@extenshi/cli 0.23.1 → 0.25.0

package/README.md

@@ -49,7 +49,7 @@ Only missing, untracked, source-changed or target-edited keys appear in the requ
 
 Apply requires a reviewed bundle and rejects unknown keys, empty messages, changed placeholders, changed positional substitutions or dollar escapes, missing protected terms, stale source hashes, invalid locale paths and symlinked workspace files. It validates all requested locales before writing and checks localized manifest lengths plus new findings from the existing listing risk rules against the default locale. Manifest checks resolve case-insensitive message names, static named placeholders and dollar escapes before measuring visible text. Manifest strings that require runtime positional arguments are rejected; use static content there. Checks are heuristic and cannot certify translation accuracy or store acceptance. Complete translations are required for each applied locale; sparse browser fallback catalogs need their missing keys translated first.
 
-`check` prints JSON and exits with status 1 for missing, stale, unreviewed or invalid translations, including target locales configured but not created. This workflow covers extension message catalogs, including localized manifest text. Full store descriptions and screenshots need separate localization. RTL text is accepted for supported locales, but visual direction, overflow and interaction need testing in the target browser.
+`check` prints JSON and exits with status 1 for missing, stale, unreviewed or invalid translations, including target locales configured but not created. A project that keeps its own translations (for example a script that writes every `messages.json`) has no `.extenshi-localization.json`, so nothing there was ever reviewed through prepare/apply. Without that file `check` runs in `parity-only` mode, or run `check ./extension --parity-only` yourself: it compares every locale with the default locale for missing or extra keys, changed `$NAME$`, `$1` and `$$` tokens and `placeholders` definitions, empty or malformed messages, reserved `@@` names, case-only duplicates, a missing `default_locale` directory and locale directories Chrome ignores, plus the same listing-risk and manifest length findings review mode reports; it ignores review state. See the localization guide for the rule list. The JSON reports `"mode"` and, when the mode was chosen automatically, a `note`. This workflow covers extension message catalogs, including localized manifest text. Full store descriptions and screenshots need separate localization. RTL text is accepted for supported locales, but visual direction, overflow and interaction need testing in the target browser.
 
 
 ### Standalone Pay

package/dist/amo-source.d.ts

@@ -1,34 +1,77 @@
 /**
- * `extenshi amo-source <project-dir> [--out <path>]` — produce the AMO
- * source-code archive + BUILD.md reviewer instructions.
+ * `extenshi amo-source <project-dir> [--out <path>] [--build <cmd>] [--verify <package>]`
+ * — produce the AMO source-code archive + BUILD.md reviewer instructions, and
+ * optionally prove a reviewer can rebuild the package from it.
  *
  * AMO requires reviewable source for any minified/bundled/transpiled code so a
  * reviewer can rebuild the extension and diff it against the submitted
  * package: https://extensionworkshop.com/documentation/publish/source-code-submission/
  *
- * This command does NOT run the build itself and does NOT talk to AMO's API
- * (that is `publisher/src/services/firefox.ts`, owned separately). It only:
- *   1. archives the project's tracked-looking source (excluding node_modules,
- *      dist, .git, dotenv secrets, and any top-level directory the project's
- *      own .gitignore names plainly — e.g. `dist-firefox/`, `dist-edge/`),
- *   2. writes BUILD.md with the exact commands a reviewer needs (Node/npm
- *      versions, package manager + lockfile, the build script from
- *      package.json), and
+ * This command does NOT talk to AMO's API (that is
+ * `publisher/src/services/firefox.ts`, owned separately). It:
+ *   1. archives the project's source — in a git repository `git archive HEAD`
+ *      (.gitignore, nested ignore files, export-ignore and untracked build
+ *      output all stay out); outside git, every file minus
+ *      node_modules/dist-style directories and what the top-level .gitignore
+ *      names. Dotenv files, symlinks and files over 25 MB never go in, and the
+ *      result lists each one it left out;
+ *   2. writes BUILD.md with the commands a reviewer needs (Node/npm versions,
+ *      package manager + lockfile, the build command);
  *   3. flags vendored minified files that carry no reproducible-build
- *      provenance as BLOCKERS — the developer must vendor their source (e.g.
- *      under vendor-src/) before submitting.
+ *      provenance as BLOCKERS — unless their source is vendored under
+ *      `vendor-src/<name>/` (optionally pinned by a `SOURCE_COMMIT` file), the
+ *      layout these docs tell developers to use;
+ *   4. with `--verify <package>`, unpacks the archive into an empty directory,
+ *      runs the install + build there, and compares the rebuilt package's
+ *      SHA-256 with the one you are about to upload.
  *
- * If the project directory is a clean git working tree, the archive is
- * refused when there are uncommitted changes (matching the pattern this repo
- * already uses for its own extension projects) — the archive should match a
- * commit a reviewer can also check out. A directory that is not a git repo at
- * all is archived as-is; there is nothing to compare it against.
+ * If the project directory is a git working tree, the archive is refused when
+ * there are uncommitted changes — the archive should match a commit a reviewer
+ * can also check out. A directory that is not a git repo at all is archived
+ * as-is; there is nothing to compare it against.
  */
 import { type MinifiedFileFinding } from './amo-source-detect.js';
 export interface AmoSourceOptions {
     projectDir: string;
     /** Where to write the archive. Default: `amo-source.zip` in the current directory. */
     outputPath?: string;
+    /**
+     * The build step a reviewer runs after installing (BUILD.md, and `--verify`).
+     * Default: `npm run build` when package.json has a build script.
+     */
+    buildCommand?: string;
+    /**
+     * The package you will upload, relative to the project (e.g.
+     * `deploy-firefox.zip`). Rebuild it in a clean directory from the archive and
+     * compare SHA-256 digests.
+     */
+    verifyPackage?: string;
+    /** Discard the clean-room install/build output instead of streaming it to stderr. */
+    quiet?: boolean;
+}
+/** A minified file whose source is vendored under `vendor-src/`. */
+export interface VendoredBundle extends MinifiedFileFinding {
+    /** `vendor-src/<name>` — the directory holding its source. */
+    sourceDir: string;
+    /** The upstream commit pinned in `<sourceDir>/SOURCE_COMMIT`, when there is one. */
+    sourceCommit?: string;
+    /** Which rule tied the file to its source: the build config names it, or the directory name does. */
+    matchedBy: 'build config' | 'name';
+}
+export interface VerifyResult {
+    /** Project-relative path of the package that was compared. */
+    packagePath: string;
+    /** SHA-256 of the package in the project — the one you upload. */
+    expected: string;
+    /** SHA-256 of the package rebuilt from the archive, or null when the build did not produce it. */
+    actual: string | null;
+    match: boolean;
+    /** What ran in the clean room, in order. */
+    commands: string[];
+    /** Kept for inspection when the rebuild did not match; removed otherwise. */
+    cleanRoom?: string;
+    /** Why the rebuild failed, when it did. */
+    error?: string;
 }
 export interface AmoSourceResult {
     zipPath: string;
@@ -36,6 +79,34 @@ export interface AmoSourceResult {
     fileCount: number;
     blockers: MinifiedFileFinding[];
     reproducible: MinifiedFileFinding[];
+    /** Minified files recognised as rebuilt from `vendor-src/` (subset of `reproducible`). */
+    vendored: VendoredBundle[];
+    /** Files the archive leaves out (dotenv, symlinks, over 25 MB), with the reason. */
+    skipped: SkippedFile[];
+    verification?: VerifyResult;
+}
+interface IgnoreRule {
+    re: RegExp;
+    negate: boolean;
+    dirOnly: boolean;
+}
+/**
+ * The top-level `.gitignore` of a project that is NOT a git repository, read
+ * the way git reads it: comments, `!` negation, trailing `/` for directories,
+ * a leading or inner `/` anchoring the pattern to the root, `*`, `?`, `**`,
+ * last match wins. Character classes (`[abc]`) and backslash escapes are not
+ * supported; such a pattern matches literally, so the file stays IN the archive
+ * (the safe direction). Inside a repository none of this runs — `git ls-files`
+ * already applies every ignore file git knows about.
+ */
+export declare function compileGitignore(raw: string): IgnoreRule[];
+/** `rel` is a project-relative posix path. */
+export declare function isGitignored(rel: string, isDir: boolean, rules: readonly IgnoreRule[]): boolean;
+/** A file left out of the archive, and why — reported, never dropped silently. */
+export interface SkippedFile {
+    path: string;
+    reason: string;
 }
 export declare function runAmoSource(opts: AmoSourceOptions): Promise<AmoSourceResult>;
+export {};
 //# sourceMappingURL=amo-source.d.ts.map

package/dist/amo-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"amo-source.d.ts","sourceRoot":"","sources":["../src/amo-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAsDtF,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,YAAY,EAAE,mBAAmB,EAAE,CAAA;CACnC;AAyJD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuCnF"}
+{"version":3,"file":"amo-source.d.ts","sourceRoot":"","sources":["../src/amo-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAQH,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AA2BtF,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,cAAe,SAAQ,mBAAmB;IAC1D,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qGAAqG;IACrG,SAAS,EAAE,cAAc,GAAG,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,YAAY;IAC5B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAA;IACnB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAA;IAChB,kGAAkG;IAClG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,KAAK,EAAE,OAAO,CAAA;IACd,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,YAAY,EAAE,mBAAmB,EAAE,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,oFAAoF;IACpF,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,YAAY,CAAA;CAC3B;AA4CD,UAAU,UAAU;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CAChB;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAgB1D;AAED,8CAA8C;AAC9C,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAO/F;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACd;AA0XD,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA0GnF"}