@extenshi/cli 0.23.0 → 0.24.0

package/dist/amo-source.d.ts

@@ -1,34 +1,77 @@
 /**
- * `extenshi amo-source <project-dir> [--out <path>]` — produce the AMO
- * source-code archive + BUILD.md reviewer instructions.
+ * `extenshi amo-source <project-dir> [--out <path>] [--build <cmd>] [--verify <package>]`
+ * — produce the AMO source-code archive + BUILD.md reviewer instructions, and
+ * optionally prove a reviewer can rebuild the package from it.
  *
  * AMO requires reviewable source for any minified/bundled/transpiled code so a
  * reviewer can rebuild the extension and diff it against the submitted
  * package: https://extensionworkshop.com/documentation/publish/source-code-submission/
  *
- * This command does NOT run the build itself and does NOT talk to AMO's API
- * (that is `publisher/src/services/firefox.ts`, owned separately). It only:
- *   1. archives the project's tracked-looking source (excluding node_modules,
- *      dist, .git, dotenv secrets, and any top-level directory the project's
- *      own .gitignore names plainly — e.g. `dist-firefox/`, `dist-edge/`),
- *   2. writes BUILD.md with the exact commands a reviewer needs (Node/npm
- *      versions, package manager + lockfile, the build script from
- *      package.json), and
+ * This command does NOT talk to AMO's API (that is
+ * `publisher/src/services/firefox.ts`, owned separately). It:
+ *   1. archives the project's source — in a git repository `git archive HEAD`
+ *      (.gitignore, nested ignore files, export-ignore and untracked build
+ *      output all stay out); outside git, every file minus
+ *      node_modules/dist-style directories and what the top-level .gitignore
+ *      names. Dotenv files, symlinks and files over 25 MB never go in, and the
+ *      result lists each one it left out;
+ *   2. writes BUILD.md with the commands a reviewer needs (Node/npm versions,
+ *      package manager + lockfile, the build command);
  *   3. flags vendored minified files that carry no reproducible-build
- *      provenance as BLOCKERS — the developer must vendor their source (e.g.
- *      under vendor-src/) before submitting.
+ *      provenance as BLOCKERS — unless their source is vendored under
+ *      `vendor-src/<name>/` (optionally pinned by a `SOURCE_COMMIT` file), the
+ *      layout these docs tell developers to use;
+ *   4. with `--verify <package>`, unpacks the archive into an empty directory,
+ *      runs the install + build there, and compares the rebuilt package's
+ *      SHA-256 with the one you are about to upload.
  *
- * If the project directory is a clean git working tree, the archive is
- * refused when there are uncommitted changes (matching the pattern this repo
- * already uses for its own extension projects) — the archive should match a
- * commit a reviewer can also check out. A directory that is not a git repo at
- * all is archived as-is; there is nothing to compare it against.
+ * If the project directory is a git working tree, the archive is refused when
+ * there are uncommitted changes — the archive should match a commit a reviewer
+ * can also check out. A directory that is not a git repo at all is archived
+ * as-is; there is nothing to compare it against.
  */
 import { type MinifiedFileFinding } from './amo-source-detect.js';
 export interface AmoSourceOptions {
     projectDir: string;
     /** Where to write the archive. Default: `amo-source.zip` in the current directory. */
     outputPath?: string;
+    /**
+     * The build step a reviewer runs after installing (BUILD.md, and `--verify`).
+     * Default: `npm run build` when package.json has a build script.
+     */
+    buildCommand?: string;
+    /**
+     * The package you will upload, relative to the project (e.g.
+     * `deploy-firefox.zip`). Rebuild it in a clean directory from the archive and
+     * compare SHA-256 digests.
+     */
+    verifyPackage?: string;
+    /** Discard the clean-room install/build output instead of streaming it to stderr. */
+    quiet?: boolean;
+}
+/** A minified file whose source is vendored under `vendor-src/`. */
+export interface VendoredBundle extends MinifiedFileFinding {
+    /** `vendor-src/<name>` — the directory holding its source. */
+    sourceDir: string;
+    /** The upstream commit pinned in `<sourceDir>/SOURCE_COMMIT`, when there is one. */
+    sourceCommit?: string;
+    /** Which rule tied the file to its source: the build config names it, or the directory name does. */
+    matchedBy: 'build config' | 'name';
+}
+export interface VerifyResult {
+    /** Project-relative path of the package that was compared. */
+    packagePath: string;
+    /** SHA-256 of the package in the project — the one you upload. */
+    expected: string;
+    /** SHA-256 of the package rebuilt from the archive, or null when the build did not produce it. */
+    actual: string | null;
+    match: boolean;
+    /** What ran in the clean room, in order. */
+    commands: string[];
+    /** Kept for inspection when the rebuild did not match; removed otherwise. */
+    cleanRoom?: string;
+    /** Why the rebuild failed, when it did. */
+    error?: string;
 }
 export interface AmoSourceResult {
     zipPath: string;
@@ -36,6 +79,34 @@ export interface AmoSourceResult {
     fileCount: number;
     blockers: MinifiedFileFinding[];
     reproducible: MinifiedFileFinding[];
+    /** Minified files recognised as rebuilt from `vendor-src/` (subset of `reproducible`). */
+    vendored: VendoredBundle[];
+    /** Files the archive leaves out (dotenv, symlinks, over 25 MB), with the reason. */
+    skipped: SkippedFile[];
+    verification?: VerifyResult;
+}
+interface IgnoreRule {
+    re: RegExp;
+    negate: boolean;
+    dirOnly: boolean;
+}
+/**
+ * The top-level `.gitignore` of a project that is NOT a git repository, read
+ * the way git reads it: comments, `!` negation, trailing `/` for directories,
+ * a leading or inner `/` anchoring the pattern to the root, `*`, `?`, `**`,
+ * last match wins. Character classes (`[abc]`) and backslash escapes are not
+ * supported; such a pattern matches literally, so the file stays IN the archive
+ * (the safe direction). Inside a repository none of this runs — `git ls-files`
+ * already applies every ignore file git knows about.
+ */
+export declare function compileGitignore(raw: string): IgnoreRule[];
+/** `rel` is a project-relative posix path. */
+export declare function isGitignored(rel: string, isDir: boolean, rules: readonly IgnoreRule[]): boolean;
+/** A file left out of the archive, and why — reported, never dropped silently. */
+export interface SkippedFile {
+    path: string;
+    reason: string;
 }
 export declare function runAmoSource(opts: AmoSourceOptions): Promise<AmoSourceResult>;
+export {};
 //# sourceMappingURL=amo-source.d.ts.map

package/dist/amo-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"amo-source.d.ts","sourceRoot":"","sources":["../src/amo-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAsDtF,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,YAAY,EAAE,mBAAmB,EAAE,CAAA;CACnC;AAyJD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuCnF"}
+{"version":3,"file":"amo-source.d.ts","sourceRoot":"","sources":["../src/amo-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAQH,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AA2BtF,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,cAAe,SAAQ,mBAAmB;IAC1D,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qGAAqG;IACrG,SAAS,EAAE,cAAc,GAAG,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,kGAAkG;IAClG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,KAAK,EAAE,OAAO,CAAA;IACd,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,YAAY,EAAE,mBAAmB,EAAE,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,oFAAoF;IACpF,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC3B;AA4CD,UAAU,UAAU;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CAChB;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAgB1D;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAO/F;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACd;AA0XD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAsGnF"}