@zappie/check 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @zappie/check
 
+## 0.6.0
+
+### Minor Changes
+
+- 009fbbf: The lint step runs the security rules from `eslint-plugin-zappie` as errors on every source file, with Zappie's config alone, so a project's ESLint config, ignores and `eslint-disable` comments can't turn them off. The build step scans the build output once for navigation off the site, refresh tags and headers, external scripts and links or sources on hosts the site doesn't list (`build/*`).
+
+### Patch Changes
+
+- Updated dependencies [1ad2db2]
+- Updated dependencies [d9baf67]
+- Updated dependencies [8ea70dc]
+- Updated dependencies [ea37bcf]
+  - eslint-plugin-zappie@0.4.0
+  - @zappie/sdk@0.2.0
+
+## 0.5.0
+
+### Minor Changes
+
+- 68b9710: The config step checks `app/brand.json`, Studio's brand brief, when a site has one: its size, its JSON and every key and choice (`brand/*`). Its source map no longer copies the source text, which keeps the archive under its size budget.
+
 ## 0.4.1
 
 ### Patch Changes

package/README.md

@@ -11,19 +11,32 @@ npx zappie check
 
 `zappie check` runs these steps in order and stops at the first that fails. Pass `--all` to run every step anyway.
 
-| Step        | What it looks at                                                                            |
-| ----------- | ------------------------------------------------------------------------------------------- |
-| `config`    | `zappie.config.ts` and `theme.json`, against the SDK and token rules                        |
-| `allowlist` | Dependencies, devDependencies and lockfile install scripts, against Zappie's allowlists     |
-| `audit`     | High and critical dependency advisories, with critical findings enforced on request         |
-| `lint`      | The `eslint-plugin-zappie` rules and the `jsx-a11y` accessibility baseline                  |
-| `types`     | A TypeScript check of the project                                                           |
-| `test`      | Your project's tests                                                                        |
-| `build`     | A production build                                                                          |
-| `secrets`   | No secret keys or tokens in your source or build                                            |
-| `readiness` | Initial route discovery is enabled, or the config records why the site opts out             |
-| `budgets`   | Built JavaScript and CSS sizes, against Zappie's default budgets or the ones in your config |
-| `css`       | Your source CSS and class names, and the built client CSS, for the problems below           |
+| Step        | What it looks at                                                                                                                                          |
+| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `config`    | `zappie.config.ts` and `theme.json`, against the SDK and token rules                                                                                      |
+| `allowlist` | Dependencies, devDependencies and lockfile install scripts, against Zappie's allowlists                                                                   |
+| `audit`     | High and critical dependency advisories, with critical findings enforced on request                                                                       |
+| `lint`      | The `eslint-plugin-zappie` rules and the `jsx-a11y` accessibility baseline. The security rules run on every source file, whatever your ESLint config says |
+| `types`     | A TypeScript check of the project                                                                                                                         |
+| `test`      | Your project's tests                                                                                                                                      |
+| `build`     | A production build, and one pass over its output for the problems below                                                                                   |
+| `secrets`   | No secret keys or tokens in your source or build                                                                                                          |
+| `readiness` | Initial route discovery is enabled, or the config records why the site opts out                                                                           |
+| `budgets`   | Built JavaScript and CSS sizes, against Zappie's default budgets or the ones in your config                                                               |
+| `css`       | Your source CSS and class names, and the built client CSS, for the problems below                                                                         |
+
+### Build output problems
+
+The build step reads every HTML and JavaScript file under `build/client` and `build/server` once, so code from packages and generated code are covered too.
+
+| Code                          | What it catches                                                                                                       |
+| ----------------------------- | --------------------------------------------------------------------------------------------------------------------- |
+| `build/no-offsite-navigation` | Code that sends the shopper to a URL written out in full, such as `location.href = "https://..."`, off Zappie's hosts |
+| `build/no-meta-refresh`       | A refresh tag or `Refresh` header to a URL off Zappie's hosts                                                         |
+| `build/no-external-script`    | A built page that loads a script from another host or a `data:` URL                                                   |
+| `build/unlisted-link-host`    | A link, form or source on a host that isn't Zappie's, the SDK's or listed in your config                              |
+
+A store's own domains and the sites it links to go in `security.links` in `zappie.config.ts`. Image and font hosts can go in `security.csp`, and request hosts in `outbound.allow`. A refresh or navigation to a URL computed at run time isn't caught here; the lint rules cover the source that builds it.
 
 ### CSS problems
 

package/dist/index.d.ts

@@ -72,6 +72,12 @@ declare function checkAudit(options: StepOptions, dependencies?: AuditDependenci
 declare function evaluateAudit(advisories: AuditAdvisory[], mode: "report" | "enforce", ignores?: AuditIgnore[], file?: string): CheckStep;
 declare function parseAuditOutput(manager: PackageManager, source: string): AuditAdvisory[];
 
+/** Checks a parsed `app/brand.json`. Returns one problem per wrong, missing or unknown key, with its JSON path. */
+declare function validateBrand(value: unknown): {
+    path: string;
+    message: string;
+}[];
+
 declare function checkBudgets({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function checkBuild({ cwd, packageManager, signal, }: StepOptions): Promise<CheckStep>;
@@ -115,6 +121,13 @@ declare function devSourceProblems(cwd: string): Promise<CheckProblem[]>;
 
 declare function checkLint({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
+/**
+ * Scan the build output once, which includes code from packages and code generated at build time, for navigation off
+ * the site, refresh tags and headers, pages that load scripts from elsewhere, and links or sources on hosts the site
+ * doesn't list.
+ */
+declare function outputProblems(cwd: string): Promise<CheckProblem[]>;
+
 declare function checkReadiness({ cwd, signal, }: StepOptions): Promise<CheckStep>;
 
 declare function runCheck(options: CheckOptions): Promise<CheckResult>;
@@ -132,5 +145,5 @@ declare function checkTests({ cwd, packageManager, signal, }: StepOptions): Prom
 
 declare function checkTypes(options: StepOptions): Promise<CheckStep>;
 
-export { BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, GLOBAL_DEV_PACKAGE_ALLOWLIST, INSTALL_SCRIPT_ALLOWLIST, SECRET_FILE_SIZE_CAP, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, devSourceProblems, evaluateAudit, loadConfig, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport };
+export { BUILTIN_ALLOWLIST_SOURCE, CSS_ERRORS, GLOBAL_DEV_PACKAGE_ALLOWLIST, INSTALL_SCRIPT_ALLOWLIST, SECRET_FILE_SIZE_CAP, analyseCss, checkAllowlist, checkAudit, checkBudgets, checkBuild, checkConfig, checkCss, checkLint, checkReadiness, checkSecrets, checkTests, checkTypes, devSourceProblems, evaluateAudit, loadConfig, outputProblems, parseAuditOutput, runCheck, scanSecrets, supportsTypeScriptImport, validateBrand };
 export type { AllowlistSource, AuditAdvisory, AuditIgnore, AuditMode, CheckOptions, CheckProblem, CheckResult, CheckResultValue, CheckStep, CheckStepName, CssCode, CssInputs, PackageManager, SecretFinding, StepOptions, TextFile };