@webjsdev/core 0.7.54 → 0.7.55

package/index.d.ts

@@ -53,6 +53,8 @@ export type {
   WebjsTrailingSlash,
   WebjsCspConfig,
   WebjsDoctorConfig,
+  WebjsAuditConfig,
+  WebjsAuditIgnore,
   WebjsDoctorSeverity,
   WebjsCiConfig,
   WebjsCiStep,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/core",
-  "version": "0.7.54",
+  "version": "0.7.55",
   "type": "module",
   "description": "The runtime for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Ships the html and css template tags, the WebComponent base class, signals, directives, and the isomorphic renderers.",
   "types": "./index.d.ts",

package/src/webjs-config.d.ts

@@ -212,6 +212,27 @@ export interface WebjsDoctorConfig {
   gate?: Record<string, WebjsDoctorSeverity>;
 }
 
+/** One advisory `webjs audit` accepts (#1492): its id and why that is safe. */
+export interface WebjsAuditIgnore {
+  /** The advisory id, `GHSA-xxxx-xxxx-xxxx` or `CVE-YYYY-NNNN`. */
+  id: string;
+  /** Why accepting it is safe: which chain reaches it, and why that chain cannot reach users. Required. */
+  reason: string;
+}
+
+/**
+ * `webjs.audit` (#1492): the dependency audit's failing level and its
+ * allowlist, in one place. `webjs audit` runs `npm audit` or `bun audit` and
+ * fails on any advisory at or above `level` that `ignore` does not list. A
+ * malformed block exits 1, so an allowlist cannot silently stop applying.
+ */
+export interface WebjsAuditConfig {
+  /** The lowest severity that fails the audit. Default `'high'`. */
+  level?: 'low' | 'moderate' | 'high' | 'critical';
+  /** Advisories with no patched release that the app's users cannot reach. */
+  ignore?: WebjsAuditIgnore[];
+}
+
 /** The object form of `webjs.csp` (the non-boolean shape). */
 export interface WebjsCspConfig {
   /**
@@ -292,6 +313,13 @@ export interface WebjsConfig {
    */
   doctor?: WebjsDoctorConfig;
 
+  /**
+   * `webjs audit` policy (#1492): the failing severity and the advisories the
+   * app accepts, each with a reason. Read by the CLI
+   * (`packages/cli/lib/audit.js`), NOT the server.
+   */
+  audit?: WebjsAuditConfig;
+
   /** Per-path response-header rules, shaped like Next's. */
   headers?: WebjsHeaderRule[];