@zappie/check 0.2.6 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @zappie/check
 
+## 0.4.0
+
+### Minor Changes
+
+- 628ac42: The `build` step fails when `build/client` or `build/server` has Studio's dev-only `data-zappie-source` or `data-zappie-component` attributes (`build/no-dev-source-attributes`). `magic-string` joins `GLOBAL_DEV_PACKAGE_ALLOWLIST` for the starter's `zappieSource()` plugin.
+
+### Patch Changes
+
+- Updated dependencies [628ac42]
+  - @zappie/sdk@0.1.19
+
+## 0.3.0
+
+### Minor Changes
+
+- 5c0569f: The `allowlist` step checks devDependencies against `packages.allow` and the allowlists, including the new `GLOBAL_DEV_PACKAGE_ALLOWLIST`. It fails any installed or locked package with an install script, except those in `INSTALL_SCRIPT_ALLOWLIST`: esbuild, workerd and fsevents. Packages are named by their folder, and one whose manifest claims another name fails. Alias, git, file, link and tarball sources in package.json fail. Linked packages are checked once, and the walk stops at a link out of the project. When nothing is installed, the step says install scripts weren't checked.
+
+### Patch Changes
+
+- Updated dependencies [88f52b6]
+- Updated dependencies [a151b0b]
+- Updated dependencies [a151b0b]
+- Updated dependencies [195a5b8]
+  - eslint-plugin-zappie@0.3.2
+  - @zappie/sdk@0.1.17
+
 ## 0.2.6
 
 ### Patch Changes

package/README.md

@@ -14,7 +14,7 @@ npx zappie check
 | Step        | What it looks at                                                                            |
 | ----------- | ------------------------------------------------------------------------------------------- |
 | `config`    | `zappie.config.ts` and `theme.json`, against the SDK and token rules                        |
-| `allowlist` | Every npm dependency is on Zappie's package allowlist or in `packages.allow` in your config |
+| `allowlist` | Dependencies, devDependencies and lockfile install scripts, against Zappie's allowlists     |
 | `audit`     | High and critical dependency advisories, with critical findings enforced on request         |
 | `lint`      | The `eslint-plugin-zappie` rules and the `jsx-a11y` accessibility baseline                  |
 | `types`     | A TypeScript check of the project                                                           |

package/dist/index.d.ts

@@ -43,7 +43,12 @@ type StepOptions = Omit<CheckOptions, "all">;
 
 type AllowlistSource = {
     load(signal?: AbortSignal): Promise<readonly string[]>;
+    loadDev?(signal?: AbortSignal): Promise<readonly string[]>;
 };
+/** Build and test tools allowed in devDependencies without a packages.allow entry. */
+declare const GLOBAL_DEV_PACKAGE_ALLOWLIST: readonly ["typescript", "vite", "@react-router/dev", "magic-string", "@cloudflare/*", "wrangler", "eslint", "eslint-plugin-zappie", "vitest", "@playwright/test", "@types/*", "@zappie/*", "zappie", "postcss", "jsdom", "@testing-library/*"];
+/** The only packages allowed to run install scripts. npm flags fsevents on every platform. */
+declare const INSTALL_SCRIPT_ALLOWLIST: readonly ["esbuild", "workerd", "fsevents"];
 declare const BUILTIN_ALLOWLIST_SOURCE: AllowlistSource;
 declare function checkAllowlist({ cwd, signal }: StepOptions, source?: AllowlistSource): Promise<CheckStep>;
 
@@ -102,6 +107,12 @@ type CssCode = "css/important" | "css/duplicate-keyframes" | "css/duplicate-sele
 declare const CSS_ERRORS: ReadonlySet<CssCode>;
 declare function analyseCss(inputs: CssInputs): CheckProblem[];
 
+/**
+ * Find Studio's dev-only source attributes in the build output. They name the files and lines of the site's code, so
+ * a published page must never carry them. Source maps are skipped: they quote library source, not rendered markup.
+ */
+declare function devSourceProblems(cwd: string): Promise<CheckProblem[]>;
+
 declare function checkLint({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkReadiness({ cwd, signal, }: StepOptions): Promise<CheckStep>;
@@ -121,4 +132,4 @@ declare function checkTests({ cwd, packageManager, signal, }: StepOptions): Prom
 
 declare function checkTypes(options: StepOptions): Promise<CheckStep>;
 
-export { type AllowlistSource, type AuditAdvisory, type AuditIgnore, type AuditMode, BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type CssCode, type CssInputs, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, type TextFile, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, evaluateAudit, loadConfig, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport };
+export { type AllowlistSource, type AuditAdvisory, type AuditIgnore, type AuditMode, BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, type CheckOptions, type CheckProblem, type CheckResult, type CheckResultValue, type CheckStep, type CheckStepName, type CssCode, type CssInputs, GLOBAL_DEV_PACKAGE_ALLOWLIST, INSTALL_SCRIPT_ALLOWLIST, type PackageManager, SECRET_FILE_SIZE_CAP, type SecretFinding, type StepOptions, type TextFile, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, devSourceProblems, evaluateAudit, loadConfig, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport };