@zappie/check 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @zappie/check
 
+## 0.2.2
+
+### Patch Changes
+
+- afb46d4: Add storefront security lint rules, pass outbound hosts from `zappie.config.ts` to ESLint, and provide `safeRedirect` from `@zappie/sdk/redirect` for untrusted navigation targets.
+- Updated dependencies [2b672c9]
+- Updated dependencies [9b5b412]
+- Updated dependencies [32ecccf]
+- Updated dependencies [afb46d4]
+- Updated dependencies [6a8e227]
+- Updated dependencies [c0171ae]
+- Updated dependencies [0cbc4da]
+  - @zappie/sdk@0.1.12
+  - eslint-plugin-zappie@0.3.0
+
+## 0.2.1
+
+### Patch Changes
+
+- edfc401: Audit storefront dependencies and widen secret scanning to tracked files, Worker output, server bundles and optional Git history.
+- Updated dependencies [edfc401]
+  - @zappie/sdk@0.1.11
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -15,6 +15,7 @@ npx zappie check
 | ----------- | ------------------------------------------------------------------------------------------- |
 | `config`    | `zappie.config.ts` and `theme.json`, against the SDK and token rules                        |
 | `allowlist` | Every npm dependency is on Zappie's package allowlist or in `packages.allow` in your config |
+| `audit`     | High and critical dependency advisories, with critical findings enforced on request         |
 | `lint`      | The `eslint-plugin-zappie` rules and the `jsx-a11y` accessibility baseline                  |
 | `types`     | A TypeScript check of the project                                                           |
 | `test`      | Your project's tests                                                                        |
@@ -42,6 +43,27 @@ Warnings don't fail the step. A reviewed `!important` passes with `/* zappie-all
 
 Add `--json` for a machine-readable result. Its shape is the JSON Schema at `@zappie/check/schema/check-result.v1.json`.
 
+Dependency auditing defaults to `--audit=report`. Use `--audit=off` when the registry is unavailable or `--audit=enforce` to fail on an unacknowledged critical advisory. A high or critical advisory with no fixed version can be acknowledged for at most 90 days:
+
+```ts
+export default defineConfig({
+  // ...
+  audit: {
+    ignore: [
+      {
+        id: "GHSA-abcd-1234-5678",
+        reason: "The maintainer has not published a fixed release",
+        until: "2026-11-30",
+      },
+    ],
+  },
+});
+```
+
+An unreadable or missing lockfile, registry failure, timeout, or unsupported Yarn or Bun project is reported as `audit/unavailable`. Report mode keeps checking and enforce mode fails. Invalid or expired acknowledgements are reported without hiding the advisory or stopping later checks.
+
+Pass `--history` to include committed Git history in the secret scan. The normal scan covers every tracked file plus generated files under `workers/**`, `build/client/**` and `build/server/**`.
+
 ## From code
 
 ```ts

package/dist/index.d.ts

@@ -5,8 +5,22 @@ type CheckProblem = {
     line?: number;
     message: string;
     fix: string | null;
+    advisory?: AuditAdvisory;
 };
-type CheckStepName = "config" | "allowlist" | "lint" | "types" | "test" | "build" | "secrets" | "readiness" | "budgets" | "css";
+type AuditMode = "off" | "report" | "enforce";
+type AuditAdvisory = {
+    id: string;
+    package: string;
+    severity: "high" | "critical";
+    vulnerableVersion: string;
+    fixedVersion: string | null;
+    fixCommand?: string;
+    upgradePackage?: string;
+    upgradeVersion?: string;
+    ignored: boolean;
+    ignoredUntil?: string;
+};
+type CheckStepName = "config" | "allowlist" | "audit" | "lint" | "types" | "test" | "build" | "secrets" | "readiness" | "budgets" | "css";
 type CheckStep = {
     name: CheckStepName;
     result: CheckResultValue;
@@ -21,6 +35,8 @@ type CheckOptions = {
     cwd: string;
     all?: boolean;
     packageManager: PackageManager;
+    audit?: AuditMode;
+    history?: boolean;
     signal?: AbortSignal;
 };
 type StepOptions = Omit<CheckOptions, "all">;
@@ -31,6 +47,26 @@ type AllowlistSource = {
 declare const BUILTIN_ALLOWLIST_SOURCE: AllowlistSource;
 declare function checkAllowlist({ cwd, signal }: StepOptions, source?: AllowlistSource): Promise<CheckStep>;
 
+type CommandResult = {
+    code: number;
+    stdout: string;
+    stderr: string;
+};
+declare function command(executable: string, args: string[], cwd: string, signal?: AbortSignal): Promise<CommandResult>;
+
+type AuditIgnore = {
+    id: string;
+    reason: string;
+    until: string;
+};
+type AuditDependencies = {
+    run?: typeof command;
+    timeoutMs?: number;
+};
+declare function checkAudit(options: StepOptions, dependencies?: AuditDependencies): Promise<CheckStep>;
+declare function evaluateAudit(advisories: AuditAdvisory[], mode: "report" | "enforce", ignores?: AuditIgnore[], file?: string): CheckStep;
+declare function parseAuditOutput(manager: PackageManager, source: string): AuditAdvisory[];
+
 declare function checkBudgets({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkBuild({ cwd, packageManager, signal, }: StepOptions): Promise<CheckStep>;
@@ -76,11 +112,13 @@ declare const SECRET_FILE_SIZE_CAP: number;
 type SecretFinding = CheckProblem & {
     severity: "error" | "warning";
 };
-declare function scanSecrets(dir: string): Promise<SecretFinding[]>;
-declare function checkSecrets({ cwd, signal, }: StepOptions): Promise<CheckStep>;
+declare function scanSecrets(dir: string, options?: {
+    history?: boolean;
+}): Promise<SecretFinding[]>;
+declare function checkSecrets({ cwd, history, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkTests({ cwd, packageManager, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkTypes(options: StepOptions): Promise<CheckStep>;
 
-export { type AllowlistSource, BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type CssCode, type CssInputs, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, type TextFile, analyseCss, checkAllowlist, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, loadConfig, runCheck, scanSecrets, supportsTypeScriptImport };
+export { type AllowlistSource, type AuditAdvisory, type AuditIgnore, type AuditMode, BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type CssCode, type CssInputs, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, type TextFile, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, evaluateAudit, loadConfig, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport };