@extenshi/cli 0.23.1 → 0.24.0

package/dist/amo-source.js

@@ -1,34 +1,43 @@
 /**
- * `extenshi amo-source <project-dir> [--out <path>]` — produce the AMO
- * source-code archive + BUILD.md reviewer instructions.
+ * `extenshi amo-source <project-dir> [--out <path>] [--build <cmd>] [--verify <package>]`
+ * — produce the AMO source-code archive + BUILD.md reviewer instructions, and
+ * optionally prove a reviewer can rebuild the package from it.
  *
  * AMO requires reviewable source for any minified/bundled/transpiled code so a
  * reviewer can rebuild the extension and diff it against the submitted
  * package: https://extensionworkshop.com/documentation/publish/source-code-submission/
  *
- * This command does NOT run the build itself and does NOT talk to AMO's API
- * (that is `publisher/src/services/firefox.ts`, owned separately). It only:
- *   1. archives the project's tracked-looking source (excluding node_modules,
- *      dist, .git, dotenv secrets, and any top-level directory the project's
- *      own .gitignore names plainly — e.g. `dist-firefox/`, `dist-edge/`),
- *   2. writes BUILD.md with the exact commands a reviewer needs (Node/npm
- *      versions, package manager + lockfile, the build script from
- *      package.json), and
+ * This command does NOT talk to AMO's API (that is
+ * `publisher/src/services/firefox.ts`, owned separately). It:
+ *   1. archives the project's source — in a git repository `git archive HEAD`
+ *      (.gitignore, nested ignore files, export-ignore and untracked build
+ *      output all stay out); outside git, every file minus
+ *      node_modules/dist-style directories and what the top-level .gitignore
+ *      names. Dotenv files, symlinks and files over 25 MB never go in, and the
+ *      result lists each one it left out;
+ *   2. writes BUILD.md with the commands a reviewer needs (Node/npm versions,
+ *      package manager + lockfile, the build command);
  *   3. flags vendored minified files that carry no reproducible-build
- *      provenance as BLOCKERS — the developer must vendor their source (e.g.
- *      under vendor-src/) before submitting.
+ *      provenance as BLOCKERS — unless their source is vendored under
+ *      `vendor-src/<name>/` (optionally pinned by a `SOURCE_COMMIT` file), the
+ *      layout these docs tell developers to use;
+ *   4. with `--verify <package>`, unpacks the archive into an empty directory,
+ *      runs the install + build there, and compares the rebuilt package's
+ *      SHA-256 with the one you are about to upload.
  *
- * If the project directory is a clean git working tree, the archive is
- * refused when there are uncommitted changes (matching the pattern this repo
- * already uses for its own extension projects) — the archive should match a
- * commit a reviewer can also check out. A directory that is not a git repo at
- * all is archived as-is; there is nothing to compare it against.
+ * If the project directory is a git working tree, the archive is refused when
+ * there are uncommitted changes — the archive should match a commit a reviewer
+ * can also check out. A directory that is not a git repo at all is archived
+ * as-is; there is nothing to compare it against.
  */
-import { execFileSync } from 'node:child_process';
+import { execFileSync, execSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import JSZip from 'jszip';
 import { detectMinifiedFiles } from './amo-source-detect.js';
+/** Outside git only: directories that are never source. Inside git the index decides. */
 const BASE_EXCLUDE_DIRS = new Set([
     'node_modules',
     '.git',
@@ -41,39 +50,6 @@ const BASE_EXCLUDE_DIRS = new Set([
     '.next',
 ]);
 const ENV_FILE_RE = /^\.env(\..+)?$/i;
-// A plain top-level directory ignore line: letters/digits/-/_/. only, no
-// globs, no nested path, optional trailing slash. Anything more complex
-// (negations, globs, nested paths) is skipped rather than mis-handled — this
-// is a heuristic, not a gitignore engine, and under-excluding is the safer
-// failure mode (a developer notices an oversized archive; over-excluding
-// silently drops source AMO needed).
-const SIMPLE_GITIGNORE_DIR_RE = /^([\w.-]+)\/?$/;
-/**
- * Fold a project's own top-level `.gitignore` build-output directories into
- * the exclude set — `dist-firefox/`, `dist-edge/` etc. are exactly the kind
- * of committed-for-CI build output that should never end up in a "source"
- * archive, and there is no way to enumerate every project's naming scheme in
- * a fixed list.
- */
-function additionalExcludeDirs(projectDir) {
-    const extra = new Set();
-    let raw;
-    try {
-        raw = fs.readFileSync(path.join(projectDir, '.gitignore'), 'utf8');
-    }
-    catch {
-        return extra;
-    }
-    for (const line of raw.split('\n')) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('!'))
-            continue;
-        const m = SIMPLE_GITIGNORE_DIR_RE.exec(trimmed);
-        if (m)
-            extra.add(m[1]);
-    }
-    return extra;
-}
 const TEXT_CODE_RE = /\.(?:m?js|cjs)$/i;
 const MAX_FILE_BYTES = 25 * 1024 * 1024;
 const LOCKFILES = [
@@ -81,6 +57,8 @@ const LOCKFILES = [
     { file: 'yarn.lock', manager: 'yarn', installCmd: 'yarn install --immutable' },
     { file: 'pnpm-lock.yaml', manager: 'pnpm', installCmd: 'pnpm install --frozen-lockfile' },
 ];
+/** The vendored-source convention the AMO docs page and BUILD.md point developers at. */
+const VENDOR_SRC_DIR = 'vendor-src';
 function isGitClean(cwd) {
     const git = (...args) => execFileSync('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'] })
         .toString()
@@ -93,25 +71,15 @@ function isGitClean(cwd) {
     }
     const status = git('status', '--porcelain', '--', '.');
     let commit;
+    let commitTime;
     try {
         commit = git('rev-parse', 'HEAD');
+        commitTime = new Date(Number(git('show', '-s', '--format=%ct', 'HEAD')) * 1000);
     }
     catch {
         // No commits yet — still archivable, just nothing to diff against.
     }
-    return { isRepo: true, clean: status.length === 0, commit };
-}
-function readPackageJson(projectDir) {
-    try {
-        const raw = fs.readFileSync(path.join(projectDir, 'package.json'), 'utf8');
-        return JSON.parse(raw);
-    }
-    catch {
-        return {};
-    }
-}
-function detectLockfile(projectDir) {
-    return LOCKFILES.find((l) => fs.existsSync(path.join(projectDir, l.file)));
+    return { isRepo: true, clean: status.length === 0, commit, commitTime };
 }
 function npmVersion() {
     try {
@@ -123,60 +91,354 @@ function npmVersion() {
         return undefined;
     }
 }
-function walkProject(projectDir, outputAbsPath) {
-    const zip = new JSZip();
-    const textFiles = new Map();
-    let fileCount = 0;
-    const excludeDirs = new Set([...BASE_EXCLUDE_DIRS, ...additionalExcludeDirs(projectDir)]);
-    const walk = (dir) => {
-        for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+/** One gitignore glob as a regex body: `**` crosses directories, `*` and `?` do not. */
+function globToRegex(glob) {
+    let out = '';
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '*' && glob[i + 1] === '*') {
+            // `**/` → any number of leading directories; a trailing `/**` → everything inside.
+            if (glob[i + 2] === '/') {
+                out += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                out += '.*';
+                i += 1;
+            }
+        }
+        else if (c === '*')
+            out += '[^/]*';
+        else if (c === '?')
+            out += '[^/]';
+        else
+            out += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+    return out;
+}
+/**
+ * The top-level `.gitignore` of a project that is NOT a git repository, read
+ * the way git reads it: comments, `!` negation, trailing `/` for directories,
+ * a leading or inner `/` anchoring the pattern to the root, `*`, `?`, `**`,
+ * last match wins. Character classes (`[abc]`) and backslash escapes are not
+ * supported; such a pattern matches literally, so the file stays IN the archive
+ * (the safe direction). Inside a repository none of this runs — `git ls-files`
+ * already applies every ignore file git knows about.
+ */
+export function compileGitignore(raw) {
+    const rules = [];
+    for (const line of raw.split(/\r?\n/)) {
+        let pattern = line.replace(/\s+$/, '');
+        if (!pattern || pattern.startsWith('#'))
+            continue;
+        const negate = pattern.startsWith('!');
+        if (negate)
+            pattern = pattern.slice(1);
+        const dirOnly = pattern.endsWith('/');
+        if (dirOnly)
+            pattern = pattern.replace(/\/+$/, '');
+        if (!pattern)
+            continue;
+        const anchored = pattern.includes('/');
+        pattern = pattern.replace(/^\//, '');
+        const body = globToRegex(pattern);
+        rules.push({ re: new RegExp(anchored ? `^${body}$` : `(?:^|/)${body}$`), negate, dirOnly });
+    }
+    return rules;
+}
+/** `rel` is a project-relative posix path. */
+export function isGitignored(rel, isDir, rules) {
+    let ignored = false;
+    for (const rule of rules) {
+        if (rule.dirOnly && !isDir)
+            continue;
+        if (rule.re.test(rel))
+            ignored = !rule.negate;
+    }
+    return ignored;
+}
+/** Entry timestamp outside git, where there is no commit time: the DOS epoch. */
+const FIXED_ENTRY_DATE = new Date('1980-01-01T00:00:00Z');
+function emptyArchive(date) {
+    return { zip: new JSZip(), textFiles: new Map(), files: [], skipped: [], date };
+}
+/** Add one file unless it must stay out; `mode` is the full unix mode when known. */
+function addFile(out, rel, buf, mode) {
+    if (ENV_FILE_RE.test(path.posix.basename(rel))) {
+        out.skipped.push({ path: rel, reason: 'dotenv file' });
+        return;
+    }
+    if (buf.length > MAX_FILE_BYTES) {
+        out.skipped.push({ path: rel, reason: 'larger than 25 MB' });
+        return;
+    }
+    // Keep the mode so a clean-room build can run a committed executable script.
+    out.zip.file(rel, buf, { unixPermissions: mode & 0o777, date: out.date });
+    out.files.push(rel);
+    if (TEXT_CODE_RE.test(rel))
+        out.textFiles.set(rel, buf.toString('utf8'));
+}
+/**
+ * In a git repository the archive is `git archive HEAD -- .`, run from the
+ * project directory: the committed blobs, with `export-ignore` and line-ending
+ * attributes applied — exactly what a reviewer gets from the same commit, and
+ * what keeps a previous `amo-source.zip`, `deploy*.zip` packages and gitignored
+ * font binaries out. Reading the working tree instead would also archive
+ * sparse-checkout gaps as missing files and smudge-filtered bytes.
+ */
+async function archiveFromGit(projectDir, outputAbsPath, date) {
+    const raw = execFileSync('git', ['archive', '--format=zip', 'HEAD', '--', '.'], {
+        cwd: projectDir,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 1024 * 1024 * 1024,
+    });
+    const committed = await JSZip.loadAsync(raw);
+    const out = emptyArchive(date);
+    const entries = Object.values(committed.files).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+        if (entry.dir)
+            continue;
+        if (path.resolve(projectDir, entry.name) === path.resolve(outputAbsPath))
+            continue; // never zip ourselves
+        const mode = typeof entry.unixPermissions === 'number' ? entry.unixPermissions : 0o100644;
+        if ((mode & 0o170000) === 0o120000) {
+            out.skipped.push({ path: entry.name, reason: 'symbolic link' });
+            continue;
+        }
+        addFile(out, entry.name, await entry.async('nodebuffer'), mode);
+    }
+    return out;
+}
+/**
+ * Outside git: every regular file except node_modules/dist-style directories
+ * and what the top-level .gitignore names.
+ */
+function archiveFromDisk(projectDir, outputAbsPath) {
+    let rules = [];
+    try {
+        rules = compileGitignore(fs.readFileSync(path.join(projectDir, '.gitignore'), 'utf8'));
+    }
+    catch {
+        // No .gitignore — the base exclude list alone.
+    }
+    const out = emptyArchive(FIXED_ENTRY_DATE);
+    const walk = (dir, relDir) => {
+        // Sorted, so the archive and every later "first match" are the same on every machine.
+        const entries = fs
+            .readdirSync(dir, { withFileTypes: true })
+            .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        for (const ent of entries) {
+            const rel = relDir ? `${relDir}/${ent.name}` : ent.name;
             const full = path.join(dir, ent.name);
-            if (path.resolve(full) === path.resolve(outputAbsPath))
-                continue; // never zip ourselves
             if (ent.isDirectory()) {
-                if (excludeDirs.has(ent.name))
+                if (BASE_EXCLUDE_DIRS.has(ent.name) || isGitignored(rel, true, rules))
                     continue;
-                walk(full);
-                continue;
+                walk(full, rel);
             }
-            if (!ent.isFile())
-                continue;
-            if (ENV_FILE_RE.test(ent.name))
-                continue;
-            const stat = fs.statSync(full);
-            if (stat.size > MAX_FILE_BYTES)
-                continue;
-            const rel = path.relative(projectDir, full).split(path.sep).join('/');
-            const buf = fs.readFileSync(full);
-            zip.file(rel, buf);
-            fileCount++;
-            if (TEXT_CODE_RE.test(ent.name)) {
-                try {
-                    textFiles.set(rel, buf.toString('utf8'));
-                }
-                catch {
-                    // Binary content that happened to match the extension — skip minification scan for it.
-                }
+            else if (ent.isFile() && !isGitignored(rel, false, rules)) {
+                if (path.resolve(full) === path.resolve(outputAbsPath))
+                    continue;
+                // Size first: a stray multi-GB file is reported, never read into memory.
+                const stat = fs.statSync(full);
+                if (stat.size > MAX_FILE_BYTES)
+                    out.skipped.push({ path: rel, reason: 'larger than 25 MB' });
+                else
+                    addFile(out, rel, fs.readFileSync(full), stat.mode);
             }
         }
     };
-    walk(projectDir);
-    return { zip, textFiles, fileCount };
+    walk(projectDir, '');
+    return out;
 }
+const BUILD_CONFIG_RE = /^(?:package\.json|(?:rollup|vite|webpack|esbuild|tsup|rspack)\.config\.[cm]?[jt]s)$/i;
+/** `vendor-src/<name>/` directories in the archive, read from the archive itself, in path order. */
+async function vendorSourceDirs(zip, archived) {
+    const byDir = new Map();
+    for (const rel of archived) {
+        const parts = rel.split('/');
+        if (parts[0] !== VENDOR_SRC_DIR || parts.length < 3)
+            continue;
+        const dir = `${parts[0]}/${parts[1]}`;
+        byDir.set(dir, [...(byDir.get(dir) ?? []), parts.slice(2).join('/')]);
+    }
+    const read = async (rel) => zip.file(rel)?.async('string');
+    const out = [];
+    for (const dir of [...byDir.keys()].sort()) {
+        const inside = byDir.get(dir) ?? [];
+        let packageName;
+        try {
+            packageName = JSON.parse((await read(`${dir}/package.json`)) ?? '{}').name;
+        }
+        catch {
+            // Unparseable package.json — matched by directory name and config only.
+        }
+        const pinned = (await read(`${dir}/SOURCE_COMMIT`))?.trim();
+        const configs = inside.filter((f) => !f.includes('/') && BUILD_CONFIG_RE.test(f));
+        const configText = (await Promise.all(configs.map((f) => read(`${dir}/${f}`)))).join('\n');
+        out.push({
+            dir,
+            packageName,
+            // 64 for SHA-256 repositories.
+            sourceCommit: pinned && /^[0-9a-f]{7,64}$/i.test(pinned) ? pinned : undefined,
+            configText,
+        });
+    }
+    return out;
+}
+/** `extenshi-storage.esm.min.js` → `extenshi-storage`: the name a source directory would carry. */
+function bundleStem(file) {
+    let stem = path.posix
+        .basename(file)
+        .toLowerCase()
+        .replace(/\.[cm]?js$/, '');
+    for (;;) {
+        const next = stem.replace(/[.-](?:min|esm|umd|cjs|iife|bundle|prod|production)$/, '');
+        if (next === stem)
+            return stem;
+        stem = next;
+    }
+}
+/** Suffixes that name the same library's source, not another library (`react-dom` is not `react`). */
+const SOURCE_SUFFIX_RE = /^[-_.](?:sdk|src|source|lib|library|js|core)$/;
+function namesMatch(stem, name) {
+    const n = name.toLowerCase().replace(/^@[^/]+\//, '');
+    return n === stem || (n.startsWith(stem) && SOURCE_SUFFIX_RE.test(n.slice(stem.length)));
+}
+/**
+ * Which `vendor-src/<name>/` holds the source of a minified file: its build
+ * configuration names the file, or the directory (or its package name) is the
+ * file's own name, optionally with a source-ish suffix —
+ * `extenshi-storage.esm.min.js` ↔ `vendor-src/extenshi-storage-sdk/`. BUILD.md
+ * says which rule matched, so a wrong attribution is visible.
+ */
+function matchVendorSource(file, sources) {
+    const base = path.posix.basename(file);
+    // The whole file name, not a substring: `dist/myapp.min.js` in a config is not `app.min.js`.
+    const named = new RegExp(`(?:^|[^\\w.-])${base.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:[^\\w.-]|$)`);
+    const byConfig = sources.find((s) => named.test(s.configText));
+    if (byConfig)
+        return { source: byConfig, by: 'build config' };
+    const stem = bundleStem(file);
+    const byName = sources.find((s) => namesMatch(stem, path.posix.basename(s.dir)) || (s.packageName && namesMatch(stem, s.packageName)));
+    return byName ? { source: byName, by: 'name' } : undefined;
+}
+// ── Clean-room rebuild ───────────────────────────────────────────────────────
+function sha256(buf) {
+    return createHash('sha256').update(buf).digest('hex');
+}
+async function extractTo(zip, dir) {
+    for (const entry of Object.values(zip.files)) {
+        if (entry.dir)
+            continue;
+        const dest = path.join(dir, ...entry.name.split('/'));
+        // The archive is self-made, but keep the helper safe for any zip.
+        if (!dest.startsWith(dir + path.sep))
+            throw new Error(`refusing to extract ${entry.name} outside the clean room`);
+        fs.mkdirSync(path.dirname(dest), { recursive: true });
+        fs.writeFileSync(dest, await entry.async('nodebuffer'));
+        const mode = typeof entry.unixPermissions === 'number' ? entry.unixPermissions & 0o777 : 0;
+        if (mode)
+            fs.chmodSync(dest, mode);
+    }
+}
+/**
+ * What the clean room inherits: where tools live, who the user is, temp and
+ * locale settings, and how to reach the network. Nothing else — a `VITE_*`,
+ * `NODE_ENV` or release-channel variable in the developer's shell would make
+ * the rebuild match while the documented commands alone, on a reviewer's
+ * machine, would not. A build that needs such a value must say so in --build.
+ * SOURCE_DATE_EPOCH is let through: a fixed timestamp leaks no project state,
+ * and reproducible-build tooling expects to see it.
+ */
+const CLEAN_ROOM_ENV_RE = /^(?:SOURCE_DATE_EPOCH|PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TMP|TEMP|LANG|LC_[A-Z]+|TERM|HTTPS?_PROXY|NO_PROXY|https?_proxy|no_proxy|NODE_EXTRA_CA_CERTS|SSL_CERT_(?:FILE|DIR)|SYSTEMROOT|COMSPEC|PATHEXT|WINDIR|APPDATA|LOCALAPPDATA|USERPROFILE|PROGRAMDATA)$/i;
+/** Per command: generous for a cold `npm ci`, finite for CI. */
+const CLEAN_ROOM_TIMEOUT_MS = 30 * 60 * 1000;
+function cleanEnv() {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env))
+        if (CLEAN_ROOM_ENV_RE.test(k))
+            env[k] = v;
+    return env;
+}
+/**
+ * Validate `--verify` before anything is written, so a typo does not leave a
+ * fresh archive without its BUILD.md.
+ */
+function verifyTarget(projectDir, packagePath, commands) {
+    const rel = path.relative(projectDir, path.resolve(projectDir, packagePath));
+    if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+        throw new Error(`--verify: ${packagePath} is outside ${projectDir}; pass the package the build writes inside the project`);
+    }
+    const submitted = path.join(projectDir, rel);
+    if (!fs.existsSync(submitted) || !fs.statSync(submitted).isFile()) {
+        throw new Error(`--verify: ${submitted} does not exist — build the package you will upload first, then verify it`);
+    }
+    if (commands.length === 0) {
+        throw new Error('--verify: no build command — pass --build "<command>" (package.json has no build script)');
+    }
+    return rel;
+}
+async function verifyRebuild(input) {
+    const expected = sha256(fs.readFileSync(path.join(input.projectDir, input.rel)));
+    const cleanRoom = fs.mkdtempSync(path.join(os.tmpdir(), 'extenshi-amo-cleanroom-'));
+    const result = {
+        packagePath: input.rel.split(path.sep).join('/'),
+        expected,
+        actual: null,
+        match: false,
+        commands: input.commands,
+    };
+    try {
+        await extractTo(input.zip, cleanRoom);
+        const env = cleanEnv();
+        for (const command of input.commands) {
+            execSync(command, {
+                cwd: cleanRoom,
+                env,
+                stdio: input.quiet ? 'ignore' : ['ignore', process.stderr, process.stderr],
+                // A hung install or a watch-mode build fails the check instead of blocking forever.
+                timeout: CLEAN_ROOM_TIMEOUT_MS,
+            });
+        }
+        const rebuilt = path.join(cleanRoom, input.rel);
+        if (fs.existsSync(rebuilt))
+            result.actual = sha256(fs.readFileSync(rebuilt));
+        else
+            result.error = `the build did not write ${result.packagePath}`;
+    }
+    catch (err) {
+        result.error = err.message.split('\n')[0];
+    }
+    result.match = result.actual === expected;
+    if (result.match)
+        fs.rmSync(cleanRoom, { recursive: true, force: true });
+    else
+        result.cleanRoom = cleanRoom;
+    return result;
+}
+// ── BUILD.md ─────────────────────────────────────────────────────────────────
 function renderBuildMd(input) {
-    const installCmd = input.lockfile?.installCmd ?? 'npm install';
-    const buildCmd = input.buildScript ? `npm run ${input.buildScript}` : undefined;
-    const commands = [installCmd, buildCmd].filter((c) => Boolean(c));
     const blockersBlock = input.blockers.length === 0
         ? '_None detected._'
         : input.blockers
-            .map((f) => `- \`${f.path}\` — no reproducible-build banner found. Vendor its pre-minification source (e.g. under \`vendor-src/\`), add a build script that reproduces it byte-for-byte, and document the exact command here.`)
+            .map((f) => `- \`${f.path}\` — no reproducible-build banner found. Vendor its pre-minification source under \`vendor-src/<name>/\` (pin the upstream commit in \`vendor-src/<name>/SOURCE_COMMIT\`), add a build script that reproduces it byte-for-byte, and document the exact command here.`)
             .join('\n');
-    const reproducibleBlock = input.reproducible.length === 0
+    const vendoredPaths = new Set(input.vendored.map((v) => v.path));
+    const vendoredBlock = input.vendored.length === 0
+        ? ''
+        : `\n## Vendored bundles rebuilt from vendor-src/\n\n${input.vendored
+            .map((v) => `- \`${v.path}\` — source in \`${v.sourceDir}/\` (matched by ${v.matchedBy})${v.sourceCommit ? `, upstream commit \`${v.sourceCommit}\`` : ' — no `SOURCE_COMMIT` file, name the upstream commit here'}. Document the command that rebuilds it byte-for-byte.`)
+            .join('\n')}\n`;
+    const bannerOnly = input.reproducible.filter((f) => !vendoredPaths.has(f.path));
+    const reproducibleBlock = bannerOnly.length === 0
         ? ''
-        : `\n## Vendored bundles with a provenance banner\n\n${input.reproducible
+        : `\n## Vendored bundles with a provenance banner\n\n${bannerOnly
             .map((f) => `- \`${f.path}\` — declares its own version/commit/build command in a header comment.`)
             .join('\n')}\n`;
+    const v = input.verification;
+    const verifiedLine = v?.match === true
+        ? `\nThe uploaded package is \`${v.packagePath}\`, SHA-256 \`${v.expected}\`. The steps above rebuilt it byte for byte from this archive in an empty directory (\`extenshi amo-source --verify\`).\n`
+        : '';
     return `# Source code for AMO review
 
 Upload the sibling \`.zip\` in AMO's "Source code" step, and paste the section
@@ -189,15 +451,15 @@ Requirements:
 - Node.js ${input.nodeVersion}${input.npmVersion ? `, npm ${input.npmVersion}` : ''}${input.lockfile ? ` (${input.lockfile.manager}, lockfile included)` : ' (no lockfile found — pin your own versions here)'}
 
 \`\`\`sh
-${commands.length > 0 ? commands.join('\n') : '# No install/build script detected in package.json — fill in the exact commands here.'}
+${input.commands.length > 0 ? input.commands.join('\n') : '# No install/build script detected in package.json — fill in the exact commands here.'}
 \`\`\`
-
+${verifiedLine}
 ${input.commit ? `Archived from commit \`${input.commit}\`.` : 'Archived from an uncommitted directory (not a git repository, or no commits yet) — there is no commit to diff against.'}
 
 ## Files that need a source-code submission
 
 ${blockersBlock}
-${reproducibleBlock}
+${vendoredBlock}${reproducibleBlock}
 ## web-ext lint
 
 Run \`npx web-ext@10 lint --source-dir <built-output>\` and confirm 0 errors
@@ -216,25 +478,84 @@ export async function runAmoSource(opts) {
     }
     const zipPath = path.resolve(opts.outputPath ?? 'amo-source.zip');
     const buildMdPath = path.join(path.dirname(zipPath), 'BUILD.md');
-    const { zip, textFiles, fileCount } = walkProject(projectDir, zipPath);
+    // A repository with no commit yet has no HEAD to archive; treat it as a directory.
+    const archive = git.isRepo && git.commit
+        ? await archiveFromGit(projectDir, zipPath, git.commitTime ?? FIXED_ENTRY_DATE)
+        : archiveFromDisk(projectDir, zipPath);
+    const { zip, textFiles, files, skipped } = archive;
     const minified = detectMinifiedFiles(textFiles);
-    const blockers = minified.filter((f) => !f.hasProvenanceBanner);
-    const reproducible = minified.filter((f) => f.hasProvenanceBanner);
-    const pkg = readPackageJson(projectDir);
+    const sources = await vendorSourceDirs(zip, files);
+    const vendored = [];
+    for (const f of minified) {
+        const match = matchVendorSource(f.path, sources);
+        if (match)
+            vendored.push({
+                ...f,
+                sourceDir: match.source.dir,
+                sourceCommit: match.source.sourceCommit,
+                matchedBy: match.by,
+            });
+    }
+    const vendoredPaths = new Set(vendored.map((v) => v.path));
+    const blockers = minified.filter((f) => !f.hasProvenanceBanner && !vendoredPaths.has(f.path));
+    const reproducible = minified.filter((f) => f.hasProvenanceBanner || vendoredPaths.has(f.path));
+    // From the ARCHIVE, like the lockfile below: what is not in it never reaches
+    // the reviewer, so BUILD.md must not be derived from it.
+    let pkg = {};
+    try {
+        pkg = JSON.parse((await zip.file('package.json')?.async('string')) ?? '{}');
+    }
+    catch {
+        // An unparseable package.json — no engines, no default build script.
+    }
+    // A lockfile on disk that is gitignored does not reach the reviewer, so
+    // BUILD.md must not promise it and `npm ci` would fail.
+    const lockfile = LOCKFILES.find((l) => files.includes(l.file));
+    const installCmd = lockfile?.installCmd ?? 'npm install';
+    const buildCmd = opts.buildCommand ?? (pkg.scripts?.build ? 'npm run build' : undefined);
+    const commands = [installCmd, buildCmd].filter((c) => Boolean(c));
+    // The clean room runs only a real rebuild: an install with no build after it
+    // proves nothing, and `npm install` without a package.json invents one.
+    const rebuildCommands = buildCmd
+        ? [files.includes('package.json') ? installCmd : undefined, buildCmd].filter((c) => Boolean(c))
+        : [];
+    const verifyRel = opts.verifyPackage
+        ? verifyTarget(projectDir, opts.verifyPackage, rebuildCommands)
+        : undefined;
+    fs.mkdirSync(path.dirname(zipPath), { recursive: true });
+    const buf = await zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE', platform: 'UNIX' });
+    fs.writeFileSync(zipPath, buf);
+    const verification = verifyRel
+        ? await verifyRebuild({
+            projectDir,
+            // Rebuild from the bytes that were written, not from the working tree.
+            zip: await JSZip.loadAsync(buf),
+            rel: verifyRel,
+            commands: rebuildCommands,
+            quiet: opts.quiet ?? false,
+        })
+        : undefined;
     const buildMd = renderBuildMd({
-        projectDir,
         commit: git.commit,
         nodeVersion: pkg.engines?.node ?? process.version,
         npmVersion: pkg.engines?.npm ?? npmVersion(),
-        lockfile: detectLockfile(projectDir),
-        buildScript: pkg.scripts?.build ? 'build' : undefined,
+        lockfile,
+        commands,
         blockers,
         reproducible,
+        vendored,
+        verification,
     });
-    fs.mkdirSync(path.dirname(zipPath), { recursive: true });
-    const buf = await zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE' });
-    fs.writeFileSync(zipPath, buf);
     fs.writeFileSync(buildMdPath, buildMd, 'utf8');
-    return { zipPath, buildMdPath, fileCount, blockers, reproducible };
+    return {
+        zipPath,
+        buildMdPath,
+        fileCount: files.length,
+        blockers,
+        reproducible,
+        vendored,
+        skipped,
+        verification,
+    };
 }
 //# sourceMappingURL=amo-source.js.map