@extenshi/cli 0.21.0 → 0.22.0

package/dist/zip.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Minimal dependency-free ZIP writer (STORE method, no compression).
+ *
+ * Good enough for the /tools exports: PNG payloads are already compressed,
+ * and text members (manifest snippets, HTML) are tiny. Avoids pulling
+ * jszip into the dojo bundle — and a bundled dependency is not merely
+ * unnecessary here but actively risky, since dojo's image installs from a pruned
+ * workspace set where a package hoisted by another workspace resolves in dev and
+ * disappears in the build.
+ *
+ * Two writers used to exist in this app: this one and a second, near-identical
+ * one for extension archives. They are now one. What differs between the callers
+ * is the TIMESTAMP: an icon export wants "now", while an extension build has to
+ * be reproducible, so the same project state produces the same bytes. Hence
+ * `mtime` rather than a fork.
+ *
+ * (`lib/tools/icon-preview.ts` carries a third copy on purpose — it lives inside
+ * a string of standalone JavaScript served to the browser, so it cannot import.)
+ *
+ * SYNCED COPY: this file exists byte-identical at
+ *   dojo/src/lib/tools/zip.ts            (canonical — edit here)
+ *   tools/extenshi-cli/src/zip.ts        (`extenshi package`, published to npm)
+ * so the CLI and Dojo produce the same bytes for the same files instead of the
+ * platform growing a third writer. The CLI cannot import dojo, hence a copy;
+ * `tools/extenshi-cli/src/package-sync.test.ts` fails CI when the two drift. After
+ * editing, run: cp dojo/src/lib/tools/zip.ts tools/extenshi-cli/src/zip.ts
+ */
+export interface ZipBuilderOptions {
+    /**
+     * Modification stamp written into every entry. Omit for "now".
+     *
+     * Pass a constant when the archive has to be reproducible — and construct it
+     * from LOCAL components (`new Date(2000, 0, 1)`), because the DOS fields this
+     * format carries are local-time fields with no zone: a UTC instant would render
+     * differently on two machines and defeat the point.
+     */
+    mtime?: Date;
+}
+export declare class ZipBuilder {
+    private readonly options;
+    private entries;
+    private chunks;
+    private offset;
+    constructor(options?: ZipBuilderOptions);
+    addFile(name: string, content: Uint8Array | string): void;
+    toBlob(): Blob;
+    /**
+     * The finished archive as bytes.
+     *
+     * Separate from `toBlob` so the structure can be asserted in Node — a
+     * hand-written binary format wants tests that read it back, and a Blob is an
+     * awkward thing to parse.
+     */
+    toBytes(): Uint8Array;
+    private push;
+}
+//# sourceMappingURL=zip.d.ts.map

package/dist/zip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.d.ts","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAsCH,MAAM,WAAW,iBAAiB;IACjC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,IAAI,CAAA;CACZ;AAED,qBAAa,UAAU;IAKV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,MAAM,CAAI;gBAEW,OAAO,GAAE,iBAAsB;IAE5D,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAyBzD,MAAM,IAAI,IAAI;IAId;;;;;;OAMG;IACH,OAAO,IAAI,UAAU;IAwCrB,OAAO,CAAC,IAAI;CAIZ"}

package/dist/zip.js

@@ -0,0 +1,134 @@
+/**
+ * Minimal dependency-free ZIP writer (STORE method, no compression).
+ *
+ * Good enough for the /tools exports: PNG payloads are already compressed,
+ * and text members (manifest snippets, HTML) are tiny. Avoids pulling
+ * jszip into the dojo bundle — and a bundled dependency is not merely
+ * unnecessary here but actively risky, since dojo's image installs from a pruned
+ * workspace set where a package hoisted by another workspace resolves in dev and
+ * disappears in the build.
+ *
+ * Two writers used to exist in this app: this one and a second, near-identical
+ * one for extension archives. They are now one. What differs between the callers
+ * is the TIMESTAMP: an icon export wants "now", while an extension build has to
+ * be reproducible, so the same project state produces the same bytes. Hence
+ * `mtime` rather than a fork.
+ *
+ * (`lib/tools/icon-preview.ts` carries a third copy on purpose — it lives inside
+ * a string of standalone JavaScript served to the browser, so it cannot import.)
+ *
+ * SYNCED COPY: this file exists byte-identical at
+ *   dojo/src/lib/tools/zip.ts            (canonical — edit here)
+ *   tools/extenshi-cli/src/zip.ts        (`extenshi package`, published to npm)
+ * so the CLI and Dojo produce the same bytes for the same files instead of the
+ * platform growing a third writer. The CLI cannot import dojo, hence a copy;
+ * `tools/extenshi-cli/src/package-sync.test.ts` fails CI when the two drift. After
+ * editing, run: cp dojo/src/lib/tools/zip.ts tools/extenshi-cli/src/zip.ts
+ */
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++) {
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        }
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+function crc32(data) {
+    let crc = 0xffffffff;
+    for (let i = 0; i < data.length; i++) {
+        crc = CRC_TABLE[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function dosDateTime(d) {
+    return {
+        dosTime: (d.getHours() << 11) | (d.getMinutes() << 5) | Math.floor(d.getSeconds() / 2),
+        dosDate: ((d.getFullYear() - 1980) << 9) | ((d.getMonth() + 1) << 5) | d.getDate(),
+    };
+}
+export class ZipBuilder {
+    options;
+    entries = [];
+    chunks = [];
+    offset = 0;
+    constructor(options = {}) {
+        this.options = options;
+    }
+    addFile(name, content) {
+        const data = typeof content === 'string' ? new TextEncoder().encode(content) : content;
+        const nameBytes = new TextEncoder().encode(name);
+        const crc = crc32(data);
+        const { dosTime, dosDate } = dosDateTime(this.options.mtime ?? new Date());
+        const header = new DataView(new ArrayBuffer(30));
+        header.setUint32(0, 0x04034b50, true); // local file header signature
+        header.setUint16(4, 20, true); // version needed
+        header.setUint16(6, 0x0800, true); // UTF-8 names
+        header.setUint16(8, 0, true); // method: store
+        header.setUint16(10, dosTime, true);
+        header.setUint16(12, dosDate, true);
+        header.setUint32(14, crc, true);
+        header.setUint32(18, data.length, true);
+        header.setUint32(22, data.length, true);
+        header.setUint16(26, nameBytes.length, true);
+        header.setUint16(28, 0, true);
+        this.entries.push({ name, data, crc, offset: this.offset, dosTime, dosDate });
+        this.push(new Uint8Array(header.buffer));
+        this.push(nameBytes);
+        this.push(data);
+    }
+    toBlob() {
+        return new Blob([this.toBytes()], { type: 'application/zip' });
+    }
+    /**
+     * The finished archive as bytes.
+     *
+     * Separate from `toBlob` so the structure can be asserted in Node — a
+     * hand-written binary format wants tests that read it back, and a Blob is an
+     * awkward thing to parse.
+     */
+    toBytes() {
+        const centralChunks = [];
+        let centralSize = 0;
+        for (const e of this.entries) {
+            const nameBytes = new TextEncoder().encode(e.name);
+            const rec = new DataView(new ArrayBuffer(46));
+            rec.setUint32(0, 0x02014b50, true); // central directory signature
+            rec.setUint16(4, 20, true); // version made by
+            rec.setUint16(6, 20, true); // version needed
+            rec.setUint16(8, 0x0800, true); // UTF-8 names
+            rec.setUint16(10, 0, true); // method: store
+            rec.setUint16(12, e.dosTime, true);
+            rec.setUint16(14, e.dosDate, true);
+            rec.setUint32(16, e.crc, true);
+            rec.setUint32(20, e.data.length, true);
+            rec.setUint32(24, e.data.length, true);
+            rec.setUint16(28, nameBytes.length, true);
+            rec.setUint32(42, e.offset, true);
+            centralChunks.push(new Uint8Array(rec.buffer), nameBytes);
+            centralSize += 46 + nameBytes.length;
+        }
+        const end = new DataView(new ArrayBuffer(22));
+        end.setUint32(0, 0x06054b50, true); // end of central directory signature
+        end.setUint16(8, this.entries.length, true);
+        end.setUint16(10, this.entries.length, true);
+        end.setUint32(12, centralSize, true);
+        end.setUint32(16, this.offset, true);
+        const parts = [...this.chunks, ...centralChunks, new Uint8Array(end.buffer)];
+        const total = parts.reduce((sum, part) => sum + part.length, 0);
+        const bytes = new Uint8Array(total);
+        let at = 0;
+        for (const part of parts) {
+            bytes.set(part, at);
+            at += part.length;
+        }
+        return bytes;
+    }
+    push(chunk) {
+        this.chunks.push(chunk);
+        this.offset += chunk.length;
+    }
+}
+//# sourceMappingURL=zip.js.map

package/dist/zip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip.js","sourceRoot":"","sources":["../src/zip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;IACvB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAA;QACT,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC,CAAC,EAAE,CAAA;AAEJ,SAAS,KAAK,CAAC,IAAgB;IAC9B,IAAI,GAAG,GAAG,UAAU,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,CAAO;IAC3B,OAAO;QACN,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;KAClF,CAAA;AACF,CAAC;AAcD,MAAM,OAAO,UAAU;IAKO;IAJrB,OAAO,GAAe,EAAE,CAAA;IACxB,MAAM,GAAiB,EAAE,CAAA;IACzB,MAAM,GAAG,CAAC,CAAA;IAElB,YAA6B,UAA6B,EAAE;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAEhE,OAAO,CAAC,IAAY,EAAE,OAA4B;QACjD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACtF,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QACvB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QAE1E,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA,CAAC,8BAA8B;QACpE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA,CAAC,iBAAiB;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA,CAAC,cAAc;QAChD,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA,CAAC,gBAAgB;QAC7C,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACnC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;QAC/B,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;QAE7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAED,MAAM;QACL,OAAO,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAc,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,OAAO;QACN,MAAM,aAAa,GAAiB,EAAE,CAAA;QACtC,IAAI,WAAW,GAAG,CAAC,CAAA;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAClD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA,CAAC,8BAA8B;YACjE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA,CAAC,kBAAkB;YAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA,CAAC,iBAAiB;YAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA,CAAC,cAAc;YAC7C,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA,CAAC,gBAAgB;YAC3C,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAClC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAClC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9B,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACtC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACtC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACzC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACjC,aAAa,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YACzD,WAAW,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,CAAA;QACrC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA,CAAC,qCAAqC;QACxE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3C,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC5C,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;QACpC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAEpC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,aAAa,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,EAAE,GAAG,CAAC,CAAA;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACnB,EAAE,IAAI,IAAI,CAAC,MAAM,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACb,CAAC;IAEO,IAAI,CAAC,KAAiB;QAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAA;IAC5B,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@extenshi/cli",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Pre-publish security scanner for browser extensions",
   "type": "module",
   "publishConfig": {
@@ -21,8 +21,9 @@
     "prepublishOnly": "yarn build"
   },
   "dependencies": {
-    "@extenshi/contracts": "^0.1.0",
-    "@extenshi/publisher": "^0.8.0",
+    "@extenshi/contracts": "^0.1.2",
+    "@extenshi/publisher": "^0.8.1",
+    "@resvg/resvg-wasm": "2.6.2",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "jszip": "^3.10.1",