@extenshi/cli 0.21.0 → 0.23.0

package/dist/cli.js

@@ -32,9 +32,13 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import * as readline from 'node:readline/promises';
 import { program } from 'commander';
+import { runAmoSource } from './amo-source.js';
+import { assertEvidenceBinding, evidenceArtifact, evidenceBrowsers, generatedListingEvidence, listingEvidence, permissionsEvidence, recordAutoEvidence, recordScreenshotsEvidence, scanEvidence, screenshotsEvidence, screenshotsEvidencePlan, smokeEvidence, } from './auto-evidence.js';
 import { checkAutoUpdate } from './auto-update.js';
 import { CONFIG_PATH, loadConfig, readTelemetryPreference, saveConfig, saveTelemetryPreference, } from './config.js';
-import { isExpectedError } from './expected-error.js';
+import { runDomainAdd, runDomainRemove, runDomainStatus, runDomainVerify } from './domain.js';
+import { registerEvidenceIngest } from './evidence-ingest.js';
+import { InvalidInputError, isExpectedError } from './expected-error.js';
 import { runGenerateListing } from './generate-listing.js';
 import { runIconPreview } from './icon.js';
 import { applyLocalization, checkLocalization, prepareLocalization } from './localize.js';
@@ -42,13 +46,20 @@ import { initializeLocalization } from './localize-init.js';
 import { makeLoginBff } from './login-bff.js';
 import { runBrowserLogin } from './login-flow.js';
 import { openBrowser, openLoopback, sleep } from './login-runtime.js';
-import { runPageGenerate, runPagePublish, runPageRegister, runPageUnpublish } from './page.js';
+import { runMediaUpload } from './media.js';
+import { parsePackageBrowsers, resolvePackagedArtifact, runPackage } from './package.js';
+import { runPageDraft, runPageGenerate, runPagePreview, runPagePublish, runPageRegister, runPageRollback, runPageUnpublish, runPageValidate, runPageVersions, } from './page.js';
 import { registerPayCommands } from './pay.js';
+import { registerPayTestCycle } from './pay-test-cycle.js';
 import { registerProjectCommands } from './project.js';
 import { runPublish } from './publish.js';
+import { runListingOnlyChecks } from './review-checks.js';
 import { runReviewRisk } from './review-risk.js';
 import { parseRefs, parseStore, runRisk } from './risk.js';
 import { runScan } from './scan.js';
+import { runScreenshotsCommand } from './screenshots.js';
+import { ENGINE_BROWSER, parseSmokeEngine, renderSmoke, runSmoke } from './smoke.js';
+import { runStoreAssets } from './store-assets.js';
 import { captureError, captureEvent, classifyError, flagsFromArgv, flushTelemetry, initTelemetry, } from './telemetry.js';
 import { defaultConsentDeps, envAnswerSource, maybeAskForTelemetryConsent } from './telemetry-consent.js';
 const MISSING_KEY_HELP = "Looks like you don't have an Extenshi API key set up yet — let's fix that.\n" +
@@ -103,7 +114,8 @@ async function runCommand(command, action) {
     }
 }
 registerProjectCommands(program);
-registerPayCommands(program);
+registerPayTestCycle(registerPayCommands(program));
+registerEvidenceIngest(program, runCommand);
 program
     .name('extenshi')
     .description('Pre-publish security scanner for browser extensions')
@@ -125,12 +137,21 @@ program
     .option('--listing <file>', 'JSON file with your store listing text (name / shortDescription / description, optionally per locale). ' +
     'Without it the listing checks still run, but only over the name and short description the package carries — ' +
     'the full description lives in the dashboard, never in the artifact')
+    .option('--evidence', 'Record the result as `scan` release evidence for the project bound here (extenshi project bind), bound to this exact package')
+    .option('--evidence-browser <list>', 'Store(s) the evidence is for: chrome,edge,firefox (default: read from the extenshi-packages.json next to the zip)')
     .action(async (artifact, opts) => {
     await runCommand('scan', async () => {
         const config = await loadConfig(opts.apiUrl);
         if (!config.apiKey) {
             throw new Error(MISSING_KEY_HELP);
         }
+        // Everything --evidence needs is settled before a credit is spent.
+        let evidence;
+        if (opts.evidence) {
+            assertEvidenceBinding();
+            const { digest } = await evidenceArtifact(artifact);
+            evidence = { digest, browsers: evidenceBrowsers(artifact, digest, opts.evidenceBrowser) };
+        }
         // Auto-update check (fail-soft — never blocks scan)
         await checkAutoUpdate();
         let reportFormat;
@@ -161,7 +182,7 @@ program
         // explicitly disabled (--no-open), and not in CI (no browser/display —
         // the file is still written so CI can archive it as an artifact).
         const openReport = format === 'html' && (opts.open ?? true) && !process.env.CI;
-        await runScan({
+        const body = await runScan({
             artifactPath: artifact,
             apiKey: config.apiKey,
             apiUrl: config.apiUrl,
@@ -180,6 +201,8 @@ program
             bffUrl: config.bffUrl,
             listingPath: opts.listing,
         });
+        if (evidence)
+            await recordAutoEvidence(scanEvidence({ artifactDigest: evidence.digest, browsers: evidence.browsers, body }));
     });
 });
 program
@@ -191,6 +214,13 @@ program
     .option('--stores <list>', 'Comma-separated stores: chrome,firefox,edge (default: every store with complete credentials)')
     .option('--firefox-artifact <path>', 'Separate .xpi for Firefox (default: the main artifact)')
     .option('--release-notes <text>', 'Release notes passed to stores that accept them')
+    .option('--listing <file>', 'Firefox: AMO listing (JSON, or the AMO.md `generate-listing --store firefox` writes, placeholders filled); ' +
+    'creates the add-on on first submission or edits its listing')
+    .option('--source <archive>', 'Firefox: reviewer source archive (.zip/.tar.gz) for the new version (needs --listing)')
+    .option('--screenshots <dir>', 'Firefox: AMO previews in file-name order: an image folder or `extenshi screenshots` output (its firefox/<locale>/ set); needs --listing')
+    .option('--allow-new-addon', 'Firefox: allow creating a NEW AMO add-on, whose id is permanent (in a bound project the owner-decided amo.addonId governs this)')
+    .option('--addon-id <id>', 'Firefox: the AMO add-on id ({GUID} or name@domain), stated explicitly; required with --allow-new-addon outside a bound project')
+    .option('--replace-screenshots', 'Firefox: replace the previews of an existing AMO add-on')
     .option('--validate', 'Only validate store credentials, publish nothing')
     .option('--no-wait', 'Edge: return after commit without polling the operation to a terminal status')
     .option('--extension-id <id>', 'Numeric catalog ID — checks publish-beta access against this specific extension')
@@ -227,6 +257,12 @@ program
             bffUrl: config.bffUrl,
             apiKey: config.apiKey,
             extensionId,
+            listingPath: opts.listing,
+            sourcePath: opts.source,
+            screenshotsDir: opts.screenshots,
+            allowNewAddon: opts.allowNewAddon ?? false,
+            addonId: opts.addonId,
+            replaceScreenshots: opts.replaceScreenshots ?? false,
         });
     });
 });
@@ -245,8 +281,20 @@ program
     'The package already supplies the localized name and short description; this adds the full description, ' +
     'which exists only in the developer dashboard.')
     .option('--json', 'Output raw JSON findings')
+    .option('--evidence', 'Record `permissions` evidence (bound to the packaged manifest) and, with --listing, `listing` evidence per locale ' +
+    '(bound to that file — pass the same file to release prepare --listing) for the project bound here')
+    .option('--evidence-browser <list>', 'Store(s) the evidence is for: chrome,edge,firefox (default: --store, else the extenshi-packages.json next to the zip)')
     .action(async (artifact, opts) => {
     await runCommand('review-risk', async () => {
+        let evidence;
+        if (opts.evidence) {
+            assertEvidenceBinding();
+            const { digest } = await evidenceArtifact(artifact);
+            evidence = {
+                digest,
+                browsers: evidenceBrowsers(artifact, digest, opts.evidenceBrowser ?? opts.store),
+            };
+        }
         // Default to CHROME — this tool is Chrome-Web-Store-centric, and pinning
         // the store avoids diffing against another store's snapshot.
         const storeMap = {
@@ -262,7 +310,7 @@ program
         // manifest diff only uses the key if the catalog read path is gated.
         const config = await loadConfig();
         await checkAutoUpdate();
-        await runReviewRisk({
+        const result = await runReviewRisk({
             artifactPath: artifact,
             extensionId: opts.extensionId,
             bffUrl: (opts.catalogUrl ?? 'https://bff.extenshi.io').replace(/\/$/, ''),
@@ -271,6 +319,27 @@ program
             listingPath: opts.listing,
             outputJson: opts.json ?? false,
         });
+        if (evidence) {
+            const listingFindings = runListingOnlyChecks(result.listing);
+            const records = permissionsEvidence({
+                artifactDigest: evidence.digest,
+                manifest: result.manifest,
+                browsers: evidence.browsers,
+                findings: result.summary.findings,
+                listingCheckIds: new Set(listingFindings.map((f) => f.check)),
+            });
+            if (opts.listing)
+                records.push(...listingEvidence({
+                    artifactDigest: evidence.digest,
+                    listingBytes: await readFile(opts.listing),
+                    listing: result.listing,
+                    browsers: evidence.browsers,
+                    listingFindings,
+                }));
+            else
+                process.stderr.write('note: no listing evidence — it binds to a listing file; pass --listing <file> (the one you give release prepare --listing)\n');
+            await recordAutoEvidence(records);
+        }
     });
 });
 const localize = program
@@ -322,21 +391,140 @@ localize
 });
 program
     .command('generate-listing <artifact>')
-    .description('Generate CHROMEWEBSTORE.md from a packaged (.zip/.crx/.xpi) or unpacked extension: ' +
+    .description('Generate a store listing draft from a packaged (.zip/.crx/.xpi) or unpacked extension: ' +
     'listing copy, permission justifications, single purpose and privacy-practices questions. ' +
     'Assembles the existing justification and privacy-disclosure checklists — does not write ' +
-    'anything into Chrome Web Store. The file is the same listing draft `review-risk --listing` accepts.')
-    .option('--output <path>', 'Where to write the markdown (default: CHROMEWEBSTORE.md in the current directory)')
+    'anything into any store dashboard. --store picks CHROMEWEBSTORE.md / EDGE.md / AMO.md ' +
+    '(default chrome); all three are the same listing draft `review-risk --listing` accepts.')
+    .option('--store <store>', 'Which store to draft for: chrome (default), edge, or firefox', 'chrome')
+    .option('--output <path>', 'Where to write the markdown (default: the per-store filename in the current directory)')
     .option('--listing <file>', 'JSON file with your store listing text (name / shortDescription / description). ' +
     'Overlays the package so the generated markdown can include the full dashboard description.')
+    .option('--evidence', 'After writing the file, run the listing rules over it and record `listing` evidence per locale, bound to the ' +
+    'generated file (pass it to release prepare --listing). Needs a packaged zip, not a folder.')
+    .option('--evidence-browser <list>', 'Store(s) the evidence is for: chrome,edge,firefox (default: the --store the draft is written for)')
     .action(async (artifact, opts) => {
     await runCommand('generate-listing', async () => {
+        const store = (opts.store ?? 'chrome').trim().toLowerCase();
+        if (store !== 'chrome' && store !== 'edge' && store !== 'firefox') {
+            throw new Error(`--store must be chrome, edge or firefox (got "${opts.store}")`);
+        }
+        // The draft is one store's listing, so its evidence is that store's by default.
+        let evidence;
+        if (opts.evidence) {
+            assertEvidenceBinding();
+            const { bytes, digest } = await evidenceArtifact(artifact);
+            evidence = {
+                bytes,
+                digest,
+                browsers: evidenceBrowsers(artifact, digest, opts.evidenceBrowser ?? store),
+            };
+        }
         await checkAutoUpdate();
-        await runGenerateListing({
+        const outputPath = await runGenerateListing({
             artifactPath: artifact,
             outputPath: opts.output,
             listingPath: opts.listing,
+            store,
         });
+        if (evidence)
+            await recordAutoEvidence(await generatedListingEvidence({
+                artifactBytes: evidence.bytes,
+                artifactDigest: evidence.digest,
+                draftPath: outputPath,
+                browsers: evidence.browsers,
+            }));
+    });
+});
+program
+    .command('package [dir]')
+    .description('Build one reproducible store zip per browser from an unpacked build directory: sorted entries, fixed ' +
+    'timestamps, no file modes or extra metadata — the same bytes on every machine and timezone. Prints the ' +
+    'sha256 of each zip and writes extenshi-packages.json, which release prepare, test smoke and evidence ' +
+    'ingest accept directly. Never modifies the source directory. Free, offline.')
+    .option('--browser <list>', 'Comma-separated: chrome,edge,firefox (default: chrome)')
+    .option('--chrome-dir <dir>', 'Build directory for Chrome (overrides [dir])')
+    .option('--edge-dir <dir>', 'Build directory for Edge (overrides [dir])')
+    .option('--firefox-dir <dir>', 'Build directory for Firefox (overrides [dir])')
+    .option('--out <dir>', 'Output directory (default: .extenshi/packages — ignored by the dirty-tree digest release prepare records)')
+    .option('--exclude <patterns...>', 'Leave files out (gitignore-style globs, comma-separated or repeated). Dot-entries and node_modules are always left out.')
+    .option('--gecko-id <id>', 'Firefox: write this add-on ID into the PACKAGED manifest. A missing or placeholder ID is refused otherwise.')
+    .option('--fix-war', 'Replace wildcard web_accessible_resources with the explicit list of matching files, in the packaged copy only')
+    .option('--json', 'Print the packages manifest as JSON')
+    .action(async (dir, opts) => {
+    await runCommand('package', async () => {
+        runPackage({
+            dir,
+            dirs: { chrome: opts.chromeDir, edge: opts.edgeDir, firefox: opts.firefoxDir },
+            browsers: parsePackageBrowsers(opts.browser),
+            outDir: opts.out ?? '.extenshi/packages',
+            exclude: opts.exclude,
+            geckoId: opts.geckoId,
+            fixWar: opts.fixWar ?? false,
+            json: opts.json ?? false,
+            cliVersion: pkg.version,
+        });
+    });
+});
+const test = program.command('test').description('Test packaged extensions in real browsers');
+test
+    .command('smoke <package>')
+    .description('Install the EXACT package (a zip, or extenshi-packages.json + --browser) in a real browser and check that it ' +
+    'loads, its service worker/background starts, the browser reports no manifest errors, and its popup/options/' +
+    'side-panel pages open without console errors. chromium/edge use Playwright (install it in your project: ' +
+    'npm i -D playwright && npx playwright install chromium); firefox needs only a Firefox binary. Exit 1 on failure.')
+    .requiredOption('--browser <browser>', 'chromium (alias chrome) | edge | firefox')
+    .option('--json', 'Print the result as JSON')
+    .option('--timeout <ms>', 'Budget per wait (service worker start, page load)', '15000')
+    .option('--headed', 'Show the browser window')
+    .option('--firefox-bin <path>', 'Firefox binary (default: FIREFOX_BIN, standard install locations, PATH)')
+    .option('--browser-path <path>', 'Chromium/Edge executable instead of the Playwright channel default')
+    .option('--evidence', 'Record the result as `installed` release evidence for the project bound here (extenshi project bind)')
+    .action(async (packagePath, opts) => {
+    await runCommand('test smoke', async () => {
+        const engine = parseSmokeEngine(opts.browser);
+        if (opts.evidence)
+            assertEvidenceBinding();
+        const timeoutMs = Number.parseInt(opts.timeout, 10);
+        if (!Number.isFinite(timeoutMs) || timeoutMs < 1000)
+            throw new InvalidInputError('--timeout must be ≥ 1000 ms');
+        const { artifactPath } = resolvePackagedArtifact(packagePath, ENGINE_BROWSER[engine]);
+        const result = await runSmoke({
+            artifactPath,
+            engine,
+            timeoutMs,
+            headed: opts.headed ?? false,
+            firefoxBinary: opts.firefoxBin,
+            browserPath: opts.browserPath,
+        });
+        process.stdout.write(opts.json ? `${JSON.stringify(result, null, 2)}\n` : `${renderSmoke(result)}\n`);
+        if (opts.evidence)
+            await recordAutoEvidence(smokeEvidence({ browser: ENGINE_BROWSER[engine], result }));
+        if (result.status === 'failed')
+            process.exitCode = 1;
+    });
+});
+program
+    .command('amo-source <project-dir>')
+    .description('Produce the AMO source-code archive + BUILD.md reviewer instructions for a Firefox add-on ' +
+    'project directory. Excludes node_modules/dist/.git and dotenv secrets (.env*); includes the ' +
+    'lockfile. Refuses on an uncommitted git working tree (the archive should match a real commit). ' +
+    'Flags vendored minified files with no reproducible-build provenance as blockers. Does not talk ' +
+    'to the AMO API — upload the archive by hand, or via the separate AMO API submission path.')
+    .option('--out <path>', 'Where to write the archive (default: amo-source.zip in the current directory)')
+    .action(async (projectDir, opts) => {
+    await runCommand('amo-source', async () => {
+        await checkAutoUpdate();
+        const result = await runAmoSource({ projectDir, outputPath: opts.out });
+        console.log(`Wrote ${result.zipPath} (${result.fileCount} files)`);
+        console.log(`Wrote ${result.buildMdPath}`);
+        if (result.blockers.length > 0) {
+            console.log(`\n${result.blockers.length} file(s) need a source-code submission before this can go to AMO:`);
+            for (const f of result.blockers)
+                console.log(`  - ${f.path}`);
+            console.log('See BUILD.md for what to do about each one.');
+            process.exitCode = 1;
+        }
     });
 });
 program
@@ -399,6 +587,66 @@ icon
         await runIconPreview(iconPath, opts, pkg.version);
     });
 });
+icon
+    .command('store-assets <source>')
+    .description('Render the store LISTING artwork from one .svg / .png source: Chrome Web Store icon 128 (96 px artwork + ' +
+    '16 px padding), 440×280 promo tile and 1400×560 marquee; Edge Add-ons 300×300 logo and 440×280 / ' +
+    '1400×560 tiles; AMO 128 / 64 / 32 icons. Offline (WebAssembly renderer), no API key.')
+    .option('--store <stores>', 'Comma-separated: chrome, edge, firefox (default: all)')
+    .option('--out <dir>', 'Output directory (default: ./store-assets)')
+    .option('--background <color>', 'Promo tile / marquee background (default: a light tint of the icon colour)')
+    .option('--icon-background <color>', 'Fill behind icons and the Edge logo (default: transparent)')
+    .option('--promo <file>', 'Full-bleed artwork (.svg/.png) for the 440×280 tiles instead of composing the icon')
+    .option('--marquee <file>', 'Full-bleed artwork (.svg/.png) for the 1400×560 tiles instead of composing the icon')
+    .option('--font <files...>', 'Font files for text in SVG sources (system fonts are matched by name otherwise)')
+    .option('--json', 'Print the result as JSON')
+    .action(async (source, opts) => {
+    await runCommand('icon store-assets', async () => {
+        await runStoreAssets(source, opts);
+    });
+});
+program
+    .command('screenshots <extension>')
+    .description('Store screenshots without a human: load an unpacked build (or .zip) in Chromium, run the declarative ' +
+    'scenes in --scenes per locale (the UI language is switched and verified through chrome.i18n), and ' +
+    'write each store size — Chrome/Edge/AMO 1280×800 (or --small) — as <out>/<store>/<locale>/NN-<scene>-WxH.png ' +
+    'plus screenshots.json. Needs Playwright with Chromium in the project (npm i -D playwright && npx playwright ' +
+    'install chromium). Scenes format: https://docs.extenshi.io/developers/cli#extenshi-screenshots')
+    .requiredOption('--scenes <scenes.json>', 'Declarative scenes file')
+    .option('--locales <codes>', 'Comma-separated _locales codes (default: every locale the extension ships)')
+    .option('--store <stores>', 'Comma-separated: chrome, edge, firefox (default: all)')
+    .option('--out <dir>', 'Output directory (default: ./store-screenshots)')
+    .option('--small', "Each store's smaller size: Chrome 640×400, Edge 640×480, AMO 640×400")
+    .option('--headed', 'Show the browser window (debugging scenes)')
+    .option('--json', 'Print the result as JSON')
+    .option('--evidence', 'Record `screenshots` evidence per shot locale and store for the project bound here (extenshi project bind), ' +
+    "bound to this zip and to --listing, with that store's PNGs attached (private storage). Needs a packaged zip, not a folder.")
+    .option('--listing <file>', 'With --evidence: the listing revision these screenshots illustrate — the file you give release prepare --listing')
+    .option('--evidence-browser <list>', 'Store(s) the evidence is for: chrome,edge,firefox (default: --store, else the extenshi-packages.json next to the zip); each must be shot')
+    .action(async (extension, opts) => {
+    await runCommand('screenshots', async () => {
+        // Settled before Chromium starts, so a run that cannot be recorded is not shot.
+        const evidence = opts.evidence ? await screenshotsEvidencePlan({ extension, ...opts }) : undefined;
+        const result = await runScreenshotsCommand(extension, opts);
+        if (evidence)
+            await recordScreenshotsEvidence(screenshotsEvidence({ ...evidence, result }), result.files);
+    });
+});
+program
+    .command('media')
+    .description("The project's PUBLIC media store (logo, screenshots) used by hosted pages")
+    .command('upload <files...>')
+    .description("Upload PNG/JPEG/WebP images (≤2 MB each; .svg is rasterized to PNG locally) to the project's public media " +
+    'store and print their stable URLs — the same store Dojo uploads use, accepted by `page publish` as ' +
+    'screenshots[].url / logoUrl. The server strips metadata and enforces a per-project quota. Requires an ' +
+    'API key (extenshi login) with hosted.write.')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .option('--svg-width <px>', 'Width to rasterize .svg files at (default 1024)')
+    .action(async (files, opts) => {
+    await runCommand('media upload', async () => {
+        await runMediaUpload(files, opts);
+    });
+});
 const page = program
     .command('page')
     .description('Landing page (homepage) for your extension: generate static HTML offline, register its URL');
@@ -430,19 +678,84 @@ page
 });
 page
     .command('publish')
-    .description('Host the landing page on extenshi.io (page.extenshi.io/<code>, or /landing on your active custom ' +
-    'domain) from the same JSON config as `page generate`. Republishing keeps the URL. Also registers it ' +
+    .description('Host the landing page on extenshi.io (page.extenshi.io/<code>, or the root of your active custom ' +
+    'domain) from the same JSON config as `page generate` (v1, or schema v2 from `page draft`). Republishing keeps the URL. Also registers it ' +
     'as the project homepage unless --no-homepage. Screenshots must be https store/Dojo images. ' +
     'Requires an API key (extenshi login).')
     .requiredOption('--project <id>', 'Dojo project ID (UUID)')
     .requiredOption('--config <landing.json>', 'Landing config JSON')
     .option('--logo <file>', 'Logo: .svg or .png/.jpg/.webp/.gif (≤256 KiB)')
     .option('--no-homepage', 'Do not register the URL as the project homepage')
+    .option('--upload-local', "Upload local screenshot / logoUrl paths (relative to the config file) to the project's public media store first")
     .action(async (opts) => {
     await runCommand('page publish', async () => {
         await runPagePublish(opts);
     });
 });
+page
+    .command('draft')
+    .description('Draft a full homepage (schema v2: sections, theme, SEO, locales) from the project state on extenshi.io — ' +
+    'manifest and its translations, the published page, project media, Pay offers, hosted privacy/uninstall/' +
+    'terms pages — and write it as a config for `page preview` / `page publish`. Prints where each field ' +
+    'came from and what only you can add. Writes nothing on the server. Requires an API key.')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .option('--out <landing.json>', 'Where to write the config', 'landing.json')
+    .option('--chrome-url <url>', 'Chrome Web Store listing URL (when the project does not know it yet)')
+    .option('--firefox-url <url>', 'Firefox Add-ons listing URL')
+    .option('--edge-url <url>', 'Edge Add-ons listing URL')
+    .action(async (opts) => {
+    await runCommand('page draft', async () => {
+        await runPageDraft(opts);
+    });
+});
+page
+    .command('preview')
+    .description('Validate and render a config exactly as `page publish` would (image hosts, store locales, Pay offer ' +
+    'prices, canonical URL) without publishing. Writes the page to --out; exits non-zero with every problem ' +
+    'and its fix when publish would refuse it. --screenshot saves a full-page PNG (needs Playwright + ' +
+    'Chromium, as for `extenshi screenshots`). Requires an API key.')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .requiredOption('--config <landing.json>', 'Landing config JSON')
+    .option('--locale <locale>', 'Which locale page to render (default: the default locale)')
+    .option('--out <path>', 'Where to write the rendered HTML', 'preview.html')
+    .option('--screenshot <png>', 'Also save a full-page screenshot')
+    .option('--logo <file>', 'Logo: .svg or .png/.jpg/.webp/.gif (≤256 KiB)')
+    .action(async (opts) => {
+    await runCommand('page preview', async () => {
+        await runPagePreview(opts);
+    });
+});
+page
+    .command('validate')
+    .description('Check a landing config against the shared rules offline (sections, attribution, fonts, colours, locales, ' +
+    'SEO) and print every problem with its fix. Hosted-only rules need `page preview`. No API key.')
+    .requiredOption('--config <landing.json>', 'Landing config JSON')
+    .action(async (opts) => {
+    await runCommand('page validate', async () => {
+        await runPageValidate(opts);
+    });
+});
+page
+    .command('versions')
+    .description('Version history of the hosted landing page (newest first; which one is live, why each exists).')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .action(async (opts) => {
+    await runCommand('page versions', async () => {
+        await runPageVersions(opts);
+    });
+});
+page
+    .command('rollback')
+    .description('Restore an earlier version of the hosted landing page. It is published as a new version (history stays ' +
+    "append-only), re-rendered with today's URL and Pay prices.")
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .requiredOption('--version <n>', 'Version number to restore (see `extenshi page versions`)')
+    .option('--no-homepage', 'Do not register the URL as the project homepage')
+    .action(async (opts) => {
+    await runCommand('page rollback', async () => {
+        await runPageRollback(opts);
+    });
+});
 page
     .command('unpublish')
     .description('Take the hosted landing page offline (404). The URL returns on the next publish; a homepage ' +
@@ -453,6 +766,48 @@ page
         await runPageUnpublish(opts);
     });
 });
+const domain = program
+    .command('domain')
+    .description('Custom domain for the project homepage (served at the domain root) and every hosted page — Pro, one ' +
+    'hostname per project. Prints the exact DNS records; nothing is served until ownership (TXT) and the ' +
+    'HTTPS certificate are verified.');
+domain
+    .command('add')
+    .description('Add www.example.com (or the apex) and print the CNAME + TXT records to set')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .requiredOption('--hostname <host>', 'e.g. www.example.com')
+    .action(async (opts) => {
+    await runCommand('domain add', async () => {
+        await runDomainAdd(opts);
+    });
+});
+domain
+    .command('status')
+    .description('Show the domain, its verification state, the DNS records and the next step')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .action(async (opts) => {
+    await runCommand('domain status', async () => {
+        await runDomainStatus(opts);
+    });
+});
+domain
+    .command('verify')
+    .description('Check ownership and the certificate now; on ACTIVE the homepage moves to the domain root and HOMEPAGE_URL follows')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .action(async (opts) => {
+    await runCommand('domain verify', async () => {
+        await runDomainVerify(opts);
+    });
+});
+domain
+    .command('remove')
+    .description('Stop serving the custom domain; the homepage returns to page.extenshi.io')
+    .requiredOption('--project <id>', 'Dojo project ID (UUID)')
+    .action(async (opts) => {
+    await runCommand('domain remove', async () => {
+        await runDomainRemove(opts);
+    });
+});
 /**
  * Change or inspect the answer to the first-run telemetry question.
  *