@zappie/check 0.1.3 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @zappie/check
 
+## 0.2.1
+
+### Patch Changes
+
+- edfc401: Audit storefront dependencies and widen secret scanning to tracked files, Worker output, server bundles and optional Git history.
+- Updated dependencies [edfc401]
+  - @zappie/sdk@0.1.11
+
+## 0.2.0
+
+### Minor Changes
+
+- 79deec3: Hold every template to the same accessibility, semantics, performance and CSS bar.
+
+  - `eslint-plugin-zappie`: `zappie/no-lazy-overlay` reports `React.lazy` and `Suspense` and points at `deferred()` from `@zappie/foundations`. It is an error in `recommended`.
+  - `@zappie/check`: `lint` fails when a project turns down a `jsx-a11y` rule from `recommended`. A new `css` step reports `css/important` and `css/class-patch` as errors, and `css/duplicate-keyframes`, `css/duplicate-selector`, `css/arbitrary-token`, `css/literal-token`, `css/unused-custom-property`, `css/reduced-motion` and `css/unreadable` as warnings.
+  - `@zappie/verify`: V13 fails on a missing main landmark, a page without exactly one h1, a dialog without a name, a positive tabindex, a phone control under 44×44 px and focus that doesn't return after the item or cart closes. V16 times each marked overlay from tap to first paint on a phone profile. V17 checks each marked overlay's focus, Escape and scroll lock. Both are skipped while a menu has no overlay markers. V14 records `menuCssKbGz`. `findRegressions` compares two reports' metrics.
+  - `@zappie/starter`: menu controls are at least 44×44 px on a phone.
+
+### Patch Changes
+
+- Updated dependencies [4f3cdc3]
+- Updated dependencies [79deec3]
+  - @zappie/sdk@0.1.8
+  - eslint-plugin-zappie@0.2.0
+
 ## 0.1.3
 
 ### Patch Changes

package/README.md

@@ -15,16 +15,55 @@ npx zappie check
 | ----------- | ------------------------------------------------------------------------------------------- |
 | `config`    | `zappie.config.ts` and `theme.json`, against the SDK and token rules                        |
 | `allowlist` | Every npm dependency is on Zappie's package allowlist or in `packages.allow` in your config |
-| `lint`      | The `eslint-plugin-zappie` rules                                                            |
+| `audit`     | High and critical dependency advisories, with critical findings enforced on request         |
+| `lint`      | The `eslint-plugin-zappie` rules and the `jsx-a11y` accessibility baseline                  |
 | `types`     | A TypeScript check of the project                                                           |
 | `test`      | Your project's tests                                                                        |
 | `build`     | A production build                                                                          |
 | `secrets`   | No secret keys or tokens in your source or build                                            |
 | `readiness` | Initial route discovery is enabled, or the config records why the site opts out             |
 | `budgets`   | Built JavaScript and CSS sizes, against Zappie's default budgets or the ones in your config |
+| `css`       | Your source CSS and class names, and the built client CSS, for the problems below           |
+
+### CSS problems
+
+| Code                         | Level   | What it catches                                                                                         |
+| ---------------------------- | ------- | ------------------------------------------------------------------------------------------------------- |
+| `css/important`              | Error   | `!important` in source CSS or `@apply`, or an important utility such as `p-4!` or `!p-4`                |
+| `css/class-patch`            | Error   | A selector that matches a class attribute, such as `[class*="bg-white"]`. Dark mode goes through tokens |
+| `css/duplicate-keyframes`    | Warning | Two `@keyframes` with the same frames under different names, or one name defined twice                  |
+| `css/duplicate-selector`     | Warning | A selector, or a selector list, styled by more than one source rule in the same context                 |
+| `css/arbitrary-token`        | Warning | An arbitrary utility that restates a token from your `@theme`, such as `text-[hsl(var(--foreground))]`  |
+| `css/literal-token`          | Warning | A plain CSS colour, radius or shadow that equals a token your CSS defines                               |
+| `css/unused-custom-property` | Warning | A custom property your CSS defines that no CSS, source or built script reads                            |
+| `css/reduced-motion`         | Warning | An animation or transition with no `prefers-reduced-motion` path                                        |
+| `css/unreadable`             | Warning | A CSS file that can't be parsed                                                                         |
+
+Warnings don't fail the step. A reviewed `!important` passes with `/* zappie-allow-important: <reason> */` on the same line. Declarations inside `@media (prefers-reduced-motion: reduce)` may use `!important`.
 
 Add `--json` for a machine-readable result. Its shape is the JSON Schema at `@zappie/check/schema/check-result.v1.json`.
 
+Dependency auditing defaults to `--audit=report`. Use `--audit=off` when the registry is unavailable or `--audit=enforce` to fail on an unacknowledged critical advisory. A high or critical advisory with no fixed version can be acknowledged for at most 90 days:
+
+```ts
+export default defineConfig({
+  // ...
+  audit: {
+    ignore: [
+      {
+        id: "GHSA-abcd-1234-5678",
+        reason: "The maintainer has not published a fixed release",
+        until: "2026-11-30",
+      },
+    ],
+  },
+});
+```
+
+An unreadable or missing lockfile, registry failure, timeout, or unsupported Yarn or Bun project is reported as `audit/unavailable`. Report mode keeps checking and enforce mode fails. Invalid or expired acknowledgements are reported without hiding the advisory or stopping later checks.
+
+Pass `--history` to include committed Git history in the secret scan. The normal scan covers every tracked file plus generated files under `workers/**`, `build/client/**` and `build/server/**`.
+
 ## From code
 
 ```ts

package/dist/index.d.ts

@@ -5,8 +5,22 @@ type CheckProblem = {
     line?: number;
     message: string;
     fix: string | null;
+    advisory?: AuditAdvisory;
 };
-type CheckStepName = "config" | "allowlist" | "lint" | "types" | "test" | "build" | "secrets" | "readiness" | "budgets";
+type AuditMode = "off" | "report" | "enforce";
+type AuditAdvisory = {
+    id: string;
+    package: string;
+    severity: "high" | "critical";
+    vulnerableVersion: string;
+    fixedVersion: string | null;
+    fixCommand?: string;
+    upgradePackage?: string;
+    upgradeVersion?: string;
+    ignored: boolean;
+    ignoredUntil?: string;
+};
+type CheckStepName = "config" | "allowlist" | "audit" | "lint" | "types" | "test" | "build" | "secrets" | "readiness" | "budgets" | "css";
 type CheckStep = {
     name: CheckStepName;
     result: CheckResultValue;
@@ -21,6 +35,8 @@ type CheckOptions = {
     cwd: string;
     all?: boolean;
     packageManager: PackageManager;
+    audit?: AuditMode;
+    history?: boolean;
     signal?: AbortSignal;
 };
 type StepOptions = Omit<CheckOptions, "all">;
@@ -31,6 +47,26 @@ type AllowlistSource = {
 declare const BUILTIN_ALLOWLIST_SOURCE: AllowlistSource;
 declare function checkAllowlist({ cwd, signal }: StepOptions, source?: AllowlistSource): Promise<CheckStep>;
 
+type CommandResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+declare function command(executable: string, args: string[], cwd: string, signal?: AbortSignal): Promise<CommandResult>;
+
+type AuditIgnore = {
+    id: string;
+    reason: string;
+    until: string;
+};
+type AuditDependencies = {
+    run?: typeof command;
+    timeoutMs?: number;
+};
+declare function checkAudit(options: StepOptions, dependencies?: AuditDependencies): Promise<CheckStep>;
+declare function evaluateAudit(advisories: AuditAdvisory[], mode: "report" | "enforce", ignores?: AuditIgnore[], file?: string): CheckStep;
+declare function parseAuditOutput(manager: PackageManager, source: string): AuditAdvisory[];
+
 declare function checkBudgets({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkBuild({ cwd, packageManager, signal, }: StepOptions): Promise<CheckStep>;
@@ -44,6 +80,28 @@ declare function supportsTypeScriptImport(version?: string): boolean;
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 declare function checkConfig({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
+declare function checkCss({ cwd, signal, }: StepOptions): Promise<CheckStep>;
+
+type TextFile = {
+    file: string;
+    text: string;
+};
+type CssInputs = {
+    /** CSS the project authors. */
+    sourceCss: TextFile[];
+    /** Script and markup that can hold class strings or read custom properties. */
+    sourceCode: TextFile[];
+    /** Client CSS the build emitted, Tailwind's generated rules among it. */
+    builtCss: TextFile[];
+    /** Client JavaScript the build emitted; it can read custom properties too. */
+    builtCode: TextFile[];
+};
+
+type CssCode = "css/important" | "css/duplicate-keyframes" | "css/duplicate-selector" | "css/arbitrary-token" | "css/unused-custom-property" | "css/reduced-motion" | "css/class-patch" | "css/literal-token" | "css/unreadable";
+/** These codes fail the step. The other codes warn for one release. */
+declare const CSS_ERRORS: ReadonlySet<CssCode>;
+declare function analyseCss(inputs: CssInputs): CheckProblem[];
+
 declare function checkLint({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkReadiness({ cwd, signal, }: StepOptions): Promise<CheckStep>;
@@ -54,11 +112,13 @@ declare const SECRET_FILE_SIZE_CAP: number;
 type SecretFinding = CheckProblem & {
     severity: "error" | "warning";
 };
-declare function scanSecrets(dir: string): Promise<SecretFinding[]>;
-declare function checkSecrets({ cwd, signal, }: StepOptions): Promise<CheckStep>;
+declare function scanSecrets(dir: string, options?: {
+    history?: boolean;
+}): Promise<SecretFinding[]>;
+declare function checkSecrets({ cwd, history, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkTests({ cwd, packageManager, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkTypes(options: StepOptions): Promise<CheckStep>;
 
-export { type AllowlistSource, BUILTIN_ALLOWLIST_SOURCE, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, checkAllowlist, checkBudgets, checkBuild, checkConfig, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, loadConfig, runCheck, scanSecrets, supportsTypeScriptImport };
+export { type AllowlistSource, type AuditAdvisory, type AuditIgnore, type AuditMode, BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type CssCode, type CssInputs, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, type TextFile, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, evaluateAudit, loadConfig, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport };