v11y-check 0.18.0 → 0.19.0

package/.meta/changelog.json

@@ -1,4 +1,106 @@
 [
+  {
+    "version": "0.19.0",
+    "date": "2026-10-01",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds `v11y update-templates`, which writes `.github/workflows/audit.yaml` when it is missing or differs from the installed template, prints a diff of the update, and never reads or writes the config file. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 2
+          },
+          {
+            "description": "Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Rewords the `v11y-check` README and the message that `v11y` prints for missing build output, which addressed the reader in the second person and used em-dashes and figurative verbs. (#939)",
+            "hash": "700bc1f5ef09a8e6167de0bf109940f26eb4c18e",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that two comments in the `audit.yaml` workflow generated by `v11y init` did not follow the project's writing rules; the v11y-check kit check reports a previously generated `audit.yaml` as stale until `v11y init --force` regenerates it. (#946)",
+            "hash": "dc1c4bd4b05425ed1c2a7d031105c402c3d01f20",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Replaces every `.sort()` call that suppressed `unicorn/no-array-sort` with `toSorted()` and drops the spread copy wherever the source was already an array. (#925)",
+            "hash": "4680fb4e865ffce0bd135fac20d49b766b156992",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Renames the `resolveAuditCiBin` test to `returns a non-empty path to the audit-ci bin`, because the old title claimed that it exercised the fallback, and moves a verbose-hint test from the \"Threshold annotation\" group to the \"Actions footer\" group of `format-check.unit.test.ts`. (#924)",
+            "hash": "71a216c8403245b45c42acd06c23ebad09063c1f",
+            "entry": 2
+          },
+          {
+            "description": "Moves the helpers in the `format-check`, `format-summary`, and `format-verbose` unit tests below their `describe` blocks and sorts them alphabetically, matching `cli.unit.test.ts` and `run-audit.unit.test.ts`. (#947)",
+            "hash": "a0b69c1fa72236e877d1b973140ad6ac40a91018",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Adds `esbuild` 0.28.2 to the pnpm catalog and declares it as a devDependency of `nmr`, `release-kit`, and `v11y-check`, because `readyup` declares it only as an optional peer and `rdy compile` failed in those packages once a regenerated lockfile stopped installing it. (#944)",
+            "hash": "6dffd5df5bc4209dc225d08390ef2b67fe381f1b",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Revises the comments in `packages/v11y-check/src` and the `default` readyup kit against the comment-discipline rules, correcting the ones that misstated the code, such as the `@internal Exported for testing` tags on functions that production code calls, and deleting the ones that restated it. (#924)",
+            "hash": "71a216c8403245b45c42acd06c23ebad09063c1f",
+            "entry": 1
+          },
+          {
+            "description": "Revises the doc comments, code comments, and test titles across `packages/v11y-check`, including its readyup kit, to follow the plain-speech doctrine and writing conventions. (#939)",
+            "hash": "700bc1f5ef09a8e6167de0bf109940f26eb4c18e",
+            "entry": 2
+          },
+          {
+            "description": "Replaces the inline headings of the `Types` and `Display ID helper` sections in `format-check.ts`, and of the `Helpers` sections in the `format-check`, `format-summary`, and `format-verbose` unit tests, with `// region | …` / `// endregion | …` folds, which the house style reserves for supporting blocks. (#947)",
+            "hash": "a0b69c1fa72236e877d1b973140ad6ac40a91018",
+            "entry": 1
+          },
+          {
+            "description": "Retitles the `Dependency updates` section of v11y-check's 0.14.1 changelog entry to `📦 Dependencies`, in `.meta/changelog.json` and in the `CHANGELOG.md` rendered from it, so that the next release does not re-emit the retired title. (#950)",
+            "hash": "5a4771a1cb1e1b324a9ce3cb64fc3527199946a7",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "0.18.0",
     "date": "2026-09-18",
@@ -307,7 +409,7 @@
     "date": "2026-08-04",
     "sections": [
       {
-        "title": "Dependency updates",
+        "title": "📦 Dependencies",
         "audience": "dev",
         "items": [{ "description": "Bumped `@williamthorsen/nmr-core` to 0.9.1" }]
       }

package/.readyup/kits/default.js

@@ -8,13 +8,13 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { defineRdyKit } from "readyup";
 import { fileExists, fileMatchesHash, hasDevDependency, hasMinDevDependencyVersion } from "readyup/check-utils";
-var AUDIT_WORKFLOW_HASH = "cdcab39d794ed7ec5ea45e8f3c887eb5d15edb63eab65e515714556933d9b03f";
+var AUDIT_WORKFLOW_HASH = "ad969e3fefe603cee04de02e300e6f4d4d9dae9e8e58bddb9db81980115bc260";
 var default_default = defineRdyKit({
   checklists: [
     {
       name: "v11y-check",
       checks: [
-        // -- Setup ---------------------------------------------------------------
+        // -- Setup --
         {
           name: "v11y-check in devDependencies",
           severity: "error",
@@ -35,7 +35,7 @@ var default_default = defineRdyKit({
             }
           ]
         },
-        // -- Audit-ci config migration -------------------------------------------
+        // -- Audit-ci config migration --
         {
           name: "audit-ci configs are under .config/audit-ci/",
           severity: "warn",
@@ -43,7 +43,7 @@ var default_default = defineRdyKit({
           check: noLegacyAuditCiDirectory,
           fix: "Move audit-ci configs from .audit-ci/ to .config/audit-ci/ and update references"
         },
-        // -- Audit workflow ------------------------------------------------------
+        // -- Audit workflow --
         {
           name: "audit.yaml workflow exists",
           severity: "warn",
@@ -54,7 +54,7 @@ var default_default = defineRdyKit({
               name: "audit.yaml matches template",
               severity: "warn",
               check: () => fileMatchesHash(".github/workflows/audit.yaml", AUDIT_WORKFLOW_HASH),
-              fix: "Run `v11y init --force` to regenerate audit.yaml from the current template"
+              fix: "Run `v11y update-templates` to regenerate audit.yaml from the current template"
             }
           ]
         }
@@ -63,7 +63,7 @@ var default_default = defineRdyKit({
   ]
 });
 function getMinVersion() {
-  const picked = { "version": "0.18.0" };
+  const picked = { "version": "0.19.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("v11y-check/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "5600fe16",
+          "hash": "3ca06efb",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "b9dec108",
+          "hash": "819284aa",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -25,8 +25,8 @@
       "path": "kits/default.js",
       "readyupVersion": "0.38.0",
       "source": "kits/default.ts",
-      "sourceHash": "5600fe16",
-      "targetHash": "35553b19"
+      "sourceHash": "3ca06efb",
+      "targetHash": "32c10111"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.19.0 — 2026-10-01
+
+### 🎉 Features
+
+- Adds `v11y update-templates`, which writes `.github/workflows/audit.yaml` when it is missing or differs from the installed template, prints a diff of the update, and never reads or writes the config file. (#952)
+- Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)
+
+### 🐛 Bug fixes
+
+- Rewords the `v11y-check` README and the message that `v11y` prints for missing build output, which addressed the reader in the second person and used em-dashes and figurative verbs. (#939)
+- Fixes the issue that two comments in the `audit.yaml` workflow generated by `v11y init` did not follow the project's writing rules; the v11y-check kit check reports a previously generated `audit.yaml` as stale until `v11y init --force` regenerates it. (#946)
+
+### ♻️ Refactoring
+
+- Replaces every `.sort()` call that suppressed `unicorn/no-array-sort` with `toSorted()` and drops the spread copy wherever the source was already an array. (#925)
+
+### 🧪 Tests
+
+- Renames the `resolveAuditCiBin` test to `returns a non-empty path to the audit-ci bin`, because the old title claimed that it exercised the fallback, and moves a verbose-hint test from the "Threshold annotation" group to the "Actions footer" group of `format-check.unit.test.ts`. (#924)
+- Moves the helpers in the `format-check`, `format-summary`, and `format-verbose` unit tests below their `describe` blocks and sorts them alphabetically, matching `cli.unit.test.ts` and `run-audit.unit.test.ts`. (#947)
+
+### 📦 Dependencies
+
+- Adds `esbuild` 0.28.2 to the pnpm catalog and declares it as a devDependency of `nmr`, `release-kit`, and `v11y-check`, because `readyup` declares it only as an optional peer and `rdy compile` failed in those packages once a regenerated lockfile stopped installing it. (#944)
+
+### 📚 Documentation
+
+- Revises the comments in `packages/v11y-check/src` and the `default` readyup kit against the comment-discipline rules, correcting the ones that misstated the code, such as the `@internal Exported for testing` tags on functions that production code calls, and deleting the ones that restated it. (#924)
+- Revises the doc comments, code comments, and test titles across `packages/v11y-check`, including its readyup kit, to follow the plain-speech doctrine and writing conventions. (#939)
+- Replaces the inline headings of the `Types` and `Display ID helper` sections in `format-check.ts`, and of the `Helpers` sections in the `format-check`, `format-summary`, and `format-verbose` unit tests, with `// region | …` / `// endregion | …` folds, which the house style reserves for supporting blocks. (#947)
+- Retitles the `Dependency updates` section of v11y-check's 0.14.1 changelog entry to `📦 Dependencies`, in `.meta/changelog.json` and in the `CHANGELOG.md` rendered from it, so that the next release does not re-emit the retired title. (#950)
+
 ## 0.18.0 — 2026-09-18
 
 ### 🎉 Features
@@ -175,7 +207,7 @@ All notable changes to this project will be documented in this file.
 
 ## 0.14.1 — 2026-08-04
 
-### Dependency updates
+### 📦 Dependencies
 
 - Bumped `@williamthorsen/nmr-core` to 0.9.1
 

package/README.md

@@ -5,21 +5,17 @@
 Wraps [audit-ci](https://github.com/IBM/audit-ci) with a richer config model, typed JSON source of truth, and a sync workflow that automates allowlist management.
 
 <!-- section:release-notes -->
-## Release notes — v0.18.0 (2026-09-18)
+## Release notes — v0.19.0 (2026-10-01)
 
 ### 🎉 Features
 
-- Adopt output styles, shared glyphs, and column-aware wrapping (#836)
+- Adds `v11y update-templates`, which writes `.github/workflows/audit.yaml` when it is missing or differs from the installed template, prints a diff of the update, and never reads or writes the config file. (#952)
+- Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)
 
-  - Makes `v11y-check` print `check` and `init` output without emoji, and with a word such as `PASS` or `STALE` in place of each row marker, to whichever of stdout and stderr is not a terminal, or to both when `CI` is set.
-  - Adds the `V11Y_CHECK_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich`, overrides that detection, and makes any other value a usage error that exits with code 1.
-  - Changes the emoji row markers of rich output: ❌ replaces 🚨 for an unallowed row, ✅ replaces ⚠️ for an allowed row, ⏩ replaces ℹ️ for a below-threshold row, 🧹 replaces 🗑️ for a stale row, and the `allowed` and `ignored` suffixes of a compact row lose their emoji.
+### 🐛 Bug fixes
 
-- Give nmr plain output in pipes and CI logs (#838)
-
-  - Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.
-  - Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.
-  - Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.
+- Rewords the `v11y-check` README and the message that `v11y` prints for missing build output, which addressed the reader in the second person and used em-dashes and figurative verbs. (#939)
+- Fixes the issue that two comments in the `audit.yaml` workflow generated by `v11y init` did not follow the project's writing rules; the v11y-check kit check reports a previously generated `audit.yaml` as stale until `v11y init --force` regenerates it. (#946)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -30,7 +26,7 @@ Requires Node.js 24 or later.
 pnpm add -D v11y-check
 ```
 
-The package is `v11y-check`; the bin is `v11y`. The package also ships `v11y-check` as a bin alias, so `pnpm exec v11y-check` and `npx v11y-check` continue to work.
+The package is `v11y-check`; the bin is `v11y`. The package also declares `v11y-check` as a bin alias, so `pnpm exec v11y-check` and `npx v11y-check` continue to work.
 
 ## Quick start
 
@@ -48,7 +44,7 @@ npx v11y-check sync
 npx v11y-check --raw
 ```
 
-No config file is required. When `.config/v11y-check.config.json` is absent, the tool uses built-in defaults: `severityThreshold: 'moderate'` for dev, `severityThreshold: 'low'` for prod, and empty allowlists.
+The tool does not require a config file. When `.config/v11y-check.config.json` is absent, the tool uses built-in defaults: `severityThreshold: 'moderate'` for dev, `severityThreshold: 'low'` for prod, and empty allowlists.
 
 ## Configuration
 
@@ -78,16 +74,16 @@ The source-of-truth config lives at `.config/v11y-check.config.json`:
 
 ### Fields
 
-- **`$schema`** (optional) — JSON Schema URL for editor autocomplete and validation. Automatically included by `init` and `sync`.
-- **`dev`** / **`prod`** — Scope-specific settings:
-  - **`severityThreshold`** (optional) — Fail on advisories at or above this severity. Valid values: `'low'`, `'moderate'`, `'high'`, `'critical'`. When omitted, audit-ci uses its own defaults.
-  - **`allowlist`** — Typed advisory entries with `id`, `path`, `url`, and optional `reason` and `addedAt`. `addedAt` is an ISO 8601 UTC datetime (e.g., `2026-04-15T09:30:00.000Z`) populated automatically by `v11y sync` on new entries; existing entries retain whatever value they had. Older `YYYY-MM-DD` values are still accepted.
+- **`$schema`** (optional): JSON Schema URL for editor autocomplete and validation. Automatically included by `init` and `sync`.
+- **`dev`** / **`prod`**: Scope-specific settings:
+  - **`severityThreshold`** (optional): Fail on advisories at or above this severity. Valid values: `'low'`, `'moderate'`, `'high'`, `'critical'`. When omitted, audit-ci uses its own defaults.
+  - **`allowlist`**: Typed advisory entries with `id`, `path`, `url`, and optional `reason` and `addedAt`. `addedAt` is an ISO 8601 UTC datetime (e.g., `2026-04-15T09:30:00.000Z`) populated automatically by `v11y sync` on new entries; existing entries retain whatever value they had. Older `YYYY-MM-DD` values are still accepted.
 
 ### Output style
 
 The `V11Y_CHECK_OUTPUT_STYLE` environment variable sets the style for every command, `init` included: `rich` marks each finding with an emoji, such as ❌ or ✅, and `plain` prints a word in its place, such as `FAIL` or `PASS`, which a reader of a log can search for. `auto`, the default, defers to detection. Any other value is a usage error that exits with code 1.
 
-Detection decides stdout and stderr separately. A stream is plain when `CI` is set to anything other than an empty string or `false`, when the stream is not a terminal, or when `TERM` is `linux`; otherwise it is rich. `--json` output contains no emoji in either style.
+Detection decides stdout and stderr separately. A stream is plain when `CI` is set to anything other than an empty string or `false`, when the stream is not a terminal, or when `TERM` is `linux`; otherwise it is rich. `--json` output does not contain any emoji in either style.
 
 ## CLI reference
 
@@ -99,6 +95,7 @@ Commands:
   check (default)      Grouped vulnerability check with severity indicators
   sync                 Synchronize allowlists with current audit findings
   init                 Scaffold a starter config file and GitHub Actions workflow
+  update-templates     Update the scaffolded workflow to the current template
 
 Scope options:
   --dev                Target dev dependencies only
@@ -125,6 +122,12 @@ Environment:
   --force, -f     Overwrite an existing workflow (an existing config is never overwritten)
 ```
 
+### Update-templates options
+
+```
+  --dry-run, -n   Preview changes without writing files
+```
+
 ### JSON output shape
 
 `--json` emits one object per requested scope plus a top-level `summary` block:
@@ -150,15 +153,15 @@ Environment:
 
 ## Scaffolded GitHub Actions workflow
 
-`v11y init` scaffolds `.github/workflows/audit.yaml` alongside the config file. The workflow is a thin caller that delegates to the versioned reusable workflow published at `williamthorsen/node-monorepo-tools/.github/workflows/audit.reusable.yaml@workflow/audit-v1`, so your repository tracks the reusable workflow at a stable version tag.
+`v11y init` scaffolds `.github/workflows/audit.yaml` alongside the config file. The workflow is a thin caller that delegates to the versioned reusable workflow published at `williamthorsen/node-monorepo-tools/.github/workflows/audit.reusable.yaml@workflow/audit-v1`, so the consuming repository tracks the reusable workflow at a stable version tag.
 
-The scaffolded workflow triggers on pull requests to `main`/`next`, on a daily schedule, and on manual `workflow_dispatch`. Commit the file into your repository so the caller runs in CI. If the reusable workflow's caller-side requirements change (for example, the tag bumps), re-run `v11y init --force` to refresh the file.
+The scaffolded workflow triggers on pull requests to `main`/`next`, on a daily schedule, and on manual `workflow_dispatch`. Commit the file into the repository so that the caller runs in CI. If the reusable workflow's caller-side requirements change (for example, the tag bumps), run `v11y update-templates` to refresh the file, which shows what changed and leaves the config file untouched.
 
-The reusable workflow installs pnpm with [`pnpm/setup`](https://github.com/pnpm/setup), which installs pnpm 11 or newer only and reads the version from your `devEngines.packageManager` or `packageManager` field. A repository pinned below that cannot run it.
+The reusable workflow installs pnpm with [`pnpm/setup`](https://github.com/pnpm/setup), which installs pnpm 11 or newer only and reads the version from the repository's `devEngines.packageManager` or `packageManager` field. A repository pinned below that cannot run it.
 
 ## Readiness checks
 
-v11y-check publishes a [readyup](https://www.npmjs.com/package/readyup) kit that checks a consuming repo against the release it has installed: that v11y-check is a devDependency at or above the current version, that audit-ci configs sit under `.config/audit-ci/`, and that `.github/workflows/audit.yaml` matches the template this package scaffolds. The kit ships inside the package, so it checks against the version you installed rather than whatever a repository ref happens to point at.
+v11y-check publishes a [readyup](https://www.npmjs.com/package/readyup) kit that checks a consuming repo against the release that it has installed: that v11y-check is a devDependency at or above the current version, that audit-ci configs are under `.config/audit-ci/`, and that `.github/workflows/audit.yaml` matches the template scaffolded by this package. The kit is included in the package, so it checks against the installed version rather than whatever a repository ref happens to point at.
 
 Add `readyup` as a devDependency, then name v11y-check in its config:
 
@@ -172,12 +175,12 @@ export default defineRdyConfig({
 ```
 
 ```bash
-rdy run --packages              # every kit each listed package publishes
+rdy run --packages              # every kit that each listed package publishes
 rdy run --from npm:v11y-check   # v11y-check's kit alone, without the config entry
 rdy list --from npm:v11y-check  # what v11y-check publishes
 ```
 
-`--packages` is the form that survives v11y-check publishing further kits. Every form needs `readyup` 0.23 or later, and `v11y-check` as a _direct_ devDependency: a strict pnpm layout links nothing else into the project, so a transitive copy is unreachable.
+`--packages` is the form that keeps working if v11y-check publishes further kits. Every form needs `readyup` 0.23 or later, and `v11y-check` as a _direct_ devDependency: A strict pnpm layout links only direct dependencies into the project, which leaves a transitive copy unreachable.
 
 The kit is no longer reachable through `rdy run --from github:williamthorsen/node-monorepo-tools`. Repos still using that form should switch to one of the invocations above.
 
@@ -185,7 +188,7 @@ The kit is no longer reachable through `rdy run --from github:williamthorsen/nod
 
 v0.4 introduces breaking changes to the config schema:
 
-- **`outDir` removed.** Intermediate audit-ci files are now written to a temp directory and cleaned up automatically. Remove `outDir` from your config.
+- **`outDir` removed.** Intermediate audit-ci files are now written to a temp directory and cleaned up automatically. Remove `outDir` from the config.
 - **Severity booleans replaced by `severityThreshold`.** Replace `"moderate": true` with `"severityThreshold": "moderate"`, `"high": true` with `"severityThreshold": "high"`, etc. Only one threshold per scope is supported.
 - **`generate` subcommand removed.** The `v11y generate` command no longer exists. Flat audit-ci configs are now managed internally.
 - **Config is optional.** All commands now work without a config file, using built-in defaults.
@@ -195,4 +198,4 @@ To migrate an existing config:
 1. Remove the `outDir` field.
 2. Replace severity booleans with `severityThreshold` in each scope.
 3. Optionally add a `$schema` field set to `https://github.com/williamthorsen/node-monorepo-tools/raw/v11y-check-v<version>/packages/v11y-check/schemas/config.json`, with `<version>` replaced by the installed v11y-check version.
-4. Delete any generated `audit-ci.*.json` files that were in your config directory.
+4. Delete any generated `audit-ci.*.json` files that were in the config directory.

package/bin/v11y.js

@@ -3,7 +3,7 @@ try {
   await import('../dist/esm/bin/v11y.js');
 } catch (error) {
   if (error.code === 'ERR_MODULE_NOT_FOUND') {
-    process.stderr.write('v11y: build output not found — run `nmr build` first\n');
+    process.stderr.write('v11y: build output not found; run `nmr build` first\n');
   } else {
     process.stderr.write(`v11y: failed to load: ${error.message}\n`);
   }

package/dist/esm/bin/route.d.ts

@@ -1,5 +1,5 @@
 /**
- * Route CLI arguments to the appropriate subcommand.
+ * Routes CLI arguments to the appropriate subcommand.
  *
  * Returns a numeric exit code: 0 for success, 1 for errors.
  */

package/dist/esm/bin/route.js

@@ -3,9 +3,10 @@ import { parseArgs, readPackageVersion, reportError } from '@williamthorsen/nmr-
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { auditCommand, checkCommand, syncCommand } from "../cli.js";
 import { initCommand } from "../init/initCommand.js";
+import { updateTemplatesCommand } from "../init/updateTemplatesCommand.js";
 import { OUTPUT_STYLE_ENV_VAR, resolveStyles } from "../resolveStyles.js";
 const VERSION = readPackageVersion(import.meta.url);
-const SUBCOMMANDS = ['check', 'init', 'sync'];
+const SUBCOMMANDS = ['check', 'init', 'sync', 'update-templates'];
 const MIN_PREFIX_LENGTH = 3;
 function showHelp() {
     console.info(`
@@ -16,6 +17,7 @@ Commands:
   check (default)      Grouped vulnerability check with severity indicators
   sync                 Synchronize allowlists with current audit findings
   init                 Scaffold a starter config file and GitHub Actions workflow
+  update-templates     Update the scaffolded workflow to the current template
 
 Scope options:
   --dev                Target dev dependencies only
@@ -63,6 +65,19 @@ Other options:
   --help, -h         Show this help message
 `);
 }
+function showUpdateTemplatesHelp() {
+    console.info(`
+Usage: v11y update-templates [options]
+
+Update .github/workflows/audit.yaml to the template of the installed version,
+showing what changed. Creates the workflow when it is missing. Never touches
+the config file.
+
+Options:
+  --dry-run, -n   Preview changes without writing files
+  --help, -h      Show this help message
+`);
+}
 function parseSharedFlags(flags, styles) {
     const flagSchema = {
         config: { long: '--config', type: 'string' },
@@ -126,6 +141,9 @@ export async function routeCommand(args) {
     if (command === 'sync') {
         return handleSubcommand(args.slice(1), styles, syncCommand, showSyncHelp);
     }
+    if (command === 'update-templates') {
+        return handleUpdateTemplates(args.slice(1), styles);
+    }
     if (command !== undefined && !command.startsWith('-')) {
         const typoMatch = findTypoMatch(command);
         if (typoMatch !== undefined) {
@@ -181,3 +199,21 @@ function handleInit(flags, styles) {
     }
     return initCommand({ dryRun: parsed.flags.dryRun, force: parsed.flags.force, styles });
 }
+function handleUpdateTemplates(flags, styles) {
+    if (flags.some((f) => f === '--help' || f === '-h')) {
+        showUpdateTemplatesHelp();
+        return 0;
+    }
+    const updateTemplatesFlagSchema = {
+        dryRun: { long: '--dry-run', type: 'boolean', short: '-n' },
+    };
+    let parsed;
+    try {
+        parsed = parseArgs(flags, updateTemplatesFlagSchema);
+    }
+    catch (error) {
+        reportError(describeError(error));
+        return 1;
+    }
+    return updateTemplatesCommand({ dryRun: parsed.flags.dryRun, styles });
+}

package/dist/esm/cli.d.ts

@@ -1,12 +1,12 @@
 import { type CommandOptions } from './types.js';
 /**
- * Run the default audit command (CI mode).
+ * Runs the default audit command (CI mode).
  *
  * Generates config, invokes audit-ci for each scope, and returns a combined exit code.
  */
 export declare function auditCommand(options: CommandOptions): Promise<number>;
 /**
- * Run the default grouped-check command.
+ * Runs the default grouped-check command.
  *
  * Audits each scope without allowlist filtering, cross-references results with
  * the config allowlist, detects stale entries, and produces grouped output.
@@ -14,10 +14,10 @@ export declare function auditCommand(options: CommandOptions): Promise<number>;
  */
 export declare function checkCommand(options: CommandOptions): Promise<number>;
 /**
- * Run the `sync` subcommand.
+ * Runs the `sync` subcommand.
  *
  * Audits each scope in report mode without allowlist filtering, then updates
- * the allowlist to match current findings. When no config file exists, creates
- * one at the default path.
+ * the allowlist to match current findings. When the config file doesn't exist,
+ * creates one at the default path.
  */
 export declare function syncCommand(options: CommandOptions): Promise<number>;

package/dist/esm/config.d.ts

@@ -1,7 +1,7 @@
 import { type V11yCheckConfig } from './types.js';
 /** Default config file path, relative to the working directory. */
 export declare const DEFAULT_CONFIG_PATH = ".config/v11y-check.config.json";
-/** Discriminate between a config loaded from a file and one built from defaults. */
+/** Discriminates between a config loaded from a file and one built from defaults. */
 export type ConfigSource = 'defaults' | 'file';
 /** Result of loading config, including the source discriminator. */
 export interface LoadConfigResult {
@@ -11,7 +11,7 @@ export interface LoadConfigResult {
     configSource: ConfigSource;
 }
 /**
- * Load and validate the v11y-check config from disk, falling back to defaults.
+ * Loads and validates the v11y-check config from disk, falling back to defaults.
  *
  * When `configPath` is explicitly provided, the file must exist. When omitted,
  * the default path is tried; if absent, `DEFAULT_CONFIG` is returned.

package/dist/esm/format-actions.d.ts

@@ -1,7 +1,7 @@
 import type { CheckResult } from './format-check.js';
 import type { AuditScope } from './types.js';
 /**
- * Compute the "Actions:" footer for check output.
+ * Computes the "Actions:" footer for check output.
  *
  * Returns an empty string when the allowlist is fully current. Otherwise returns
  * a bulleted action list with a verbose hint (when vulns exist) and a sync hint.

package/dist/esm/format-check.d.ts

@@ -1,6 +1,6 @@
 import { type OutputStyle } from '@williamthorsen/nmr-core';
 import type { AuditResult, AuditScope, SeverityThreshold } from './types.js';
-/** Classification of an allowlist entry relative to current audit findings. */
+/** An audit finding that the allowlist admits, with the entry's reason and date. */
 export interface AllowedVuln {
     addedAt?: string | undefined;
     cvss?: {
@@ -35,19 +35,19 @@ export interface CheckResult {
 }
 /** Maps a severity string to its indicator in a style: a colored circle when rich, nothing when plain. */
 export declare function severityIndicator(severity: string | undefined, style: OutputStyle): string;
-/** Resolve the best display ID for a vulnerability: GHSA ID if available, otherwise the numeric ID. */
+/** Resolves the best display ID for a vulnerability: GHSA ID if available, otherwise the numeric ID. */
 export declare function displayId(vuln: {
     ghsaId?: string | undefined;
     id: string;
 }): string;
-/** Build the severity suffix for a finding line, e.g. `  🔴 critical`. */
+/** Builds the severity suffix for a finding line, e.g. `  🔴 critical`. */
 export declare function formatSeveritySuffix(severity: string | undefined, style: OutputStyle): string;
 /**
- * Format check results as human-readable text output.
+ * Formats check results as human-readable text output.
  *
  * Produces an intro banner, scoped findings with severity labels and GHSA IDs,
  * and an action hints footer.
  */
 export declare function formatCheckText(result: CheckResult, scopes: AuditScope[], style: OutputStyle, now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;
-/** Format check results as a JSON string with a top-level `summary` block derived from the result. */
+/** Formats check results as a JSON string with a top-level `summary` block derived from the result. */
 export declare function formatCheckJson(result: CheckResult, scopes: AuditScope[]): string;

package/dist/esm/format-summary.d.ts

@@ -8,10 +8,10 @@ export interface CheckSummary {
     count: number;
 }
 /**
- * Derive the headline summary from a check result.
+ * Derives the headline summary from a check result.
  *
  * Priority is severity-driven: unallowed > allowed > stale > none. The count is the total across
  * the requested scopes for the *active* category only; for `'none'` it is `0`. Below-threshold
- * findings never affect the summary — the threshold already excludes them from pass/fail.
+ * findings never affect the summary: The threshold already excludes them from pass/fail.
  */
 export declare function deriveSummary(result: CheckResult, scopes: AuditScope[]): CheckSummary;

package/dist/esm/format-time.d.ts

@@ -1,10 +1,8 @@
 /**
- * Produce a human-readable relative-time string such as "just now", "N minutes ago",
+ * Produces a human-readable relative-time string such as "just now", "N minutes ago",
  * "yesterday", "N months ago", "N years ago".
  *
  * Uses millisecond math for units up through weeks to avoid DST/timezone drift on
  * short intervals, and UTC calendar math for months and years.
- *
- * @internal — exported for test access; consumers should use higher-level formatting helpers.
  */
 export declare function formatRelativeTime(fromIso: string, now: Date): string;

package/dist/esm/format-verbose.d.ts

@@ -1,5 +1,5 @@
 import { type OutputStyle } from '@williamthorsen/nmr-core';
 import { type CheckResult } from './format-check.js';
 import type { AuditScope, SeverityThreshold } from './types.js';
-/** Format the verbose per-vulnerability check output as text. */
+/** Formats the verbose per-vulnerability check output as text. */
 export declare function formatCheckVerboseText(result: CheckResult, scopes: AuditScope[], style: OutputStyle, now?: Date, thresholds?: Partial<Record<AuditScope, SeverityThreshold>>): string;

package/dist/esm/generate.d.ts

@@ -6,7 +6,7 @@ interface AuditCiFlatConfig {
     'show-not-found'?: boolean;
 }
 /**
- * Transform a scope config into the flat JSON structure audit-ci expects.
+ * Transforms a scope config into the flat JSON structure that audit-ci expects.
  *
  * Translates `severityThreshold` to the corresponding audit-ci boolean,
  * adds scope-specific flags (`skip-dev` for prod, `extra-args: ["--dev"]` for dev),
@@ -14,10 +14,10 @@ interface AuditCiFlatConfig {
  */
 export declare function buildFlatConfig(scopeConfig: ScopeConfig, scope: AuditScope): AuditCiFlatConfig;
 /**
- * Generate the audit-ci config file for a scope and write it to disk.
+ * Generates the audit-ci config file for a scope and writes it to disk.
  *
  * The output path is `{outputDir}/audit-ci.{scope}.json`. The caller must
- * ensure `outputDir` already exists (e.g., via `withTempDir`).
+ * ensure that `outputDir` exists.
  */
 export declare function generateAuditCiConfig(scopeConfig: ScopeConfig, scope: AuditScope, outputDir: string): Promise<string>;
 export {};

package/dist/esm/glyphs.d.ts

@@ -1,7 +1,7 @@
 import { type OutputStyle, type StatusGlyphName } from '@williamthorsen/nmr-core';
 /**
- * Glyphs that name no status; a status marker comes from nmr-core's `STATUS_GLYPHS`. A plain variant is empty
- * where a word always follows the glyph.
+ * Glyphs that don't name a status; a status marker comes from nmr-core's `STATUS_GLYPHS`. A plain variant is empty
+ * for a glyph that a word always follows.
  */
 export declare const V11Y_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"audit" | "scopeDev" | "scopeProd" | "severityHigh" | "severityLow" | "severityModerate" | "stale", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
 export type V11yGlyphName = keyof (typeof V11Y_GLYPHS)['rich'];
@@ -9,5 +9,5 @@ export type V11yGlyphName = keyof (typeof V11Y_GLYPHS)['rich'];
 export type RowMarkerName = StatusGlyphName | 'stale';
 /** Renders a row marker and a message, padding the marker so that messages align across markers. */
 export declare function formatMarkedLine(style: OutputStyle, name: RowMarkerName, message: string): string;
-/** Reports the cells taken by the widest row marker in a style. */
+/** Returns the number of cells taken by the widest row marker in a style. */
 export declare function measureRowMarkerColumn(style: OutputStyle): number;

package/dist/esm/init/initCommand.d.ts

@@ -5,7 +5,7 @@ interface InitOptions {
     styles: StreamStyles;
 }
 /**
- * Run the `v11y init` command.
+ * Runs the `v11y init` command.
  *
  * Scaffolds the starter config file and the GitHub Actions workflow, then prints next steps.
  * Returns the process exit code (0 for success, 1 if any write failed).

package/dist/esm/init/scaffold.d.ts

@@ -1,4 +1,5 @@
 import { type WriteResult } from '@williamthorsen/nmr-core';
+export declare const WORKFLOW_PATH = ".github/workflows/audit.yaml";
 interface ScaffoldOptions {
     dryRun: boolean;
     force: boolean;
@@ -7,30 +8,25 @@ interface ScaffoldResult {
     configResult: WriteResult;
 }
 /**
- * Scaffold the v11y-check config file with sensible defaults, never overwriting an existing one, whose allowlist
+ * Scaffolds the v11y-check config file with sensible defaults, never overwriting an existing one, whose allowlist
  * `v11y sync` maintains.
- *
- * Returns `{ configResult }` to preserve the signature consumed by `syncCommand`, which predates
- * the workflow scaffolding and treats the config result as a named field.
  */
 export declare function scaffoldConfig({ dryRun }: {
     dryRun: boolean;
 }): ScaffoldResult;
-/** Copy the bundled audit.yaml.template to `.github/workflows/audit.yaml` in the target repo. */
+/** Copies the bundled audit.yaml.template to `.github/workflows/audit.yaml` in the target repo. */
 export declare function copyWorkflowTemplate(dryRun: boolean, overwrite: boolean): WriteResult;
-/**
- * Scaffold the GitHub Actions audit workflow to `.github/workflows/audit.yaml`.
- *
- * Wraps `copyWorkflowTemplate` to provide a stable seam for future post-write transformations
- * (e.g., variable substitution) without changing call sites.
- */
+/** Reads the bundled audit.yaml.template, returning a description of the failure when it cannot. */
+export declare function readWorkflowTemplate(): {
+    content: string;
+} | {
+    error: string;
+};
+/** Scaffolds the GitHub Actions audit workflow to `.github/workflows/audit.yaml`. */
 export declare function scaffoldWorkflow(dryRun: boolean, overwrite: boolean): WriteResult;
 /**
- * Scaffold v11y-check files for the target repo.
- *
- * Writes both the config file and the GitHub Actions workflow. Returns a flat array of write
- * results in the order [config, workflow]. `ScaffoldOptions.force` is translated to `overwrite`
- * for the workflow alone; an existing config is never overwritten.
+ * Scaffolds the config file and the GitHub Actions workflow, returning their write results in that order. `force`
+ * overwrites the workflow alone; an existing config is never overwritten.
  */
 export declare function scaffoldFiles({ dryRun, force }: ScaffoldOptions): WriteResult[];
 export {};

package/dist/esm/init/scaffold.js

@@ -4,34 +4,33 @@ import { findPackageRoot, writeFileWithCheck } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { v11yCheckConfigTemplate } from "./templates.js";
 const CONFIG_PATH = '.config/v11y-check.config.json';
-const WORKFLOW_PATH = '.github/workflows/audit.yaml';
+export const WORKFLOW_PATH = '.github/workflows/audit.yaml';
 export function scaffoldConfig({ dryRun }) {
     const configResult = writeFileWithCheck(CONFIG_PATH, v11yCheckConfigTemplate, { dryRun, overwrite: false });
     return { configResult };
 }
 export function copyWorkflowTemplate(dryRun, overwrite) {
+    const template = readWorkflowTemplate();
+    if ('error' in template) {
+        return { filePath: WORKFLOW_PATH, outcome: 'failed', error: template.error };
+    }
+    return writeFileWithCheck(WORKFLOW_PATH, template.content, { dryRun, overwrite });
+}
+export function readWorkflowTemplate() {
     let root;
     try {
         root = findPackageRoot(import.meta.url);
     }
     catch (error) {
-        const message = describeError(error);
-        return { filePath: WORKFLOW_PATH, outcome: 'failed', error: `Failed to resolve package root: ${message}` };
+        return { error: `Failed to resolve package root: ${describeError(error)}` };
     }
     const templatePath = resolve(root, 'templates', 'audit.yaml.template');
-    let content;
     try {
-        content = readFileSync(templatePath, 'utf8');
+        return { content: readFileSync(templatePath, 'utf8') };
     }
     catch (error) {
-        const message = describeError(error);
-        return {
-            filePath: WORKFLOW_PATH,
-            outcome: 'failed',
-            error: `Failed to read bundled template at ${templatePath}: ${message}`,
-        };
+        return { error: `Failed to read bundled template at ${templatePath}: ${describeError(error)}` };
     }
-    return writeFileWithCheck(WORKFLOW_PATH, content, { dryRun, overwrite });
 }
 export function scaffoldWorkflow(dryRun, overwrite) {
     return copyWorkflowTemplate(dryRun, overwrite);

package/dist/esm/init/updateTemplatesCommand.d.ts

@@ -0,0 +1,12 @@
+import { type StreamStyles } from '@williamthorsen/nmr-core';
+interface UpdateTemplatesOptions {
+    dryRun: boolean;
+    styles: StreamStyles;
+}
+/**
+ * Runs the `v11y update-templates` command and returns the process exit code.
+ *
+ * Brings the scaffolded audit workflow up to date with the bundled template; the config file is never read or written.
+ */
+export declare function updateTemplatesCommand({ dryRun, styles }: UpdateTemplatesOptions): number;
+export {};

package/dist/esm/init/updateTemplatesCommand.js

@@ -0,0 +1,14 @@
+import { printStep, reportTemplateUpdate, updateManagedFile, } from '@williamthorsen/nmr-core';
+import { readWorkflowTemplate, WORKFLOW_PATH } from "./scaffold.js";
+export function updateTemplatesCommand({ dryRun, styles }) {
+    if (dryRun) {
+        console.info('[dry-run mode]');
+    }
+    printStep('Updating workflows');
+    const template = readWorkflowTemplate();
+    const result = 'error' in template
+        ? { filePath: WORKFLOW_PATH, outcome: 'failed', error: template.error }
+        : updateManagedFile(WORKFLOW_PATH, template.content, { dryRun });
+    reportTemplateUpdate(result, dryRun, styles);
+    return result.outcome === 'failed' ? 1 : 0;
+}

package/dist/esm/resolveStyles.d.ts

@@ -1,10 +1,10 @@
 import { type StreamStyles } from '@williamthorsen/nmr-core';
-/** The environment variable holding the caller's standing style preference: `auto`, `plain`, or `rich`. */
+/** The environment variable that sets the caller's standing style preference: `auto`, `plain`, or `rich`. */
 export declare const OUTPUT_STYLE_ENV_VAR = "V11Y_CHECK_OUTPUT_STYLE";
 export interface ResolveStylesOptions {
     readonly env: Readonly<Record<string, string | undefined>>;
     readonly stderrIsTty: boolean;
     readonly stdoutIsTty: boolean;
 }
-/** Resolves the style of each output stream, reporting a usage error and returning `undefined` when the variable names no setting. */
+/** Resolves the style of each output stream, reporting a usage error and returning `undefined` when the variable doesn't name a setting. */
 export declare function resolveStyles(options: ResolveStylesOptions): StreamStyles | undefined;

package/dist/esm/run-audit.d.ts

@@ -1,5 +1,5 @@
 import type { AuditResult } from './types.js';
-/** Resolve the audit-ci binary path from node_modules. */
+/** Resolves the audit-ci binary path from node_modules. */
 export declare function resolveAuditCiBin(): string;
 /** Result of parsing audit-ci output, including any warnings. */
 export interface ParseResult {
@@ -7,7 +7,7 @@ export interface ParseResult {
     warnings: string[];
 }
 /**
- * Parse audit-ci JSON output into typed audit results.
+ * Parses audit-ci JSON output into typed audit results.
  *
  * Extracts advisories from the JSON, mapping each to an `AuditResult` with
  * the first discovered dependency path. Returns warnings when input is
@@ -19,7 +19,7 @@ export interface StaleEntriesResult {
     entries: string[];
     warnings: string[];
 }
-/** Extract stale allowlist entries from audit-ci JSON output. */
+/** Extracts stale allowlist entries from audit-ci JSON output. */
 export declare function extractStaleEntries(jsonString: string): StaleEntriesResult;
 /** Options for running audit-ci. */
 interface RunAuditOptions {
@@ -37,7 +37,7 @@ export interface AuditRunResult {
     warnings: string[];
 }
 /**
- * Invoke audit-ci with the given config file in normal (CI) mode.
+ * Invokes audit-ci with the given config file in normal (CI) mode.
  *
  * Returns the exit code faithfully. When `json` is true, output is JSON;
  * otherwise audit-ci uses its default text format. Stale overrides are
@@ -51,10 +51,6 @@ export interface ReportResult {
     stderr: string;
     warnings: string[];
 }
-/**
- * Invoke audit-ci in report mode (no allowlist filtering, swallows exit code).
- *
- * Always returns exit code 0. Parses JSON output into typed `AuditResult` objects.
- */
+/** Invokes audit-ci with JSON output, ignoring its exit code, and parses the advisories into `AuditResult` objects. */
 export declare function runReport({ configPath, cwd, reportType }: Omit<RunAuditOptions, 'json'>): ReportResult;
 export {};

package/dist/esm/sync.d.ts

@@ -1,7 +1,7 @@
 import type { AllowlistEntry, AuditResult, AuditScope, V11yCheckConfig } from './types.js';
-/** Produce a full ISO 8601 UTC datetime string. */
+/** Produces a full ISO 8601 UTC datetime string. */
 export declare function formatUtcDatetime(date: Date): string;
-/** Format a Date as a human-friendly UTC string for use in reason messages. */
+/** Formats a Date as a human-friendly UTC string for use in reason messages. */
 export declare function formatFriendlyUtc(date: Date): string;
 /** Result of a sync operation for a single scope. */
 export interface SyncResult {
@@ -11,10 +11,10 @@ export interface SyncResult {
     scope: AuditScope;
 }
 /**
- * Compute the updated allowlist by diffing audit results against the current entries.
+ * Computes the updated allowlist by diffing audit results against the current entries.
  *
  * New advisories are added with an auto-populated reason. Resolved advisories are removed.
- * Existing entries with a non-empty reason are preserved.
+ * Existing entries are kept unchanged.
  */
 export declare function computeSyncDiff(currentAllowlist: AllowlistEntry[], auditResults: AuditResult[], date?: Date): {
     added: AllowlistEntry[];
@@ -22,19 +22,19 @@ export declare function computeSyncDiff(currentAllowlist: AllowlistEntry[], audi
     removed: AllowlistEntry[];
 };
 /**
- * Build the updated config by replacing the allowlist for the given scope.
+ * Builds the updated config by replacing the allowlist for the given scope with its entries sorted by ID.
  *
  * Returns a new config object; does not mutate the input.
  */
 export declare function buildUpdatedConfig(config: V11yCheckConfig, scope: AuditScope, newAllowlist: AllowlistEntry[]): V11yCheckConfig;
 /**
- * Serialize the config to JSON with alphabetically ordered allowlist entry keys.
+ * Serializes the config to JSON with alphabetically ordered allowlist entry keys.
  *
- * Includes `$schema` when present. Uses `severityThreshold` instead of boolean fields.
+ * Includes `$schema` when present.
  */
 export declare function serializeConfig(config: V11yCheckConfig): string;
 /**
- * Synchronize the allowlist for a scope by diffing audit results against the current config.
+ * Synchronizes the allowlist for a scope by diffing audit results against the current config.
  *
  * Returns the sync diff and the updated config. Writes the updated config to disk.
  */

package/dist/esm/sync.js

@@ -53,7 +53,7 @@ export function computeSyncDiff(currentAllowlist, auditResults, date) {
     return { added, kept, removed };
 }
 export function buildUpdatedConfig(config, scope, newAllowlist) {
-    const sorted = [...newAllowlist].sort((a, b) => a.id.localeCompare(b.id));
+    const sorted = newAllowlist.toSorted((a, b) => a.id.localeCompare(b.id));
     return {
         ...config,
         [scope]: {

package/dist/esm/tmp.d.ts

@@ -1,9 +1,7 @@
 /**
- * Execute a callback with a temporary directory, ensuring cleanup afterward.
+ * Executes a callback with a temporary directory, ensuring cleanup afterward.
  *
  * Creates a unique temp directory under `os.tmpdir()` and removes it
  * (recursively) when the callback completes or throws.
- *
- * @internal Exported for testing.
  */
 export declare function withTempDir<T>(fn: (tempDir: string) => Promise<T>): Promise<T>;

package/dist/esm/types.d.ts

@@ -27,7 +27,7 @@ export declare const allowlistEntrySchema: z.ZodObject<{
 /** Configuration for a single audit scope (dev or prod). */
 export interface ScopeConfig {
     allowlist: AllowlistEntry[];
-    /** Fail on advisories at or above this severity. */
+    /** Severity at or above which an advisory fails the audit. */
     severityThreshold?: SeverityThreshold | undefined;
 }
 /** Zod schema for a scope configuration block. */
@@ -86,7 +86,7 @@ export declare const v11yCheckConfigSchema: z.ZodObject<{
         }>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
-/** Built-in defaults used when no config file is present. */
+/** Built-in defaults used when the config file isn't present. */
 export declare const DEFAULT_CONFIG: V11yCheckConfig;
 /** A single vulnerability found by audit-ci. */
 export interface AuditResult {
@@ -112,11 +112,9 @@ export interface CommandOptions {
     verbose: boolean;
 }
 /**
- * Determine whether a severity string is at or above the given threshold.
+ * Determines whether a severity string is at or above the given threshold.
  *
  * Unrecognized or undefined severities are treated as above threshold
- * (conservative — surfaces unknown vulns rather than hiding them).
- *
- * @internal Exported for testing.
+ * (conservative: An unknown vuln is reported rather than hidden).
  */
 export declare function isSeverityAtOrAbove(severity: string | undefined, threshold: SeverityThreshold): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "v11y-check",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "private": false,
   "description": "Wrap audit-ci with a richer config model, typed JSON source of truth, and sync workflow",
   "keywords": [
@@ -45,15 +45,16 @@
     "templates"
   ],
   "dependencies": {
-    "@williamthorsen/nmr-core": "0.12.0",
+    "@williamthorsen/nmr-core": "0.13.1",
     "@williamthorsen/toolbelt.errors": "0.8.1",
     "audit-ci": "7.1.0",
-    "zod": "4.6.2"
+    "zod": "4.6.5"
   },
   "devDependencies": {
     "@williamthorsen/toolbelt.filesystem": "0.9.1",
     "@williamthorsen/toolbelt.testing": "0.6.1",
     "@williamthorsen/toolbelt.vitest": "0.10.1",
+    "esbuild": "0.28.2",
     "readyup": "0.38.0",
     "vitest": "4.1.11"
   },

package/templates/audit.yaml.template

@@ -7,7 +7,7 @@ on:
       - main
       - next
 
-  # Daily schedule — adjust cron expression per repo if a different cadence is desired.
+  # Run daily. Adjust the cron expression in a repo that needs a different cadence.
   schedule:
     - cron: '0 8 * * *'
 
@@ -16,7 +16,7 @@ on:
 # Permissions must be declared here. The GITHUB_TOKEN scope passed to the called
 # reusable workflow is bounded by this caller's permissions block; when omitted,
 # the repository's default workflow permissions apply (read-only here), which would
-# silently deny the issues/pull-requests writes the reusable workflow needs.
+# silently deny the issue and pull-request writes that the reusable workflow needs.
 permissions:
   contents: read
   issues: write