@webjsdev/core 0.7.54 → 0.7.56

package/index.d.ts

@@ -53,6 +53,8 @@ export type {
   WebjsTrailingSlash,
   WebjsCspConfig,
   WebjsDoctorConfig,
+  WebjsAuditConfig,
+  WebjsAuditIgnore,
   WebjsDoctorSeverity,
   WebjsCiConfig,
   WebjsCiStep,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/core",
-  "version": "0.7.54",
+  "version": "0.7.56",
   "type": "module",
   "description": "The runtime for WebJs, a full-stack JavaScript framework built on web components with server-side rendering and no build step. Ships the html and css template tags, the WebComponent base class, signals, directives, and the isomorphic renderers.",
   "types": "./index.d.ts",

package/src/webjs-config.d.ts

@@ -132,6 +132,20 @@ export interface WebjsDevTasks {
    * appDir) entries are skipped. Read by the server (`readDevWatchPathsFromApp`).
    */
   watch?: string[];
+  /**
+   * Dev embed bridge (#1498, #1504), DEV-ONLY, off by default. Parent origins
+   * (`https://builder.example`) allowed to frame the dev server and exchange
+   * `webjs-embed` messages with it. A set `WEBJS_EMBED_ORIGINS` replaces this
+   * list. Ignored by `webjs start`.
+   */
+  embedOrigins?: string[];
+  /**
+   * Dev source locations (#1499, #1504), DEV-ONLY, off by default. `true` stamps
+   * `data-webjs-src="<app-relative-file>:<line>"` on the element opening tags of
+   * the app's `html` templates. `WEBJS_SOURCE_LOCATIONS=1|0` overrides it for
+   * one run. Ignored by `webjs start`.
+   */
+  sourceLocations?: boolean;
 }
 
 /** Start task orchestration in `webjs.start` (#550). Read by the CLI, not the server. */
@@ -212,6 +226,27 @@ export interface WebjsDoctorConfig {
   gate?: Record<string, WebjsDoctorSeverity>;
 }
 
+/** One advisory `webjs audit` accepts (#1492): its id and why that is safe. */
+export interface WebjsAuditIgnore {
+  /** The advisory id, `GHSA-xxxx-xxxx-xxxx` or `CVE-YYYY-NNNN`. */
+  id: string;
+  /** Why accepting it is safe: which chain reaches it, and why that chain cannot reach users. Required. */
+  reason: string;
+}
+
+/**
+ * `webjs.audit` (#1492): the dependency audit's failing level and its
+ * allowlist, in one place. `webjs audit` runs `npm audit` or `bun audit` and
+ * fails on any advisory at or above `level` that `ignore` does not list. A
+ * malformed block exits 1, so an allowlist cannot silently stop applying.
+ */
+export interface WebjsAuditConfig {
+  /** The lowest severity that fails the audit. Default `'high'`. */
+  level?: 'low' | 'moderate' | 'high' | 'critical';
+  /** Advisories with no patched release that the app's users cannot reach. */
+  ignore?: WebjsAuditIgnore[];
+}
+
 /** The object form of `webjs.csp` (the non-boolean shape). */
 export interface WebjsCspConfig {
   /**
@@ -292,6 +327,13 @@ export interface WebjsConfig {
    */
   doctor?: WebjsDoctorConfig;
 
+  /**
+   * `webjs audit` policy (#1492): the failing severity and the advisories the
+   * app accepts, each with a reason. Read by the CLI
+   * (`packages/cli/lib/audit.js`), NOT the server.
+   */
+  audit?: WebjsAuditConfig;
+
   /** Per-path response-header rules, shaped like Next's. */
   headers?: WebjsHeaderRule[];