@extenshi/cli 0.0.8 → 0.0.9

package/dist/review-checks.js

@@ -0,0 +1,560 @@
+/**
+ * review-risk — pure check logic for the pre-publish "will the store reject /
+ * slow-walk / silently disable this?" suite.
+ *
+ * Every finding maps to ONE of three real-world consequences, never a generic
+ * lint level:
+ *
+ *   REJECTED  — the store will reject the submission (you cannot ship as-is).
+ *   SLOW      — it ships, but review moves from <24h to several days.
+ *   ATTRITION — it ships and passes review, but installed users are silently
+ *               dropped on the update until they re-accept a new permission.
+ *
+ * Each check's `citation` points to the relevant official Chrome Web Store /
+ * Chrome for Developers documentation so the user can verify the rule at the
+ * source. (We do not cite third-party books in product output.)
+ *
+ * This module is PURE (no I/O) so the rules are unit-testable against fixtures.
+ * Archive extraction lives in review-archive.ts; the network manifest fetch in
+ * review-catalog.ts; rendering in review-render.ts.
+ */
+// ── ch.10 permission → Chrome warning dialog ─────────────────────────────────
+//
+// The auto-disable-on-update behaviour (check 3) hinges on ONE thing: does
+// *adding* this required permission trigger a warning dialog? If it does, the
+// browser silently disables the extension for every existing user on the
+// update. Permissions absent from this map are granted silently (alarms,
+// storage, scripting, activeTab, cookies, …) and are safe to add in an update.
+//
+// Values are the verbatim Chrome warning strings from ch.10 "Permissions List",
+// so the CLI can quote the exact dialog the user's installed base will see.
+// Source of truth: chapters/10-permissions.md — do NOT edit from memory.
+export const PERMISSION_WARNINGS = {
+    'accessibilityFeatures.modify': 'Change your accessibility settings',
+    'accessibilityFeatures.read': 'Read your accessibility settings',
+    bookmarks: 'Read and change your bookmarks',
+    clipboardRead: 'Read data you copy and paste',
+    clipboardWrite: 'Modify data you copy and paste',
+    contentSettings: "Change your settings that control websites' access to features such as cookies, JavaScript, plugins, geolocation, microphone, camera etc.",
+    debugger: 'Access the page debugger backend / Read and change all your data on the websites you visit',
+    declarativeNetRequest: 'Block content on any page',
+    declarativeNetRequestFeedback: 'Read your browsing history',
+    desktopCapture: 'Capture content of your screen',
+    downloads: 'Manage your downloads',
+    'downloads.open': 'Open downloaded files',
+    favicon: 'Read the icons of the websites you visit',
+    geolocation: 'Detect your physical location',
+    history: 'Read and change your browsing history',
+    identity: 'Know your email address',
+    'identity.email': 'Know your email address',
+    management: 'Manage your apps, extensions, and themes',
+    nativeMessaging: 'Communicate with cooperating native applications',
+    notifications: 'Display notifications',
+    pageCapture: 'Read and change all your data on the websites you visit',
+    privacy: 'Change your privacy-related settings',
+    proxy: 'Read and change all your data on the websites you visit',
+    readingList: 'Read and change entries in the reading list',
+    sessions: 'Read your browsing history on all your signed-in devices',
+    'system.storage': 'Identify and eject storage devices',
+    tabCapture: 'Read and change all your data on the websites you visit',
+    tabs: 'Read your browsing history',
+    topSites: 'Read a list of your most frequently visited websites',
+    ttsEngine: 'Read all text spoken using synthesized speech',
+    webAuthenticationProxy: 'Read and change all your data on all websites',
+    webNavigation: 'Read your browsing history',
+};
+// Official Chrome documentation backing each check (shown as the finding source).
+const DOC_REMOTE_CODE = 'https://developer.chrome.com/docs/webstore/program-policies/code-readability';
+const DOC_REVIEW = 'https://developer.chrome.com/docs/webstore/review-process';
+const DOC_PERMISSION_WARNINGS = 'https://developer.chrome.com/docs/extensions/develop/concepts/permission-warnings';
+const DOC_CSP = 'https://developer.chrome.com/docs/extensions/reference/manifest/content-security-policy';
+const DOC_SERVICE_WORKER = 'https://developer.chrome.com/docs/extensions/develop/concepts/service-workers/lifecycle';
+const DOC_PERMISSIONS = 'https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions';
+// ── Host-permission helpers ──────────────────────────────────────────────────
+/**
+ * The four spellings of "every host" from ch.10 "Global Host Permission" — all
+ * have the same effect and all trip the slow manual review queue. `<all_urls>`
+ * is included for the rare case it lands in `permissions` rather than
+ * `host_permissions`.
+ */
+const GLOBAL_HOST_PATTERNS = new Set(['<all_urls>', '*://*/*', 'http://*/*', 'https://*/*']);
+/** A manifest entry that is a host match pattern (vs an API permission name). */
+function looksLikeHostPattern(value) {
+    return value === '<all_urls>' || value.includes('://') || value.startsWith('*://');
+}
+export function isGlobalHost(value) {
+    if (GLOBAL_HOST_PATTERNS.has(value))
+        return true;
+    // Tolerate the trailing-slash-only forms (`https://*/`, `*://*/`) the
+    // canonical four omit but browsers treat identically.
+    return /^(\*|https?):\/\/\*\/(\*)?$/.test(value);
+}
+function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+/**
+ * Required API permissions only (host patterns stripped out). In MV2 hosts and
+ * API permissions share the `permissions` array, so we split by shape.
+ */
+export function requiredApiPermissions(m) {
+    return asStringArray(m.permissions).filter((p) => !looksLikeHostPattern(p));
+}
+/** Required host patterns: `host_permissions` (MV3) plus any host-shaped entry in `permissions` (MV2). */
+export function requiredHostPermissions(m) {
+    return [...asStringArray(m.host_permissions), ...asStringArray(m.permissions).filter(looksLikeHostPattern)];
+}
+// ── HTML entrypoint resolution ───────────────────────────────────────────────
+/** Normalise a manifest-declared path to the package-relative key used in the file map. */
+export function normalizePath(p) {
+    return p.replace(/^\.?\//, '').split(/[?#]/)[0];
+}
+/**
+ * HTML pages the browser renders inside the extension's own CSP — popup,
+ * options, side panel, devtools, newtab/history/bookmarks overrides, sandbox
+ * pages, and the MV2 background page. These are exactly where inline scripts and
+ * eval get the extension rejected.
+ */
+export function htmlEntrypoints(m) {
+    const out = [];
+    const add = (v) => {
+        if (typeof v === 'string' && v.trim())
+            out.push(normalizePath(v));
+    };
+    add(m.action?.default_popup);
+    add(m.browser_action?.default_popup);
+    add(m.options_ui?.page);
+    add(m.options_page);
+    add(m.side_panel?.default_path);
+    add(m.devtools_page);
+    add(m.background?.page);
+    if (m.chrome_url_overrides)
+        for (const v of Object.values(m.chrome_url_overrides))
+            add(v);
+    for (const v of asStringArray(m.sandbox?.pages))
+        add(v);
+    return [...new Set(out)];
+}
+// ── Check 1: slow-review-queue predictor (ch.10) ─────────────────────────────
+export function checkSlowReviewQueue(m) {
+    const global = requiredHostPermissions(m).filter(isGlobalHost);
+    if (global.length === 0)
+        return [];
+    return [
+        {
+            verdict: 'SLOW',
+            check: 'global-host-permissions',
+            title: 'Global host permissions put the extension in the slow manual review queue',
+            detail: 'Requesting access to every host (any of <all_urls>, *://*/*, http://*/*, https://*/*) ' +
+                'forces a manual review, which typically raises review time from under 24 hours to several days.',
+            evidence: [...new Set(global)].join(', '),
+            recommendation: 'Narrow to the specific hosts you actually call (e.g. https://api.example.com/*), or drop host ' +
+                'permissions entirely in favour of activeTab — see the activeTab recommendation below.',
+            citation: `Chrome Web Store: review process — ${DOC_REVIEW}`,
+        },
+    ];
+}
+// ── Check 2: listing-change re-review note (ch.13) ───────────────────────────
+/**
+ * Static advisory — there is nothing in the package to inspect; it's a
+ * publishing-process fact developers routinely get burned by. Emitted once.
+ */
+export function checkListingChangeReReview() {
+    return [
+        {
+            verdict: 'SLOW',
+            check: 'listing-change-rereview',
+            title: 'Editing the store listing re-triggers a full slow manual review',
+            detail: 'Changing description, screenshots, category, or URLs in the Chrome Web Store listing makes the ' +
+                'entire extension undergo a slow manual review — even when the code did not change.',
+            recommendation: 'Batch store-listing edits together with a code release so you pay the slow-review cost once, not on ' +
+                'every metadata tweak.',
+            citation: `Chrome Web Store: review process — ${DOC_REVIEW}`,
+        },
+    ];
+}
+// ── Check 3: auto-disable-on-update guard (ch.10 / ch.13) — manifest diff ─────
+/**
+ * Diff the local manifest against the last-published one. A newly-added
+ * *required* permission that shows a warning silently disables the extension for
+ * the whole installed base on update (only a small toolbar icon appears) →
+ * silent attrition. Newly-added permissions of any kind also re-trip the slow
+ * review queue (ch.10).
+ *
+ * `prior` is the manifest fetched from the catalog's last snapshot; pass null
+ * when it could not be fetched (the caller surfaces why and this returns []).
+ */
+export function checkAutoDisableOnUpdate(local, prior) {
+    if (!prior)
+        return [];
+    const findings = [];
+    const priorApi = new Set(requiredApiPermissions(prior));
+    const priorHosts = new Set(requiredHostPermissions(prior));
+    const newApi = requiredApiPermissions(local).filter((p) => !priorApi.has(p));
+    const newHosts = requiredHostPermissions(local).filter((h) => !priorHosts.has(h));
+    // Newly-added required API permissions that show a warning → auto-disable.
+    for (const perm of newApi) {
+        const warning = PERMISSION_WARNINGS[perm];
+        if (!warning)
+            continue; // silently-granted permission — safe to add in an update
+        findings.push({
+            verdict: 'ATTRITION',
+            check: 'auto-disable-new-permission',
+            title: `Adding required "${perm}" silently disables the extension for existing users`,
+            detail: `"${perm}" shows the warning "${warning}". When an update adds a required permission that warns, ` +
+                'the browser silently disables the extension for everyone who already has it installed and shows only ' +
+                'a small toolbar icon — most users never re-enable, so you lose them.',
+            evidence: `new required permission "${perm}" (absent from the last published manifest)`,
+            recommendation: `Move "${perm}" into optional_permissions and request it at runtime with chrome.permissions.request(), ` +
+                'so existing users keep the extension enabled.',
+            citation: `Chrome: permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`,
+        });
+    }
+    // Newly-added host permissions always warn ("Read and change your data on …")
+    // → same auto-disable behaviour.
+    for (const host of newHosts) {
+        const global = isGlobalHost(host);
+        findings.push({
+            verdict: 'ATTRITION',
+            check: 'auto-disable-new-host',
+            title: `Adding host access "${host}" silently disables the extension for existing users`,
+            detail: `Host permissions show a "Read and change ${global ? 'all your data on the websites you visit' : `your data on ${host}`}" ` +
+                'warning. Adding one in an update silently disables the extension for the installed base until each user ' +
+                're-accepts — only a small toolbar icon signals it.',
+            evidence: `new host permission "${host}" (absent from the last published manifest)`,
+            recommendation: 'Move it to optional_host_permissions and request it on a user gesture, or use activeTab if you only ' +
+                'need the active tab.',
+            citation: `Chrome: permission warnings re-prompt users on update — ${DOC_PERMISSION_WARNINGS}`,
+        });
+    }
+    // Any new permission also re-trips the slow review queue (ch.10), independent
+    // of whether it warns. One consolidated note.
+    if (newApi.length + newHosts.length > 0) {
+        findings.push({
+            verdict: 'SLOW',
+            check: 'update-adds-permissions',
+            title: 'This update adds new permissions, which re-triggers the slow review queue',
+            detail: 'Adding new permissions in an update places the update in the slow manual review queue (a few days vs <24h).',
+            evidence: [...newApi, ...newHosts].join(', '),
+            recommendation: 'Expected if the new permissions are intentional — just plan for the slower review. Drop any permission ' +
+                'you do not actually use yet.',
+            citation: `Chrome Web Store: review process — ${DOC_REVIEW}`,
+        });
+    }
+    return findings;
+}
+// ── Check 4a: remotely-loaded code (ch.13) ───────────────────────────────────
+/** Dynamic analytics loaders + generic remote-script injection — banned under MV3. */
+const REMOTE_CODE_PATTERNS = [
+    {
+        id: 'analytics-cdn',
+        re: /googletagmanager\.com\/gtag\/js|google-analytics\.com\/(?:analytics|ga)\.js|www\.google-analytics\.com\/analytics\.js/i,
+        what: 'a Google Analytics script loaded from a CDN',
+    },
+    {
+        id: 'dynamic-script-tag',
+        re: /document\.createElement\(\s*['"`]script['"`]\s*\)/i,
+        what: 'a dynamically created <script> element (remote code injection)',
+    },
+    {
+        id: 'remote-importscripts',
+        re: /importScripts\(\s*['"`]https?:\/\//i,
+        what: 'importScripts() of a remote URL',
+    },
+    {
+        id: 'dynamic-import-url',
+        re: /\bimport\(\s*['"`]https?:\/\//i,
+        what: 'a dynamic import() of a remote URL',
+    },
+];
+export function checkRemoteCode(files) {
+    const findings = [];
+    for (const [path, content] of files) {
+        // Match the extensions review-archive actually extracts (TEXT_ENTRY_RE) —
+        // .ts/.tsx are stripped by the build before packaging, so never present.
+        if (!/\.(?:m?js|cjs|html?)$/i.test(path))
+            continue;
+        for (const { id, re, what } of REMOTE_CODE_PATTERNS) {
+            for (const where of matchAllLocations(content, re)) {
+                findings.push({
+                    verdict: 'REJECTED',
+                    check: `remote-code-${id}`,
+                    title: 'Remotely-loaded code is not allowed in Manifest V3',
+                    detail: `Found ${what}. MV3 requires every executable script to ship inside the package — analytics ` +
+                        'libraries and other scripts can no longer be fetched and run at runtime.',
+                    evidence: `${path}:${where.line}  ${where.snippet}`,
+                    recommendation: 'Bundle the script into your package and reference it locally. For Google Analytics, include the ' +
+                        'gtag/analytics.js file in the build instead of loading it from the CDN.',
+                    citation: `Chrome Web Store: remote hosted code policy — ${DOC_REMOTE_CODE}`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+// ── Check 4b: inline scripts / eval in HTML entrypoints (ch.4 / ch.5 CSP) ─────
+const INLINE_SCRIPT_RE = /<script(?![^>]*\bsrc\s*=)[^>]*>([\s\S]*?)<\/script>/i;
+const INLINE_HANDLER_RE = /\son[a-z]+\s*=\s*["']/i;
+const JS_URL_RE = /\b(?:href|src|action)\s*=\s*["']\s*javascript:/i;
+const EVAL_RE = /\b(?:eval\s*\(|new\s+Function\s*\()/;
+export function checkHtmlCsp(m, files) {
+    const findings = [];
+    const entrypoints = new Set(htmlEntrypoints(m));
+    // Inline <script> needs the capture group (must have a non-empty body), so it
+    // runs its own global scan; the simpler patterns use matchAllLocations. Every
+    // occurrence is reported (capped) so the dev fixes them all in one pass.
+    const inlineScriptG = new RegExp(INLINE_SCRIPT_RE.source, 'gi');
+    for (const [path, content] of files) {
+        if (!/\.html?$/i.test(path))
+            continue;
+        // Only the entrypoints the browser renders under the extension CSP matter.
+        // If the manifest declared none we still scan any HTML (better a heads-up
+        // than a miss), but prefer flagging declared entrypoints.
+        const isEntrypoint = entrypoints.size === 0 || entrypoints.has(normalizePath(path));
+        if (!isEntrypoint)
+            continue;
+        let inlineCount = 0;
+        for (const match of content.matchAll(inlineScriptG)) {
+            if (!match[1]?.trim())
+                continue; // empty <script></script> or src-only — not inline code
+            const where = locate(content, match.index ?? 0);
+            findings.push({
+                verdict: 'REJECTED',
+                check: 'inline-script',
+                title: 'Inline <script> violates the Manifest V3 content security policy',
+                detail: 'MV3 forbids inline script in extension pages. The default CSP blocks it, so the page silently fails ' +
+                    'and the store rejects the package.',
+                evidence: `${path}:${where.line}  inline <script>…</script>`,
+                recommendation: 'Move the code into a separate .js file and load it with <script src="…">.',
+                citation: `Chrome extensions: content security policy — ${DOC_CSP}`,
+            });
+            if (++inlineCount >= 10)
+                break;
+        }
+        for (const where of matchAllLocations(content, INLINE_HANDLER_RE)) {
+            findings.push({
+                verdict: 'REJECTED',
+                check: 'inline-event-handler',
+                title: 'Inline event handler (onclick=…) violates the Manifest V3 CSP',
+                detail: 'Inline event-handler attributes execute inline JavaScript, which the MV3 CSP blocks — the handler ' +
+                    'never fires and the package is rejected.',
+                evidence: `${path}:${where.line}  ${where.snippet}`,
+                recommendation: 'Attach handlers from a bundled script with addEventListener() instead of on* attributes.',
+                citation: `Chrome extensions: content security policy — ${DOC_CSP}`,
+            });
+        }
+        for (const where of matchAllLocations(content, JS_URL_RE)) {
+            findings.push({
+                verdict: 'REJECTED',
+                check: 'javascript-url',
+                title: 'javascript: URL violates the Manifest V3 CSP',
+                detail: 'javascript: URLs run inline code, which the MV3 CSP blocks.',
+                evidence: `${path}:${where.line}`,
+                recommendation: 'Replace the javascript: URL with a bundled-script event handler.',
+                citation: `Chrome extensions: content security policy — ${DOC_CSP}`,
+            });
+        }
+    }
+    // eval / new Function anywhere in shipped JS or HTML entrypoints — also CSP-blocked.
+    for (const [path, content] of files) {
+        if (!/\.(?:m?js|cjs|html?)$/i.test(path))
+            continue;
+        for (const where of matchAllLocations(content, EVAL_RE)) {
+            findings.push({
+                verdict: 'REJECTED',
+                check: 'eval',
+                title: 'eval()/new Function() violates the Manifest V3 CSP',
+                detail: "MV3's content security policy blocks eval() and new Function(); calling them throws at runtime.",
+                evidence: `${path}:${where.line}  ${where.snippet}`,
+                recommendation: 'Remove eval/new Function — parse JSON with JSON.parse and replace dynamic code with real functions.',
+                citation: `Chrome extensions: content security policy — ${DOC_CSP}`,
+            });
+        }
+    }
+    return findings;
+}
+// ── Check 4c: service-worker anti-patterns (ch.6) ────────────────────────────
+const SW_DOM_APIS = [
+    {
+        id: 'window',
+        re: /\bwindow\s*\./,
+        api: 'window',
+        why: 'the service worker global is ServiceWorkerGlobalScope; window is undefined',
+    },
+    {
+        id: 'document',
+        re: /\bdocument\s*\./,
+        api: 'document',
+        why: 'service workers have no DOM, so document is undefined',
+    },
+    {
+        id: 'localStorage',
+        re: /\blocalStorage\b/,
+        api: 'localStorage',
+        why: 'localStorage is unavailable in a service worker',
+    },
+    {
+        id: 'sessionStorage',
+        re: /\bsessionStorage\b/,
+        api: 'sessionStorage',
+        why: 'sessionStorage is unavailable in a service worker',
+    },
+    {
+        id: 'xhr',
+        re: /\bXMLHttpRequest\b/,
+        api: 'XMLHttpRequest',
+        why: 'XMLHttpRequest is unavailable in a service worker — use fetch()',
+    },
+    {
+        id: 'get-background-page',
+        re: /getBackgroundPage\s*\(/,
+        api: 'chrome.extension.getBackgroundPage()',
+        why: 'programmatic background-page access was removed in MV3',
+    },
+];
+// Only setInterval — it's unambiguously a recurring scheduler. A one-shot
+// setTimeout is legitimate (a short in-task delay fires before the worker idles
+// out), so flagging it would be a false positive.
+const SW_TIMER_RE = /\bsetInterval\s*\(/;
+export function checkServiceWorker(m, files) {
+    const swPath = m.background?.service_worker;
+    if (typeof swPath !== 'string' || !swPath.trim())
+        return [];
+    const content = readFile(files, swPath);
+    if (content === undefined)
+        return [];
+    // Only the service_worker entry-point file is scanned — imported modules
+    // (importScripts / ESM import) are not followed, so a clean result here does
+    // not prove the whole worker graph is clean. The finding wording says
+    // "entry-point" to avoid implying otherwise.
+    const findings = [];
+    for (const { id, re, api, why } of SW_DOM_APIS) {
+        const where = matchLocation(content, re);
+        if (!where)
+            continue;
+        findings.push({
+            verdict: 'REJECTED',
+            check: `sw-${id}`,
+            title: `Service worker references ${api}, which does not exist in Manifest V3`,
+            detail: `The service worker entry-point references ${api}, but ${why}. A reference thrown in the first turn ` +
+                'of the event loop makes the worker fail to register, so the extension never runs.',
+            evidence: `${normalizePath(swPath)}:${where.line}  ${where.snippet}`,
+            recommendation: id === 'xhr'
+                ? 'Use fetch() instead of XMLHttpRequest.'
+                : 'Move DOM/window work to a content script, popup, or offscreen document and message the worker.',
+            citation: `Chrome extensions: service worker lifecycle — ${DOC_SERVICE_WORKER}`,
+        });
+    }
+    const timer = matchLocation(content, SW_TIMER_RE);
+    if (timer) {
+        findings.push({
+            // ATTRITION, not REJECTED: the store ships it, but the scheduler silently
+            // dies at runtime so installed users quietly lose the feature.
+            verdict: 'ATTRITION',
+            check: 'sw-timer-scheduler',
+            title: 'setInterval in a service worker is an unreliable scheduler',
+            detail: 'This passes store review, but the service worker is terminated after ~30s idle, so a setInterval ' +
+                'scheduler silently stops firing once it sleeps — the recurring work quietly breaks for installed users.',
+            evidence: `${normalizePath(swPath)}:${timer.line}  ${timer.snippet}`,
+            recommendation: 'Use chrome.alarms for recurring work (note its minimum interval is 1 minute) instead of setInterval.',
+            citation: `Chrome extensions: service worker lifecycle — ${DOC_SERVICE_WORKER}`,
+        });
+    }
+    return findings;
+}
+// ── Check 5: activeTab advisor (ch.10) ───────────────────────────────────────
+/** True when a content script auto-injects into all pages (then activeTab can't replace its host perms). */
+function hasBroadContentScript(m) {
+    for (const cs of m.content_scripts ?? []) {
+        if (asStringArray(cs.matches).some(isGlobalHost))
+            return true;
+    }
+    return false;
+}
+export function checkActiveTabAdvisor(m) {
+    const global = requiredHostPermissions(m).filter(isGlobalHost);
+    if (global.length === 0)
+        return [];
+    // activeTab only covers gesture-driven access to the focused tab. If the
+    // extension declaratively injects into every page, it genuinely needs the
+    // broad host permission — recommending activeTab there would be wrong.
+    if (hasBroadContentScript(m))
+        return [];
+    const hasGestureSurface = Boolean(m.action || m.browser_action || m.devtools_page || asStringArray(m.permissions).includes('scripting'));
+    if (!hasGestureSurface)
+        return [];
+    return [
+        {
+            verdict: 'SLOW',
+            check: 'prefer-activetab',
+            title: 'Use activeTab instead of global host permissions to skip the warning and the slow queue',
+            detail: 'This extension requests every host but appears to act on the active tab after a user gesture (toolbar ' +
+                'action / command / devtools). activeTab grants the same access on a user interaction with NO permission ' +
+                'warning and keeps the extension out of the slow manual review queue.',
+            evidence: `global host access: ${[...new Set(global)].join(', ')}`,
+            recommendation: 'Replace the global host permission with "activeTab" (plus "scripting" if you inject), and request any ' +
+                'wider access at runtime only when needed.',
+            citation: `Chrome extensions: declare permissions — ${DOC_PERMISSIONS}`,
+        },
+    ];
+}
+export function runChecks(input) {
+    return [
+        ...checkRemoteCode(input.files),
+        ...checkHtmlCsp(input.manifest, input.files),
+        ...checkServiceWorker(input.manifest, input.files),
+        ...checkAutoDisableOnUpdate(input.manifest, input.priorManifest),
+        ...checkSlowReviewQueue(input.manifest),
+        ...checkActiveTabAdvisor(input.manifest),
+        ...checkListingChangeReReview(),
+    ];
+}
+const VERDICT_ORDER = { REJECTED: 0, ATTRITION: 1, SLOW: 2 };
+export function summarize(findings) {
+    const sorted = [...findings].sort((a, b) => VERDICT_ORDER[a.verdict] - VERDICT_ORDER[b.verdict]);
+    const counts = { REJECTED: 0, ATTRITION: 0, SLOW: 0 };
+    for (const f of sorted)
+        counts[f.verdict]++;
+    return { findings: sorted, counts, blocking: counts.REJECTED > 0 };
+}
+// ── Small text utilities ─────────────────────────────────────────────────────
+/** Read a manifest-declared file out of the map, tolerating ./ and / prefixes. */
+function readFile(files, declaredPath) {
+    const key = normalizePath(declaredPath);
+    if (files.has(key))
+        return files.get(key);
+    for (const [p, content] of files)
+        if (normalizePath(p) === key)
+            return content;
+    return undefined;
+}
+/** Line number (1-based) + a trimmed snippet for the first match of `re`, or null. */
+function matchLocation(content, re) {
+    const m = re.exec(content);
+    if (!m)
+        return null;
+    return locate(content, m.index);
+}
+/**
+ * Up to `cap` match locations for `re` across the whole file — not just the
+ * first. Reporting every occurrence means a developer who fixes one inline
+ * handler and re-runs sees the rest immediately, instead of one-at-a-time
+ * (which erodes trust in the tool). Caps the count so a minified file with
+ * hundreds of matches can't flood the report.
+ */
+function matchAllLocations(content, re, cap = 10) {
+    // Clone with the global flag so we never mutate a shared regex's lastIndex.
+    const global = re.global ? re : new RegExp(re.source, `${re.flags}g`);
+    const out = [];
+    for (const m of content.matchAll(global)) {
+        out.push(locate(content, m.index ?? 0));
+        if (out.length >= cap)
+            break;
+    }
+    return out;
+}
+function locate(content, index) {
+    const line = content.slice(0, index).split('\n').length;
+    const lineText = content.split('\n')[line - 1] ?? '';
+    return { line, snippet: lineText.trim().slice(0, 100) };
+}
+//# sourceMappingURL=review-checks.js.map

package/dist/review-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-checks.js","sourceRoot":"","sources":["../src/review-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAsDH,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACpE,8BAA8B,EAAE,oCAAoC;IACpE,4BAA4B,EAAE,kCAAkC;IAChE,SAAS,EAAE,gCAAgC;IAC3C,aAAa,EAAE,8BAA8B;IAC7C,cAAc,EAAE,gCAAgC;IAChD,eAAe,EACd,2IAA2I;IAC5I,QAAQ,EAAE,4FAA4F;IACtG,qBAAqB,EAAE,2BAA2B;IAClD,6BAA6B,EAAE,4BAA4B;IAC3D,cAAc,EAAE,gCAAgC;IAChD,SAAS,EAAE,uBAAuB;IAClC,gBAAgB,EAAE,uBAAuB;IACzC,OAAO,EAAE,0CAA0C;IACnD,WAAW,EAAE,+BAA+B;IAC5C,OAAO,EAAE,uCAAuC;IAChD,QAAQ,EAAE,yBAAyB;IACnC,gBAAgB,EAAE,yBAAyB;IAC3C,UAAU,EAAE,0CAA0C;IACtD,eAAe,EAAE,kDAAkD;IACnE,aAAa,EAAE,uBAAuB;IACtC,WAAW,EAAE,yDAAyD;IACtE,OAAO,EAAE,sCAAsC;IAC/C,KAAK,EAAE,yDAAyD;IAChE,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,0DAA0D;IACpE,gBAAgB,EAAE,oCAAoC;IACtD,UAAU,EAAE,yDAAyD;IACrE,IAAI,EAAE,4BAA4B;IAClC,QAAQ,EAAE,sDAAsD;IAChE,SAAS,EAAE,+CAA+C;IAC1D,sBAAsB,EAAE,+CAA+C;IACvE,aAAa,EAAE,4BAA4B;CAC3C,CAAA;AAED,kFAAkF;AAClF,MAAM,eAAe,GAAG,8EAA8E,CAAA;AACtG,MAAM,UAAU,GAAG,2DAA2D,CAAA;AAC9E,MAAM,uBAAuB,GAC5B,mFAAmF,CAAA;AACpF,MAAM,OAAO,GAAG,yFAAyF,CAAA;AACzG,MAAM,kBAAkB,GACvB,yFAAyF,CAAA;AAC1F,MAAM,eAAe,GAAG,mFAAmF,CAAA;AAE3G,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAA;AAE5F,iFAAiF;AACjF,SAAS,oBAAoB,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,sEAAsE;IACtE,sDAAsD;IACtD,OAAO,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAW;IACjD,OAAO,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,uBAAuB,CAAC,CAAW;IAClD,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAA;AAC5G,CAAC;AAED,gFAAgF;AAEhF,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAW;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IAClE,CAAC,CAAA;IACD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IAC5B,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAA;IACpC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACvB,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;IACnB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IAC/B,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACpB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;IACvB,IAAI,CAAC,CAAC,oBAAoB;QAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACzF,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAA;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AACzB,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,oBAAoB,CAAC,CAAW;IAC/C,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,OAAO;QACN;YACC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,2EAA2E;YAClF,MAAM,EACL,wFAAwF;gBACxF,iGAAiG;YAClG,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,cAAc,EACb,gGAAgG;gBAChG,uFAAuF;YACxF,QAAQ,EAAE,sCAAsC,UAAU,EAAE;SAC5D;KACD,CAAA;AACF,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO;QACN;YACC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,iEAAiE;YACxE,MAAM,EACL,iGAAiG;gBACjG,oFAAoF;YACrF,cAAc,EACb,sGAAsG;gBACtG,uBAAuB;YACxB,QAAQ,EAAE,sCAAsC,UAAU,EAAE;SAC5D;KACD,CAAA;AACF,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAe,EAAE,KAAsB;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IAErB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAEjF,2EAA2E;IAC3E,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,OAAO;YAAE,SAAQ,CAAC,yDAAyD;QAChF,QAAQ,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,6BAA6B;YACpC,KAAK,EAAE,oBAAoB,IAAI,sDAAsD;YACrF,MAAM,EACL,IAAI,IAAI,wBAAwB,OAAO,2DAA2D;gBAClG,uGAAuG;gBACvG,sEAAsE;YACvE,QAAQ,EAAE,4BAA4B,IAAI,6CAA6C;YACvF,cAAc,EACb,SAAS,IAAI,2FAA2F;gBACxG,+CAA+C;YAChD,QAAQ,EAAE,2DAA2D,uBAAuB,EAAE;SAC9F,CAAC,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,iCAAiC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QACjC,QAAQ,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,uBAAuB;YAC9B,KAAK,EAAE,uBAAuB,IAAI,sDAAsD;YACxF,MAAM,EACL,4CAA4C,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,IAAI;gBAC3H,0GAA0G;gBAC1G,oDAAoD;YACrD,QAAQ,EAAE,wBAAwB,IAAI,6CAA6C;YACnF,cAAc,EACb,sGAAsG;gBACtG,sBAAsB;YACvB,QAAQ,EAAE,2DAA2D,uBAAuB,EAAE;SAC9F,CAAC,CAAA;IACH,CAAC;IAED,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,yBAAyB;YAChC,KAAK,EAAE,2EAA2E;YAClF,MAAM,EACL,6GAA6G;YAC9G,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7C,cAAc,EACb,yGAAyG;gBACzG,8BAA8B;YAC/B,QAAQ,EAAE,sCAAsC,UAAU,EAAE;SAC5D,CAAC,CAAA;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,sFAAsF;AACtF,MAAM,oBAAoB,GAAoD;IAC7E;QACC,EAAE,EAAE,eAAe;QACnB,EAAE,EAAE,wHAAwH;QAC5H,IAAI,EAAE,6CAA6C;KACnD;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,EAAE,EAAE,oDAAoD;QACxD,IAAI,EAAE,gEAAgE;KACtE;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,EAAE,EAAE,qCAAqC;QACzC,IAAI,EAAE,iCAAiC;KACvC;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE,oCAAoC;KAC1C;CACD,CAAA;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC7C,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAClD,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,oBAAoB,EAAE,CAAC;YACrD,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACb,OAAO,EAAE,UAAU;oBACnB,KAAK,EAAE,eAAe,EAAE,EAAE;oBAC1B,KAAK,EAAE,oDAAoD;oBAC3D,MAAM,EACL,SAAS,IAAI,gFAAgF;wBAC7F,0EAA0E;oBAC3E,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;oBACnD,cAAc,EACb,kGAAkG;wBAClG,yEAAyE;oBAC1E,QAAQ,EAAE,iDAAiD,eAAe,EAAE;iBAC5E,CAAC,CAAA;YACH,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG,sDAAsD,CAAA;AAC/E,MAAM,iBAAiB,GAAG,wBAAwB,CAAA;AAClD,MAAM,SAAS,GAAG,iDAAiD,CAAA;AACnE,MAAM,OAAO,GAAG,qCAAqC,CAAA;AAErD,MAAM,UAAU,YAAY,CAAC,CAAW,EAAE,KAAc;IACvD,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IAE/C,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAE/D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QACrC,2EAA2E;QAC3E,0EAA0E;QAC1E,0DAA0D;QAC1D,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;QACnF,IAAI,CAAC,YAAY;YAAE,SAAQ;QAE3B,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBAAE,SAAQ,CAAC,wDAAwD;YACxF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,kEAAkE;gBACzE,MAAM,EACL,sGAAsG;oBACtG,oCAAoC;gBACrC,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,6BAA6B;gBAC5D,cAAc,EAAE,2EAA2E;gBAC3F,QAAQ,EAAE,gDAAgD,OAAO,EAAE;aACnE,CAAC,CAAA;YACF,IAAI,EAAE,WAAW,IAAI,EAAE;gBAAE,MAAK;QAC/B,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,sBAAsB;gBAC7B,KAAK,EAAE,+DAA+D;gBACtE,MAAM,EACL,oGAAoG;oBACpG,0CAA0C;gBAC3C,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;gBACnD,cAAc,EACb,0FAA0F;gBAC3F,QAAQ,EAAE,gDAAgD,OAAO,EAAE;aACnE,CAAC,CAAA;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,gBAAgB;gBACvB,KAAK,EAAE,8CAA8C;gBACrD,MAAM,EAAE,6DAA6D;gBACrE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;gBACjC,cAAc,EAAE,kEAAkE;gBAClF,QAAQ,EAAE,gDAAgD,OAAO,EAAE;aACnE,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IAED,qFAAqF;IACrF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAQ;QAClD,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,oDAAoD;gBAC3D,MAAM,EACL,iGAAiG;gBAClG,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;gBACnD,cAAc,EACb,qGAAqG;gBACtG,QAAQ,EAAE,gDAAgD,OAAO,EAAE;aACnE,CAAC,CAAA;QACH,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,MAAM,WAAW,GAAgE;IAChF;QACC,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,eAAe;QACnB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,4EAA4E;KACjF;IACD;QACC,EAAE,EAAE,UAAU;QACd,EAAE,EAAE,iBAAiB;QACrB,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,uDAAuD;KAC5D;IACD;QACC,EAAE,EAAE,cAAc;QAClB,EAAE,EAAE,kBAAkB;QACtB,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,iDAAiD;KACtD;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,EAAE,EAAE,oBAAoB;QACxB,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,mDAAmD;KACxD;IACD;QACC,EAAE,EAAE,KAAK;QACT,EAAE,EAAE,oBAAoB;QACxB,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,iEAAiE;KACtE;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,EAAE,EAAE,wBAAwB;QAC5B,GAAG,EAAE,sCAAsC;QAC3C,GAAG,EAAE,wDAAwD;KAC7D;CACD,CAAA;AAED,0EAA0E;AAC1E,gFAAgF;AAChF,kDAAkD;AAClD,MAAM,WAAW,GAAG,oBAAoB,CAAA;AAExC,MAAM,UAAU,kBAAkB,CAAC,CAAW,EAAE,KAAc;IAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,CAAA;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAEpC,yEAAyE;IACzE,6EAA6E;IAC7E,sEAAsE;IACtE,6CAA6C;IAC7C,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,QAAQ,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,UAAU;YACnB,KAAK,EAAE,MAAM,EAAE,EAAE;YACjB,KAAK,EAAE,6BAA6B,GAAG,uCAAuC;YAC9E,MAAM,EACL,6CAA6C,GAAG,SAAS,GAAG,yCAAyC;gBACrG,mFAAmF;YACpF,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACpE,cAAc,EACb,EAAE,KAAK,KAAK;gBACX,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,gGAAgG;YACpG,QAAQ,EAAE,iDAAiD,kBAAkB,EAAE;SAC/E,CAAC,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACjD,IAAI,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC;YACb,0EAA0E;YAC1E,+DAA+D;YAC/D,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,oBAAoB;YAC3B,KAAK,EAAE,4DAA4D;YACnE,MAAM,EACL,mGAAmG;gBACnG,yGAAyG;YAC1G,QAAQ,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;YACpE,cAAc,EACb,sGAAsG;YACvG,QAAQ,EAAE,iDAAiD,kBAAkB,EAAE;SAC/E,CAAC,CAAA;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,gFAAgF;AAEhF,4GAA4G;AAC5G,SAAS,qBAAqB,CAAC,CAAW;IACzC,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAA;IAC9D,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAW;IAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,qBAAqB,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IAEvC,MAAM,iBAAiB,GAAG,OAAO,CAChC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CACrG,CAAA;IACD,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAA;IAEjC,OAAO;QACN;YACC,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,yFAAyF;YAChG,MAAM,EACL,wGAAwG;gBACxG,0GAA0G;gBAC1G,sEAAsE;YACvE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAClE,cAAc,EACb,wGAAwG;gBACxG,2CAA2C;YAC5C,QAAQ,EAAE,4CAA4C,eAAe,EAAE;SACvE;KACD,CAAA;AACF,CAAC;AAWD,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC5C,OAAO;QACN,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QAC5C,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;QAClD,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC;QAChE,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACxC,GAAG,0BAA0B,EAAE;KAC/B,CAAA;AACF,CAAC;AAED,MAAM,aAAa,GAA4B,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AASrF,MAAM,UAAU,SAAS,CAAC,QAAyB;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAChG,MAAM,MAAM,GAA4B,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAA;IAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAA;AACnE,CAAC;AAED,gFAAgF;AAEhF,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAAc,EAAE,YAAoB;IACrD,MAAM,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,KAAK;QAAE,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,OAAO,CAAA;IAC9E,OAAO,SAAS,CAAA;AACjB,CAAC;AAOD,sFAAsF;AACtF,SAAS,aAAa,CAAC,OAAe,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,EAAU,EAAE,GAAG,GAAG,EAAE;IAC/D,4EAA4E;IAC5E,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAA;IACrE,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;QACvC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAK;IAC7B,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;AACxD,CAAC"}

package/dist/review-render.d.ts

@@ -0,0 +1,10 @@
+/**
+ * review-risk — terminal rendering.
+ *
+ * Findings are grouped by consequence, worst first: what the store will REJECT,
+ * then what causes user ATTRITION on update, then what merely triggers a SLOW
+ * review. The label is the consequence, never a generic "error/warning".
+ */
+import type { ReviewSummary } from './review-checks.js';
+export declare function renderReviewReport(summary: ReviewSummary): void;
+//# sourceMappingURL=review-render.d.ts.map

package/dist/review-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-render.d.ts","sourceRoot":"","sources":["../src/review-render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAiB,aAAa,EAAW,MAAM,oBAAoB,CAAA;AAwB/E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAyC/D"}