surfscan 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.1 (2026-11-09)
+
+- New `deps.trustedPackages` config key: DEPS-004 skips the listed packages and says which it skipped. surfscan itself is always skipped, so depending on it no longer raises DEPS-004.
+
 ## 0.1.0 (2026-11-05)
 
 First release.

package/README.md

@@ -165,13 +165,14 @@ In CI, pass `--strict`. If any check could not run, surfscan exits 2 instead of
 {
   "ignore": ["RULES-006"],
   "ignorePaths": ["vendor/**"],
-  "deps": { "minAgeDays": 30 }
+  "deps": { "minAgeDays": 30, "trustedPackages": ["my-new-lib"] }
 }
 ```
 
 - `ignore`: rule IDs to skip
 - `ignorePaths`: globs to exclude from scanning
 - `deps.minAgeDays`: DEPS-004 threshold in days (default 30)
+- `deps.trustedPackages`: package names the DEPS-004 age check skips (surfscan itself is always skipped). Other DEPS rules still apply. A project's `surfscan.json` is controlled by whoever owns the project, so do not rely on it when scanning code you do not trust.
 
 Unknown keys are rejected with an error.
 

package/dist/{chunk-5SNUPVTB.js → chunk-MJKZGRUS.js}

@@ -136,7 +136,7 @@ var CONFIG_FILE_NAME = "surfscan.json";
 var DEFAULT_CONFIG = {
   ignore: [],
   ignorePaths: [],
-  deps: { minAgeDays: 30 }
+  deps: { minAgeDays: 30, trustedPackages: [] }
 };
 var ConfigError = class extends Error {
   constructor(message) {
@@ -145,7 +145,7 @@ var ConfigError = class extends Error {
   }
 };
 var TOP_LEVEL_KEYS = ["ignore", "ignorePaths", "deps"];
-var DEPS_KEYS = ["minAgeDays"];
+var DEPS_KEYS = ["minAgeDays", "trustedPackages"];
 var RULE_ID = /^[A-Z]+-\d{3}$/;
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -173,7 +173,7 @@ function validateConfig(raw, source = CONFIG_FILE_NAME) {
   const config = {
     ignore: [...DEFAULT_CONFIG.ignore],
     ignorePaths: [...DEFAULT_CONFIG.ignorePaths],
-    deps: { ...DEFAULT_CONFIG.deps }
+    deps: { ...DEFAULT_CONFIG.deps, trustedPackages: [...DEFAULT_CONFIG.deps.trustedPackages] }
   };
   if (raw.ignore !== void 0) {
     config.ignore = stringArray(raw.ignore, "ignore", source);
@@ -198,6 +198,13 @@ function validateConfig(raw, source = CONFIG_FILE_NAME) {
       }
       config.deps.minAgeDays = minAgeDays;
     }
+    if (raw.deps.trustedPackages !== void 0) {
+      const names = stringArray(raw.deps.trustedPackages, "deps.trustedPackages", source);
+      if (names.some((n) => n.trim() === "")) {
+        throw new ConfigError(`${source}: "deps.trustedPackages" must not contain empty names`);
+      }
+      config.deps.trustedPackages = names;
+    }
   }
   return config;
 }
@@ -2655,6 +2662,7 @@ function dataFor(context) {
 function finding2(rule, ref, message, fix) {
   return { ruleId: rule.id, severity: rule.severity, message, file: ref.file, line: ref.line, fix };
 }
+var BUILT_IN_TRUSTED = ["surfscan"];
 async function registryFindings(context, check) {
   const { refs, lookups } = await dataFor(context);
   const out = [];
@@ -2742,19 +2750,30 @@ var rules5 = [
     severity: "medium",
     title: "Newly published package",
     check(context) {
-      const { minAgeDays } = context.config.deps;
+      const { minAgeDays, trustedPackages } = context.config.deps;
+      const trusted = /* @__PURE__ */ new Set([...BUILT_IN_TRUSTED, ...trustedPackages]);
+      const skipped = /* @__PURE__ */ new Set();
       const now = Date.now();
       return registryFindings(context, (ref, packument) => {
         const created = Date.parse(packument.created ?? "");
         if (Number.isNaN(created)) return void 0;
         const ageDays = Math.floor((now - created) / DAY_MS);
         if (ageDays >= minAgeDays) return void 0;
+        if (trusted.has(ref.name)) {
+          skipped.add(ref.name);
+          return void 0;
+        }
         return finding2(
           this,
           ref,
           `"${ref.name}" was first published ${ageDays} day(s) ago (minimum ${minAgeDays})`,
           "review the package and its maintainer before using it, or wait until it has a track record"
         );
+      }).then((findings) => {
+        if (skipped.size > 0) {
+          context.warn(`deps: skipped the age check (DEPS-004) for ${skipped.size} trusted package(s): ${[...skipped].join(", ")}`);
+        }
+        return findings;
       });
     }
   },
@@ -2880,4 +2899,4 @@ export {
   rules5,
   depsScanner
 };
-//# sourceMappingURL=chunk-5SNUPVTB.js.map
+//# sourceMappingURL=chunk-MJKZGRUS.js.map