@extenshi/cli 0.0.7 → 0.0.9

package/dist/report.js

@@ -0,0 +1,122 @@
+/**
+ * Markdown store-compliance report renderer for `extenshi scan --report`.
+ *
+ * Pure (no I/O) so it is snapshot-testable. Schema-tolerant: reads whatever the
+ * scan server returns. The store-compliance metadata (label / storeImpact /
+ * remediation) is SERVER-DRIVEN — embedded in the `compliance` payload key — so
+ * the published CLI does not need to vendor the rule registry. When the server
+ * has not been updated to emit `compliance` yet, the report degrades to a note.
+ */
+import { STORE_IMPACT_SHORT, summarizeCompliance, summarizeReport, } from './render.js';
+/** Escape characters that would break a markdown table cell. */
+function cell(s) {
+    return s.replace(/\|/g, '\\|').replace(/\r?\n/g, ' ').trim();
+}
+const SEVERITY_ORDER = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO', 'UNKNOWN'];
+function computeVerdict(compliance, summary) {
+    const active = compliance.findings;
+    const hasRejection = active.some((f) => f.storeImpact === 'REJECTION_LIKELY');
+    const critHighSecurity = summary.critHigh > 0;
+    if (hasRejection) {
+        return {
+            headline: 'HIGH RISK of store rejection or delisting',
+            detail: 'This build has a manifest signal that stores commonly reject or delist for. Fix the high-impact items below before you submit.',
+        };
+    }
+    if (active.length > 0 || critHighSecurity) {
+        return {
+            headline: 'Review before submitting',
+            detail: 'Nothing here is an automatic rejection, but the items below commonly draw extra store scrutiny. Make sure each is justified in your listing.',
+        };
+    }
+    return {
+        headline: 'No store-compliance blockers detected',
+        detail: 'Based on this scan, we did not find manifest signals that typically fail store review. This is not a guarantee of approval.',
+    };
+}
+function renderComplianceSection(compliance) {
+    const out = ['## Store-compliance risks (ranked by review danger)', ''];
+    if (!compliance.present) {
+        out.push('_Store-compliance analysis is unavailable — the scan server has not been updated yet. Re-run after the next server rollout (no CLI action needed)._', '');
+        return out;
+    }
+    if (compliance.findings.length === 0) {
+        out.push('_No store-compliance signals detected in the manifest._', '');
+        return out;
+    }
+    out.push('| # | Risk | Severity | Store impact | Stores |', '|---|------|----------|--------------|--------|');
+    compliance.findings.forEach((f, i) => {
+        const impact = STORE_IMPACT_SHORT[f.storeImpact] ?? f.storeImpact;
+        out.push(`| ${i + 1} | ${cell(f.label)} | ${cell(f.severity)} | ${cell(impact)} | ${cell(f.stores.join(', '))} |`);
+    });
+    out.push('');
+    compliance.findings.forEach((f, i) => {
+        out.push(`### ${i + 1}. ${f.label}`);
+        if (f.summary)
+            out.push('', `**Why stores care:** ${f.summary}`);
+        if (f.evidence.length > 0) {
+            out.push('', '**Evidence:**', '', '```', ...f.evidence.slice(0, 10), '```');
+        }
+        if (f.remediation)
+            out.push('', `**How to fix:** ${f.remediation}`);
+        out.push('');
+    });
+    return out;
+}
+function renderSecuritySection(summary) {
+    const out = ['## Security findings', ''];
+    if (summary.findings.length === 0) {
+        out.push('_No code-analysis findings._', '');
+        return out;
+    }
+    const bySeverity = new Map();
+    for (const f of summary.findings) {
+        const arr = bySeverity.get(f.severity) ?? [];
+        arr.push(f);
+        bySeverity.set(f.severity, arr);
+    }
+    for (const sev of SEVERITY_ORDER) {
+        const group = bySeverity.get(sev);
+        if (!group || group.length === 0)
+            continue;
+        out.push(`### ${sev} (${group.length})`, '', '| Finding | Scanner | Location |', '|---------|---------|----------|');
+        for (const f of group) {
+            out.push(`| ${cell(f.headline)} | ${cell(f.scanner)} | ${cell(f.location)} |`);
+        }
+        out.push('');
+    }
+    return out;
+}
+export function renderMarkdownReport(body, meta) {
+    const summary = summarizeReport(body);
+    const compliance = summarizeCompliance(body);
+    const lines = [];
+    lines.push(`# Extenshi scan report — ${meta.artifactName}`);
+    const job = summary.jobId ? ` · Job \`${summary.jobId}\`` : '';
+    lines.push(`> Generated by @extenshi/cli v${meta.cliVersion} · ${meta.generatedAt.toISOString()}${job}`, '');
+    const verdict = computeVerdict(compliance, summary);
+    lines.push('## Verdict', '', `**${verdict.headline}**`, '', verdict.detail, '');
+    lines.push(...renderComplianceSection(compliance));
+    if (compliance.present) {
+        lines.push('## Manifest risk score', '', `**${compliance.manifestRiskScore}/100**`, '');
+        if (compliance.flags.length > 0) {
+            lines.push(`Flags set: ${compliance.flags.map((f) => `\`${f}\``).join(', ')}`, '');
+        }
+    }
+    lines.push(...renderSecuritySection(summary));
+    lines.push('## Scanner status', '');
+    lines.push(`${summary.scannersOk}/${summary.scannersRun} scanners succeeded.`, '');
+    if (summary.issues.length > 0) {
+        lines.push('| Scanner | Status | Detail |', '|---------|--------|--------|');
+        for (const i of summary.issues) {
+            lines.push(`| ${cell(i.scanner)} | ${cell(i.status)} | ${cell(i.error ?? '')} |`);
+        }
+        lines.push('');
+    }
+    lines.push('## Notes', '');
+    if (summary.jobId)
+        lines.push(`- Scan job: \`${summary.jobId}\``);
+    lines.push('- This scan is automated. The scanners are heuristics that may miss real issues or over-flag benign code — a clean result is not a guarantee of safety or store approval. See the [security-risk disclaimer](https://catalog.extenshi.io/disclaimers/security-risk).', '- If a credit was charged for a failed scan it auto-refunds within a minute.', '- Manage claims and respond to findings at https://dojo.extenshi.io', '');
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAGN,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GACf,MAAM,aAAa,CAAA;AAQpB,gEAAgE;AAChE,SAAS,IAAI,CAAC,CAAS;IACtB,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AAC7D,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAU,CAAA;AAExF,SAAS,cAAc,CACtB,UAA6B,EAC7B,OAAsB;IAEtB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAA;IAClC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,kBAAkB,CAAC,CAAA;IAC7E,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IAC7C,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO;YACN,QAAQ,EAAE,2CAA2C;YACrD,MAAM,EACL,gIAAgI;SACjI,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC3C,OAAO;YACN,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EACL,8IAA8I;SAC/I,CAAA;IACF,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,uCAAuC;QACjD,MAAM,EACL,6HAA6H;KAC9H,CAAA;AACF,CAAC;AAED,SAAS,uBAAuB,CAAC,UAA6B;IAC7D,MAAM,GAAG,GAAa,CAAC,qDAAqD,EAAE,EAAE,CAAC,CAAA;IACjF,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CACP,qJAAqJ,EACrJ,EAAE,CACF,CAAA;QACD,OAAO,GAAG,CAAA;IACX,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,CAAC,CAAA;QACvE,OAAO,GAAG,CAAA;IACX,CAAC;IAED,GAAG,CAAC,IAAI,CACP,iDAAiD,EACjD,iDAAiD,CACjD,CAAA;IACD,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,CAAA;QACjE,GAAG,CAAC,IAAI,CACP,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACxG,CAAA;IACF,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEZ,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QACnE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAsB;IACpD,MAAM,GAAG,GAAa,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAA;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAA;QAC5C,OAAO,GAAG,CAAA;IACX,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC5C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACX,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAC1C,GAAG,CAAC,IAAI,CACP,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,EAC9B,EAAE,EACF,kCAAkC,EAClC,kCAAkC,CAClC,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/E,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA6B,EAAE,IAAgB;IACnF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAA;IAE1B,KAAK,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,KAAK,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;IAE5G,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACnD,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAE/E,KAAK,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAA;IAElD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,EAAE,KAAK,UAAU,CAAC,iBAAiB,QAAQ,EAAE,EAAE,CAAC,CAAA;QACvF,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,cAAc,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACnF,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;IAE7C,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;IACnC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,WAAW,sBAAsB,EAAE,EAAE,CAAC,CAAA;IAClF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAA;QAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAA;QAClF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAA;IACjE,KAAK,CAAC,IAAI,CACT,sQAAsQ,EACtQ,8EAA8E,EAC9E,qEAAqE,EACrE,EAAE,CACF,CAAA;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAC/B,CAAC"}

package/dist/review-archive.d.ts

@@ -0,0 +1,29 @@
+/**
+ * review-risk — pull the manifest and inspectable text files out of a packaged
+ * extension artifact.
+ *
+ * Accepts the same artifacts as `extenshi scan`:
+ *   .zip / .xpi  → a plain ZIP
+ *   .crx         → a ZIP behind a CRX2 or CRX3 header (stripped here)
+ *
+ * Only text entries the checks read (.js/.mjs/.cjs/.html/.json) are decoded,
+ * each capped in size, with a global byte budget — a malicious or huge package
+ * can't blow up memory. Binary assets (images, wasm) are skipped.
+ */
+import type { FileMap, Manifest } from './review-checks.js';
+export interface LoadedArtifact {
+    manifest: Manifest;
+    files: FileMap;
+    /** Non-fatal notes (e.g. byte budget hit, files skipped). */
+    warnings: string[];
+}
+/**
+ * Strip a CRX header if present and return the inner ZIP bytes.
+ *
+ * CRX3: "Cr24" | version(4 LE)=3 | headerLen(4 LE) | header | ZIP
+ * CRX2: "Cr24" | version(4 LE)=2 | pubKeyLen(4 LE) | sigLen(4 LE) | pubKey | sig | ZIP
+ * Anything else is assumed to already be a ZIP.
+ */
+export declare function stripCrxHeader(buf: Buffer): Buffer;
+export declare function loadArtifact(buf: Buffer): Promise<LoadedArtifact>;
+//# sourceMappingURL=review-archive.d.ts.map

package/dist/review-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-archive.d.ts","sourceRoot":"","sources":["../src/review-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAS3D,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAelD;AAED,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAuDvE"}

package/dist/review-archive.js

@@ -0,0 +1,106 @@
+/**
+ * review-risk — pull the manifest and inspectable text files out of a packaged
+ * extension artifact.
+ *
+ * Accepts the same artifacts as `extenshi scan`:
+ *   .zip / .xpi  → a plain ZIP
+ *   .crx         → a ZIP behind a CRX2 or CRX3 header (stripped here)
+ *
+ * Only text entries the checks read (.js/.mjs/.cjs/.html/.json) are decoded,
+ * each capped in size, with a global byte budget — a malicious or huge package
+ * can't blow up memory. Binary assets (images, wasm) are skipped.
+ */
+import JSZip from 'jszip';
+/** Skip any single entry larger than this — source files are never this big. */
+const MAX_ENTRY_BYTES = 4 * 1024 * 1024; // 4 MB
+/** Stop decoding once the cumulative decoded text passes this. */
+const MAX_TOTAL_BYTES = 40 * 1024 * 1024; // 40 MB
+const TEXT_ENTRY_RE = /\.(?:m?js|cjs|html?|json)$/i;
+/**
+ * Strip a CRX header if present and return the inner ZIP bytes.
+ *
+ * CRX3: "Cr24" | version(4 LE)=3 | headerLen(4 LE) | header | ZIP
+ * CRX2: "Cr24" | version(4 LE)=2 | pubKeyLen(4 LE) | sigLen(4 LE) | pubKey | sig | ZIP
+ * Anything else is assumed to already be a ZIP.
+ */
+export function stripCrxHeader(buf) {
+    if (buf.length < 16 || buf.toString('ascii', 0, 4) !== 'Cr24')
+        return buf;
+    const version = buf.readUInt32LE(4);
+    if (version === 3) {
+        const headerLen = buf.readUInt32LE(8);
+        const start = 12 + headerLen;
+        return start <= buf.length ? buf.subarray(start) : buf;
+    }
+    if (version === 2) {
+        const pubKeyLen = buf.readUInt32LE(8);
+        const sigLen = buf.readUInt32LE(12);
+        const start = 16 + pubKeyLen + sigLen;
+        return start <= buf.length ? buf.subarray(start) : buf;
+    }
+    return buf;
+}
+export async function loadArtifact(buf) {
+    const zip = await JSZip.loadAsync(stripCrxHeader(buf));
+    const manifestEntry = findManifestEntry(zip);
+    if (!manifestEntry) {
+        throw new Error('No manifest.json found in the artifact — is this a packaged extension (.zip/.crx/.xpi)?');
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(await manifestEntry.async('string'));
+    }
+    catch (err) {
+        throw new Error(`manifest.json is not valid JSON: ${err.message}`);
+    }
+    const files = new Map();
+    const warnings = [];
+    let totalBytes = 0;
+    let skippedLarge = 0;
+    let budgetHit = false;
+    for (const entry of Object.values(zip.files)) {
+        if (entry.dir)
+            continue;
+        if (!TEXT_ENTRY_RE.test(entry.name))
+            continue;
+        // jszip exposes the uncompressed size on the internal `_data` record; guard
+        // on it when available so we never decode a giant entry. This reaches into
+        // a private field — verified against jszip 3.10.x (the pinned `^3.10.1`).
+        // If you bump jszip, re-check that `_data.uncompressedSize` still exists;
+        // the text-length fallback below is the safety net if it ever disappears.
+        const declaredSize = entry._data
+            ?.uncompressedSize;
+        if (typeof declaredSize === 'number' && declaredSize > MAX_ENTRY_BYTES) {
+            skippedLarge++;
+            continue;
+        }
+        if (totalBytes >= MAX_TOTAL_BYTES) {
+            budgetHit = true;
+            break;
+        }
+        const text = await entry.async('string');
+        if (text.length > MAX_ENTRY_BYTES) {
+            skippedLarge++;
+            continue;
+        }
+        totalBytes += text.length;
+        files.set(entry.name, text);
+    }
+    if (skippedLarge > 0)
+        warnings.push(`${skippedLarge} oversized file(s) skipped (>4 MB)`);
+    if (budgetHit)
+        warnings.push('file scan stopped early at the 40 MB decode budget — some files were not inspected');
+    return { manifest, files, warnings };
+}
+/** manifest.json lives at the package root; tolerate a stray leading folder just in case. */
+function findManifestEntry(zip) {
+    const direct = zip.file('manifest.json');
+    if (direct)
+        return direct;
+    for (const entry of Object.values(zip.files)) {
+        if (!entry.dir && /(^|\/)manifest\.json$/i.test(entry.name))
+            return entry;
+    }
+    return null;
+}
+//# sourceMappingURL=review-archive.js.map

package/dist/review-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-archive.js","sourceRoot":"","sources":["../src/review-archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,OAAO;AAC/C,kEAAkE;AAClE,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA,CAAC,QAAQ;AAEjD,MAAM,aAAa,GAAG,6BAA6B,CAAA;AASnD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,GAAG,CAAA;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,CAAA;QAC5B,OAAO,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,EAAE,GAAG,SAAS,GAAG,MAAM,CAAA;QACrC,OAAO,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IAEtD,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA;IAC3G,CAAC;IAED,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAa,CAAA;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,KAAK,GAAY,IAAI,GAAG,EAAE,CAAA;IAChC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,GAAG;YAAE,SAAQ;QACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QAE7C,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,YAAY,GAAI,KAA8D,CAAC,KAAK;YACzF,EAAE,gBAAgB,CAAA;QACnB,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;YACxE,YAAY,EAAE,CAAA;YACd,SAAQ;QACT,CAAC;QACD,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;YACnC,SAAS,GAAG,IAAI,CAAA;YAChB,MAAK;QACN,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACnC,YAAY,EAAE,CAAA;YACd,SAAQ;QACT,CAAC;QACD,UAAU,IAAI,IAAI,CAAC,MAAM,CAAA;QACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,YAAY,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,oCAAoC,CAAC,CAAA;IACxF,IAAI,SAAS;QACZ,QAAQ,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAA;IAEpG,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AACrC,CAAC;AAED,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,GAAU;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/review-catalog.d.ts

@@ -0,0 +1,43 @@
+/**
+ * review-risk — fetch the last-published manifest for an extension from the
+ * Extenshi catalog so check 3 can diff against it. This is the part that is
+ * unique to us: we keep per-extension manifest snapshots, so we can tell you
+ * whether *this* update adds an auto-disabling permission versus what's live.
+ *
+ * Talks to the public BFF tRPC gateway:
+ *   GET {bffUrl}/api/trpc/store.getLatestPublishedManifest?input=<json>
+ *
+ * The BFF read path may be gated behind a developer API key, so we send the
+ * `ek_` key when the caller has one. Everything here is fail-soft: any problem
+ * (key required, extension unknown, catalog older than this CLI, network error)
+ * resolves to `{ manifest: null, reason }` — the command then runs every other
+ * check and prints why the diff was skipped, rather than failing the run.
+ */
+export interface PriorManifestResult {
+    /** The parsed last-published manifest, or null when it could not be obtained. */
+    manifest: Record<string, unknown> | null;
+    /** Present when manifest is null: a human-readable reason to print. */
+    reason?: string;
+    /** Snapshot metadata, when found. */
+    meta?: {
+        store?: string;
+        version?: string;
+        fetchedAt?: string;
+    };
+}
+export interface FetchPriorManifestOptions {
+    /** BFF base URL, e.g. https://bff.extenshi.io (no trailing slash). */
+    bffUrl: string;
+    /** Numeric catalog extension ID. */
+    extensionId: string;
+    /** Optional `ek_` developer key — sent when the read path is gated. */
+    apiKey?: string;
+    /**
+     * Which store's snapshot to diff against. Permission sets differ per store, so
+     * pinning this avoids comparing a Chrome upload against, say, a Firefox
+     * snapshot. Omitted → the catalog returns the latest snapshot of any store.
+     */
+    store?: 'CHROME' | 'FIREFOX' | 'EDGE';
+}
+export declare function fetchPriorManifest(opts: FetchPriorManifestOptions): Promise<PriorManifestResult>;
+//# sourceMappingURL=review-catalog.d.ts.map

package/dist/review-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-catalog.d.ts","sourceRoot":"","sources":["../src/review-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,MAAM,WAAW,mBAAmB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IACxC,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC/D;AAED,MAAM,WAAW,yBAAyB;IACzC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAA;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;CACrC;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiFtG"}

package/dist/review-catalog.js

@@ -0,0 +1,82 @@
+/**
+ * review-risk — fetch the last-published manifest for an extension from the
+ * Extenshi catalog so check 3 can diff against it. This is the part that is
+ * unique to us: we keep per-extension manifest snapshots, so we can tell you
+ * whether *this* update adds an auto-disabling permission versus what's live.
+ *
+ * Talks to the public BFF tRPC gateway:
+ *   GET {bffUrl}/api/trpc/store.getLatestPublishedManifest?input=<json>
+ *
+ * The BFF read path may be gated behind a developer API key, so we send the
+ * `ek_` key when the caller has one. Everything here is fail-soft: any problem
+ * (key required, extension unknown, catalog older than this CLI, network error)
+ * resolves to `{ manifest: null, reason }` — the command then runs every other
+ * check and prints why the diff was skipped, rather than failing the run.
+ */
+import { fetch } from 'undici';
+const FETCH_TIMEOUT_MS = 15_000;
+export async function fetchPriorManifest(opts) {
+    const id = Number(opts.extensionId);
+    if (!Number.isInteger(id) || id <= 0) {
+        return {
+            manifest: null,
+            reason: `invalid --extension-id "${opts.extensionId}" (expected a positive number)`,
+        };
+    }
+    const query = opts.store ? { extensionId: id, store: opts.store } : { extensionId: id };
+    const input = encodeURIComponent(JSON.stringify(query));
+    const url = `${opts.bffUrl}/api/trpc/store.getLatestPublishedManifest?input=${input}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: opts.apiKey ? { authorization: `Bearer ${opts.apiKey}` } : {},
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const e = err;
+        const why = e.name === 'TimeoutError' ? `timed out after ${FETCH_TIMEOUT_MS / 1000}s` : e.message;
+        return { manifest: null, reason: `could not reach the catalog (${why})` };
+    }
+    if (res.status === 401) {
+        return {
+            manifest: null,
+            reason: 'the catalog manifest read is gated — set EXTENSHI_API_KEY (run `extenshi login`) to enable the diff',
+        };
+    }
+    if (res.status === 404) {
+        return {
+            manifest: null,
+            reason: 'the deployed catalog API predates this feature (no getLatestPublishedManifest) — update once it ships',
+        };
+    }
+    if (!res.ok) {
+        return { manifest: null, reason: `catalog returned HTTP ${res.status}` };
+    }
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        return { manifest: null, reason: 'catalog returned a non-JSON response' };
+    }
+    // tRPC (no transformer): { result: { data: <payload> } }, or { error: {...} }.
+    const error = body.error;
+    if (error) {
+        return { manifest: null, reason: `catalog error: ${error.message ?? 'unknown'}` };
+    }
+    const data = body.result?.data;
+    if (!data || data.manifest == null || typeof data.manifest !== 'object') {
+        const reason = data?.reason === 'no_snapshot'
+            ? 'no published manifest on record for this extension yet'
+            : data?.reason === 'manifest_unresolved'
+                ? 'the last snapshot could not be resolved to a manifest'
+                : 'the catalog returned no manifest for this extension';
+        return { manifest: null, reason };
+    }
+    return {
+        manifest: data.manifest,
+        meta: { store: data.store, version: data.version, fetchedAt: data.fetchedAt },
+    };
+}
+//# sourceMappingURL=review-catalog.js.map

package/dist/review-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-catalog.js","sourceRoot":"","sources":["../src/review-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,MAAM,gBAAgB,GAAG,MAAM,CAAA;AA0B/B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,OAAO;YACN,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2BAA2B,IAAI,CAAC,WAAW,gCAAgC;SACnF,CAAA;IACF,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IACvF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,oDAAoD,KAAK,EAAE,CAAA;IAErF,IAAI,GAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YACtE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,GAAY,CAAA;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACjG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,GAAG,GAAG,EAAE,CAAA;IAC1E,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO;YACN,QAAQ,EAAE,IAAI;YACd,MAAM,EACL,qGAAqG;SACtG,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO;YACN,QAAQ,EAAE,IAAI;YACd,MAAM,EACL,uGAAuG;SACxG,CAAA;IACF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;IACzE,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IAC1E,CAAC;IAED,+EAA+E;IAC/E,MAAM,KAAK,GAAI,IAAyC,CAAC,KAAK,CAAA;IAC9D,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,EAAE,CAAA;IAClF,CAAC;IAED,MAAM,IAAI,GAAI,IAAwC,CAAC,MAAM,EAAE,IASnD,CAAA;IAEZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,MAAM,GACX,IAAI,EAAE,MAAM,KAAK,aAAa;YAC7B,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,qBAAqB;gBACvC,CAAC,CAAC,uDAAuD;gBACzD,CAAC,CAAC,qDAAqD,CAAA;QAC1D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAClC,CAAC;IAED,OAAO;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;KAC7E,CAAA;AACF,CAAC"}

package/dist/review-checks.d.ts

@@ -0,0 +1,139 @@
+/**
+ * review-risk — pure check logic for the pre-publish "will the store reject /
+ * slow-walk / silently disable this?" suite.
+ *
+ * Every finding maps to ONE of three real-world consequences, never a generic
+ * lint level:
+ *
+ *   REJECTED  — the store will reject the submission (you cannot ship as-is).
+ *   SLOW      — it ships, but review moves from <24h to several days.
+ *   ATTRITION — it ships and passes review, but installed users are silently
+ *               dropped on the update until they re-accept a new permission.
+ *
+ * Each check's `citation` points to the relevant official Chrome Web Store /
+ * Chrome for Developers documentation so the user can verify the rule at the
+ * source. (We do not cite third-party books in product output.)
+ *
+ * This module is PURE (no I/O) so the rules are unit-testable against fixtures.
+ * Archive extraction lives in review-archive.ts; the network manifest fetch in
+ * review-catalog.ts; rendering in review-render.ts.
+ */
+export type Verdict = 'REJECTED' | 'SLOW' | 'ATTRITION';
+export interface ReviewFinding {
+    /** The real-world consequence — drives the label shown to the user. */
+    verdict: Verdict;
+    /** Stable machine id (for --json consumers / suppression later). */
+    check: string;
+    /** One-line headline. */
+    title: string;
+    /** Why it matters, in plain language. */
+    detail: string;
+    /** The offending value or `file:line`, when there is one. */
+    evidence?: string;
+    /** The concrete fix. */
+    recommendation: string;
+    /** Official Chrome documentation backing the rule (shown to the user). */
+    citation: string;
+}
+/** A parsed manifest.json — only the fields the checks read are typed. */
+export interface Manifest {
+    manifest_version?: number;
+    name?: string;
+    version?: string;
+    permissions?: unknown;
+    optional_permissions?: unknown;
+    host_permissions?: unknown;
+    optional_host_permissions?: unknown;
+    content_scripts?: Array<{
+        matches?: unknown;
+        js?: unknown;
+        [k: string]: unknown;
+    }>;
+    background?: {
+        service_worker?: string;
+        scripts?: unknown;
+        page?: string;
+        type?: string;
+        [k: string]: unknown;
+    };
+    action?: {
+        default_popup?: string;
+        [k: string]: unknown;
+    };
+    browser_action?: {
+        default_popup?: string;
+        [k: string]: unknown;
+    };
+    options_ui?: {
+        page?: string;
+        [k: string]: unknown;
+    };
+    options_page?: string;
+    side_panel?: {
+        default_path?: string;
+        [k: string]: unknown;
+    };
+    devtools_page?: string;
+    chrome_url_overrides?: Record<string, string>;
+    sandbox?: {
+        pages?: unknown;
+        [k: string]: unknown;
+    };
+    [k: string]: unknown;
+}
+/** A text file pulled out of the artifact: package-relative path → contents. */
+export type FileMap = Map<string, string>;
+export declare const PERMISSION_WARNINGS: Readonly<Record<string, string>>;
+export declare function isGlobalHost(value: string): boolean;
+/**
+ * Required API permissions only (host patterns stripped out). In MV2 hosts and
+ * API permissions share the `permissions` array, so we split by shape.
+ */
+export declare function requiredApiPermissions(m: Manifest): string[];
+/** Required host patterns: `host_permissions` (MV3) plus any host-shaped entry in `permissions` (MV2). */
+export declare function requiredHostPermissions(m: Manifest): string[];
+/** Normalise a manifest-declared path to the package-relative key used in the file map. */
+export declare function normalizePath(p: string): string;
+/**
+ * HTML pages the browser renders inside the extension's own CSP — popup,
+ * options, side panel, devtools, newtab/history/bookmarks overrides, sandbox
+ * pages, and the MV2 background page. These are exactly where inline scripts and
+ * eval get the extension rejected.
+ */
+export declare function htmlEntrypoints(m: Manifest): string[];
+export declare function checkSlowReviewQueue(m: Manifest): ReviewFinding[];
+/**
+ * Static advisory — there is nothing in the package to inspect; it's a
+ * publishing-process fact developers routinely get burned by. Emitted once.
+ */
+export declare function checkListingChangeReReview(): ReviewFinding[];
+/**
+ * Diff the local manifest against the last-published one. A newly-added
+ * *required* permission that shows a warning silently disables the extension for
+ * the whole installed base on update (only a small toolbar icon appears) →
+ * silent attrition. Newly-added permissions of any kind also re-trip the slow
+ * review queue (ch.10).
+ *
+ * `prior` is the manifest fetched from the catalog's last snapshot; pass null
+ * when it could not be fetched (the caller surfaces why and this returns []).
+ */
+export declare function checkAutoDisableOnUpdate(local: Manifest, prior: Manifest | null): ReviewFinding[];
+export declare function checkRemoteCode(files: FileMap): ReviewFinding[];
+export declare function checkHtmlCsp(m: Manifest, files: FileMap): ReviewFinding[];
+export declare function checkServiceWorker(m: Manifest, files: FileMap): ReviewFinding[];
+export declare function checkActiveTabAdvisor(m: Manifest): ReviewFinding[];
+export interface ReviewInputs {
+    manifest: Manifest;
+    files: FileMap;
+    /** Last-published manifest from the catalog, or null when unavailable. */
+    priorManifest: Manifest | null;
+}
+export declare function runChecks(input: ReviewInputs): ReviewFinding[];
+export interface ReviewSummary {
+    findings: ReviewFinding[];
+    counts: Record<Verdict, number>;
+    /** True when at least one finding will block publishing. */
+    blocking: boolean;
+}
+export declare function summarize(findings: ReviewFinding[]): ReviewSummary;
+//# sourceMappingURL=review-checks.d.ts.map

package/dist/review-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-checks.d.ts","sourceRoot":"","sources":["../src/review-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,WAAW,CAAA;AAEvD,MAAM,WAAW,aAAa;IAC7B,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAA;IAChB,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAA;IACb,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wBAAwB;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;CAChB;AAED,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAA;IAClF,UAAU,CAAC,EAAE;QACZ,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KACpB,CAAA;IACD,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACzD,cAAc,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACjE,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACpD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACnD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACpB;AAED,gFAAgF;AAChF,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAazC,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkChE,CAAA;AA2BD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKnD;AAMD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAE5D;AAED,0GAA0G;AAC1G,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAE7D;AAID,2FAA2F;AAC3F,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAerD;AAID,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,QAAQ,GAAG,aAAa,EAAE,CAkBjE;AAID;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,aAAa,EAAE,CAe5D;AAID;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI,GAAG,aAAa,EAAE,CAoEjG;AA4BD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAyB/D;AASD,wBAAgB,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAkFzE;AAgDD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAkD/E;AAYD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,GAAG,aAAa,EAAE,CA6BlE;AAID,MAAM,WAAW,YAAY;IAC5B,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,EAAE,OAAO,CAAA;IACd,0EAA0E;IAC1E,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC9B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,EAAE,CAU9D;AAID,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC/B,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAA;CACjB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CAKlE"}