@zappie/check 0.2.0 → 0.2.1

package/dist/index.js

@@ -42,7 +42,7 @@ function distance(left, right) {
   }
   return row[right.length] ?? Infinity;
 }
-function unknownKeys(value, allowed, path14, issue) {
+function unknownKeys(value, allowed, path15, issue) {
   for (const key of Object.keys(value)) {
     if (allowed.includes(key)) {
       continue;
@@ -50,7 +50,7 @@ function unknownKeys(value, allowed, path14, issue) {
     const closest = allowed.map((candidate) => ({ candidate, score: distance(key, candidate) })).sort((left, right) => left.score - right.score)[0];
     const hint = closest && closest.score <= 2 ? closest.candidate : void 0;
     issue({
-      path: path14 ? `${path14}.${key}` : key,
+      path: path15 ? `${path15}.${key}` : key,
       code: "unknown_key",
       message: hint ? `Unknown field "${key}". Rename it to "${hint}".` : `Unknown field "${key}". Remove it from the configuration.`,
       severity: "error"
@@ -76,20 +76,20 @@ function hostname(value) {
 }
 
 // ../sdk/src/site-config/sections.ts
-function nested(value, path14, keys, issue, validate) {
+function nested(value, path15, keys, issue, validate) {
   if (value === void 0) {
     return;
   }
   if (!record(value)) {
     issue({
-      path: path14,
+      path: path15,
       code: "invalid_type",
-      message: `Expected an object. Set ${path14} to an object or remove it.`,
+      message: `Expected an object. Set ${path15} to an object or remove it.`,
       severity: "error"
     });
     return;
   }
-  unknownKeys(value, keys, path14, issue);
+  unknownKeys(value, keys, path15, issue);
   validate(value);
 }
 function budgets(value, issue, error) {
@@ -126,18 +126,18 @@ function budgets(value, issue, error) {
             `Expected a positive finite number. Set budgets.${key} to a number greater than zero.`
           );
         } else if (amount > DEFAULT_BUDGETS[key]) {
-          const message5 = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
+          const message6 = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
           if (budget.override === void 0) {
             error(
               `budgets.${key}`,
               "budget_override",
-              `${message5} Add budgets.override.reason to explain the increase.`
+              `${message6} Add budgets.override.reason to explain the increase.`
             );
           } else {
             issue({
               path: `budgets.${key}`,
               code: "budget_override",
-              message: `${message5} Lower it to the default when the exception is no longer needed.`,
+              message: `${message6} Lower it to the default when the exception is no longer needed.`,
               severity: "warning"
             });
           }
@@ -181,6 +181,7 @@ var rootKeys = [
   "prerender",
   "menu",
   "packages",
+  "audit",
   "outbound",
   "budgets",
   "readiness",
@@ -189,7 +190,7 @@ var rootKeys = [
 function validateConfig(input) {
   const issues = [];
   const issue = (value) => issues.push(value);
-  const error = (path14, code, message5) => issue({ path: path14, code, message: message5, severity: "error" });
+  const error = (path15, code, message6) => issue({ path: path15, code, message: message6, severity: "error" });
   if (!record(input)) {
     return {
       valid: false,
@@ -284,12 +285,12 @@ function validateConfig(input) {
     issues
   };
 }
-function requiredSlug(value, path14, error) {
+function requiredSlug(value, path15, error) {
   if (!nonblank(value)) {
     error(
-      path14,
+      path15,
       value === void 0 ? "missing_required" : "invalid_type",
-      `Expected a non-empty storefront slug. Set ${path14} to the slug used by createZappie().`
+      `Expected a non-empty storefront slug. Set ${path15} to the slug used by createZappie().`
     );
   }
 }
@@ -308,29 +309,29 @@ function theme(value, error) {
     );
   }
 }
-function stringList(value, path14, error, options = {}) {
+function stringList(value, path15, error, options = {}) {
   if (value === void 0) {
     return void 0;
   }
   if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
     error(
-      path14,
+      path15,
       "invalid_type",
-      `Expected an array of strings. Set ${path14} to string values.`
+      `Expected an array of strings. Set ${path15} to string values.`
     );
     return void 0;
   }
   if (options.nonempty && value.length === 0) {
     error(
-      path14,
+      path15,
       "invalid_format",
-      `Expected at least one value. Add a value to ${path14} or remove the field.`
+      `Expected at least one value. Add a value to ${path15} or remove the field.`
     );
   }
   value.forEach((entry, index) => {
     if (options.slug && !nonblank(entry)) {
       error(
-        `${path14}[${index}]`,
+        `${path15}[${index}]`,
         "invalid_format",
         "Expected a non-empty branch slug. Remove the empty value or use a branch slug."
       );
@@ -338,17 +339,17 @@ function stringList(value, path14, error, options = {}) {
   });
   if (options.unique && new Set(value).size !== value.length) {
     error(
-      path14,
+      path15,
       "duplicate",
-      `Expected unique values. Remove duplicates from ${path14}.`
+      `Expected unique values. Remove duplicates from ${path15}.`
     );
   }
   return value;
 }
 function paths(value, error) {
   const values = stringList(value, "prerender", error, { unique: true });
-  values?.forEach((path14, index) => {
-    if (!path14.startsWith("/")) {
+  values?.forEach((path15, index) => {
+    if (!path15.startsWith("/")) {
       error(
         `prerender[${index}]`,
         "invalid_format",
@@ -851,11 +852,11 @@ var record2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var includes = (values, key) => values.includes(key);
 function validateTheme(input) {
   const issues = [];
-  const issue = (path14, code, message5, severity = "error") => issues.push({ path: path14, code, message: message5, severity });
-  const keys = (obj, allowed, path14) => {
+  const issue = (path15, code, message6, severity = "error") => issues.push({ path: path15, code, message: message6, severity });
+  const keys = (obj, allowed, path15) => {
     for (const key of Object.keys(obj)) {
       if (!allowed.includes(key)) {
-        issue(path14 ? `${path14}.${key}` : key, "invalid_theme", "Unknown field");
+        issue(path15 ? `${path15}.${key}` : key, "invalid_theme", "Unknown field");
       }
     }
   };
@@ -916,9 +917,9 @@ function validateTheme(input) {
       }
     }
     for (const [key, value] of Object.entries(values)) {
-      const path14 = `${group}.${key}`;
+      const path15 = `${group}.${key}`;
       if (!includes(TOKEN_NAMES, key)) {
-        issue(path14, "unknown_token", "Unknown semantic token");
+        issue(path15, "unknown_token", "Unknown semantic token");
         continue;
       }
       let code, valid = false;
@@ -936,7 +937,7 @@ function validateTheme(input) {
         valid = typeof value === "string" && safeValue(value) && (includes(DURATION_TOKENS, key) ? isDuration(value) : isEasing(value));
       }
       if (!valid) {
-        issue(path14, code, "Invalid or unsafe token value");
+        issue(path15, code, "Invalid or unsafe token value");
       }
     }
   }
@@ -946,30 +947,30 @@ function validateTheme(input) {
     } else {
       const roles = /* @__PURE__ */ new Set();
       input.fonts.forEach((font, i) => {
-        const path14 = `fonts[${i}]`;
+        const path15 = `fonts[${i}]`;
         if (!record2(font)) {
-          issue(path14, "invalid_font", "Expected a font object");
+          issue(path15, "invalid_font", "Expected a font object");
           return;
         }
-        keys(font, ["family", "source", "url", "weights", "role"], path14);
+        keys(font, ["family", "source", "url", "weights", "role"], path15);
         if (typeof font.family !== "string" || !isFontFamily(font.family) || font.family.includes(",")) {
           issue(
-            `${path14}.family`,
+            `${path15}.family`,
             "invalid_font",
             "Expected one unquoted font family"
           );
         }
         if (typeof font.source !== "string" || !["google", "self", "system"].includes(font.source)) {
-          issue(`${path14}.source`, "invalid_font", "Unknown font source");
+          issue(`${path15}.source`, "invalid_font", "Unknown font source");
         }
         if (typeof font.role !== "string" || !["display", "body", "mono"].includes(font.role) || roles.has(font.role)) {
-          issue(`${path14}.role`, "invalid_font", "Expected a unique font role");
+          issue(`${path15}.role`, "invalid_font", "Expected a unique font role");
         }
         roles.add(String(font.role));
         if (font.source === "self" || font.url !== void 0) {
           if (typeof font.url !== "string" || !isAssetUrl(font.url, false) || !new URL(font.url).pathname.endsWith(".woff2")) {
             issue(
-              `${path14}.url`,
+              `${path15}.url`,
               "invalid_font",
               "Expected an HTTPS .woff2 URL"
             );
@@ -979,7 +980,7 @@ function validateTheme(input) {
           (w) => typeof w !== "number" || !Number.isInteger(w) || w < 1 || w > 1e3
         ))) {
           issue(
-            `${path14}.weights`,
+            `${path15}.weights`,
             "invalid_font",
             "Expected 1\u20139 integer weights between 1 and 1000"
           );
@@ -1089,13 +1090,13 @@ function escape(value) {
 }
 
 // src/result.ts
-function problem(message5, fix, details = {}) {
-  return { ...details, message: message5, fix };
+function problem(message6, fix, details = {}) {
+  return { ...details, message: message6, fix };
 }
 function step(name, result, problems = []) {
   return { name, result, problems };
 }
-var skipped = (name, message5) => step(name, "skipped", [problem(message5, null)]);
+var skipped = (name, message6) => step(name, "skipped", [problem(message6, null)]);
 
 // src/config.ts
 function supportsTypeScriptImport(version = process.versions.node) {
@@ -1318,22 +1319,500 @@ async function installedManifest(cwd, name) {
   }
 }
 
+// src/audit.ts
+import { access as access2, readFile as readFile4 } from "fs/promises";
+import path4 from "path";
+
+// src/command.ts
+import { spawn } from "child_process";
+function command(executable, args, cwd, signal) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, {
+      cwd,
+      env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },
+      stdio: ["ignore", "pipe", "pipe"],
+      ...signal ? { signal } : {}
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (value) => {
+      stdout += String(value);
+    });
+    child.stderr.on("data", (value) => {
+      stderr += String(value);
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      resolve({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+function execArgs(manager, binary, args) {
+  if (manager === "npm") {
+    return { executable: "npm", args: ["exec", "--no", "--", binary, ...args] };
+  }
+  if (manager === "yarn") {
+    return { executable: "yarn", args: ["exec", binary, ...args] };
+  }
+  if (manager === "bun") {
+    return { executable: "bun", args: ["x", "--no-install", binary, ...args] };
+  }
+  return { executable: "pnpm", args: ["exec", binary, ...args] };
+}
+function scriptArgs(manager, name) {
+  if (manager === "bun") {
+    return { executable: "bun", args: ["run", name] };
+  }
+  if (manager === "npm") {
+    return { executable: "npm", args: ["run", name] };
+  }
+  return { executable: manager, args: [name] };
+}
+
+// src/audit.ts
+var AUDIT_TIMEOUT_MS = 6e4;
+async function checkAudit(options, dependencies = {}) {
+  const mode = options.audit ?? "report";
+  if (mode === "off") {
+    return skipped("audit", "Dependency auditing is off.");
+  }
+  options.signal?.throwIfAborted();
+  let invalidIgnores = [];
+  let ignores = [];
+  try {
+    const parsed = await auditIgnores(options.cwd);
+    ignores = parsed.ignores;
+    invalidIgnores = parsed.problems;
+  } catch (error) {
+    invalidIgnores.push(
+      problem(
+        `Could not use audit.ignore: ${message2(error)}`,
+        "Fix or remove the invalid acknowledgement. The advisory remains unacknowledged.",
+        { rule: "audit/invalid-ignore", file: "zappie.config.ts", line: 1 }
+      )
+    );
+  }
+  if (options.packageManager === "yarn" || options.packageManager === "bun") {
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${options.packageManager} is not supported.`,
+        "Use npm or pnpm for dependency auditing, or run with --audit=off.",
+        "package.json"
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  const lockfile2 = await findLockfile(options.cwd, options.packageManager);
+  if (!lockfile2) {
+    return withProblems(
+      unavailable(
+        mode,
+        "Could not audit dependencies: no lockfile was found.",
+        "Commit the package manager lockfile and run zappie check again.",
+        "package.json"
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  const invocation = auditCommand(options.packageManager);
+  const timeoutMs = dependencies.timeoutMs ?? AUDIT_TIMEOUT_MS;
+  const timeout = AbortSignal.timeout(timeoutMs);
+  const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+  let result;
+  try {
+    result = await (dependencies.run ?? command)(
+      invocation.executable,
+      invocation.args,
+      options.cwd,
+      signal
+    );
+  } catch (error) {
+    options.signal?.throwIfAborted();
+    const detail = timeout.aborted ? `the audit timed out after ${Math.ceil(timeoutMs / 1e3)} seconds` : message2(error);
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${detail}.`,
+        "Check registry access and run zappie check again.",
+        relativeLockfile(options.cwd, lockfile2)
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  options.signal?.throwIfAborted();
+  let advisories;
+  try {
+    advisories = parseAuditOutput(options.packageManager, result.stdout);
+    if (result.code > 1) {
+      throw new Error(`the audit command exited with status ${result.code}`);
+    }
+  } catch (error) {
+    return withProblems(
+      unavailable(
+        mode,
+        `Could not audit dependencies: ${message2(error)}.`,
+        "Check registry access and run zappie check again.",
+        relativeLockfile(options.cwd, lockfile2)
+      ),
+      invalidIgnores,
+      mode
+    );
+  }
+  return withProblems(
+    evaluateAudit(
+      advisories,
+      mode,
+      ignores,
+      relativeLockfile(options.cwd, lockfile2)
+    ),
+    invalidIgnores,
+    mode
+  );
+}
+function evaluateAudit(advisories, mode, ignores = [], file) {
+  const problems = [];
+  const applied = advisories.map((advisory) => {
+    const acknowledged = ignores.find(
+      ({ id }) => normalizedId(id) === normalizedId(advisory.id)
+    );
+    if (acknowledged && malicious(advisory.id)) {
+      problems.push(
+        problem(
+          `${advisory.id} is a malicious-package advisory and cannot be acknowledged.`,
+          `Remove ${advisory.package} and replace it with a trusted package or release.`,
+          {
+            rule: "audit/invalid-ignore",
+            advisory,
+            ...file ? { file, line: 1 } : {}
+          }
+        )
+      );
+      return advisory;
+    }
+    if (acknowledged && (advisory.fixedVersion || advisory.upgradeVersion || advisory.fixCommand)) {
+      const upgradePackage = advisory.upgradePackage ?? advisory.package;
+      const upgradeVersion = advisory.upgradeVersion ?? advisory.fixedVersion;
+      const fix = advisory.fixCommand ? `Run ${advisory.fixCommand}.` : `Upgrade ${upgradePackage} to ${upgradeVersion} or later.`;
+      const reason = advisory.fixCommand ? `${advisory.id} has an available fix and cannot be acknowledged.` : `${advisory.id} has a fixed version and cannot be acknowledged.`;
+      problems.push(
+        problem(reason, fix, {
+          rule: "audit/invalid-ignore",
+          advisory,
+          ...file ? { file, line: 1 } : {}
+        })
+      );
+      return advisory;
+    }
+    return acknowledged ? { ...advisory, ignored: true, ignoredUntil: acknowledged.until } : advisory;
+  });
+  problems.push(...applied.map((advisory) => advisoryProblem(advisory, file)));
+  const critical = applied.some(
+    ({ severity, ignored }) => severity === "critical" && !ignored
+  );
+  const invalidIgnore2 = problems.some(
+    ({ rule }) => rule === "audit/invalid-ignore"
+  );
+  return step(
+    "audit",
+    mode === "enforce" && (critical || invalidIgnore2) ? "failed" : "passed",
+    problems
+  );
+}
+function unavailable(mode, message6, fix, file) {
+  return step("audit", mode === "enforce" ? "failed" : "passed", [
+    problem(message6, fix, { rule: "audit/unavailable", file, line: 1 })
+  ]);
+}
+function withProblems(checked, extra, mode) {
+  if (extra.length === 0) {
+    return checked;
+  }
+  return step("audit", mode === "enforce" ? "failed" : checked.result, [
+    ...extra,
+    ...checked.problems
+  ]);
+}
+async function findLockfile(cwd, manager) {
+  const names = manager === "npm" ? ["package-lock.json", "npm-shrinkwrap.json"] : ["pnpm-lock.yaml"];
+  let directory = path4.resolve(cwd);
+  for (; ; ) {
+    if (directory !== path4.resolve(cwd) && manager === "pnpm" && await workspaceExcludes(directory, path4.resolve(cwd))) {
+      return null;
+    }
+    for (const name of names) {
+      const candidate = path4.join(directory, name);
+      try {
+        await access2(candidate);
+        return candidate;
+      } catch {
+      }
+    }
+    const parent = path4.dirname(directory);
+    if (parent === directory) {
+      return null;
+    }
+    directory = parent;
+  }
+}
+async function workspaceExcludes(directory, cwd) {
+  try {
+    const source = await readFile4(
+      path4.join(directory, "pnpm-workspace.yaml"),
+      "utf8"
+    );
+    const block = /^packages:\s*\n((?:[ \t]+.*(?:\n|$))*)/m.exec(source)?.[1];
+    if (!block) {
+      return false;
+    }
+    const relative2 = path4.relative(directory, cwd).replaceAll(path4.sep, "/");
+    const patterns = [
+      ...block.matchAll(/^\s*-\s*["']?([^"'\s]+)["']?\s*$/gm)
+    ].map((match) => match[1] ?? "");
+    return !patterns.some((pattern) => workspacePattern(pattern, relative2));
+  } catch {
+    return false;
+  }
+}
+function workspacePattern(pattern, relative2) {
+  if (pattern === ".") {
+    return relative2 === "";
+  }
+  const expression = pattern.split("*").map((part) => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^/]+");
+  return new RegExp(`^${expression}$`).test(relative2);
+}
+function relativeLockfile(cwd, lockfile2) {
+  return path4.relative(cwd, lockfile2).replaceAll(path4.sep, "/");
+}
+function auditCommand(manager) {
+  return manager === "pnpm" ? { executable: "pnpm", args: ["audit", "--json"] } : { executable: "npm", args: ["audit", "--json"] };
+}
+function parseAuditOutput(manager, source) {
+  const value = JSON.parse(source);
+  requireAuditReport(manager, value);
+  const parsed = manager === "npm" ? npmAdvisories(value) : pnpmAdvisories(value);
+  return parsed.filter(({ severity }) => severity === "high" || severity === "critical").sort((left, right) => left.id.localeCompare(right.id));
+}
+function requireAuditReport(manager, value) {
+  if (record3(value.error)) {
+    throw new Error(
+      string(value.error.message) ?? string(value.error.code) ?? string(value.message) ?? "the package manager returned an error"
+    );
+  }
+  if (manager === "npm" && !record3(value.vulnerabilities)) {
+    throw new Error("npm returned no vulnerability report");
+  }
+  if (manager === "pnpm" && !record3(value.advisories) && !record3(value.metadata)) {
+    throw new Error("pnpm returned no advisory report");
+  }
+}
+function pnpmAdvisories(value) {
+  if (!record3(value.advisories)) {
+    return [];
+  }
+  return Object.entries(value.advisories).flatMap(([key, raw]) => {
+    if (!record3(raw)) {
+      return [];
+    }
+    const findings = Array.isArray(raw.findings) ? raw.findings : [];
+    const versions = findings.flatMap(
+      (finding) => record3(finding) && typeof finding.version === "string" ? [finding.version] : []
+    );
+    const severity = normalizedSeverity(raw.severity);
+    if (!severity) {
+      return [];
+    }
+    return [
+      {
+        id: string(raw.github_advisory_id) ?? string(raw.id) ?? key,
+        package: string(raw.module_name) ?? "unknown package",
+        severity,
+        vulnerableVersion: versions.join(", ") || string(raw.vulnerable_versions) || "unknown",
+        fixedVersion: firstFixed(string(raw.patched_versions)),
+        ignored: false
+      }
+    ];
+  });
+}
+function npmAdvisories(value) {
+  if (!record3(value.vulnerabilities)) {
+    return [];
+  }
+  const advisories = /* @__PURE__ */ new Map();
+  for (const [packageName2, raw] of Object.entries(value.vulnerabilities)) {
+    if (!record3(raw) || !Array.isArray(raw.via)) {
+      continue;
+    }
+    for (const via of raw.via) {
+      if (!record3(via)) {
+        continue;
+      }
+      const severity = normalizedSeverity(via.severity);
+      if (!severity) {
+        continue;
+      }
+      const id = ghsaFrom(string(via.url)) ?? string(via.name) ?? String(via.source ?? packageName2);
+      const upgrade = npmUpgrade(raw.fixAvailable);
+      advisories.set(id, {
+        id,
+        package: packageName2,
+        severity,
+        vulnerableVersion: string(via.range) ?? string(raw.range) ?? "unknown",
+        fixedVersion: upgrade.upgradePackage === packageName2 ? upgrade.upgradeVersion ?? null : null,
+        ...upgrade,
+        ignored: false
+      });
+    }
+  }
+  return [...advisories.values()];
+}
+function advisoryProblem(advisory, file) {
+  const acknowledged = advisory.ignored ? ` Acknowledged until ${advisory.ignoredUntil}.` : "";
+  const upgradePackage = advisory.upgradePackage ?? advisory.package;
+  const upgradeVersion = advisory.upgradeVersion ?? advisory.fixedVersion;
+  const fix = malicious(advisory.id) ? `Remove ${advisory.package} and replace it with a trusted package or release.` : advisory.fixCommand ? `Run ${advisory.fixCommand}.` : upgradeVersion ? `Upgrade ${upgradePackage} to ${upgradeVersion} or later.` : `Review ${advisory.id}. If no fix exists, add a reason and an expiry of at most 90 days to audit.ignore.`;
+  return problem(
+    `${advisory.id}: ${advisory.package} ${advisory.vulnerableVersion} has ${advisory.severity} severity.${acknowledged}`,
+    fix,
+    {
+      rule: `audit/${advisory.id}`,
+      advisory,
+      ...file ? { file, line: 1 } : {}
+    }
+  );
+}
+async function auditIgnores(cwd) {
+  let loaded;
+  try {
+    loaded = await loadConfig(cwd);
+  } catch (error) {
+    if (missing(error)) {
+      return { ignores: [], problems: [] };
+    }
+    throw error;
+  }
+  if (!record3(loaded.value) || !record3(loaded.value.audit)) {
+    return { ignores: [], problems: [] };
+  }
+  const problems = [];
+  const ignores = parseAuditIgnores(loaded.value.audit.ignore, problems);
+  return { ignores, problems };
+}
+function parseAuditIgnores(value, problems = []) {
+  if (value === void 0) {
+    return [];
+  }
+  if (!Array.isArray(value)) {
+    problems.push(invalidIgnore("audit.ignore must be an array."));
+    return [];
+  }
+  const today = Date.parse(
+    `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}T00:00:00.000Z`
+  );
+  const ninetyDays = 90 * 24 * 60 * 60 * 1e3;
+  const ids = /* @__PURE__ */ new Set();
+  const ignores = [];
+  value.forEach((entry, index) => {
+    if (!ignoreEntry(entry) || !entry.id.trim() || !entry.reason.trim()) {
+      problems.push(
+        invalidIgnore(
+          `audit.ignore[${index}] must have a non-blank id, reason and until.`
+        )
+      );
+      return;
+    }
+    const id = normalizedId(entry.id);
+    if (ids.has(id)) {
+      problems.push(
+        invalidIgnore(`audit.ignore contains duplicate id ${entry.id}.`)
+      );
+      return;
+    }
+    const expiry = Date.parse(`${entry.until}T00:00:00.000Z`);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(entry.until) || !Number.isFinite(expiry) || new Date(expiry).toISOString().slice(0, 10) !== entry.until || expiry < today || expiry - today > ninetyDays) {
+      problems.push(
+        invalidIgnore(
+          `audit.ignore[${index}].until must be a real, unexpired date at most 90 days away.`
+        )
+      );
+      return;
+    }
+    ids.add(id);
+    ignores.push(entry);
+  });
+  return ignores;
+}
+function invalidIgnore(message6) {
+  return problem(
+    message6,
+    "Fix or remove the invalid acknowledgement. The advisory remains unacknowledged.",
+    { rule: "audit/invalid-ignore", file: "zappie.config.ts", line: 1 }
+  );
+}
+function ignoreEntry(value) {
+  return record3(value) && typeof value.id === "string" && typeof value.reason === "string" && typeof value.until === "string";
+}
+function npmUpgrade(value) {
+  if (record3(value) && typeof value.name === "string" && typeof value.version === "string") {
+    return { upgradePackage: value.name, upgradeVersion: value.version };
+  }
+  if (value === true) {
+    return { fixCommand: "npm audit fix" };
+  }
+  return {};
+}
+function firstFixed(value) {
+  if (!value || value === "<0.0.0") {
+    return null;
+  }
+  return /(?:^|\s)>=?\s*([^\s|]+)/.exec(value)?.[1] ?? null;
+}
+function ghsaFrom(value) {
+  const id = value ? /GHSA-[\w-]+/i.exec(value)?.[0] : void 0;
+  return id ? `GHSA-${id.slice(5).toLowerCase()}` : void 0;
+}
+function normalizedId(value) {
+  return value.trim().toLowerCase();
+}
+function malicious(value) {
+  return /^MAL-/i.test(value.trim());
+}
+function normalizedSeverity(value) {
+  const severity = typeof value === "string" ? value.toLowerCase() : "";
+  return severity === "high" || severity === "critical" ? severity : void 0;
+}
+function string(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function message2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function missing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function record3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/budgets.ts
-import { access as access2, readFile as readFile6 } from "fs/promises";
-import path6 from "path";
+import { access as access3, readFile as readFile7 } from "fs/promises";
+import path7 from "path";
 
 // src/budget-files.ts
-import { readFile as readFile4, readdir } from "fs/promises";
-import path4 from "path";
+import { readFile as readFile5, readdir } from "fs/promises";
+import path5 from "path";
 import { gzipSync } from "zlib";
 async function cssSizes(cwd) {
-  const root = path4.join(cwd, "build/client");
+  const root = path5.join(cwd, "build/client");
   const files = [];
   await collect(root, files);
   return Promise.all(
     files.filter((file) => file.endsWith(".css")).map(async (file) => ({
-      file: path4.relative(root, file).split(path4.sep).join("/"),
-      bytes: gzipSync(await readFile4(file, "utf8")).byteLength
+      file: path5.relative(root, file).split(path5.sep).join("/"),
+      bytes: gzipSync(await readFile5(file, "utf8")).byteLength
     }))
   );
 }
@@ -1342,7 +1821,7 @@ async function collect(directory, files) {
     if (entry.isSymbolicLink()) {
       continue;
     }
-    const file = path4.join(directory, entry.name);
+    const file = path5.join(directory, entry.name);
     if (entry.isDirectory()) {
       await collect(file, files);
     } else if (entry.isFile()) {
@@ -1352,8 +1831,8 @@ async function collect(directory, files) {
 }
 
 // src/budget-manifest.ts
-import { readFile as readFile5 } from "fs/promises";
-import path5 from "path";
+import { readFile as readFile6 } from "fs/promises";
+import path6 from "path";
 import { gzipSync as gzipSync2 } from "zlib";
 function routeKeys(manifest) {
   return Object.entries(manifest).filter(([key, entry]) => routeSource(entry.src ?? key)).map(([key]) => key).sort();
@@ -1367,7 +1846,7 @@ async function graphSizes(cwd, manifest, roots) {
     [...keys].map((key) => manifest[key]).filter((entry) => Boolean(entry)).filter(({ file }) => file.endsWith(".js")).map(async ({ file }) => ({
       file,
       bytes: gzipSync2(
-        await readFile5(path5.join(cwd, "build/client", file), "utf8")
+        await readFile6(path6.join(cwd, "build/client", file), "utf8")
       ).byteLength
     }))
   );
@@ -1401,16 +1880,16 @@ async function checkBudgets({
   signal
 }) {
   signal?.throwIfAborted();
-  const manifestFile = path6.join(cwd, "build/client/.vite/manifest.json");
+  const manifestFile = path7.join(cwd, "build/client/.vite/manifest.json");
   try {
-    await access2(manifestFile);
+    await access3(manifestFile);
   } catch {
     return skipped(
       "budgets",
       "No build/client/.vite/manifest.json is available."
     );
   }
-  const manifest = JSON.parse(await readFile6(manifestFile, "utf8"));
+  const manifest = JSON.parse(await readFile7(manifestFile, "utf8"));
   const config = (await loadConfig(cwd)).value;
   const limits = { ...DEFAULT_BUDGETS, ...config.budgets };
   const routes = routeKeys(manifest);
@@ -1465,56 +1944,8 @@ function cssProblem(sizes, limitKb, over) {
 var total = (sizes) => sizes.reduce((sum, asset) => sum + asset.bytes, 0);
 
 // src/build.ts
-import { readFile as readFile7 } from "fs/promises";
-import path7 from "path";
-
-// src/command.ts
-import { spawn } from "child_process";
-function command(executable, args, cwd, signal) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(executable, args, {
-      cwd,
-      env: { ...process.env, NO_COLOR: "1", FORCE_COLOR: "0" },
-      stdio: ["ignore", "pipe", "pipe"],
-      ...signal ? { signal } : {}
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (value) => {
-      stdout += String(value);
-    });
-    child.stderr.on("data", (value) => {
-      stderr += String(value);
-    });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      resolve({ code: code ?? 1, stdout, stderr });
-    });
-  });
-}
-function execArgs(manager, binary, args) {
-  if (manager === "npm") {
-    return { executable: "npm", args: ["exec", "--no", "--", binary, ...args] };
-  }
-  if (manager === "yarn") {
-    return { executable: "yarn", args: ["exec", binary, ...args] };
-  }
-  if (manager === "bun") {
-    return { executable: "bun", args: ["x", "--no-install", binary, ...args] };
-  }
-  return { executable: "pnpm", args: ["exec", binary, ...args] };
-}
-function scriptArgs(manager, name) {
-  if (manager === "bun") {
-    return { executable: "bun", args: ["run", name] };
-  }
-  if (manager === "npm") {
-    return { executable: "npm", args: ["run", name] };
-  }
-  return { executable: manager, args: [name] };
-}
-
-// src/build.ts
+import { readFile as readFile8 } from "fs/promises";
+import path8 from "path";
 async function checkBuild({
   cwd,
   packageManager,
@@ -1522,7 +1953,7 @@ async function checkBuild({
 }) {
   signal?.throwIfAborted();
   const manifest = JSON.parse(
-    await readFile7(path7.join(cwd, "package.json"), "utf8")
+    await readFile8(path8.join(cwd, "package.json"), "utf8")
   );
   const invocation = manifest.dependencies?.["react-router"] ? execArgs(packageManager, "react-router", ["build"]) : manifest.scripts?.build ? scriptArgs(packageManager, "build") : void 0;
   if (!invocation) {
@@ -1557,8 +1988,8 @@ ${stderr}`.split(/\r?\n/).map((line) => line.trimEnd()).filter(Boolean).slice(-1
 }
 
 // src/css-files.ts
-import { lstat, readFile as readFile8, readdir as readdir2 } from "fs/promises";
-import path8 from "path";
+import { lstat, readFile as readFile9, readdir as readdir2 } from "fs/promises";
+import path9 from "path";
 var FILE_SIZE_CAP = 1024 * 1024;
 var BUILD_FILE_SIZE_CAP = 8 * 1024 * 1024;
 var ignoredDirectories = /* @__PURE__ */ new Set([
@@ -1582,7 +2013,7 @@ async function readCssInputs(cwd) {
     return !name.startsWith(".") && !ignoredDirectories.has(name);
   });
   const built = [];
-  await collect2(path8.join(cwd, "build/client"), built, () => true);
+  await collect2(path9.join(cwd, "build/client"), built, () => true);
   const read = (files, cap) => texts(cwd, files, cap);
   return {
     sourceCss: await read(
@@ -1614,7 +2045,7 @@ async function texts(cwd, files, cap) {
     }
     result.push({
       file: relative(cwd, file),
-      text: await readFile8(file, "utf8")
+      text: await readFile9(file, "utf8")
     });
   }
   return result;
@@ -1633,7 +2064,7 @@ async function collect2(directory, files, enter) {
     if (entry.isSymbolicLink()) {
       continue;
     }
-    const file = path8.join(directory, entry.name);
+    const file = path9.join(directory, entry.name);
     if (entry.isDirectory()) {
       if (enter(entry.name)) {
         await collect2(file, files, enter);
@@ -1747,9 +2178,9 @@ function important(css, code) {
   }
   return problems;
 }
-function importantProblem(message5, file, line) {
+function importantProblem(message6, file, line) {
   return problem(
-    message5,
+    message6,
     "Raise the selector's specificity or reorder the rules instead. For a reviewed case, add /* zappie-allow-important: <reason> */ on the same line.",
     { rule: "css/important", file, ...line ? { line } : {} }
   );
@@ -2333,7 +2764,7 @@ async function checkCss({
 // src/lint.ts
 import zappie from "eslint-plugin-zappie";
 import { createRequire } from "module";
-import path9 from "path";
+import path10 from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 async function checkLint({
   cwd,
@@ -2342,12 +2773,12 @@ async function checkLint({
   signal?.throwIfAborted();
   let ESLint;
   try {
-    const require2 = createRequire(path9.join(cwd, "package.json"));
+    const require2 = createRequire(path10.join(cwd, "package.json"));
     const loadedEslint = await import(pathToFileURL2(require2.resolve("eslint")).href);
     ESLint = loadedEslint.ESLint;
   } catch (error) {
     return step("lint", "failed", [
-      problem(message2(error), "Install ESLint in the project.", {
+      problem(message3(error), "Install ESLint in the project.", {
         rule: "lint/unavailable"
       })
     ]);
@@ -2378,7 +2809,7 @@ async function checkLint({
   } catch (error) {
     return step("lint", "failed", [
       problem(
-        message2(error),
+        message3(error),
         "Fix the project ESLint configuration and run lint again.",
         {
           rule: "lint/config"
@@ -2433,7 +2864,7 @@ async function sourceFile(cwd) {
   for (const candidate of candidates) {
     try {
       await import("fs/promises").then(
-        ({ access: access3 }) => access3(path9.join(cwd, candidate))
+        ({ access: access4 }) => access4(path10.join(cwd, candidate))
       );
       return candidate;
     } catch {
@@ -2442,13 +2873,13 @@ async function sourceFile(cwd) {
   }
   return "eslint.config.mjs";
 }
-function message2(error) {
+function message3(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/readiness.ts
-import { readFile as readFile9 } from "fs/promises";
-import path10 from "path";
+import { readFile as readFile10 } from "fs/promises";
+import path11 from "path";
 import { pathToFileURL as pathToFileURL3 } from "url";
 async function checkReadiness({
   cwd,
@@ -2466,9 +2897,9 @@ async function checkReadiness({
       )
     ]);
   }
-  const file = path10.join(cwd, "react-router.config.ts");
+  const file = path11.join(cwd, "react-router.config.ts");
   try {
-    await readFile9(file, "utf8");
+    await readFile10(file, "utf8");
     const version = Date.now();
     const config = await import(`${pathToFileURL3(file).href}?readiness=${version}`);
     if (config.default?.routeDiscovery?.mode === "initial") {
@@ -2477,7 +2908,7 @@ async function checkReadiness({
   } catch (error) {
     return step("readiness", "failed", [
       problem(
-        message3(error),
+        message4(error),
         'Create react-router.config.ts and set routeDiscovery: { mode: "initial" }.',
         {
           rule: "readiness/route-discovery",
@@ -2494,13 +2925,15 @@ async function checkReadiness({
     )
   ]);
 }
-function message3(error) {
+function message4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
 // src/secrets.ts
-import { lstat as lstat2, readFile as readFile10, readdir as readdir3 } from "fs/promises";
-import path11 from "path";
+import { execFile } from "child_process";
+import { lstat as lstat2, readFile as readFile11, readdir as readdir3 } from "fs/promises";
+import path12 from "path";
+import { promisify } from "util";
 
 // src/secret-patterns.ts
 var FIX = "Move the value to a server environment variable and rotate it.";
@@ -2541,6 +2974,35 @@ function secretMatches(source, envFile) {
     fix: FIX,
     severity: "error"
   }));
+  const gitleaksDefaults = [
+    [/\bghp_[A-Za-z0-9]{36}\b/g, "github-pat", "GitHub personal access token"],
+    [
+      /\bgithub_pat_[A-Za-z0-9_]{82}\b/g,
+      "github-fine-grained-pat",
+      "GitHub fine-grained access token"
+    ],
+    [
+      /\bglpat-[A-Za-z0-9_-]{20,}\b/g,
+      "gitlab-pat",
+      "GitLab personal access token"
+    ],
+    [/\bnpm_[A-Za-z0-9]{36}\b/g, "npm-token", "npm access token"],
+    [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "slack-token", "Slack token"],
+    [/\bAIza[0-9A-Za-z_-]{35}\b/g, "google-api-key", "Google API key"],
+    [
+      /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g,
+      "sendgrid-api-key",
+      "SendGrid API key"
+    ]
+  ];
+  for (const [pattern, rule, label] of gitleaksDefaults) {
+    add(matches2, source, pattern, () => ({
+      rule: `secrets/${rule}`,
+      message: `Detected a ${label}.`,
+      fix: FIX,
+      severity: "error"
+    }));
+  }
   const occupied = matches2.map(({ index }) => index);
   const assignment = /\b([A-Za-z_$][\w$]*(?:secret|token|password|api[_-]?key)[\w$]*)\s*[:=]\s*(["'])([^"'\r\n]{24,})\2/gi;
   for (const found of source.matchAll(assignment)) {
@@ -2578,21 +3040,31 @@ function entropy(value) {
 
 // src/secrets.ts
 var SECRET_FILE_SIZE_CAP = 1024 * 1024;
-async function scanSecrets(dir) {
+var execFileAsync = promisify(execFile);
+var lockfile = /(?:^|\/)(?:package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/;
+async function scanSecrets(dir, options = {}) {
   const findings = [];
   for (const file of await filesToScan(dir)) {
-    const info = await lstat2(file);
+    let info;
+    try {
+      info = await lstat2(file);
+    } catch (error) {
+      if (missing2(error)) {
+        continue;
+      }
+      throw error;
+    }
     if (!info.isFile() || info.size > SECRET_FILE_SIZE_CAP) {
       continue;
     }
-    const contents = await readFile10(file);
+    const contents = await readFile11(file);
     if (contents.includes(0)) {
       continue;
     }
     const source = contents.toString("utf8");
     for (const match of secretMatches(
       source,
-      path11.basename(file).startsWith(".env")
+      path12.basename(file).startsWith(".env")
     )) {
       findings.push({
         rule: match.rule,
@@ -2604,14 +3076,21 @@ async function scanSecrets(dir) {
       });
     }
   }
+  if (options.history) {
+    findings.push(...await scanHistory(dir));
+  }
   return findings;
 }
 async function checkSecrets({
   cwd,
+  history,
   signal
 }) {
   signal?.throwIfAborted();
-  const findings = await scanSecrets(cwd);
+  const findings = await scanSecrets(
+    cwd,
+    history === void 0 ? {} : { history }
+  );
   signal?.throwIfAborted();
   const failed = findings.some(({ severity }) => severity === "error");
   return step(
@@ -2621,25 +3100,93 @@ async function checkSecrets({
   );
 }
 async function filesToScan(cwd) {
+  const files = await trackedFiles(cwd);
+  for (const directory of ["build/client", "build/server", "workers"]) {
+    await collect3(path12.join(cwd, directory), files);
+  }
+  return [...new Set(files)].filter((file) => !lockfile.test(relative(cwd, file))).sort();
+}
+async function trackedFiles(cwd) {
+  try {
+    const { stdout } = await execFileAsync("git", ["ls-files", "-z"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 32 * 1024 * 1024
+    });
+    const files = stdout.split("\0").filter(Boolean).map((file) => path12.join(cwd, file));
+    return files.length > 0 ? files : fallbackFiles(cwd);
+  } catch {
+    return fallbackFiles(cwd);
+  }
+}
+async function fallbackFiles(cwd) {
   const files = [];
   for (const directory of ["app", "public"]) {
-    await collect3(path11.join(cwd, directory), files);
+    await collect3(path12.join(cwd, directory), files);
   }
-  await collect3(
-    path11.join(cwd, "build/client"),
-    files,
-    (file) => file.endsWith(".js")
-  );
   try {
     for (const entry of await readdir3(cwd, { withFileTypes: true })) {
       if (entry.isFile() && rootConfig(entry.name)) {
-        files.push(path11.join(cwd, entry.name));
+        files.push(path12.join(cwd, entry.name));
       }
     }
   } catch {
-    return files.sort();
+    return files;
   }
-  return [...new Set(files)].sort();
+  return files;
+}
+async function scanHistory(cwd) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      [
+        "log",
+        "--all",
+        "--format=commit:%H",
+        "-p",
+        "--no-ext-diff",
+        "--",
+        ".",
+        ":(exclude)package-lock.json",
+        ":(exclude)pnpm-lock.yaml",
+        ":(exclude)yarn.lock",
+        ":(exclude)bun.lock",
+        ":(exclude)bun.lockb"
+      ],
+      { cwd, encoding: "utf8", maxBuffer: 128 * 1024 * 1024 }
+    );
+    return secretMatches(stdout, false).map((match) => {
+      const location2 = historyLocation(stdout, match.index);
+      return {
+        rule: match.rule,
+        file: location2 ?? "git history",
+        line: lineAt(stdout, match.index),
+        message: match.message,
+        fix: match.fix,
+        severity: match.severity
+      };
+    });
+  } catch {
+    return [
+      {
+        rule: "secrets/history-unavailable",
+        file: "git history",
+        line: 1,
+        message: "Could not scan Git history for secrets.",
+        fix: "Check Git access and run zappie check --history again.",
+        severity: "warning"
+      }
+    ];
+  }
+}
+function historyLocation(source, index) {
+  const prefix = source.slice(0, index);
+  const commit = [...prefix.matchAll(/^commit:([0-9a-f]+)$/gm)].at(-1)?.[1];
+  const changedPaths = [
+    ...prefix.matchAll(/^(?:\+\+\+ b\/|--- a\/)(.+)$/gm)
+  ].map((match) => match[1]);
+  const file = changedPaths.at(-1);
+  return commit && file ? `${commit}:${file}` : void 0;
 }
 async function collect3(directory, files, accept = () => true) {
   try {
@@ -2647,7 +3194,7 @@ async function collect3(directory, files, accept = () => true) {
       if (entry.isSymbolicLink()) {
         continue;
       }
-      const file = path11.join(directory, entry.name);
+      const file = path12.join(directory, entry.name);
       if (entry.isDirectory()) {
         await collect3(file, files, accept);
       } else if (entry.isFile() && accept(file)) {
@@ -2655,11 +3202,14 @@ async function collect3(directory, files, accept = () => true) {
       }
     }
   } catch (error) {
-    if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+    if (!missing2(error)) {
       throw error;
     }
   }
 }
+function missing2(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
 function rootConfig(name) {
   return name === "package.json" || name === "wrangler.json" || name === "wrangler.jsonc" || /(?:^|\.)config\.(?:[cm]?[jt]s|json)$/.test(name);
 }
@@ -2668,13 +3218,13 @@ function lineAt(source, index) {
 }
 
 // src/test-step.ts
-import path12 from "path";
+import path13 from "path";
 async function checkTests({
   cwd,
   packageManager,
   signal
 }) {
-  const manifest = await json(path12.join(cwd, "package.json"));
+  const manifest = await json(path13.join(cwd, "package.json"));
   if (!manifest.scripts?.test) {
     return skipped("test", "No test script is defined in package.json.");
   }
@@ -2697,11 +3247,11 @@ async function checkTests({
 }
 
 // src/types-step.ts
-import path13 from "path";
+import path14 from "path";
 async function checkTypes(options) {
   const { cwd, packageManager, signal } = options;
   signal?.throwIfAborted();
-  const manifest = await json(path13.join(cwd, "package.json"));
+  const manifest = await json(path14.join(cwd, "package.json"));
   if (manifest.dependencies?.["react-router"]) {
     const generated = execArgs(packageManager, "react-router", ["typegen"]);
     const result2 = await command(
@@ -2755,6 +3305,7 @@ function outputProblems(output) {
 var runners = [
   { name: "config", run: checkConfig },
   { name: "allowlist", run: checkAllowlist },
+  { name: "audit", run: checkAudit },
   { name: "lint", run: checkLint },
   { name: "types", run: checkTypes },
   { name: "test", run: checkTests },
@@ -2775,13 +3326,13 @@ async function runCheck(options) {
       options.signal?.throwIfAborted();
       checked = step(runner.name, "failed", [
         problem(
-          message4(error),
+          message5(error),
           "Fix the step setup and run zappie check again."
         )
       ]);
     }
     steps.push(checked);
-    if (checked.result === "failed" && !options.all) {
+    if (checked.result === "failed" && !options.all && runner.name !== "audit") {
       break;
     }
   }
@@ -2790,7 +3341,7 @@ async function runCheck(options) {
     steps
   };
 }
-function message4(error) {
+function message5(error) {
   return error instanceof Error ? error.message : String(error);
 }
 export {
@@ -2799,6 +3350,7 @@ export {
   SECRET_FILE_SIZE_CAP,
   analyseCss,
   checkAllowlist,
+  checkAudit,
   checkBudgets,
   checkBuild,
   checkConfig,
@@ -2808,7 +3360,9 @@ export {
   checkSecrets,
   checkTests,
   checkTypes,
+  evaluateAudit,
   loadConfig,
+  parseAuditOutput,
   runCheck,
   scanSecrets,
   supportsTypeScriptImport