@extenshi/cli 0.21.0 → 0.22.0

package/dist/icon.d.ts

@@ -32,6 +32,24 @@ export declare const sanitizeSvgSource: typeof scrubSvgMarkup;
 export declare function displayNameFromFile(filePath: string): string;
 /** Resolve the HTML destination: explicit --output wins, else auto-named in cwd. */
 export declare function resolvePreviewPath(output: string | undefined, iconPath: string): string;
+/** A validated icon/artwork source: sanitized SVG markup or signature-checked PNG bytes. */
+export interface IconSource {
+    resolved: string;
+    isSvg: boolean;
+    /** PNG bytes (raster sources only). */
+    png?: Buffer;
+    /** Scrubbed SVG markup (SVG sources only). */
+    svgSource?: string;
+    dataUrl: string;
+}
+/**
+ * Read and validate an .svg / .png source. Shared by `icon preview` and
+ * `icon store-assets` so both refuse the same files for the same reasons.
+ */
+export declare function readIconSource(iconPath: string, limits?: {
+    svgBytes: number;
+    pngBytes: number;
+}): IconSource;
 /**
  * Command body. Exported for unit tests (call with `open: false`).
  * Throws plain Errors — runCommand() in cli.ts turns them into exit-1 output.

package/dist/icon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"icon.d.ts","sourceRoot":"","sources":["../src/icon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAM/C,MAAM,WAAW,qBAAqB;IACrC,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oFAAoF;IACpF,IAAI,CAAC,EAAE,OAAO,CAAA;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAiB,CAAA;AAE/C,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvF;AAmBD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,qBAAqB,EAC3B,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAkDf"}
+{"version":3,"file":"icon.d.ts","sourceRoot":"","sources":["../src/icon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAM/C,MAAM,WAAW,qBAAqB;IACrC,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oFAAoF;IACpF,IAAI,CAAC,EAAE,OAAO,CAAA;CACd;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,uBAAiB,CAAA;AAE/C,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvF;AAmBD,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM;;;CAAuD,GAC3D,UAAU,CAqCZ;AAED;;;GAGG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,qBAAqB,EAC3B,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/icon.js

@@ -59,10 +59,10 @@ function openInBrowser(target) {
     }
 }
 /**
- * Command body. Exported for unit tests (call with `open: false`).
- * Throws plain Errors — runCommand() in cli.ts turns them into exit-1 output.
+ * Read and validate an .svg / .png source. Shared by `icon preview` and
+ * `icon store-assets` so both refuse the same files for the same reasons.
  */
-export async function runIconPreview(iconPath, opts, cliVersion) {
+export function readIconSource(iconPath, limits = { svgBytes: MAX_SVG_BYTES, pngBytes: MAX_PNG_BYTES }) {
     const resolved = path.resolve(process.cwd(), iconPath);
     if (!fs.existsSync(resolved)) {
         throw new Error(`Icon file not found: ${resolved}`);
@@ -72,34 +72,43 @@ export async function runIconPreview(iconPath, opts, cliVersion) {
         throw new Error(`Unsupported icon format "${ext || '(none)'}" — pass an .svg or .png file`);
     }
     const raw = fs.readFileSync(resolved);
-    let dataUrl;
-    let svgSource;
     if (ext === '.svg') {
-        if (raw.length > MAX_SVG_BYTES) {
-            throw new Error('SVG is larger than 512 KB — extension icons should be tiny');
+        if (raw.length > limits.svgBytes) {
+            throw new Error(`SVG is larger than ${Math.round(limits.svgBytes / 1024)} KB — extension icons should be tiny`);
         }
         const text = raw.toString('utf8');
         if (!text.includes('<svg')) {
             throw new Error('File does not contain an <svg> element');
         }
-        svgSource = sanitizeSvgSource(text);
-        dataUrl = `data:image/svg+xml;base64,${Buffer.from(svgSource, 'utf8').toString('base64')}`;
+        const svgSource = sanitizeSvgSource(text);
+        return {
+            resolved,
+            isSvg: true,
+            svgSource,
+            dataUrl: `data:image/svg+xml;base64,${Buffer.from(svgSource, 'utf8').toString('base64')}`,
+        };
     }
-    else {
-        if (raw.length > MAX_PNG_BYTES) {
-            throw new Error('PNG is larger than 2 MB — extension icons should be tiny');
-        }
-        if (!raw.subarray(0, 8).equals(PNG_SIGNATURE)) {
-            throw new Error('File does not look like a valid PNG (bad signature)');
-        }
-        dataUrl = `data:image/png;base64,${raw.toString('base64')}`;
+    if (raw.length > limits.pngBytes) {
+        throw new Error(`PNG is larger than ${Math.round(limits.pngBytes / 1024 / 1024)} MB — extension icons should be tiny`);
+    }
+    if (!raw.subarray(0, 8).equals(PNG_SIGNATURE)) {
+        throw new Error('File does not look like a valid PNG (bad signature)');
     }
+    return { resolved, isSvg: false, png: raw, dataUrl: `data:image/png;base64,${raw.toString('base64')}` };
+}
+/**
+ * Command body. Exported for unit tests (call with `open: false`).
+ * Throws plain Errors — runCommand() in cli.ts turns them into exit-1 output.
+ */
+export async function runIconPreview(iconPath, opts, cliVersion) {
+    const source = readIconSource(iconPath);
+    const resolved = source.resolved;
     const html = renderIconPreviewHtml({
         name: opts.name?.trim() || displayNameFromFile(resolved),
         fileName: path.basename(resolved),
-        dataUrl,
-        isSvg: ext === '.svg',
-        svgSource,
+        dataUrl: source.dataUrl,
+        isSvg: source.isSvg,
+        svgSource: source.svgSource,
         cliVersion,
         generatedAt: new Date(),
     });

package/dist/icon.js.map

@@ -1 +1 @@
-{"version":3,"file":"icon.js","sourceRoot":"","sources":["../src/icon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAA;AAChC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACrC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAWnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAE/C,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IAC7C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC1E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,MAA0B,EAAE,QAAgB;IAC9E,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;AAChE,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,MAAc;IACpC,IAAI,CAAC;QACJ,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACpB,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC7B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAiB,EAAE,IAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,8DAA8D;IAC/D,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,QAAgB,EAChB,IAA2B,EAC3B,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;IAChD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,IAAI,QAAQ,+BAA+B,CAAC,CAAA;IAC5F,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,OAAe,CAAA;IACnB,IAAI,SAA6B,CAAA;IACjC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC1D,CAAC;QACD,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACnC,OAAO,GAAG,6BAA6B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC3F,CAAC;SAAM,CAAC;QACP,IAAI,GAAG,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACvE,CAAC;QACD,OAAO,GAAG,yBAAyB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,QAAQ,CAAC;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjC,OAAO;QACP,KAAK,EAAE,GAAG,KAAK,MAAM;QACrB,SAAS;QACT,UAAU;QACV,WAAW,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAA;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC1D,aAAa,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACF,CAAC"}
+{"version":3,"file":"icon.js","sourceRoot":"","sources":["../src/icon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAA;AAChC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACrC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAWnF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAA;AAE/C,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAA;IAC7C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC1E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,MAA0B,EAAE,QAAgB;IAC9E,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;AAChE,CAAC;AAED,iEAAiE;AACjE,SAAS,aAAa,CAAC,MAAc;IACpC,IAAI,CAAC;QACJ,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACpB,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC5B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC7B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAiB,EAAE,IAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC7F,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACR,8DAA8D;IAC/D,CAAC;AACF,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC7B,QAAgB,EAChB,MAAM,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE;IAE7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAA;IACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;IAChD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,IAAI,QAAQ,+BAA+B,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,sCAAsC,CAC9F,CAAA;QACF,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO;YACN,QAAQ;YACR,KAAK,EAAE,IAAI;YACX,SAAS;YACT,OAAO,EAAE,6BAA6B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;SACzF,CAAA;IACF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACd,sBAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC,sCAAsC,CACrG,CAAA;IACF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAA;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,QAAgB,EAChB,IAA2B,EAC3B,UAAkB;IAElB,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAEhC,MAAM,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,QAAQ,CAAC;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,WAAW,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAA;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC1D,aAAa,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACF,CAAC"}

package/dist/media.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `extenshi media upload <file…> --project <id>` — put a logo or screenshot in
+ * the project's PUBLIC media store and print its stable URL.
+ *
+ * Same store and same BFF procedure (`agentUploadProjectMedia`, hosted.write)
+ * as the MCP `upload_project_media` tool; the URLs are what `page publish`
+ * (and MCP `publish_landing_page`) accept for hosted screenshots and logos —
+ * `page publish --upload-local` calls this for every local screenshot path.
+ *
+ * Client-side, before a byte leaves the machine:
+ *   - secret-looking file names are refused (same list as evidence attachments);
+ *   - the content is sniffed — PNG/JPEG/WebP go as-is, anything else is refused;
+ *   - an SVG is rasterized locally to PNG with the store-asset renderer (the
+ *     public store never serves SVG, so there is no SVG script surface at all).
+ * The BFF then re-checks everything, strips metadata and applies the quota.
+ */
+export declare const MEDIA_MAX_BYTES: number;
+export type MediaMime = 'image/png' | 'image/jpeg' | 'image/webp';
+export declare function sniffMediaMime(bytes: Uint8Array): MediaMime | null;
+export interface PreparedMedia {
+    file: string;
+    mime: MediaMime;
+    bytes: Buffer;
+    /** Set when an SVG was rasterized locally. */
+    rasterizedFrom?: 'svg';
+}
+/** Validate a local file and turn it into upload bytes. Exported for tests. */
+export declare function prepareMediaFile(file: string, svgWidth?: number): Promise<PreparedMedia>;
+export interface MediaUploadResult {
+    file: string;
+    url: string;
+    [key: string]: unknown;
+}
+/** Upload one prepared file. Shared by `media upload` and `page publish --upload-local`. */
+export declare function uploadMediaFile(projectId: string, file: string, opts?: {
+    svgWidth?: number;
+}): Promise<MediaUploadResult>;
+export declare function runMediaUpload(files: string[], opts: {
+    project: string;
+    svgWidth?: string;
+}): Promise<MediaUploadResult[]>;
+//# sourceMappingURL=media.d.ts.map

package/dist/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../src/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,eAAO,MAAM,eAAe,QAAkB,CAAA;AAE9C,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,CAAA;AAEjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI,CAWlE;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,cAAc,CAAC,EAAE,KAAK,CAAA;CACtB;AAED,+EAA+E;AAC/E,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA8B9F;AAID,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACtB;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAW5B;AAED,wBAAsB,cAAc,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAsB9B"}

package/dist/media.js

@@ -0,0 +1,96 @@
+/**
+ * `extenshi media upload <file…> --project <id>` — put a logo or screenshot in
+ * the project's PUBLIC media store and print its stable URL.
+ *
+ * Same store and same BFF procedure (`agentUploadProjectMedia`, hosted.write)
+ * as the MCP `upload_project_media` tool; the URLs are what `page publish`
+ * (and MCP `publish_landing_page`) accept for hosted screenshots and logos —
+ * `page publish --upload-local` calls this for every local screenshot path.
+ *
+ * Client-side, before a byte leaves the machine:
+ *   - secret-looking file names are refused (same list as evidence attachments);
+ *   - the content is sniffed — PNG/JPEG/WebP go as-is, anything else is refused;
+ *   - an SVG is rasterized locally to PNG with the store-asset renderer (the
+ *     public store never serves SVG, so there is no SVG script surface at all).
+ * The BFF then re-checks everything, strips metadata and applies the quota.
+ */
+import { readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+import { loadConfig } from './config.js';
+import { assertNotSecretLike } from './evidence-attachments.js';
+import { InvalidInputError } from './expected-error.js';
+import { readIconSource } from './icon.js';
+import { projectRequest } from './project.js';
+import { renderSvg, sourceInfo } from './store-assets.js';
+export const MEDIA_MAX_BYTES = 2 * 1024 * 1024;
+export function sniffMediaMime(bytes) {
+    const b = bytes;
+    if (b.length >= 8 && b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47)
+        return 'image/png';
+    if (b.length >= 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'image/jpeg';
+    if (b.length >= 12 &&
+        String.fromCharCode(b[0], b[1], b[2], b[3]) === 'RIFF' &&
+        String.fromCharCode(b[8], b[9], b[10], b[11]) === 'WEBP')
+        return 'image/webp';
+    return null;
+}
+/** Validate a local file and turn it into upload bytes. Exported for tests. */
+export async function prepareMediaFile(file, svgWidth) {
+    assertNotSecretLike(file);
+    const resolved = path.resolve(process.cwd(), file);
+    const info = await stat(resolved).catch(() => null);
+    if (!info?.isFile())
+        throw new InvalidInputError(`File not found: ${file}`);
+    if (info.size > MEDIA_MAX_BYTES && !/\.svg$/i.test(file))
+        throw new InvalidInputError(`"${file}" is ${(info.size / 1024 / 1024).toFixed(1)} MB; the limit is 2 MB per image. Re-export it smaller.`);
+    const bytes = await readFile(resolved);
+    const mime = sniffMediaMime(bytes);
+    if (mime)
+        return { file, mime, bytes };
+    if (/\.svg$/i.test(file)) {
+        // readIconSource scrubs scripts/handlers; the output is a plain PNG.
+        const source = readIconSource(resolved, { svgBytes: MEDIA_MAX_BYTES, pngBytes: MEDIA_MAX_BYTES });
+        const { width, height } = await sourceInfo(source);
+        if (!width || !height)
+            throw new InvalidInputError(`"${file}" has no size (set width/height or a viewBox)`);
+        const target = Math.min(4096, Math.max(16, Math.round(svgWidth || 1024)));
+        const raster = await renderSvg(source.svgSource, target);
+        const png = Buffer.from(raster.png);
+        if (png.length > MEDIA_MAX_BYTES)
+            throw new InvalidInputError(`"${file}" rasterized to ${target}px is over 2 MB — pass a smaller --svg-width`);
+        return { file, mime: 'image/png', bytes: png, rasterizedFrom: 'svg' };
+    }
+    throw new InvalidInputError(`"${file}" is not a PNG, JPEG or WebP image (checked by content, not by name); .svg files are rasterized to PNG.`);
+}
+const projectIdSchema = z.string().uuid({ message: '--project must be a project UUID' });
+/** Upload one prepared file. Shared by `media upload` and `page publish --upload-local`. */
+export async function uploadMediaFile(projectId, file, opts = {}) {
+    const prepared = await prepareMediaFile(file, opts.svgWidth);
+    const result = (await projectRequest(await loadConfig(), 'agentUploadProjectMedia', { projectId, mime: prepared.mime, dataBase64: prepared.bytes.toString('base64') }, true));
+    if (typeof result.url !== 'string' || !/^https:\/\//.test(result.url))
+        throw new Error('The server did not return an https URL for the upload');
+    return { file, ...result, url: result.url, ...(prepared.rasterizedFrom ? { rasterizedFrom: 'svg' } : {}) };
+}
+export async function runMediaUpload(files, opts) {
+    const projectId = projectIdSchema.safeParse(opts.project);
+    if (!projectId.success)
+        throw new InvalidInputError(projectId.error.issues[0]?.message ?? 'Invalid --project');
+    const svgWidth = opts.svgWidth ? Number(opts.svgWidth) : undefined;
+    if (svgWidth !== undefined && !(Number.isInteger(svgWidth) && svgWidth >= 16 && svgWidth <= 4096))
+        throw new InvalidInputError('--svg-width must be an integer between 16 and 4096');
+    // Validate every file before uploading any, so a typo does not leave half a batch public.
+    for (const file of files)
+        await prepareMediaFile(file, svgWidth);
+    const results = [];
+    for (const file of files) {
+        const result = await uploadMediaFile(projectId.data, file, { svgWidth });
+        results.push(result);
+        process.stderr.write(`${file} → ${result.url}${result.deduplicated ? ' (already stored)' : ''}${result.rasterizedFrom ? ' (SVG rasterized to PNG)' : ''}\n`);
+    }
+    console.log(JSON.stringify(results, null, 2));
+    process.stderr.write('These URLs are public. Use them as screenshots[].url or logoUrl in landing.json, then extenshi page publish.\n');
+    return results;
+}
+//# sourceMappingURL=media.js.map

package/dist/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../src/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAI9C,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC/C,MAAM,CAAC,GAAG,KAAK,CAAA;IACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,WAAW,CAAA;IACzG,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,YAAY,CAAA;IACzF,IACC,CAAC,CAAC,MAAM,IAAI,EAAE;QACd,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QACtD,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAExD,OAAO,YAAY,CAAA;IACpB,OAAO,IAAI,CAAA;AACZ,CAAC;AAUD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAiB;IACrE,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;QAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAA;IAC3E,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QACvD,MAAM,IAAI,iBAAiB,CAC1B,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yDAAyD,CAC7G,CAAA;IACF,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACtC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,qEAAqE;QACrE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAA;QACjG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YACpB,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,+CAA+C,CAAC,CAAA;QACrF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAmB,EAAE,MAAM,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe;YAC/B,MAAM,IAAI,iBAAiB,CAC1B,IAAI,IAAI,mBAAmB,MAAM,8CAA8C,CAC/E,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;IACtE,CAAC;IACD,MAAM,IAAI,iBAAiB,CAC1B,IAAI,IAAI,yGAAyG,CACjH,CAAA;AACF,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAA;AAQxF,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,SAAiB,EACjB,IAAY,EACZ,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CACnC,MAAM,UAAU,EAAE,EAClB,yBAAyB,EACzB,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EACjF,IAAI,CACJ,CAA4B,CAAA;IAC7B,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IACzE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAAe,EACf,IAA4C;IAE5C,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,CAAC,OAAO;QACrB,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,EAAE,IAAI,QAAQ,IAAI,IAAI,CAAC;QAChG,MAAM,IAAI,iBAAiB,CAAC,oDAAoD,CAAC,CAAA;IAClF,0FAA0F;IAC1F,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,MAAM,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,IAAI,CACtI,CAAA;IACF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,gHAAgH,CAChH,CAAA;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/package.d.ts

@@ -0,0 +1,163 @@
+/**
+ * `extenshi package <dir> --browser chrome,edge,firefox` — one reproducible
+ * store package per browser from an unpacked build directory.
+ *
+ * REPRODUCIBLE means byte-identical for the same files on any machine, in any
+ * timezone, under any umask: Dojo release readiness binds every piece of
+ * evidence (tests, scan, installed smoke) to the package's SHA-256, so a CI
+ * build and a local build of one commit must agree to the byte. The archive is
+ * written by the SAME writer Dojo uses (`zip.ts`, a byte-identical copy of
+ * dojo/src/lib/tools/zip.ts) with the same choices as Dojo's extension archive:
+ *   - entries sorted by path, manifest.json at the root, no directory entries;
+ *   - every entry stamped 2000-01-01 00:00:00 (DOS fields carry no timezone, so
+ *     the constant is built from LOCAL components — see REPRODUCIBLE_MTIME);
+ *   - STORE (no compression): deflate output depends on the zlib build, which
+ *     differs between Node releases, and reproducibility across machines is the
+ *     point. Store uploads accept uncompressed archives;
+ *   - "version made by" MS-DOS with zero external attributes, so no Unix mode
+ *     bits, owners or extra fields — nothing machine-specific survives.
+ *
+ * The user's source directory is never modified. `--fix-war` and `--gecko-id`
+ * rewrite manifest.json in the PACKAGED copy only, and every rewrite is listed
+ * in the output (`changes`).
+ */
+export declare const PACKAGE_BROWSERS: readonly ["chrome", "edge", "firefox"];
+export type PackageBrowser = (typeof PACKAGE_BROWSERS)[number];
+/** Written next to the zips; `release prepare`, `test smoke`, `evidence ingest` read it directly. */
+export declare const PACKAGES_MANIFEST_FILE = "extenshi-packages.json";
+export declare const PACKAGES_MANIFEST_SCHEMA_VERSION = 1;
+export interface PackageFile {
+    /** Posix path relative to the package root. */
+    path: string;
+    bytes: Uint8Array;
+}
+/**
+ * `--exclude` pattern → matcher, gitignore-style: `*` stays inside one path
+ * segment, `**` crosses segments, a pattern without `/` matches a basename at any
+ * depth, a pattern with `/` is anchored at the package root, and a pattern naming
+ * a directory excludes everything under it.
+ */
+export declare function excludeMatcher(patterns: readonly string[]): (relative: string) => boolean;
+/**
+ * A `web_accessible_resources` entry as the BROWSER matches it: `*` matches any
+ * run of characters INCLUDING `/` (Chromium's MatchPattern and Firefox's
+ * MatchGlob both work this way), `?` one character. Leading `/` is ignored.
+ */
+export declare function warGlobToRegExp(glob: string): RegExp;
+export interface CollectedFiles {
+    files: PackageFile[];
+    /** Relative paths left out by --exclude (dot-entries and node_modules are not listed). */
+    excluded: string[];
+}
+/**
+ * Read every file under `root`, sorted, skipping dot-entries (`.git`, `.github`,
+ * `.extenshi`, `.DS_Store`, …), `node_modules` and `skipDirs` (the output
+ * directory when it sits inside the source). Symlinks are refused: following one
+ * would pack bytes from outside the directory, and a link itself is not
+ * something every store unpacks the same way.
+ */
+export declare function collectFiles(root: string, options?: {
+    exclude?: readonly string[];
+    skipDirs?: readonly string[];
+}): CollectedFiles;
+type Json = Record<string, any>;
+/**
+ * Every file the manifest names, which the browser loads or refuses to install
+ * without: background, pages, content scripts, icons, locale, rulesets.
+ * `web_accessible_resources` is not here — its entries are patterns, handled by
+ * the WAR check.
+ */
+export declare function manifestReferences(manifest: Json): string[];
+export interface WarWildcard {
+    /** Index into the manifest's web_accessible_resources array. */
+    entry: number;
+    pattern: string;
+}
+export declare function warWildcards(manifest: Json): WarWildcard[];
+/**
+ * Replace every wildcard in `web_accessible_resources` with the explicit list of
+ * packaged files it matches (as the browser would match it). Exact entries stay.
+ * manifest.json itself is never exposed. Returns human-readable change notes.
+ */
+export declare function expandWarWildcards(manifest: Json, packagedPaths: readonly string[]): string[];
+/** `browser_specific_settings.gecko.id`, or the MV2 `applications.gecko.id` spelling. */
+export declare function manifestGeckoId(manifest: Json): string | undefined;
+export interface PackOptions {
+    browser: PackageBrowser;
+    /** Explicit Firefox add-on ID written into the packaged manifest. */
+    geckoId?: string;
+    /** Expand wildcard web_accessible_resources in the packaged manifest. */
+    fixWar?: boolean;
+    /** Bound Dojo project, used only to suggest its derived add-on ID in errors. */
+    projectId?: string;
+}
+export interface PackResult {
+    browser: PackageBrowser;
+    bytes: Uint8Array;
+    sha256: string;
+    entries: string[];
+    manifest: Json;
+    /** Rewrites applied to the PACKAGED manifest.json (never the source). */
+    changes: string[];
+    warnings: string[];
+}
+export declare function packExtension(source: readonly PackageFile[], options: PackOptions): PackResult;
+/** `dyslexia-font-reading-ruler-chrome-0.1.0.zip`: browser in the name so the wrong upload is hard. */
+export declare function packageFileName(name: string, browser: PackageBrowser, version: string): string;
+/** Resolve `__MSG_key__` against the default locale, for the file name only. */
+export declare function displayName(manifest: Json, files: readonly PackageFile[]): string;
+export interface PackageEntry {
+    browser: PackageBrowser;
+    /** Zip file name, relative to the packages manifest. */
+    file: string;
+    sha256: string;
+    bytes: number;
+    entries: number;
+    name: string;
+    version: string;
+    /** hashMetadata(packaged manifest) — equals the digest `release prepare` records. */
+    manifestDigest: string;
+    geckoId?: string;
+    /** Source directory as given, relative to where the command ran. */
+    source: string;
+    changes: string[];
+    warnings: string[];
+}
+export interface PackagesManifest {
+    schemaVersion: typeof PACKAGES_MANIFEST_SCHEMA_VERSION;
+    tool: string;
+    packages: PackageEntry[];
+}
+export declare function isPackagesManifest(value: unknown): value is PackagesManifest;
+/**
+ * `<artifact>` for `release prepare`, `test smoke` and `evidence ingest`: a zip,
+ * or the packages manifest `extenshi package` wrote (then `browser` picks the
+ * entry). The zip's bytes must still hash to what the manifest recorded — a
+ * package rebuilt or edited since then is refused rather than silently used.
+ */
+export declare function resolvePackagedArtifact(file: string, browser?: string): {
+    artifactPath: string;
+    entry?: PackageEntry;
+};
+/**
+ * Browsers a zip was packaged for, from the packages manifest next to it. Chrome
+ * and Edge built from one directory are byte-identical, so one zip can be both.
+ */
+export declare function packagedBrowsersFor(artifactPath: string, sha256: string): PackageBrowser[];
+export interface RunPackageOptions {
+    /** Default build directory for every browser without its own. */
+    dir?: string;
+    dirs?: Partial<Record<PackageBrowser, string>>;
+    browsers: PackageBrowser[];
+    outDir: string;
+    exclude?: string[];
+    geckoId?: string;
+    fixWar?: boolean;
+    json?: boolean;
+    cliVersion: string;
+    cwd?: string;
+}
+export declare function parsePackageBrowsers(value: string | undefined): PackageBrowser[];
+export declare function runPackage(options: RunPackageOptions): PackagesManifest;
+export {};
+//# sourceMappingURL=package.d.ts.map

package/dist/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../src/package.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,eAAO,MAAM,gBAAgB,wCAAyC,CAAA;AACtE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,qGAAqG;AACrG,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D,eAAO,MAAM,gCAAgC,IAAI,CAAA;AAqBjD,MAAM,WAAW,WAAW;IAC3B,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,CAAA;CACjB;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CA0BzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD;AAID,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,WAAW,EAAE,CAAA;IACpB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GACzE,cAAc,CAmChB;AAID,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAQ/B;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,EAAE,CA4B3D;AAED,MAAM,WAAW,WAAW;IAC3B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CACf;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CA0C7F;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAMlE;AAeD,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,IAAI,CAAA;IACd,yEAAyE;IACzE,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,GAAG,UAAU,CAmG9F;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAS9F;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAYjF;AAID,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,cAAc,CAAA;IACvB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,qFAAqF;IACrF,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,aAAa,EAAE,OAAO,gCAAgC,CAAA;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,YAAY,EAAE,CAAA;CACxB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAG5E;AAID;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACd;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,YAAY,CAAA;CAAE,CAyBhD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAS1F;AAID,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,EAAE,CAUhF;AAWD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA4DvE"}