@extenshi/cli 0.20.0 → 0.22.0

package/dist/package.d.ts

@@ -0,0 +1,163 @@
+/**
+ * `extenshi package <dir> --browser chrome,edge,firefox` — one reproducible
+ * store package per browser from an unpacked build directory.
+ *
+ * REPRODUCIBLE means byte-identical for the same files on any machine, in any
+ * timezone, under any umask: Dojo release readiness binds every piece of
+ * evidence (tests, scan, installed smoke) to the package's SHA-256, so a CI
+ * build and a local build of one commit must agree to the byte. The archive is
+ * written by the SAME writer Dojo uses (`zip.ts`, a byte-identical copy of
+ * dojo/src/lib/tools/zip.ts) with the same choices as Dojo's extension archive:
+ *   - entries sorted by path, manifest.json at the root, no directory entries;
+ *   - every entry stamped 2000-01-01 00:00:00 (DOS fields carry no timezone, so
+ *     the constant is built from LOCAL components — see REPRODUCIBLE_MTIME);
+ *   - STORE (no compression): deflate output depends on the zlib build, which
+ *     differs between Node releases, and reproducibility across machines is the
+ *     point. Store uploads accept uncompressed archives;
+ *   - "version made by" MS-DOS with zero external attributes, so no Unix mode
+ *     bits, owners or extra fields — nothing machine-specific survives.
+ *
+ * The user's source directory is never modified. `--fix-war` and `--gecko-id`
+ * rewrite manifest.json in the PACKAGED copy only, and every rewrite is listed
+ * in the output (`changes`).
+ */
+export declare const PACKAGE_BROWSERS: readonly ["chrome", "edge", "firefox"];
+export type PackageBrowser = (typeof PACKAGE_BROWSERS)[number];
+/** Written next to the zips; `release prepare`, `test smoke`, `evidence ingest` read it directly. */
+export declare const PACKAGES_MANIFEST_FILE = "extenshi-packages.json";
+export declare const PACKAGES_MANIFEST_SCHEMA_VERSION = 1;
+export interface PackageFile {
+    /** Posix path relative to the package root. */
+    path: string;
+    bytes: Uint8Array;
+}
+/**
+ * `--exclude` pattern → matcher, gitignore-style: `*` stays inside one path
+ * segment, `**` crosses segments, a pattern without `/` matches a basename at any
+ * depth, a pattern with `/` is anchored at the package root, and a pattern naming
+ * a directory excludes everything under it.
+ */
+export declare function excludeMatcher(patterns: readonly string[]): (relative: string) => boolean;
+/**
+ * A `web_accessible_resources` entry as the BROWSER matches it: `*` matches any
+ * run of characters INCLUDING `/` (Chromium's MatchPattern and Firefox's
+ * MatchGlob both work this way), `?` one character. Leading `/` is ignored.
+ */
+export declare function warGlobToRegExp(glob: string): RegExp;
+export interface CollectedFiles {
+    files: PackageFile[];
+    /** Relative paths left out by --exclude (dot-entries and node_modules are not listed). */
+    excluded: string[];
+}
+/**
+ * Read every file under `root`, sorted, skipping dot-entries (`.git`, `.github`,
+ * `.extenshi`, `.DS_Store`, …), `node_modules` and `skipDirs` (the output
+ * directory when it sits inside the source). Symlinks are refused: following one
+ * would pack bytes from outside the directory, and a link itself is not
+ * something every store unpacks the same way.
+ */
+export declare function collectFiles(root: string, options?: {
+    exclude?: readonly string[];
+    skipDirs?: readonly string[];
+}): CollectedFiles;
+type Json = Record<string, any>;
+/**
+ * Every file the manifest names, which the browser loads or refuses to install
+ * without: background, pages, content scripts, icons, locale, rulesets.
+ * `web_accessible_resources` is not here — its entries are patterns, handled by
+ * the WAR check.
+ */
+export declare function manifestReferences(manifest: Json): string[];
+export interface WarWildcard {
+    /** Index into the manifest's web_accessible_resources array. */
+    entry: number;
+    pattern: string;
+}
+export declare function warWildcards(manifest: Json): WarWildcard[];
+/**
+ * Replace every wildcard in `web_accessible_resources` with the explicit list of
+ * packaged files it matches (as the browser would match it). Exact entries stay.
+ * manifest.json itself is never exposed. Returns human-readable change notes.
+ */
+export declare function expandWarWildcards(manifest: Json, packagedPaths: readonly string[]): string[];
+/** `browser_specific_settings.gecko.id`, or the MV2 `applications.gecko.id` spelling. */
+export declare function manifestGeckoId(manifest: Json): string | undefined;
+export interface PackOptions {
+    browser: PackageBrowser;
+    /** Explicit Firefox add-on ID written into the packaged manifest. */
+    geckoId?: string;
+    /** Expand wildcard web_accessible_resources in the packaged manifest. */
+    fixWar?: boolean;
+    /** Bound Dojo project, used only to suggest its derived add-on ID in errors. */
+    projectId?: string;
+}
+export interface PackResult {
+    browser: PackageBrowser;
+    bytes: Uint8Array;
+    sha256: string;
+    entries: string[];
+    manifest: Json;
+    /** Rewrites applied to the PACKAGED manifest.json (never the source). */
+    changes: string[];
+    warnings: string[];
+}
+export declare function packExtension(source: readonly PackageFile[], options: PackOptions): PackResult;
+/** `dyslexia-font-reading-ruler-chrome-0.1.0.zip`: browser in the name so the wrong upload is hard. */
+export declare function packageFileName(name: string, browser: PackageBrowser, version: string): string;
+/** Resolve `__MSG_key__` against the default locale, for the file name only. */
+export declare function displayName(manifest: Json, files: readonly PackageFile[]): string;
+export interface PackageEntry {
+    browser: PackageBrowser;
+    /** Zip file name, relative to the packages manifest. */
+    file: string;
+    sha256: string;
+    bytes: number;
+    entries: number;
+    name: string;
+    version: string;
+    /** hashMetadata(packaged manifest) — equals the digest `release prepare` records. */
+    manifestDigest: string;
+    geckoId?: string;
+    /** Source directory as given, relative to where the command ran. */
+    source: string;
+    changes: string[];
+    warnings: string[];
+}
+export interface PackagesManifest {
+    schemaVersion: typeof PACKAGES_MANIFEST_SCHEMA_VERSION;
+    tool: string;
+    packages: PackageEntry[];
+}
+export declare function isPackagesManifest(value: unknown): value is PackagesManifest;
+/**
+ * `<artifact>` for `release prepare`, `test smoke` and `evidence ingest`: a zip,
+ * or the packages manifest `extenshi package` wrote (then `browser` picks the
+ * entry). The zip's bytes must still hash to what the manifest recorded — a
+ * package rebuilt or edited since then is refused rather than silently used.
+ */
+export declare function resolvePackagedArtifact(file: string, browser?: string): {
+    artifactPath: string;
+    entry?: PackageEntry;
+};
+/**
+ * Browsers a zip was packaged for, from the packages manifest next to it. Chrome
+ * and Edge built from one directory are byte-identical, so one zip can be both.
+ */
+export declare function packagedBrowsersFor(artifactPath: string, sha256: string): PackageBrowser[];
+export interface RunPackageOptions {
+    /** Default build directory for every browser without its own. */
+    dir?: string;
+    dirs?: Partial<Record<PackageBrowser, string>>;
+    browsers: PackageBrowser[];
+    outDir: string;
+    exclude?: string[];
+    geckoId?: string;
+    fixWar?: boolean;
+    json?: boolean;
+    cliVersion: string;
+    cwd?: string;
+}
+export declare function parsePackageBrowsers(value: string | undefined): PackageBrowser[];
+export declare function runPackage(options: RunPackageOptions): PackagesManifest;
+export {};
+//# sourceMappingURL=package.d.ts.map

package/dist/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../src/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,eAAO,MAAM,gBAAgB,wCAAyC,CAAA;AACtE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,qGAAqG;AACrG,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D,eAAO,MAAM,gCAAgC,IAAI,CAAA;AAqBjD,MAAM,WAAW,WAAW;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,CAAA;CACjB;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CA0BzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD;AAID,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACzE,cAAc,CAmChB;AAID,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAQ/B;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,CA4B3D;AAED,MAAM,WAAW,WAAW;IAC3B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CA0C7F;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAMlE;AAeD,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,IAAI,CAAA;IACd,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAmG9F;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAS9F;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAYjF;AAID,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,cAAc,CAAA;IACvB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,OAAO,gCAAgC,CAAA;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAG5E;AAID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACd;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,CAyBhD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAS1F;AAID,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,EAAE,CAUhF;AAWD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA4DvE"}

package/dist/package.js

@@ -0,0 +1,500 @@
+/**
+ * `extenshi package <dir> --browser chrome,edge,firefox` — one reproducible
+ * store package per browser from an unpacked build directory.
+ *
+ * REPRODUCIBLE means byte-identical for the same files on any machine, in any
+ * timezone, under any umask: Dojo release readiness binds every piece of
+ * evidence (tests, scan, installed smoke) to the package's SHA-256, so a CI
+ * build and a local build of one commit must agree to the byte. The archive is
+ * written by the SAME writer Dojo uses (`zip.ts`, a byte-identical copy of
+ * dojo/src/lib/tools/zip.ts) with the same choices as Dojo's extension archive:
+ *   - entries sorted by path, manifest.json at the root, no directory entries;
+ *   - every entry stamped 2000-01-01 00:00:00 (DOS fields carry no timezone, so
+ *     the constant is built from LOCAL components — see REPRODUCIBLE_MTIME);
+ *   - STORE (no compression): deflate output depends on the zlib build, which
+ *     differs between Node releases, and reproducibility across machines is the
+ *     point. Store uploads accept uncompressed archives;
+ *   - "version made by" MS-DOS with zero external attributes, so no Unix mode
+ *     bits, owners or extra fields — nothing machine-specific survives.
+ *
+ * The user's source directory is never modified. `--fix-war` and `--gecko-id`
+ * rewrite manifest.json in the PACKAGED copy only, and every rewrite is listed
+ * in the output (`changes`).
+ */
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { hashMetadata } from '@extenshi/contracts';
+import { InvalidInputError } from './expected-error.js';
+import { isPlaceholderGeckoId, isValidGeckoId, PLACEHOLDER_GECKO_ID, projectGeckoId } from './gecko-id.js';
+import { ZipBuilder } from './zip.js';
+export const PACKAGE_BROWSERS = ['chrome', 'edge', 'firefox'];
+/** Written next to the zips; `release prepare`, `test smoke`, `evidence ingest` read it directly. */
+export const PACKAGES_MANIFEST_FILE = 'extenshi-packages.json';
+export const PACKAGES_MANIFEST_SCHEMA_VERSION = 1;
+/**
+ * Same stamp as Dojo's extension archive (dojo/src/lib/tools/extension-zip.ts):
+ * 2000-01-01 00:00:00 LOCAL. A UTC instant would render as different DOS fields
+ * per timezone; local components always render as the same fields. 2000 rather
+ * than the DOS epoch because local midnight 1980-01-01 in a positive-offset zone
+ * falls below the earliest representable date.
+ *
+ * Built per archive rather than once at module load: the writer renders it with
+ * the CURRENT zone, so a value captured under another TZ (a test, a process that
+ * changes process.env.TZ) would no longer be local midnight — and no longer the
+ * same bytes.
+ */
+const reproducibleMtime = () => new Date(2000, 0, 1, 0, 0, 0, 0);
+/** Classic ZIP (no ZIP64) limits. */
+const MAX_ENTRIES = 0xffff;
+const MAX_TOTAL_BYTES = 1024 * 1024 * 1024;
+/** Never part of a store package, whatever the build directory holds. */
+const ALWAYS_SKIPPED_DIRS = new Set(['node_modules']);
+// ── Globs ───────────────────────────────────────────────────────────────────
+const escapeRe = (s) => s.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+/**
+ * `--exclude` pattern → matcher, gitignore-style: `*` stays inside one path
+ * segment, `**` crosses segments, a pattern without `/` matches a basename at any
+ * depth, a pattern with `/` is anchored at the package root, and a pattern naming
+ * a directory excludes everything under it.
+ */
+export function excludeMatcher(patterns) {
+    const compiled = patterns
+        .flatMap((p) => p.split(','))
+        // `dir/**` is `dir`: the suffix below already covers everything under a match.
+        .map((p) => p
+        .trim()
+        .replace(/^\.\//, '')
+        .replace(/\/+$/, '')
+        .replace(/\/\*\*$/, ''))
+        .filter(Boolean)
+        .map((pattern) => {
+        const source = pattern
+            .split('**')
+            .map((part) => part
+            .split('*')
+            .map((chunk) => escapeRe(chunk).replace(/\?/g, '[^/]'))
+            .join('[^/]*'))
+            .join('.*');
+        const anchored = pattern.includes('/');
+        return anchored ? new RegExp(`^${source}(?:/.*)?$`) : new RegExp(`(?:^|/)${source}(?:/.*)?$`);
+    });
+    return (relative) => compiled.some((re) => re.test(relative));
+}
+/**
+ * A `web_accessible_resources` entry as the BROWSER matches it: `*` matches any
+ * run of characters INCLUDING `/` (Chromium's MatchPattern and Firefox's
+ * MatchGlob both work this way), `?` one character. Leading `/` is ignored.
+ */
+export function warGlobToRegExp(glob) {
+    const body = glob
+        .replace(/^\/+/, '')
+        .split('*')
+        .map((chunk) => escapeRe(chunk).replace(/\?/g, '.'))
+        .join('.*');
+    return new RegExp(`^${body}$`);
+}
+/**
+ * Read every file under `root`, sorted, skipping dot-entries (`.git`, `.github`,
+ * `.extenshi`, `.DS_Store`, …), `node_modules` and `skipDirs` (the output
+ * directory when it sits inside the source). Symlinks are refused: following one
+ * would pack bytes from outside the directory, and a link itself is not
+ * something every store unpacks the same way.
+ */
+export function collectFiles(root, options = {}) {
+    const stat = fs.statSync(root, { throwIfNoEntry: false });
+    if (!stat?.isDirectory())
+        throw new InvalidInputError(`Build directory not found: ${root}`);
+    const excluded = excludeMatcher(options.exclude ?? []);
+    const skip = new Set((options.skipDirs ?? []).map((dir) => path.resolve(dir)));
+    const files = [];
+    const left = [];
+    let total = 0;
+    const walk = (dir, prefix) => {
+        const entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : 1));
+        for (const entry of entries) {
+            if (entry.name.startsWith('.') || ALWAYS_SKIPPED_DIRS.has(entry.name))
+                continue;
+            const full = path.join(dir, entry.name);
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (skip.has(path.resolve(full)))
+                continue;
+            if (excluded(relative)) {
+                left.push(relative);
+                continue;
+            }
+            if (entry.isSymbolicLink())
+                throw new InvalidInputError(`${relative} is a symbolic link. Packages contain files only — copy the target in, or exclude it.`);
+            if (entry.isDirectory())
+                walk(full, relative);
+            else if (entry.isFile()) {
+                const bytes = fs.readFileSync(full);
+                total += bytes.byteLength;
+                if (total > MAX_TOTAL_BYTES)
+                    throw new InvalidInputError('The build directory exceeds 1 GiB.');
+                files.push({ path: relative, bytes: new Uint8Array(bytes) });
+            }
+        }
+    };
+    walk(root, '');
+    if (files.length > MAX_ENTRIES)
+        throw new InvalidInputError(`Too many files for a ZIP (${files.length}).`);
+    return { files, excluded: left.sort() };
+}
+const asObject = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+const asStrings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : typeof v === 'string' ? [v] : [];
+const normalizeRef = (p) => p.trim().replace(/^\.?\/+/, '');
+/**
+ * Every file the manifest names, which the browser loads or refuses to install
+ * without: background, pages, content scripts, icons, locale, rulesets.
+ * `web_accessible_resources` is not here — its entries are patterns, handled by
+ * the WAR check.
+ */
+export function manifestReferences(manifest) {
+    const refs = [];
+    const bg = asObject(manifest.background);
+    refs.push(...asStrings(bg?.service_worker), ...asStrings(bg?.scripts), ...asStrings(bg?.page));
+    for (const key of ['action', 'browser_action', 'page_action']) {
+        const action = asObject(manifest[key]);
+        refs.push(...asStrings(action?.default_popup));
+        const icon = action?.default_icon;
+        refs.push(...(typeof icon === 'string' ? [icon] : Object.values(asObject(icon) ?? {}).flatMap(asStrings)));
+    }
+    refs.push(...asStrings(manifest.options_page), ...asStrings(asObject(manifest.options_ui)?.page));
+    refs.push(...asStrings(asObject(manifest.side_panel)?.default_path));
+    const sidebar = asObject(manifest.sidebar_action);
+    refs.push(...asStrings(sidebar?.default_panel));
+    refs.push(...asStrings(manifest.devtools_page));
+    refs.push(...Object.values(asObject(manifest.chrome_url_overrides) ?? {}).flatMap(asStrings));
+    for (const cs of Array.isArray(manifest.content_scripts) ? manifest.content_scripts : [])
+        refs.push(...asStrings(asObject(cs)?.js), ...asStrings(asObject(cs)?.css));
+    refs.push(...Object.values(asObject(manifest.icons) ?? {}).flatMap(asStrings));
+    if (typeof manifest.default_locale === 'string')
+        refs.push(`_locales/${manifest.default_locale}/messages.json`);
+    const dnr = asObject(manifest.declarative_net_request);
+    for (const rule of Array.isArray(dnr?.rule_resources) ? dnr.rule_resources : [])
+        refs.push(...asStrings(asObject(rule)?.path));
+    refs.push(...asStrings(asObject(manifest.sandbox)?.pages));
+    return [
+        ...new Set(refs.map(normalizeRef).filter((p) => p && !/^[a-z]+:/i.test(p) && !p.startsWith('__MSG_'))),
+    ].sort();
+}
+export function warWildcards(manifest) {
+    const war = Array.isArray(manifest.web_accessible_resources) ? manifest.web_accessible_resources : [];
+    const out = [];
+    war.forEach((item, entry) => {
+        // MV2: plain strings. MV3: { resources: [...], matches|extension_ids }.
+        const patterns = typeof item === 'string' ? [item] : asStrings(asObject(item)?.resources);
+        for (const pattern of patterns)
+            if (pattern.includes('*'))
+                out.push({ entry, pattern });
+    });
+    return out;
+}
+/**
+ * Replace every wildcard in `web_accessible_resources` with the explicit list of
+ * packaged files it matches (as the browser would match it). Exact entries stay.
+ * manifest.json itself is never exposed. Returns human-readable change notes.
+ */
+export function expandWarWildcards(manifest, packagedPaths) {
+    const changes = [];
+    const candidates = packagedPaths.filter((p) => p !== 'manifest.json');
+    const expand = (patterns) => {
+        const out = new Set();
+        for (const pattern of patterns) {
+            if (!pattern.includes('*')) {
+                out.add(pattern);
+                continue;
+            }
+            const re = warGlobToRegExp(pattern);
+            const matched = candidates.filter((p) => re.test(p));
+            changes.push(matched.length
+                ? `web_accessible_resources: "${pattern}" → ${matched.length} explicit file${matched.length === 1 ? '' : 's'}`
+                : `web_accessible_resources: "${pattern}" matched no packaged file and was removed`);
+            for (const p of matched)
+                out.add(p);
+        }
+        return [...out].sort();
+    };
+    const war = manifest.web_accessible_resources;
+    if (!Array.isArray(war))
+        return changes;
+    if (war.every((item) => typeof item === 'string')) {
+        manifest.web_accessible_resources = expand(war);
+        return changes;
+    }
+    manifest.web_accessible_resources = war
+        .map((item) => {
+        const obj = asObject(item);
+        if (!obj || !Array.isArray(obj.resources))
+            return item;
+        return { ...obj, resources: expand(asStrings(obj.resources)) };
+    })
+        .filter((item) => !(asObject(item) &&
+        Array.isArray(asObject(item)?.resources) &&
+        asObject(item)?.resources.length === 0));
+    return changes;
+}
+/** `browser_specific_settings.gecko.id`, or the MV2 `applications.gecko.id` spelling. */
+export function manifestGeckoId(manifest) {
+    for (const key of ['browser_specific_settings', 'applications']) {
+        const id = asObject(asObject(manifest[key])?.gecko)?.id;
+        if (typeof id === 'string' && id.trim())
+            return id.trim();
+    }
+    return undefined;
+}
+function geckoIdHelp(projectId) {
+    const example = projectId ? projectGeckoId(projectId) : '{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}';
+    return (`Set browser_specific_settings.gecko.id in manifest.json (email-style "name@yourdomain" or a GUID like "${example}"), ` +
+        `or pass --gecko-id <id> to write it into the packaged copy. AMO makes the ID permanent at the first upload, so pick it once.` +
+        (projectId
+            ? ` The bound Dojo project's default is ${example} (the ID Dojo's scaffold writes) — pass --gecko-id "${example}" to use it.`
+            : ''));
+}
+export function packExtension(source, options) {
+    const byPath = new Map(source.map((f) => [f.path, f]));
+    const seen = new Map();
+    for (const f of source) {
+        const folded = f.path.toLowerCase();
+        const other = seen.get(folded);
+        // Case-only twins unpack as ONE file on macOS/Windows, so which one the store
+        // or a reviewer sees would depend on their machine.
+        if (other)
+            throw new InvalidInputError(`${other} and ${f.path} differ only in letter case.`);
+        seen.set(folded, f.path);
+    }
+    const manifestFile = byPath.get('manifest.json');
+    if (!manifestFile)
+        throw new InvalidInputError('No manifest.json at the root of the build directory — point at the unpacked build.');
+    let manifest;
+    try {
+        manifest = JSON.parse(new TextDecoder().decode(manifestFile.bytes).replace(/^/, ''));
+    }
+    catch (error) {
+        throw new InvalidInputError(`manifest.json is not valid JSON: ${error.message}`);
+    }
+    if (!asObject(manifest))
+        throw new InvalidInputError('manifest.json must be a JSON object.');
+    const missing = manifestReferences(manifest).filter((ref) => !byPath.has(ref));
+    if (missing.length)
+        throw new InvalidInputError(`manifest.json names file${missing.length === 1 ? '' : 's'} the package does not contain: ${missing.join(', ')}. ` +
+            'Browsers refuse to load such a package. Add the files, or check --exclude.');
+    const changes = [];
+    const warnings = [];
+    const wildcards = warWildcards(manifest);
+    if (wildcards.length && options.fixWar) {
+        changes.push(...expandWarWildcards(manifest, source.map((f) => f.path)));
+    }
+    else if (wildcards.length) {
+        warnings.push(`web_accessible_resources uses wildcard${wildcards.length === 1 ? '' : 's'} (${wildcards.map((w) => `"${w.pattern}"`).join(', ')}) — ` +
+            'every matching file becomes readable by web pages, and reviewers ask why. Pass --fix-war to list the files explicitly in the packaged copy.');
+    }
+    if (options.browser === 'firefox') {
+        const existing = manifestGeckoId(manifest);
+        if (options.geckoId !== undefined) {
+            const id = options.geckoId.trim();
+            if (!isValidGeckoId(id) || isPlaceholderGeckoId(id))
+                throw new InvalidInputError(`--gecko-id "${id}" is ${isValidGeckoId(id) ? 'a placeholder' : 'not a valid add-on ID'}. ${geckoIdHelp(options.projectId)}`);
+            if (id !== existing) {
+                const settings = asObject(manifest.browser_specific_settings) ?? {};
+                manifest.browser_specific_settings = {
+                    ...settings,
+                    gecko: { ...(asObject(settings.gecko) ?? {}), id },
+                };
+                changes.push(`browser_specific_settings.gecko.id set to ${id}${existing ? ` (was ${existing})` : ''}`);
+            }
+        }
+        else if (!existing) {
+            throw new InvalidInputError(`The Firefox package has no add-on ID. ${geckoIdHelp(options.projectId)}`);
+        }
+        else if (isPlaceholderGeckoId(existing) || !isValidGeckoId(existing)) {
+            throw new InvalidInputError(`The Firefox add-on ID "${existing}" is ${existing === PLACEHOLDER_GECKO_ID || isPlaceholderGeckoId(existing) ? 'a placeholder' : 'not a valid add-on ID'} — an AMO upload would own it forever. ${geckoIdHelp(options.projectId)}`);
+        }
+        const bg = asObject(manifest.background);
+        if (manifest.manifest_version === 3 && bg?.service_worker && !bg.scripts && !bg.page)
+            throw new InvalidInputError('Firefox does not run MV3 background service workers and refuses this manifest ("background.service_worker is currently disabled"). ' +
+                'Add "scripts": ["<your background file>"] next to service_worker in the Firefox build — Chromium ignores it.');
+    }
+    const files = changes.length
+        ? source.map((f) => f.path === 'manifest.json'
+            ? { path: f.path, bytes: new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\n`) }
+            : f)
+        : [...source];
+    files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const zip = new ZipBuilder({ mtime: reproducibleMtime() });
+    for (const f of files)
+        zip.addFile(f.path, f.bytes);
+    const bytes = zip.toBytes();
+    return {
+        browser: options.browser,
+        bytes,
+        sha256: createHash('sha256').update(bytes).digest('hex'),
+        entries: files.map((f) => f.path),
+        manifest,
+        changes,
+        warnings,
+    };
+}
+/** `dyslexia-font-reading-ruler-chrome-0.1.0.zip`: browser in the name so the wrong upload is hard. */
+export function packageFileName(name, browser, version) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 60) || 'extension';
+    const safeVersion = version.replace(/[^0-9A-Za-z.-]/g, '') || '0.0.0';
+    return `${slug}-${browser}-${safeVersion}.zip`;
+}
+/** Resolve `__MSG_key__` against the default locale, for the file name only. */
+export function displayName(manifest, files) {
+    const raw = typeof manifest.name === 'string' ? manifest.name : '';
+    const token = /^__MSG_(\w+)__$/.exec(raw)?.[1];
+    if (!token || typeof manifest.default_locale !== 'string')
+        return raw;
+    const file = files.find((f) => f.path === `_locales/${manifest.default_locale}/messages.json`);
+    try {
+        const messages = JSON.parse(new TextDecoder().decode(file?.bytes).replace(/^/, ''));
+        const hit = Object.entries(messages).find(([key]) => key.toLowerCase() === token.toLowerCase())?.[1];
+        return typeof hit?.message === 'string' ? hit.message : raw;
+    }
+    catch {
+        return raw;
+    }
+}
+export function isPackagesManifest(value) {
+    const obj = asObject(value);
+    return obj?.schemaVersion === PACKAGES_MANIFEST_SCHEMA_VERSION && Array.isArray(obj.packages);
+}
+const sha256File = (file) => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+/**
+ * `<artifact>` for `release prepare`, `test smoke` and `evidence ingest`: a zip,
+ * or the packages manifest `extenshi package` wrote (then `browser` picks the
+ * entry). The zip's bytes must still hash to what the manifest recorded — a
+ * package rebuilt or edited since then is refused rather than silently used.
+ */
+export function resolvePackagedArtifact(file, browser) {
+    if (!file.toLowerCase().endsWith('.json'))
+        return { artifactPath: file };
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new InvalidInputError(`Could not read ${file}: ${error.message}`);
+    }
+    if (!isPackagesManifest(parsed))
+        throw new InvalidInputError(`${file} is not an ${PACKAGES_MANIFEST_FILE} written by extenshi package.`);
+    const matches = browser ? parsed.packages.filter((p) => p.browser === browser) : parsed.packages;
+    if (matches.length !== 1)
+        throw new InvalidInputError(browser
+            ? `${file} has no ${browser} package (it lists: ${parsed.packages.map((p) => p.browser).join(', ') || 'none'}).`
+            : `${file} lists ${parsed.packages.length} packages — pass --browser to pick one.`);
+    const entry = matches[0];
+    const artifactPath = path.resolve(path.dirname(file), entry.file);
+    if (!fs.existsSync(artifactPath))
+        throw new InvalidInputError(`Package not found: ${artifactPath}`);
+    if (sha256File(artifactPath) !== entry.sha256)
+        throw new InvalidInputError(`${entry.file} no longer matches the sha256 in ${path.basename(file)} — it changed after extenshi package. Re-run extenshi package.`);
+    return { artifactPath, entry };
+}
+/**
+ * Browsers a zip was packaged for, from the packages manifest next to it. Chrome
+ * and Edge built from one directory are byte-identical, so one zip can be both.
+ */
+export function packagedBrowsersFor(artifactPath, sha256) {
+    const manifestPath = path.join(path.dirname(artifactPath), PACKAGES_MANIFEST_FILE);
+    try {
+        const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (!isPackagesManifest(parsed))
+            return [];
+        return parsed.packages.filter((p) => p.sha256 === sha256).map((p) => p.browser);
+    }
+    catch {
+        return [];
+    }
+}
+export function parsePackageBrowsers(value) {
+    const list = (value ?? 'chrome')
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean)
+        .map((s) => (s === 'chromium' ? 'chrome' : s));
+    const bad = list.filter((s) => !PACKAGE_BROWSERS.includes(s));
+    if (bad.length || !list.length)
+        throw new InvalidInputError(`--browser takes a comma-separated list of: ${PACKAGE_BROWSERS.join(', ')}`);
+    return [...new Set(list)];
+}
+function boundProjectId(cwd) {
+    try {
+        const binding = JSON.parse(fs.readFileSync(path.join(cwd, '.extenshi/project.json'), 'utf8'));
+        return typeof binding.projectId === 'string' ? binding.projectId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function runPackage(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const outDir = path.resolve(cwd, options.outDir);
+    const projectId = boundProjectId(cwd);
+    const results = [];
+    for (const browser of options.browsers) {
+        const dir = options.dirs?.[browser] ?? options.dir;
+        if (!dir)
+            throw new InvalidInputError(`No build directory for ${browser}: pass <dir> or --${browser}-dir <dir>.`);
+        const root = path.resolve(cwd, dir);
+        const { files } = collectFiles(root, { exclude: options.exclude, skipDirs: [outDir] });
+        const packed = packExtension(files, {
+            browser,
+            geckoId: options.geckoId,
+            fixWar: options.fixWar,
+            projectId,
+        });
+        const version = typeof packed.manifest.version === 'string' ? packed.manifest.version : '0.0.0';
+        const name = displayName(packed.manifest, files);
+        results.push({
+            bytes: packed.bytes,
+            entry: {
+                browser,
+                file: packageFileName(name || path.basename(root), browser, version),
+                sha256: packed.sha256,
+                bytes: packed.bytes.byteLength,
+                entries: packed.entries.length,
+                name,
+                version,
+                manifestDigest: hashMetadata(packed.manifest),
+                ...(browser === 'firefox' ? { geckoId: manifestGeckoId(packed.manifest) } : {}),
+                source: path.relative(cwd, root).split(path.sep).join('/') || '.',
+                changes: packed.changes,
+                warnings: packed.warnings,
+            },
+        });
+    }
+    fs.mkdirSync(outDir, { recursive: true });
+    for (const { entry, bytes } of results)
+        fs.writeFileSync(path.join(outDir, entry.file), bytes);
+    const manifest = {
+        schemaVersion: PACKAGES_MANIFEST_SCHEMA_VERSION,
+        tool: `extenshi-cli/${options.cliVersion}`,
+        packages: results.map((r) => r.entry),
+    };
+    fs.writeFileSync(path.join(outDir, PACKAGES_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}\n`);
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify({ ...manifest, outDir }, null, 2)}\n`);
+    }
+    else {
+        // sha256sum format, so `shasum -a 256 -c` can check the files later.
+        for (const { entry } of results)
+            process.stdout.write(`${entry.sha256}  ${path.join(outDir, entry.file)}\n`);
+        for (const { entry } of results) {
+            for (const change of entry.changes)
+                process.stderr.write(`${entry.browser}: changed in the package: ${change}\n`);
+            for (const warning of entry.warnings)
+                process.stderr.write(`${entry.browser}: warning: ${warning}\n`);
+        }
+        process.stderr.write(`Wrote ${path.join(outDir, PACKAGES_MANIFEST_FILE)}\n`);
+    }
+    return manifest;
+}
+//# sourceMappingURL=package.js.map