail = formatAdvisoryDetail(vuln);
+function formatBelowThresholdBlock(vuln, style) {
+    const message = `${displayId(vuln)}${formatSeveritySuffix(vuln.severity, style)}  ignored (below threshold)`;
+    const headerLine = `${MARKER_INDENT}${formatMarkedLine(style, 'skipped', message)}`;
+    const detail = formatAdvisoryDetail(vuln, style);
     return [headerLine, ...detail].join('\n');
 }
-function formatAdvisoryDetail(vuln) {
+function formatAdvisoryDetail(vuln, style) {
+    const detailIndent = buildDetailIndent(style);
     const lines = [];
     if (vuln.title !== undefined) {
-        lines.push(`${DETAIL_INDENT}${vuln.title}`);
+        lines.push(`${detailIndent}${vuln.title}`);
     }
-    lines.push(...formatPathsLines(vuln.paths), `${DETAIL_INDENT}link: ${vuln.url}`);
+    lines.push(...formatPathsLines(vuln.paths, detailIndent), `${detailIndent}link: ${vuln.url}`);
     if (vuln.description !== undefined) {
-        lines.push('', ...formatDescriptionLines(vuln.description));
+        lines.push('', ...formatDescriptionLines(vuln.description, detailIndent));
     }
     return lines;
 }
+function buildDetailIndent(style) {
+    return ' '.repeat(MARKER_INDENT.length + measureRowMarkerColumn(style) + 1);
+}
 function findReasonInsertionIndex(hasTitle) {
     return hasTitle ? 1 : 0;
 }
-function formatPathsLines(paths) {
+function formatPathsLines(paths, detailIndent) {
     if (paths.length === 0)
         return [];
     if (paths.length === 1) {
-        return [`${DETAIL_INDENT}path: ${paths[0]}`];
+        return [`${detailIndent}path: ${paths[0]}`];
     }
-    const lines = [`${DETAIL_INDENT}paths:`];
+    const lines = [`${detailIndent}paths:`];
     for (const pathValue of paths) {
-        lines.push(`${DETAIL_INDENT}  - ${pathValue}`);
+        lines.push(`${detailIndent}  - ${pathValue}`);
     }
     return lines;
 }
@@ -106,41 +113,17 @@ function formatAllowedSuffix(addedAt, now) {
         return `  allowed (${addedAt})`;
     return `  allowed ${relative} (${addedAt})`;
 }
-function formatDescriptionLines(description) {
+function formatDescriptionLines(description, detailIndent) {
     const paragraphs = description.split(/\n\s*\n/);
     const lines = [];
     let needsSeparator = false;
     for (const paragraph of paragraphs) {
         if (needsSeparator)
             lines.push('');
-        const wrapped = wrapParagraph(paragraph.trim(), WRAP_COLUMNS);
-        for (const wrappedLine of wrapped) {
-            lines.push(`${DETAIL_INDENT}${wrappedLine}`);
-        }
+        const wrapped = wrapToWidth(paragraph, { indent: detailIndent.length, width: WRAP_COLUMNS + detailIndent.length });
+        if (wrapped !== '')
+            lines.push(...wrapped.split('\n'));
         needsSeparator = true;
     }
     return lines;
 }
-function wrapParagraph(paragraph, columns) {
-    if (paragraph.length === 0)
-        return [];
-    const words = paragraph.split(/\s+/);
-    const lines = [];
-    let current = '';
-    for (const word of words) {
-        if (current === '') {
-            current = word;
-            continue;
-        }
-        if (current.length + 1 + word.length > columns) {
-            lines.push(current);
-            current = word;
-        }
-        else {
-            current += ` ${word}`;
-        }
-    }
-    if (current !== '')
-        lines.push(current);
-    return lines;
-}

package/dist/esm/glyphs.d.ts

@@ -0,0 +1,13 @@
+import { type OutputStyle, type StatusGlyphName } from '@williamthorsen/nmr-core';
+/**
+ * Glyphs that name no status; a status marker comes from nmr-core's `STATUS_GLYPHS`. A plain variant is empty
+ * where a word always follows the glyph.
+ */
+export declare const V11Y_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"audit" | "scopeDev" | "scopeProd" | "severityHigh" | "severityLow" | "severityModerate" | "stale", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
+export type V11yGlyphName = keyof (typeof V11Y_GLYPHS)['rich'];
+/** A glyph that opens a finding's row: a status, or the stale marker. */
+export type RowMarkerName = StatusGlyphName | 'stale';
+/** Renders a row marker and a message, padding the marker so that messages align across markers. */
+export declare function formatMarkedLine(style: OutputStyle, name: RowMarkerName, message: string): string;
+/** Reports the cells taken by the widest row marker in a style. */
+export declare function measureRowMarkerColumn(style: OutputStyle): number;

package/dist/esm/glyphs.js

@@ -0,0 +1,18 @@
+import { defineGlyphSet, measureGlyphColumn, STATUS_GLYPHS, } from '@williamthorsen/nmr-core';
+export const V11Y_GLYPHS = defineGlyphSet({
+    audit: { plain: '', rich: '\u{1F52C}' },
+    scopeDev: { plain: '', rich: '\u{1F527}' },
+    scopeProd: { plain: '', rich: '\u{1F4E6}' },
+    severityHigh: { plain: '', rich: '\u{1F534}' },
+    severityLow: { plain: '', rich: '\u{1F7E1}' },
+    severityModerate: { plain: '', rich: '\u{1F7E0}' },
+    stale: { plain: 'STALE', rich: '\u{1F9F9}' },
+});
+export function formatMarkedLine(style, name, message) {
+    const glyph = name === 'stale' ? V11Y_GLYPHS[style].stale : STATUS_GLYPHS[style][name];
+    const padding = ' '.repeat(measureRowMarkerColumn(style) - glyph.width);
+    return `${glyph.text}${padding} ${message}`;
+}
+export function measureRowMarkerColumn(style) {
+    return Math.max(measureGlyphColumn(STATUS_GLYPHS[style]), V11Y_GLYPHS[style].stale.width);
+}

package/dist/esm/init/initCommand.d.ts

@@ -1,6 +1,8 @@
+import { type StreamStyles } from '@williamthorsen/nmr-core';
 interface InitOptions {
     dryRun: boolean;
     force: boolean;
+    styles: StreamStyles;
 }
 /**
  * Run the `v11y init` command.
@@ -8,5 +10,5 @@ interface InitOptions {
  * Scaffolds the starter config file and the GitHub Actions workflow, then prints next steps.
  * Returns the process exit code (0 for success, 1 if any write failed).
  */
-export declare function initCommand({ dryRun, force }: InitOptions): number;
+export declare function initCommand({ dryRun, force, styles }: InitOptions): number;
 export {};

package/dist/esm/init/initCommand.js

@@ -1,7 +1,7 @@
 import { printError, printStep, reportWriteResult } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { scaffoldFiles } from "./scaffold.js";
-export function initCommand({ dryRun, force }) {
+export function initCommand({ dryRun, force, styles }) {
     if (dryRun) {
         console.info('[dry-run mode]');
     }
@@ -11,11 +11,11 @@ export function initCommand({ dryRun, force }) {
         results = scaffoldFiles({ dryRun, force });
     }
     catch (error) {
-        printError(`Failed to scaffold files: ${describeError(error)}`);
+        printError(`Failed to scaffold files: ${describeError(error)}`, styles.stderr);
         return 1;
     }
     for (const result of results) {
-        reportWriteResult(result, dryRun);
+        reportWriteResult(result, dryRun, styles);
     }
     if (results.some((r) => r.outcome === 'failed')) {
         return 1;

package/dist/esm/resolveStyles.d.ts

@@ -0,0 +1,10 @@
+import { type StreamStyles } from '@williamthorsen/nmr-core';
+/** The environment variable holding the caller's standing style preference: `auto`, `plain`, or `rich`. */
+export declare const OUTPUT_STYLE_ENV_VAR = "V11Y_CHECK_OUTPUT_STYLE";
+export interface ResolveStylesOptions {
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly stderrIsTty: boolean;
+    readonly stdoutIsTty: boolean;
+}
+/** Resolves the style of each output stream, reporting a usage error and returning `undefined` when the variable names no setting. */
+export declare function resolveStyles(options: ResolveStylesOptions): StreamStyles | undefined;

package/dist/esm/resolveStyles.js

@@ -0,0 +1,10 @@
+import { describeInvalidOutputStyle, reportError, resolveStreamStyles, } from '@williamthorsen/nmr-core';
+export const OUTPUT_STYLE_ENV_VAR = 'V11Y_CHECK_OUTPUT_STYLE';
+export function resolveStyles(options) {
+    const { invalid, styles } = resolveStreamStyles({ ...options, envVar: OUTPUT_STYLE_ENV_VAR });
+    if (invalid !== undefined) {
+        reportError(describeInvalidOutputStyle(invalid));
+        return undefined;
+    }
+    return styles;
+}

package/dist/esm/types.d.ts

@@ -1,3 +1,4 @@
+import type { StreamStyles } from '@williamthorsen/nmr-core';
 import { z } from 'zod';
 /** The dependency scope to audit: development or production. */
 export type AuditScope = 'dev' | 'prod';
@@ -107,6 +108,7 @@ export interface CommandOptions {
     configPath?: string | undefined;
     json: boolean;
     scopes: AuditScope[];
+    styles: StreamStyles;
     verbose: boolean;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "v11y-check",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "private": false,
   "description": "Wrap audit-ci with a richer config model, typed JSON source of truth, and sync workflow",
   "keywords": [
@@ -45,16 +45,16 @@
     "templates"
   ],
   "dependencies": {
-    "@williamthorsen/nmr-core": "0.11.1",
-    "@williamthorsen/toolbelt.errors": "0.7.0",
+    "@williamthorsen/nmr-core": "0.13.0",
+    "@williamthorsen/toolbelt.errors": "0.8.1",
     "audit-ci": "7.1.0",
-    "zod": "4.5.4"
+    "zod": "4.6.5"
   },
   "devDependencies": {
-    "@williamthorsen/toolbelt.filesystem": "0.8.3",
-    "@williamthorsen/toolbelt.testing": "0.5.1",
-    "@williamthorsen/toolbelt.vitest": "0.9.0",
-    "readyup": "0.36.0",
+    "@williamthorsen/toolbelt.filesystem": "0.9.1",
+    "@williamthorsen/toolbelt.testing": "0.6.1",
+    "@williamthorsen/toolbelt.vitest": "0.10.1",
+    "readyup": "0.38.0",
     "vitest": "4.1.11"
   },
   "engines": {