@webjsdev/core 0.7.53 → 0.7.55

package/index.d.ts

@@ -53,7 +53,15 @@ export type {
   WebjsTrailingSlash,
   WebjsCspConfig,
   WebjsDoctorConfig,
+  WebjsAuditConfig,
+  WebjsAuditIgnore,
   WebjsDoctorSeverity,
+  WebjsCiConfig,
+  WebjsCiStep,
+  WebjsCiNestedStep,
+  WebjsCiCommand,
+  WebjsCiGroup,
+  WebjsCiNestedGroup,
 } from './src/webjs-config.d.ts';
 
 // Compile-time serializability typing for server actions (#488): the opt-in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/core",
-  "version": "0.7.53",
+  "version": "0.7.55",
   "type": "module",
   "description": "The runtime for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Ships the html and css template tags, the WebComponent base class, signals, directives, and the isomorphic renderers.",
   "types": "./index.d.ts",

package/src/webjs-config.d.ts

@@ -144,6 +144,46 @@ export interface WebjsStartTasks {
   before?: string[];
 }
 
+/** One command step of `webjs ci` (#1471). */
+export interface WebjsCiCommand {
+  /** Shown in the step heading and its result line. */
+  title: string;
+  /** The shell command, run with `node_modules/.bin` on PATH and `CI=true` in the environment. */
+  run: string;
+  /** Extra environment for this step only, e.g. `{ WEBJS_E2E: '1' }`. */
+  env?: Record<string, string>;
+}
+
+/** A step inside a group: a nested group takes ONE slot of its parent and runs sequentially, so it cannot declare `parallel`. */
+export interface WebjsCiNestedGroup {
+  /** The group name. */
+  title: string;
+  /** The group's steps, run in order. */
+  steps: WebjsCiNestedStep[];
+}
+
+/** A top-level group of `webjs ci` steps. */
+export interface WebjsCiGroup extends WebjsCiNestedGroup {
+  /** How many steps run at once (default 1, sequential). Captured output is replayed whole per step, never interleaved. */
+  parallel?: number;
+}
+
+/** A top-level `webjs ci` step: a string is shorthand for a command whose title is the command. */
+export type WebjsCiStep = string | WebjsCiCommand | WebjsCiGroup;
+
+/** A step inside a group: the same shapes, minus `parallel` on a nested group. */
+export type WebjsCiNestedStep = string | WebjsCiCommand | WebjsCiNestedGroup;
+
+/**
+ * Local CI in `webjs.ci` (#1471): the step list `webjs ci` runs, and the same
+ * list a cloud pipeline runs through `npm run ci`. Read by the CLI
+ * (`packages/cli/lib/ci-config.js`), not the server.
+ */
+export interface WebjsCiConfig {
+  /** The steps, run in order. A failing step fails the run. Required: a block with no steps is refused, since a run of zero steps would read as green. */
+  steps: WebjsCiStep[];
+}
+
 /**
  * A severity a `webjs.doctor.gate` entry may declare, mirroring ESLint's
  * three-level scale. `error` fails the `webjs doctor` exit, `warn` reports
@@ -172,6 +212,27 @@ export interface WebjsDoctorConfig {
   gate?: Record<string, WebjsDoctorSeverity>;
 }
 
+/** One advisory `webjs audit` accepts (#1492): its id and why that is safe. */
+export interface WebjsAuditIgnore {
+  /** The advisory id, `GHSA-xxxx-xxxx-xxxx` or `CVE-YYYY-NNNN`. */
+  id: string;
+  /** Why accepting it is safe: which chain reaches it, and why that chain cannot reach users. Required. */
+  reason: string;
+}
+
+/**
+ * `webjs.audit` (#1492): the dependency audit's failing level and its
+ * allowlist, in one place. `webjs audit` runs `npm audit` or `bun audit` and
+ * fails on any advisory at or above `level` that `ignore` does not list. A
+ * malformed block exits 1, so an allowlist cannot silently stop applying.
+ */
+export interface WebjsAuditConfig {
+  /** The lowest severity that fails the audit. Default `'high'`. */
+  level?: 'low' | 'moderate' | 'high' | 'critical';
+  /** Advisories with no patched release that the app's users cannot reach. */
+  ignore?: WebjsAuditIgnore[];
+}
+
 /** The object form of `webjs.csp` (the non-boolean shape). */
 export interface WebjsCspConfig {
   /**
@@ -227,6 +288,24 @@ export interface WebjsConfig {
   dev?: WebjsDevTasks;
   start?: WebjsStartTasks;
 
+  /**
+   * The `webjs db` verb map (#1468), bring-your-own-ORM. Each key is a verb
+   * and its value the shell command `webjs db <verb>` runs instead of the
+   * drizzle-kit default (node_modules/.bin on PATH, extra args appended), so
+   * `webjs db migrate` keeps one spelling across ORMs:
+   * `{ migrate: 'prisma migrate deploy' }`. Any key is a verb; an unmapped one
+   * keeps its default, so an app with no block is unchanged. Read by the CLI
+   * (`packages/cli/lib/app-tasks.js`), NOT the server.
+   */
+  db?: Record<string, string>;
+
+  /**
+   * Local CI (#1471): the step list `webjs ci` runs locally and a cloud
+   * pipeline runs through `npm run ci`, so the two cannot drift. Read by the
+   * CLI (`packages/cli/lib/ci-config.js`), NOT the server.
+   */
+  ci?: WebjsCiConfig;
+
   /**
    * `webjs doctor` policy (#1257): which project-health checks the project
    * treats as fatal. Read by the CLI (`packages/cli/lib/doctor.js`), NOT the
@@ -234,6 +313,13 @@ export interface WebjsConfig {
    */
   doctor?: WebjsDoctorConfig;
 
+  /**
+   * `webjs audit` policy (#1492): the failing severity and the advisories the
+   * app accepts, each with a reason. Read by the CLI
+   * (`packages/cli/lib/audit.js`), NOT the server.
+   */
+  audit?: WebjsAuditConfig;
+
   /** Per-path response-header rules, shaped like Next's. */
   headers?: WebjsHeaderRule[];