@extenshi/cli 0.0.1

package/dist/auto-update.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Auto-update check for the Extenshi CLI.
+ *
+ * On each run:
+ *   1. Check ~/.extenshi/last-update-check.json (24h TTL).
+ *   2. If stale, fetch https://registry.npmjs.org/@extenshi/cli/latest (2s timeout, fail-soft).
+ *   3. Compare current vs latest via semver.diff:
+ *      - major → FATAL: print upgrade message and exit 1
+ *      - minor/patch → warn to stderr, continue
+ *
+ * Fail-soft: any network error or parse failure is silently ignored so the
+ * scan itself is never blocked by a registry outage.
+ */
+export declare function checkAutoUpdate(): Promise<void>;
+//# sourceMappingURL=auto-update.d.ts.map

package/dist/auto-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update.d.ts","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4DH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuCrD"}

package/dist/auto-update.js

@@ -0,0 +1,100 @@
+/**
+ * Auto-update check for the Extenshi CLI.
+ *
+ * On each run:
+ *   1. Check ~/.extenshi/last-update-check.json (24h TTL).
+ *   2. If stale, fetch https://registry.npmjs.org/@extenshi/cli/latest (2s timeout, fail-soft).
+ *   3. Compare current vs latest via semver.diff:
+ *      - major → FATAL: print upgrade message and exit 1
+ *      - minor/patch → warn to stderr, continue
+ *
+ * Fail-soft: any network error or parse failure is silently ignored so the
+ * scan itself is never blocked by a registry outage.
+ */
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import os from 'node:os';
+import path from 'node:path';
+import semver from 'semver';
+const CACHE_PATH = path.join(os.homedir(), '.extenshi', 'last-update-check.json');
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const REGISTRY_URL = 'https://registry.npmjs.org/@extenshi/cli/latest';
+const REGISTRY_TIMEOUT_MS = 2000;
+function getCurrentVersion() {
+    // Read version from this package's package.json
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require('../package.json');
+        return pkg.version;
+    }
+    catch {
+        return '1.0.0';
+    }
+}
+function readCache() {
+    try {
+        const raw = fs.readFileSync(CACHE_PATH, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function writeCache(latestVersion) {
+    try {
+        fs.mkdirSync(path.dirname(CACHE_PATH), { recursive: true });
+        fs.writeFileSync(CACHE_PATH, JSON.stringify({ checkedAt: Date.now(), latestVersion }));
+    }
+    catch {
+        // Non-fatal
+    }
+}
+async function fetchLatestVersion() {
+    try {
+        const response = await fetch(REGISTRY_URL, {
+            signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        return data.version ?? null;
+    }
+    catch {
+        return null; // fail-soft: registry unavailable
+    }
+}
+export async function checkAutoUpdate() {
+    const currentVersion = getCurrentVersion();
+    let latestVersion = null;
+    const cache = readCache();
+    if (cache && Date.now() - cache.checkedAt < CACHE_TTL_MS) {
+        // Cache is fresh — use cached value
+        latestVersion = cache.latestVersion;
+    }
+    else {
+        // Cache is stale (or missing) — fetch from registry
+        latestVersion = await fetchLatestVersion();
+        if (latestVersion) {
+            writeCache(latestVersion);
+        }
+    }
+    if (!latestVersion)
+        return; // couldn't determine latest — skip check
+    const diff = semver.diff(currentVersion, latestVersion);
+    if (!diff)
+        return; // same version or parse error
+    if (diff === 'major') {
+        // Fatal: major version incompatibility
+        console.error(`\n❌ extenshi CLI is outdated (major version mismatch).\n` +
+            `   Current: v${currentVersion}  Latest: v${latestVersion}\n\n` +
+            `   Upgrade required:\n` +
+            `     npm install -g @extenshi/cli@latest\n` +
+            `   or:\n` +
+            `     yarn global add @extenshi/cli@latest\n`);
+        process.exit(1);
+    }
+    // minor or patch — warn and continue
+    process.stderr.write(`⚠️  extenshi CLI update available: v${currentVersion} → v${latestVersion}\n` +
+        `   Run: npm install -g @extenshi/cli@latest\n\n`);
+}
+//# sourceMappingURL=auto-update.js.map

package/dist/auto-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-update.js","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAA;AACjF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,WAAW;AACpD,MAAM,YAAY,GAAG,iDAAiD,CAAA;AACtE,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAEhC,SAAS,iBAAiB;IACzB,gDAAgD;IAChD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAA;QAC7D,OAAO,GAAG,CAAC,OAAO,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAA;IACf,CAAC;AACF,CAAC;AAOD,SAAS,SAAS;IACjB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,aAAqB;IACxC,IAAI,CAAC;QACJ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACvF,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAA;QAC5D,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA,CAAC,kCAAkC;IAC/C,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACpC,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAA;IAC1C,IAAI,aAAa,GAAkB,IAAI,CAAA;IAEvC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAC1D,oCAAoC;QACpC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAA;IACpC,CAAC;SAAM,CAAC;QACP,oDAAoD;QACpD,aAAa,GAAG,MAAM,kBAAkB,EAAE,CAAA;QAC1C,IAAI,aAAa,EAAE,CAAC;YACnB,UAAU,CAAC,aAAa,CAAC,CAAA;QAC1B,CAAC;IACF,CAAC;IAED,IAAI,CAAC,aAAa;QAAE,OAAM,CAAC,yCAAyC;IAEpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACvD,IAAI,CAAC,IAAI;QAAE,OAAM,CAAC,8BAA8B;IAEhD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACtB,uCAAuC;QACvC,OAAO,CAAC,KAAK,CACZ,0DAA0D;YACzD,gBAAgB,cAAc,cAAc,aAAa,MAAM;YAC/D,wBAAwB;YACxB,4CAA4C;YAC5C,UAAU;YACV,6CAA6C,CAC9C,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IAED,qCAAqC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,uCAAuC,cAAc,OAAO,aAAa,IAAI;QAC5E,iDAAiD,CAClD,CAAA;AACF,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * @extenshi/cli — pre-publish extension security scanner.
+ *
+ * Entry point. Parses CLI args via commander, runs auto-update check,
+ * then delegates to the scan command.
+ *
+ * CLI flow:
+ *
+ *   extenshi scan <artifact>
+ *     │
+ *     ├─ load API key (env > config file)
+ *     ├─ auto-update check (registry, 24h cache, fail-soft)
+ *     ├─ CI timeout pre-flight (GET /api/v1/healthz?delay=65, timeout 70s)
+ *     └─ POST /api/v1/scan (multipart, timeout 240s)
+ *          └─ render findings (pretty or --json)
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG"}

package/dist/cli.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/**
+ * @extenshi/cli — pre-publish extension security scanner.
+ *
+ * Entry point. Parses CLI args via commander, runs auto-update check,
+ * then delegates to the scan command.
+ *
+ * CLI flow:
+ *
+ *   extenshi scan <artifact>
+ *     │
+ *     ├─ load API key (env > config file)
+ *     ├─ auto-update check (registry, 24h cache, fail-soft)
+ *     ├─ CI timeout pre-flight (GET /api/v1/healthz?delay=65, timeout 70s)
+ *     └─ POST /api/v1/scan (multipart, timeout 240s)
+ *          └─ render findings (pretty or --json)
+ */
+import { createRequire } from 'node:module';
+import { program } from 'commander';
+import { checkAutoUpdate } from './auto-update.js';
+import { loadConfig } from './config.js';
+import { runScan } from './scan.js';
+const _require = createRequire(import.meta.url);
+const pkg = _require('../package.json');
+program
+    .name('extenshi')
+    .description('Pre-publish security scanner for browser extensions')
+    .version(pkg.version);
+program
+    .command('scan <artifact>')
+    .description('Scan a browser extension artifact (.crx, .xpi, or .zip)')
+    .option('--json', 'Output raw JSON (default: pretty-printed findings)')
+    .option('--extension-id <id>', 'Extension store ID (required for free-credit scans on claimed extensions)')
+    .option('--skip-preflight', 'Skip CI timeout pre-flight probe (use at your own risk)')
+    .option('--api-url <url>', 'Override the scan API base URL (default: https://scan.extenshi.io)')
+    .action(async (artifact, opts) => {
+    try {
+        const config = await loadConfig(opts.apiUrl);
+        if (!config.apiKey) {
+            console.error('Error: API key not found.\n' +
+                'Set EXTENSHI_API_KEY environment variable or run: extenshi login\n' +
+                'Get an API key at https://dojo.extenshi.io/billing/cli');
+            process.exit(1);
+        }
+        // Auto-update check (fail-soft — never blocks scan)
+        await checkAutoUpdate();
+        await runScan({
+            artifactPath: artifact,
+            apiKey: config.apiKey,
+            apiUrl: config.apiUrl,
+            extensionId: opts.extensionId,
+            outputJson: opts.json ?? false,
+            skipPreflight: opts.skipPreflight ?? false,
+        });
+    }
+    catch (err) {
+        if (err instanceof Error) {
+            console.error(`Error: ${err.message}`);
+        }
+        else {
+            console.error('Unexpected error:', err);
+        }
+        process.exit(1);
+    }
+});
+program.parse();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,iBAAiB,CAAwB,CAAA;AAE9D,OAAO;KACL,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,qDAAqD,CAAC;KAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAEtB,OAAO;KACL,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC;KACtE,MAAM,CAAC,qBAAqB,EAAE,2EAA2E,CAAC;KAC1G,MAAM,CAAC,kBAAkB,EAAE,yDAAyD,CAAC;KACrF,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;KAC/F,MAAM,CACN,KAAK,EACJ,QAAgB,EAChB,IAKC,EACA,EAAE;IACH,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE5C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACZ,6BAA6B;gBAC5B,oEAAoE;gBACpE,wDAAwD,CACzD,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;QAED,oDAAoD;QACpD,MAAM,eAAe,EAAE,CAAA;QAEvB,MAAM,OAAO,CAAC;YACb,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;YAC9B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;SAC1C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;AACF,CAAC,CACD,CAAA;AAEF,OAAO,CAAC,KAAK,EAAE,CAAA"}

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Configuration loading for the Extenshi CLI.
+ *
+ * Priority order:
+ *   1. Environment variable EXTENSHI_API_KEY / EXTENSHI_API_URL
+ *   2. Config file ~/.extenshi/config.json
+ *   3. Hardcoded defaults
+ */
+export declare function loadConfig(cliApiUrl?: string): Promise<{
+    apiKey: string | null;
+    apiUrl: string;
+}>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,wBAAsB,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQvG"}

package/dist/config.js

@@ -0,0 +1,30 @@
+/**
+ * Configuration loading for the Extenshi CLI.
+ *
+ * Priority order:
+ *   1. Environment variable EXTENSHI_API_KEY / EXTENSHI_API_URL
+ *   2. Config file ~/.extenshi/config.json
+ *   3. Hardcoded defaults
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const DEFAULT_API_URL = 'https://scan.extenshi.io';
+const CONFIG_PATH = path.join(os.homedir(), '.extenshi', 'config.json');
+function readConfigFile() {
+    try {
+        const raw = fs.readFileSync(CONFIG_PATH, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+export async function loadConfig(cliApiUrl) {
+    const fileConfig = readConfigFile();
+    const apiKey = process.env.EXTENSHI_API_KEY ?? fileConfig.apiKey ?? null;
+    const apiUrl = cliApiUrl ?? process.env.EXTENSHI_API_URL ?? fileConfig.apiUrl ?? DEFAULT_API_URL;
+    // Strip trailing slash
+    return { apiKey, apiUrl: apiUrl.replace(/\/$/, '') };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,MAAM,eAAe,GAAG,0BAA0B,CAAA;AAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;AAOvE,SAAS,cAAc;IACtB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAkB;IAClD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAA;IAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC,MAAM,IAAI,IAAI,CAAA;IACxE,MAAM,MAAM,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC,MAAM,IAAI,eAAe,CAAA;IAEhG,uBAAuB;IACvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAA;AACrD,CAAC"}

package/dist/render.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pretty-print scan findings for terminal output.
+ *
+ * Groups findings by severity (CRITICAL → HIGH → MEDIUM → LOW → INFO),
+ * then by scanner, using chalk for colour.
+ *
+ * Invoked only when --json flag is NOT set.
+ */
+export declare function renderReport(body: Record<string, unknown>): void;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA4DH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA2GhE"}

package/dist/render.js

@@ -0,0 +1,127 @@
+/**
+ * Pretty-print scan findings for terminal output.
+ *
+ * Groups findings by severity (CRITICAL → HIGH → MEDIUM → LOW → INFO),
+ * then by scanner, using chalk for colour.
+ *
+ * Invoked only when --json flag is NOT set.
+ */
+import chalk from 'chalk';
+// ── Severity ordering ──────────────────────────────────────────────────────────
+const SEVERITY_ORDER = {
+    CRITICAL: 0,
+    HIGH: 1,
+    MEDIUM: 2,
+    LOW: 3,
+    INFO: 4,
+};
+function severityRank(s) {
+    return SEVERITY_ORDER[s?.toUpperCase() ?? ''] ?? 99;
+}
+function severityColour(s) {
+    switch (s?.toUpperCase()) {
+        case 'CRITICAL':
+            return chalk.bgRed.white.bold(` ${s?.toUpperCase()} `);
+        case 'HIGH':
+            return chalk.red.bold(s?.toUpperCase());
+        case 'MEDIUM':
+            return chalk.yellow.bold(s?.toUpperCase());
+        case 'LOW':
+            return chalk.cyan(s?.toUpperCase());
+        case 'INFO':
+            return chalk.dim(s?.toUpperCase() ?? 'INFO');
+        default:
+            return chalk.dim(s ?? 'UNKNOWN');
+    }
+}
+// ── Main render function ───────────────────────────────────────────────────────
+export function renderReport(body) {
+    const report = body;
+    const scanners = report.scanners ?? [];
+    const allFindings = [];
+    let scannersRun = 0;
+    let scannersOk = 0;
+    for (const s of scanners) {
+        scannersRun++;
+        if (s.status === 'SUCCESS' || s.status === 'success') {
+            scannersOk++;
+        }
+        for (const f of s.findings ?? []) {
+            allFindings.push({ scanner: s.scanner ?? 'unknown', finding: f });
+        }
+    }
+    // Sort by severity
+    allFindings.sort((a, b) => severityRank(a.finding.severity) - severityRank(b.finding.severity));
+    // Header
+    console.log();
+    if (allFindings.length === 0) {
+        console.log(chalk.green.bold('✓ No findings — extension looks clean.'));
+    }
+    else {
+        const critHigh = allFindings.filter((f) => severityRank(f.finding.severity) <= 1).length;
+        const label = critHigh > 0
+            ? chalk.red.bold(`${allFindings.length} finding${allFindings.length !== 1 ? 's' : ''} (${critHigh} critical/high)`)
+            : chalk.yellow.bold(`${allFindings.length} finding${allFindings.length !== 1 ? 's' : ''}`);
+        console.log(`${chalk.bold('Scan report')} · ${label}`);
+    }
+    console.log(chalk.dim(`Scanners: ${scannersOk}/${scannersRun} succeeded`));
+    if (report.jobId) {
+        console.log(chalk.dim(`Job: ${report.jobId}`));
+    }
+    console.log();
+    if (allFindings.length === 0) {
+        return;
+    }
+    // Print findings grouped by severity (already sorted)
+    let lastSeverity = '';
+    for (const { scanner, finding } of allFindings) {
+        const sev = finding.severity?.toUpperCase() ?? 'UNKNOWN';
+        if (sev !== lastSeverity) {
+            lastSeverity = sev;
+            console.log(chalk.bold(`── ${severityColour(sev)} ──────────────────────────`));
+        }
+        const rule = finding.rule ? chalk.bold(finding.rule) : chalk.dim('(no rule)');
+        const desc = finding.description ?? '';
+        console.log(`  ${rule}  ${chalk.dim(`[${scanner}]`)}`);
+        if (desc) {
+            // Wrap description at 80 chars
+            const words = desc.split(' ');
+            let line = '  ';
+            for (const word of words) {
+                if (line.length + word.length + 1 > 80) {
+                    console.log(chalk.dim(line));
+                    line = `  ${word}`;
+                }
+                else {
+                    line += (line === '  ' ? '' : ' ') + word;
+                }
+            }
+            if (line.trim()) {
+                console.log(chalk.dim(line));
+            }
+        }
+        // Print any extra fields (except known ones we've already displayed)
+        const skip = new Set(['rule', 'description', 'severity']);
+        const extras = Object.entries(finding)
+            .filter(([k]) => !skip.has(k))
+            .map(([k, v]) => `${k}: ${JSON.stringify(v)}`);
+        if (extras.length > 0) {
+            console.log(chalk.dim(`  ${extras.slice(0, 3).join('  ')}`));
+        }
+        console.log();
+    }
+    // Summary per scanner (statuses)
+    const failedScanners = scanners.filter((s) => s.status !== 'SUCCESS' && s.status !== 'success');
+    if (failedScanners.length > 0) {
+        console.log(chalk.dim('── Scanner issues ──────────────────────────'));
+        for (const s of failedScanners) {
+            console.log(chalk.dim(`  ${s.scanner ?? 'unknown'}: ${s.status ?? 'unknown'}`));
+        }
+        console.log();
+    }
+    // Exit hint
+    if (allFindings.some((f) => severityRank(f.finding.severity) <= 1)) {
+        console.log(chalk.red('⚠  Critical/high findings detected. Review before publishing.'));
+    }
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AAyBzB,kFAAkF;AAElF,MAAM,cAAc,GAA2B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACP,CAAA;AAED,SAAS,YAAY,CAAC,CAAqB;IAC1C,OAAO,cAAc,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,CAAqB;IAC5C,QAAQ,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,CAAA;QACvD,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACxC,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QAC3C,KAAK,KAAK;YACT,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QACpC,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,MAAM,CAAC,CAAA;QAC7C;YACC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAA;IAClC,CAAC;AACF,CAAC;AAED,kFAAkF;AAElF,MAAM,UAAU,YAAY,CAAC,IAA6B;IACzD,MAAM,MAAM,GAAG,IAAkB,CAAA;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;IAQtC,MAAM,WAAW,GAAkB,EAAE,CAAA;IACrC,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1B,WAAW,EAAE,CAAA;QACb,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtD,UAAU,EAAE,CAAA;QACb,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;QAClE,CAAC;IACF,CAAC;IAED,mBAAmB;IACnB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;IAE/F,SAAS;IACT,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAA;IACxE,CAAC;SAAM,CAAC;QACP,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;QACxF,MAAM,KAAK,GACV,QAAQ,GAAG,CAAC;YACX,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CACd,GAAG,WAAW,CAAC,MAAM,WAAW,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,iBAAiB,CACjG;YACF,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,WAAW,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5F,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,UAAU,IAAI,WAAW,YAAY,CAAC,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAM;IACP,CAAC;IAED,sDAAsD;IACtD,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS,CAAA;QACxD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC1B,YAAY,GAAG,GAAG,CAAA;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAA;QAChF,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAA;QAEtC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,CAAA;QACtD,IAAI,IAAI,EAAE,CAAC;YACV,+BAA+B;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7B,IAAI,IAAI,GAAG,IAAI,CAAA;YACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;oBAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAA;gBACnB,CAAC;qBAAM,CAAC;oBACP,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;gBAC1C,CAAC;YACF,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;YAC7B,CAAC;QACF,CAAC;QAED,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aACpC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC7B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACd,CAAC;IAED,iCAAiC;IACjC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAA;IAC/F,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAA;QACtE,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,SAAS,KAAK,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAA;QAChF,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACd,CAAC;IAED,YAAY;IACZ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAA;IACxF,CAAC;AACF,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Core scan logic for the Extenshi CLI.
+ *
+ * CLI flow:
+ *
+ *   load key → auto-update check → CI timeout pre-flight → POST scan → render
+ *
+ *    ┌──────────────────────────────────────────────────────────┐
+ *    │ scan.ts                                                  │
+ *    │                                                          │
+ *    │  1. Pre-flight: GET /api/v1/healthz?delay=65 (70s limit) │
+ *    │     → detects CI outbound timeout < 240s                 │
+ *    │                                                          │
+ *    │  2. POST /api/v1/scan (multipart)                        │
+ *    │     fields: artifact (file), apiKey, extensionId?        │
+ *    │     timeout: 240s                                        │
+ *    │                                                          │
+ *    │  3. Render: pretty (chalk) or raw JSON (--json)          │
+ *    └──────────────────────────────────────────────────────────┘
+ *
+ * No automatic retry on network failure — the plan specifies:
+ * "при network error не делайте автоматический retry —
+ *  списанный credit вернётся автоматически в течение 1 минуты (auto-refund cron)"
+ */
+export interface ScanOptions {
+    artifactPath: string;
+    apiKey: string;
+    apiUrl: string;
+    extensionId?: string;
+    outputJson: boolean;
+    skipPreflight: boolean;
+}
+export declare function runScan(opts: ScanOptions): Promise<void>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,MAAM,WAAW,WAAW;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,aAAa,EAAE,OAAO,CAAA;CACtB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoF9D"}

package/dist/scan.js

@@ -0,0 +1,131 @@
+/**
+ * Core scan logic for the Extenshi CLI.
+ *
+ * CLI flow:
+ *
+ *   load key → auto-update check → CI timeout pre-flight → POST scan → render
+ *
+ *    ┌──────────────────────────────────────────────────────────┐
+ *    │ scan.ts                                                  │
+ *    │                                                          │
+ *    │  1. Pre-flight: GET /api/v1/healthz?delay=65 (70s limit) │
+ *    │     → detects CI outbound timeout < 240s                 │
+ *    │                                                          │
+ *    │  2. POST /api/v1/scan (multipart)                        │
+ *    │     fields: artifact (file), apiKey, extensionId?        │
+ *    │     timeout: 240s                                        │
+ *    │                                                          │
+ *    │  3. Render: pretty (chalk) or raw JSON (--json)          │
+ *    └──────────────────────────────────────────────────────────┘
+ *
+ * No automatic retry on network failure — the plan specifies:
+ * "при network error не делайте автоматический retry —
+ *  списанный credit вернётся автоматически в течение 1 минуты (auto-refund cron)"
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { FormData, fetch } from 'undici';
+import { renderReport } from './render.js';
+const SCAN_TIMEOUT_MS = 240_000; // 240 seconds
+const PREFLIGHT_TIMEOUT_MS = 70_000; // 70 seconds
+export async function runScan(opts) {
+    const { artifactPath, apiKey, apiUrl, extensionId, outputJson, skipPreflight } = opts;
+    // Validate artifact file exists
+    if (!fs.existsSync(artifactPath)) {
+        throw new Error(`Artifact file not found: ${artifactPath}`);
+    }
+    const artifactStats = fs.statSync(artifactPath);
+    if (!artifactStats.isFile()) {
+        throw new Error(`Artifact path is not a file: ${artifactPath}`);
+    }
+    const MAX_SIZE = 50 * 1024 * 1024;
+    if (artifactStats.size > MAX_SIZE) {
+        throw new Error(`Artifact file exceeds 50 MB limit (${(artifactStats.size / 1024 / 1024).toFixed(1)} MB)`);
+    }
+    // Step 1: CI timeout pre-flight
+    if (!skipPreflight) {
+        await runPreflight(apiUrl);
+    }
+    // Step 2: Upload and scan
+    process.stderr.write('Scanning...\n');
+    const artifactData = fs.readFileSync(artifactPath);
+    const artifactName = path.basename(artifactPath);
+    const form = new FormData();
+    form.append('apiKey', apiKey);
+    form.append('artifact', new File([artifactData], artifactName));
+    if (extensionId) {
+        form.append('extensionId', extensionId);
+    }
+    let response;
+    try {
+        response = await fetch(`${apiUrl}/api/v1/scan`, {
+            method: 'POST',
+            body: form,
+            signal: AbortSignal.timeout(SCAN_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new Error(`Scan request timed out after ${SCAN_TIMEOUT_MS / 1000}s.\n` +
+                'This may indicate a network issue or a slow scan.\n' +
+                'If a credit was charged, it will be auto-refunded within 1 minute.\n' +
+                'Do NOT retry immediately — wait for the auto-refund before trying again.');
+        }
+        throw err;
+    }
+    const body = (await response.json());
+    if (!response.ok) {
+        const errorMsg = typeof body.error === 'string' ? body.error : `HTTP ${response.status}`;
+        // Map known status codes to actionable messages
+        if (response.status === 401) {
+            throw new Error(`Authentication failed: ${errorMsg}\nCheck your EXTENSHI_API_KEY.`);
+        }
+        if (response.status === 402) {
+            throw new Error(`Insufficient credits.\nPurchase more at https://dojo.extenshi.io/billing/cli`);
+        }
+        if (response.status === 403) {
+            throw new Error(`Access denied: ${errorMsg}`);
+        }
+        if (response.status === 429) {
+            const retryAfter = body.retryAfterSec ?? 60;
+            throw new Error(`Rate limit exceeded. Please wait ${retryAfter}s before trying again.`);
+        }
+        throw new Error(`Scan failed: ${errorMsg}`);
+    }
+    // Step 3: Output
+    if (outputJson) {
+        process.stdout.write(`${JSON.stringify(body, null, 2)}\n`);
+    }
+    else {
+        renderReport(body);
+    }
+}
+/**
+ * CI timeout pre-flight probe.
+ *
+ * Sends GET /api/v1/healthz?delay=65 — the server sleeps 65s then responds 200.
+ * If we don't get a response within 70s, the CI runner's outbound timeout is
+ * shorter than the 240s the scan needs.
+ */
+async function runPreflight(apiUrl) {
+    try {
+        await fetch(`${apiUrl}/api/v1/healthz?delay=65`, {
+            signal: AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS),
+        });
+        // Got response → timeout is at least 70s, proceed
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new Error(`Your CI/network outbound HTTP timeout appears shorter than the 240s extenshi scan needs.\n\n` +
+                `The pre-flight probe (65s delay) did not complete within 70s.\n\n` +
+                `To fix:\n` +
+                `  • GitHub Actions: add  timeout-minutes: 10  to the scan step\n` +
+                `  • Corporate proxy: contact IT to increase the outbound timeout\n` +
+                `  • To skip this check (at your own risk): use --skip-preflight\n\n` +
+                `No credit was charged — the scan was not attempted.`);
+        }
+        // Network errors (not timeout) — warn and proceed
+        process.stderr.write(`Pre-flight probe failed (${err.message}) — proceeding anyway.\n`);
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,eAAe,GAAG,OAAO,CAAA,CAAC,cAAc;AAC9C,MAAM,oBAAoB,GAAG,MAAM,CAAA,CAAC,aAAa;AAWjD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC9C,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAA;IAErF,gCAAgC;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAC/C,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,YAAY,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;IACjC,IAAI,aAAa,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,aAAa,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3G,CAAC;IAED,gCAAgC;IAChC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED,0BAA0B;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAErC,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAClD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IAEhD,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC,CAAA;IAC/D,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACxC,CAAC;IAED,IAAI,QAA2C,CAAA;IAC/C,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACd,gCAAgC,eAAe,GAAG,IAAI,MAAM;gBAC3D,qDAAqD;gBACrD,sEAAsE;gBACtE,0EAA0E,CAC3E,CAAA;QACF,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;IAE/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAA;QAExF,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,gCAAgC,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;QAChG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAA;QAC9C,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAI,IAAmC,CAAC,aAAa,IAAI,EAAE,CAAA;YAC3E,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,wBAAwB,CAAC,CAAA;QACxF,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,iBAAiB;IACjB,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,CAAC;SAAM,CAAC;QACP,YAAY,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;YAChD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;SACjD,CAAC,CAAA;QACF,kDAAkD;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACd,8FAA8F;gBAC7F,mEAAmE;gBACnE,WAAW;gBACX,kEAAkE;gBAClE,oEAAoE;gBACpE,qEAAqE;gBACrE,qDAAqD,CACtD,CAAA;QACF,CAAC;QACD,kDAAkD;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA6B,GAAa,CAAC,OAAO,0BAA0B,CAAC,CAAA;IACnG,CAAC;AACF,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@extenshi/cli",
+  "version": "0.0.1",
+  "description": "Pre-publish security scanner for browser extensions",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "extenshi": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "prepublishOnly": "yarn build"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.1.0",
+    "ora": "^8.1.1",
+    "semver": "^7.6.3",
+    "undici": "^7.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.16.5",
+    "@types/semver": "^7.5.8",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}