@extenshi/cli 0.8.1 → 0.10.0

package/dist/login-runtime.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The real I/O behind `runBrowserLogin`: a one-shot loopback listener, a
+ * browser launcher, and an interruptible sleep.
+ *
+ * Kept apart from `login-flow.ts` so the state machine can be tested without
+ * binding sockets or launching applications.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-runtime.ts`, and
+ * pinned equal by `login-twin-sync.test.ts`. See the note in `login-flow.ts`
+ * for why the two published packages duplicate rather than share.
+ */
+import type { LoopbackListener } from './login-flow.js';
+/**
+ * Bind a loopback listener for the browser to come back to.
+ *
+ * Returns null — never throws — when binding is not possible: a sandbox that
+ * forbids listening, an SSH session with no browser on this machine, an
+ * exhausted port range. The login then completes by polling alone, so a null
+ * here costs the user a tab they have to close by hand and nothing else.
+ *
+ * Binds to 127.0.0.1 explicitly rather than all interfaces: it must not become
+ * a socket anything off-box can reach, and on macOS binding to 0.0.0.0 is what
+ * triggers the "accept incoming connections?" firewall prompt.
+ */
+export declare function openLoopback(): Promise<LoopbackListener | null>;
+/**
+ * Launch the browser, reporting whether it plausibly worked.
+ *
+ * A false return is not an error: SSH sessions, containers and bare servers
+ * legitimately have nothing to launch, and the caller prints the URL for the
+ * user to open elsewhere. Env vars that mean "no browser here" are honoured
+ * before trying, because launching under `CI` would hang a pipeline on a
+ * spawned process nobody can see.
+ */
+export declare function openBrowser(url: string): Promise<boolean>;
+/** Sleep, cut short if `wakeup` settles first. */
+export declare function sleep(ms: number, wakeup?: Promise<unknown>): Promise<void>;
+//# sourceMappingURL=login-runtime.d.ts.map

package/dist/login-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runtime.d.ts","sourceRoot":"","sources":["../src/login-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAsCvD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAkErE;AAcD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6B/D;AAED,kDAAkD;AAClD,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1E"}

package/dist/login-runtime.js

@@ -0,0 +1,186 @@
+/**
+ * The real I/O behind `runBrowserLogin`: a one-shot loopback listener, a
+ * browser launcher, and an interruptible sleep.
+ *
+ * Kept apart from `login-flow.ts` so the state machine can be tested without
+ * binding sockets or launching applications.
+ *
+ * TWIN FILE — byte-identical to `tools/extenshi-cli/src/login-runtime.ts`, and
+ * pinned equal by `login-twin-sync.test.ts`. See the note in `login-flow.ts`
+ * for why the two published packages duplicate rather than share.
+ */
+import { spawn } from 'node:child_process';
+import http from 'node:http';
+/** Give up on binding rather than hang a login on a firewall prompt. */
+const BIND_TIMEOUT_MS = 2_000;
+const CALLBACK_PATH = '/callback';
+/**
+ * The page the browser lands on after approving.
+ *
+ * Self-contained (no network, no fonts): it is served from a throwaway local
+ * server that is about to close, so anything it references would fail to load.
+ * `window.close()` only works for script-opened tabs, so the text has to stand
+ * on its own when the tab stays put.
+ */
+function resultPage(result) {
+    const approved = result !== 'denied';
+    const title = approved ? 'Terminal connected' : 'Login declined';
+    const body = approved
+        ? 'You can close this tab and go back to your terminal.'
+        : 'Nothing was connected. You can close this tab.';
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><title>${title} · Extenshi</title>
+<style>
+ :root { color-scheme: light dark }
+ body { font: 16px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; display: grid;
+        place-items: center; min-height: 100vh; margin: 0; text-align: center; padding: 24px }
+ .card { max-width: 26rem }
+ h1 { font-size: 1.25rem; margin: 0 0 .5rem }
+ p { margin: 0; opacity: .75 }
+ .mark { font-size: 2.5rem; line-height: 1; margin-bottom: .75rem }
+</style></head>
+<body><div class="card">
+ <div class="mark">${approved ? '✓' : '✕'}</div>
+ <h1>${title}</h1><p>${body}</p>
+</div><script>setTimeout(function(){window.close()},1200)</script></body></html>`;
+}
+/**
+ * Bind a loopback listener for the browser to come back to.
+ *
+ * Returns null — never throws — when binding is not possible: a sandbox that
+ * forbids listening, an SSH session with no browser on this machine, an
+ * exhausted port range. The login then completes by polling alone, so a null
+ * here costs the user a tab they have to close by hand and nothing else.
+ *
+ * Binds to 127.0.0.1 explicitly rather than all interfaces: it must not become
+ * a socket anything off-box can reach, and on macOS binding to 0.0.0.0 is what
+ * triggers the "accept incoming connections?" firewall prompt.
+ */
+export async function openLoopback() {
+    let resolveHit = () => { };
+    const hit = new Promise((resolve) => {
+        resolveHit = resolve;
+    });
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== CALLBACK_PATH) {
+            res.writeHead(404, { 'content-type': 'text/plain' });
+            res.end('Not found');
+            return;
+        }
+        // `result` is display-only: what actually happened is decided by the poll
+        // that follows, so a hand-crafted request to this port can change the page
+        // wording and nothing else.
+        const result = url.searchParams.get('result') ?? 'approved';
+        res.writeHead(200, {
+            'content-type': 'text/html; charset=utf-8',
+            // The page states the outcome of a one-time login; caching it would
+            // show a stale verdict on the next one.
+            'cache-control': 'no-store',
+        });
+        res.end(resultPage(result));
+        resolveHit();
+    });
+    const bound = await new Promise((resolve) => {
+        const settle = (ok) => {
+            clearTimeout(timer);
+            server.removeAllListeners('error');
+            resolve(ok);
+        };
+        const timer = setTimeout(() => settle(false), BIND_TIMEOUT_MS);
+        server.once('error', () => settle(false));
+        try {
+            server.listen(0, '127.0.0.1', () => settle(true));
+        }
+        catch {
+            settle(false);
+        }
+    });
+    if (!bound) {
+        server.close();
+        return null;
+    }
+    const address = server.address();
+    if (!address || typeof address.port !== 'number') {
+        server.close();
+        return null;
+    }
+    // Don't hold the process open: if the browser never comes back, the poll loop
+    // (and Ctrl-C) must still be what ends the command.
+    server.unref();
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}${CALLBACK_PATH}`,
+        hit,
+        close: () => {
+            server.close();
+            // A tab kept alive by keep-alive would otherwise delay the close.
+            server.closeAllConnections?.();
+        },
+    };
+}
+/** Per-platform "open this URL in whatever the user uses". */
+function openCommand(url) {
+    if (process.platform === 'darwin')
+        return { command: 'open', args: [url] };
+    if (process.platform === 'win32') {
+        // `start` is a cmd builtin, and its first quoted argument is the WINDOW
+        // TITLE — hence the empty "" before the URL, without which a quoted URL
+        // silently becomes a title and no browser opens.
+        return { command: 'cmd', args: ['/c', 'start', '""', url] };
+    }
+    return { command: 'xdg-open', args: [url] };
+}
+/**
+ * Launch the browser, reporting whether it plausibly worked.
+ *
+ * A false return is not an error: SSH sessions, containers and bare servers
+ * legitimately have nothing to launch, and the caller prints the URL for the
+ * user to open elsewhere. Env vars that mean "no browser here" are honoured
+ * before trying, because launching under `CI` would hang a pipeline on a
+ * spawned process nobody can see.
+ */
+export async function openBrowser(url) {
+    if (process.env.EXTENSHI_NO_BROWSER || process.env.CI)
+        return false;
+    // A Linux box with no display has no browser to open — but WSL does, via the
+    // Windows host, so don't treat "no DISPLAY" as decisive there.
+    if (process.platform === 'linux' &&
+        !process.env.DISPLAY &&
+        !process.env.WAYLAND_DISPLAY &&
+        !process.env.WSL_DISTRO_NAME) {
+        return false;
+    }
+    const { command, args } = openCommand(url);
+    return new Promise((resolve) => {
+        try {
+            const child = spawn(command, args, { stdio: 'ignore', detached: true });
+            // An ENOENT (`xdg-open` not installed) arrives asynchronously, so resolve
+            // on whichever comes first: the error, or the process getting far enough
+            // to be disowned.
+            child.once('error', () => resolve(false));
+            child.once('spawn', () => {
+                child.unref();
+                resolve(true);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/** Sleep, cut short if `wakeup` settles first. */
+export function sleep(ms, wakeup) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        // Never let a pending sleep be the reason the CLI won't exit.
+        timer.unref?.();
+        void wakeup?.then(() => {
+            clearTimeout(timer);
+            resolve();
+        }, () => {
+            clearTimeout(timer);
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=login-runtime.js.map

package/dist/login-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-runtime.js","sourceRoot":"","sources":["../src/login-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAA;AAI5B,wEAAwE;AACxE,MAAM,eAAe,GAAG,KAAK,CAAA;AAE7B,MAAM,aAAa,GAAG,WAAW,CAAA;AAEjC;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAc;IACjC,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAA;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAChE,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,sDAAsD;QACxD,CAAC,CAAC,gDAAgD,CAAA;IACnD,OAAO;qDAC6C,KAAK;;;;;;;;;;;qBAWrC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;OAClC,KAAK,WAAW,IAAI;iFACsD,CAAA;AACjF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,IAAI,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,UAAU,GAAG,OAAO,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACP,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4BAA4B;QAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAA;QAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,0BAA0B;YAC1C,oEAAoE;YACpE,wCAAwC;YACxC,eAAe,EAAE,UAAU;SAC3B,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,UAAU,EAAE,CAAA;IACb,CAAC,CAAC,CAAA;IAEF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,CAAC,EAAW,EAAE,EAAE;YAC9B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAClC,OAAO,CAAC,EAAE,CAAC,CAAA;QACZ,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAA;QAC9D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACzC,IAAI,CAAC;YACJ,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,CAAC,KAAK,CAAC,CAAA;QACd,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAwB,CAAA;IACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,8EAA8E;IAC9E,oDAAoD;IACpD,MAAM,CAAC,KAAK,EAAE,CAAA;IAEd,OAAO;QACN,WAAW,EAAE,oBAAoB,OAAO,CAAC,IAAI,GAAG,aAAa,EAAE;QAC/D,GAAG;QACH,KAAK,EAAE,GAAG,EAAE;YACX,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,kEAAkE;YAClE,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAA;QAC/B,CAAC;KACD,CAAA;AACF,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,GAAW;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,wEAAwE;QACxE,wEAAwE;QACxE,iDAAiD;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IACnE,6EAA6E;IAC7E,+DAA+D;IAC/D,IACC,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACpB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe;QAC5B,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAC3B,CAAC;QACF,OAAO,KAAK,CAAA;IACb,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1C,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,kBAAkB;YAClB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,KAAK,CAAC,KAAK,EAAE,CAAA;gBACb,OAAO,CAAC,IAAI,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,CAAA;QACf,CAAC;IACF,CAAC,CAAC,CAAA;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAyB;IAC1D,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACrC,8DAA8D;QAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,KAAK,MAAM,EAAE,IAAI,CAChB,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,EAAE,CAAA;QACV,CAAC,EACD,GAAG,EAAE;YACJ,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,EAAE,CAAA;QACV,CAAC,CACD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC"}

package/dist/risk.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `extenshi risk` — bulk safety lookup for extensions you already have,
+ * addressed by their STORE ids.
+ *
+ * This is the inventory case: you hold a list of installed extensions (from a
+ * fleet report, an MDM export, `chrome://extensions`) and want to know which of
+ * them are risky, without knowing their catalog ids.
+ *
+ * Why it exists as its own command
+ * --------------------------------
+ * Doing this one extension at a time cost three metered catalog reads each
+ * (resolve the store id → follow the cluster canonical → fetch the risk
+ * summary). This command hits `security.getSecuritySummaryBatch`, which answers
+ * up to {@link MAX_EXTENSIONS_PER_REQUEST} extensions in ONE metered read — an
+ * 87-extension inventory drops from 261 credits to 3.
+ *
+ * Cluster correctness is handled server-side: each store id is resolved through
+ * its cross-store cluster to the same listing the extension page renders, so a
+ * score printed here matches the page a user can open. When the score comes
+ * from a DIFFERENT store's listing of the same extension (cluster members are
+ * scanned independently and genuinely disagree), the row says so rather than
+ * presenting a sibling's number as this listing's own.
+ */
+/**
+ * Max extensions per request.
+ *
+ * CROSS-PACKAGE SYNC POINT — this is a published npm package and cannot import
+ * from the BFF. The authority is `METERED_BATCH_MAX_EXTENSIONS` in
+ * `catalog/catalog-bff/src/lib/metered-batch-cap.ts`, which rejects an over-cap
+ * request; this constant only lets the CLI fail fast with a useful message
+ * instead of round-tripping. Pinned by `risk.test.ts`.
+ */
+export declare const MAX_EXTENSIONS_PER_REQUEST = 40;
+export type Store = 'CHROME' | 'FIREFOX' | 'EDGE';
+export interface StoreRef {
+    storeId: string;
+    store: Store;
+}
+/** Normalise a user-supplied store name, or undefined when unrecognised. */
+export declare function parseStore(value: string | undefined): Store | undefined;
+/**
+ * Parse the id list a caller supplied (argv and/or a `--file`) into store refs.
+ *
+ * Accepted per entry: a bare id (uses `defaultStore`) or `store:id`, so one
+ * file can mix browsers — which is the normal shape of a real inventory.
+ * Blank lines and `#` comments are skipped. Duplicates collapse: a user with
+ * the same extension in two profiles should not pay for it twice.
+ */
+export declare function parseRefs(entries: string[], defaultStore: Store): {
+    refs: StoreRef[];
+    invalid: string[];
+};
+/** One row as returned by the BFF batch (fields beyond these are ignored). */
+interface RiskRow {
+    storeId?: string;
+    store?: string;
+    extensionId?: number | null;
+    canonicalExtensionId?: number | null;
+    extensionName?: string | null;
+    riskCategory?: string | null;
+    riskScore?: number | string | null;
+    scoredExtensionId?: number | null;
+    scoredStore?: string | null;
+    totalFindings?: number | null;
+    lastScanDate?: string | null;
+}
+export declare function rankRow(row: RiskRow): number;
+export interface RunRiskOptions {
+    refs: StoreRef[];
+    bffUrl: string;
+    apiKey?: string;
+    outputJson: boolean;
+}
+export declare function runRisk(opts: RunRiskOptions): Promise<void>;
+export {};
+//# sourceMappingURL=risk.d.ts.map

package/dist/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../src/risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAE5C,MAAM,MAAM,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;AAEjD,MAAM,WAAW,QAAQ;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,KAAK,CAAA;CACZ;AAQD,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,SAAS,CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,GAAG;IAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BzG;AAED,8EAA8E;AAC9E,UAAU,OAAO;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAClC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AA0CD,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE5C;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,QAAQ,EAAE,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,OAAO,CAAA;CACnB;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDjE"}

package/dist/risk.js

@@ -0,0 +1,214 @@
+/**
+ * `extenshi risk` — bulk safety lookup for extensions you already have,
+ * addressed by their STORE ids.
+ *
+ * This is the inventory case: you hold a list of installed extensions (from a
+ * fleet report, an MDM export, `chrome://extensions`) and want to know which of
+ * them are risky, without knowing their catalog ids.
+ *
+ * Why it exists as its own command
+ * --------------------------------
+ * Doing this one extension at a time cost three metered catalog reads each
+ * (resolve the store id → follow the cluster canonical → fetch the risk
+ * summary). This command hits `security.getSecuritySummaryBatch`, which answers
+ * up to {@link MAX_EXTENSIONS_PER_REQUEST} extensions in ONE metered read — an
+ * 87-extension inventory drops from 261 credits to 3.
+ *
+ * Cluster correctness is handled server-side: each store id is resolved through
+ * its cross-store cluster to the same listing the extension page renders, so a
+ * score printed here matches the page a user can open. When the score comes
+ * from a DIFFERENT store's listing of the same extension (cluster members are
+ * scanned independently and genuinely disagree), the row says so rather than
+ * presenting a sibling's number as this listing's own.
+ */
+import chalk from 'chalk';
+import { fetch } from 'undici';
+const FETCH_TIMEOUT_MS = 20_000;
+/**
+ * Max extensions per request.
+ *
+ * CROSS-PACKAGE SYNC POINT — this is a published npm package and cannot import
+ * from the BFF. The authority is `METERED_BATCH_MAX_EXTENSIONS` in
+ * `catalog/catalog-bff/src/lib/metered-batch-cap.ts`, which rejects an over-cap
+ * request; this constant only lets the CLI fail fast with a useful message
+ * instead of round-tripping. Pinned by `risk.test.ts`.
+ */
+export const MAX_EXTENSIONS_PER_REQUEST = 40;
+const STORE_ALIASES = {
+    chrome: 'CHROME',
+    firefox: 'FIREFOX',
+    edge: 'EDGE',
+};
+/** Normalise a user-supplied store name, or undefined when unrecognised. */
+export function parseStore(value) {
+    if (!value)
+        return undefined;
+    return STORE_ALIASES[value.trim().toLowerCase()];
+}
+/**
+ * Parse the id list a caller supplied (argv and/or a `--file`) into store refs.
+ *
+ * Accepted per entry: a bare id (uses `defaultStore`) or `store:id`, so one
+ * file can mix browsers — which is the normal shape of a real inventory.
+ * Blank lines and `#` comments are skipped. Duplicates collapse: a user with
+ * the same extension in two profiles should not pay for it twice.
+ */
+export function parseRefs(entries, defaultStore) {
+    const refs = [];
+    const invalid = [];
+    const seen = new Set();
+    for (const raw of entries) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        let store = defaultStore;
+        let storeId = line;
+        const sep = line.indexOf(':');
+        if (sep > 0) {
+            const named = parseStore(line.slice(0, sep));
+            if (named) {
+                store = named;
+                storeId = line.slice(sep + 1).trim();
+            }
+        }
+        if (!storeId || storeId.length > 100) {
+            invalid.push(line);
+            continue;
+        }
+        const key = `${store}:${storeId}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        refs.push({ storeId, store });
+    }
+    return { refs, invalid };
+}
+/**
+ * The website's coefficient: 100 = safest. The backend stores RISK (0 = safest),
+ * so every user-facing surface inverts it — printing the raw number here would
+ * make the CLI contradict the extension page by construction.
+ */
+function toSafetyScore(risk) {
+    if (risk === undefined || risk === null)
+        return null;
+    const value = Number(risk);
+    if (!Number.isFinite(value))
+        return null;
+    return Math.max(0, Math.min(100, Math.round((100 - value) * 100) / 100));
+}
+function colorForCategory(category) {
+    switch (category) {
+        case 'CRITICAL':
+            return chalk.bgRed.white;
+        case 'HIGH':
+            return chalk.red;
+        case 'MEDIUM':
+            return chalk.yellow;
+        case 'LOW':
+            return chalk.cyan;
+        case 'NONE':
+            return chalk.green;
+        default:
+            return chalk.gray;
+    }
+}
+/** Severity order for the printed table: worst first, unscanned last. */
+const CATEGORY_RANK = {
+    CRITICAL: 0,
+    HIGH: 1,
+    MEDIUM: 2,
+    REVIEW_REQUIRED: 3,
+    LOW: 4,
+    NONE: 5,
+    UNKNOWN: 6,
+};
+export function rankRow(row) {
+    return CATEGORY_RANK[row.riskCategory ?? ''] ?? 7;
+}
+export async function runRisk(opts) {
+    if (opts.refs.length === 0) {
+        throw new Error('no extension ids given. Pass ids as arguments or use --file <path>.');
+    }
+    if (opts.refs.length > MAX_EXTENSIONS_PER_REQUEST) {
+        throw new Error(`${opts.refs.length} extensions given; the limit is ${MAX_EXTENSIONS_PER_REQUEST} per request.\n` +
+            `Split the list into batches of ${MAX_EXTENSIONS_PER_REQUEST} or fewer — each request costs ` +
+            '1 read credit, whatever its size.');
+    }
+    // tRPC queries travel as a GET query string, so the batch size bounds the URL
+    // length. Worst case the schema allows — 40 entries of 100-char Firefox ids —
+    // measured at 7,060 bytes and verified against the live BFF (HTTP 200), which
+    // leaves ~1 KB under nginx's default 8 KB header buffer. That margin is the
+    // real constraint on raising MAX_EXTENSIONS_PER_REQUEST: a larger cap needs
+    // the header buffer raised (or a POST transport) first, not just a new number.
+    const input = encodeURIComponent(JSON.stringify({ extensions: opts.refs }));
+    const url = `${opts.bffUrl}/api/trpc/security.getSecuritySummaryBatch?input=${input}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            headers: opts.apiKey ? { authorization: `Bearer ${opts.apiKey}` } : {},
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        const e = err;
+        const why = e.name === 'TimeoutError' ? `timed out after ${FETCH_TIMEOUT_MS / 1000}s` : e.message;
+        throw new Error(`could not reach the catalog (${why})`);
+    }
+    const body = (await res.json().catch(() => null));
+    if (body?.error?.message)
+        throw new Error(body.error.message);
+    if (!res.ok)
+        throw new Error(`catalog returned HTTP ${res.status}`);
+    const rows = (Array.isArray(body?.result?.data) ? body.result.data : []);
+    if (opts.outputJson) {
+        console.log(JSON.stringify({ requested: opts.refs.length, matched: rows.length, extensions: rows }, null, 2));
+        return;
+    }
+    printTable(opts.refs, rows);
+}
+function printTable(refs, rows) {
+    const byKey = new Map(rows.map((r) => [`${r.store}:${r.storeId}`, r]));
+    const sorted = [...rows].sort((a, b) => rankRow(a) - rankRow(b));
+    console.log('');
+    console.log(chalk.bold(`Safety for ${refs.length} extension${refs.length === 1 ? '' : 's'} (100 = safest)`));
+    console.log('');
+    if (sorted.length === 0) {
+        console.log(chalk.gray('  None of these ids matched a catalog listing.'));
+    }
+    for (const row of sorted) {
+        const color = colorForCategory(row.riskCategory);
+        const score = toSafetyScore(row.riskScore);
+        const name = row.extensionName ?? row.storeId ?? '(unnamed)';
+        const scoreText = score === null ? chalk.gray('  —') : color(String(score).padStart(3));
+        const category = row.riskCategory ? color(row.riskCategory) : chalk.gray('not scanned');
+        console.log(`  ${scoreText}  ${chalk.bold(name)}  ${category}`);
+        const details = [];
+        const canonical = row.canonicalExtensionId ?? row.extensionId;
+        if (canonical != null)
+            details.push(`https://catalog.extenshi.io/extensions/${canonical}`);
+        if (row.totalFindings != null)
+            details.push(`${row.totalFindings} findings`);
+        if (details.length > 0)
+            console.log(chalk.gray(`       ${details.join('  ·  ')}`));
+        // Cluster members are scanned independently and their scores disagree,
+        // so a borrowed number is labelled rather than presented as this
+        // listing's own.
+        if (row.scoredExtensionId != null && row.scoredExtensionId !== row.extensionId && row.scoredStore) {
+            console.log(chalk.gray(`       score measured on this extension's ${row.scoredStore} listing`));
+        }
+    }
+    const missing = refs.filter((ref) => !byKey.has(`${ref.store}:${ref.storeId}`));
+    if (missing.length > 0) {
+        console.log('');
+        console.log(chalk.gray(`  ${missing.length} id(s) have no catalog listing yet (not a safety verdict):`));
+        for (const ref of missing)
+            console.log(chalk.gray(`    ${ref.store.toLowerCase()}:${ref.storeId}`));
+    }
+    const unscanned = rows.filter((r) => r.riskCategory == null).length;
+    if (unscanned > 0) {
+        console.log('');
+        console.log(chalk.gray(`  ${unscanned} listed but never scanned — no score is not a clean bill of health.`));
+    }
+    console.log('');
+}
+//# sourceMappingURL=risk.js.map

package/dist/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../src/risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAA;AAS5C,MAAM,aAAa,GAA0B;IAC5C,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;CACZ,CAAA;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAiB,EAAE,YAAmB;IAC/D,MAAM,IAAI,GAAe,EAAE,CAAA;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAE9B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;QACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAE3C,IAAI,KAAK,GAAG,YAAY,CAAA;QACxB,IAAI,OAAO,GAAG,IAAI,CAAA;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACX,KAAK,GAAG,KAAK,CAAA;gBACb,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACrC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,SAAQ;QACT,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AACzB,CAAC;AAiBD;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAa;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAmC;IAC5D,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAA;QACzB,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,GAAG,CAAA;QACjB,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,MAAM,CAAA;QACpB,KAAK,KAAK;YACT,OAAO,KAAK,CAAC,IAAI,CAAA;QAClB,KAAK,MAAM;YACV,OAAO,KAAK,CAAC,KAAK,CAAA;QACnB;YACC,OAAO,KAAK,CAAC,IAAI,CAAA;IACnB,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,aAAa,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,eAAe,EAAE,CAAC;IAClB,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;CACV,CAAA;AAED,MAAM,UAAU,OAAO,CAAC,GAAY;IACnC,OAAO,aAAa,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,IAAI,CAAC,CAAA;AAClD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAoB;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,mCAAmC,0BAA0B,iBAAiB;YAChG,kCAAkC,0BAA0B,iCAAiC;YAC7F,mCAAmC,CACpC,CAAA;IACF,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,oDAAoD,KAAK,EAAE,CAAA;IAErF,IAAI,GAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YACtE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,GAAY,CAAA;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;QACjG,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAGxC,CAAA;IAER,IAAI,IAAI,EAAE,KAAK,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAc,CAAA;IAErF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAChG,CAAA;QACD,OAAM;IACP,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,IAAe;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAEhE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAA;IAC5G,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAEf,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,OAAO,IAAI,WAAW,CAAA;QAC5D,MAAM,SAAS,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACvF,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAA;QAE/D,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,WAAW,CAAA;QAC7D,IAAI,SAAS,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAA;QAC1F,IAAI,GAAG,CAAC,aAAa,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,aAAa,WAAW,CAAC,CAAA;QAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;QAElF,uEAAuE;QACvE,iEAAiE;QACjE,iBAAiB;QACjB,IAAI,GAAG,CAAC,iBAAiB,IAAI,IAAI,IAAI,GAAG,CAAC,iBAAiB,KAAK,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACnG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6CAA6C,GAAG,CAAC,WAAW,UAAU,CAAC,CAAC,CAAA;QAChG,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,MAAM,4DAA4D,CAAC,CAAC,CAAA;QACxG,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACpG,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;IACnE,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CACV,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,qEAAqE,CAAC,CAC/F,CAAA;IACF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAChB,CAAC"}

package/dist/scan.d.ts

@@ -31,7 +31,7 @@ import { type ComplianceReviewPayload } from './compliance-review.js';
  * ownership you have verified, and ONLY when you name one with
  * `--extension-id <id>` (the numeric catalog ID of a verified extension). A
  * bare `extenshi scan <artifact>` running on free credits therefore 403s —
- * which is confusing when dojo just says "5 free scans left".
+ * which is confusing when dojo just says "3 free scans left".
  *
  * The BFF signals this case via a stable `errorCode`
  * (`FREE_REQUIRES_CLAIM` / `FREE_REQUIRES_VERIFIED_OWNERSHIP`). The CLI ships

package/dist/scan.js

@@ -44,7 +44,7 @@ const DOJO_URL = 'https://dojo.extenshi.io';
  * ownership you have verified, and ONLY when you name one with
  * `--extension-id <id>` (the numeric catalog ID of a verified extension). A
  * bare `extenshi scan <artifact>` running on free credits therefore 403s —
- * which is confusing when dojo just says "5 free scans left".
+ * which is confusing when dojo just says "3 free scans left".
  *
  * The BFF signals this case via a stable `errorCode`
  * (`FREE_REQUIRES_CLAIM` / `FREE_REQUIRES_VERIFIED_OWNERSHIP`). The CLI ships

package/dist/svg-scrub.d.ts

@@ -1,19 +1,26 @@
 /**
- * Canonical regex-based SVG scrubber, shared by the offline CLI preview and the
- * hosted dojo generator so both strip the exact same constructs.
+ * Canonical regex-based SVG scrubber, shared by the offline CLI preview, the
+ * hosted dojo generator and the catalog-bff persistence path so all three strip
+ * the exact same constructs.
  *
  * Regex-based (not DOM-based) on purpose: it must run in Node with no DOMParser
  * — the CLI runs offline in a terminal, and the dojo API route runs server-side.
  * Patterns intentionally over-remove rather than under-remove: an icon has no
  * legitimate use for scripts, styles, animation, or external references.
  *
- * SINGLE SOURCE, TWO COPIES: this file exists byte-identical at
- *   tools/extenshi-cli/src/svg-scrub.ts   (canonical — edit here)
+ * SINGLE SOURCE, THREE COPIES: this file exists byte-identical at
+ *   tools/extenshi-cli/src/svg-scrub.ts    (canonical — edit here)
  *   dojo/src/lib/tools/svg-scrub.ts        (synced copy for the dojo build)
+ *   catalog/catalog-bff/src/lib/svg-scrub.ts (synced copy for the BFF build)
  * because the published @extenshi/cli npm package cannot depend on unpublished
- * workspace packages, and dojo's Docker build does not build the CLI package.
+ * workspace packages, and neither dojo's nor the BFF's Docker build builds the
+ * CLI package. The BFF copy is the load-bearing one for welcome pages: it
+ * sanitizes agent-authored SVG *before it is persisted*, so a hostile block can
+ * never reach the database, let alone a rendered page.
  * A test in tools/extenshi-cli/src/icon.test.ts fails CI when the copies drift;
- * after editing, run: cp tools/extenshi-cli/src/svg-scrub.ts dojo/src/lib/tools/svg-scrub.ts
+ * after editing, run:
+ *   cp tools/extenshi-cli/src/svg-scrub.ts dojo/src/lib/tools/svg-scrub.ts
+ *   cp tools/extenshi-cli/src/svg-scrub.ts catalog/catalog-bff/src/lib/svg-scrub.ts
  *
  * This is the same rationale as icon-preview.ts (see the note there).
  */

package/dist/svg-scrub.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"svg-scrub.d.ts","sourceRoot":"","sources":["../src/svg-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,eAAO,MAAM,kBAAkB,8LAiBrB,CAAA;AAIV;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0BlD"}
+{"version":3,"file":"svg-scrub.d.ts","sourceRoot":"","sources":["../src/svg-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,eAAO,MAAM,kBAAkB,8LAiBrB,CAAA;AAIV;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA0BlD"}

package/dist/svg-scrub.js

@@ -1,19 +1,26 @@
 /**
- * Canonical regex-based SVG scrubber, shared by the offline CLI preview and the
- * hosted dojo generator so both strip the exact same constructs.
+ * Canonical regex-based SVG scrubber, shared by the offline CLI preview, the
+ * hosted dojo generator and the catalog-bff persistence path so all three strip
+ * the exact same constructs.
  *
  * Regex-based (not DOM-based) on purpose: it must run in Node with no DOMParser
  * — the CLI runs offline in a terminal, and the dojo API route runs server-side.
  * Patterns intentionally over-remove rather than under-remove: an icon has no
  * legitimate use for scripts, styles, animation, or external references.
  *
- * SINGLE SOURCE, TWO COPIES: this file exists byte-identical at
- *   tools/extenshi-cli/src/svg-scrub.ts   (canonical — edit here)
+ * SINGLE SOURCE, THREE COPIES: this file exists byte-identical at
+ *   tools/extenshi-cli/src/svg-scrub.ts    (canonical — edit here)
  *   dojo/src/lib/tools/svg-scrub.ts        (synced copy for the dojo build)
+ *   catalog/catalog-bff/src/lib/svg-scrub.ts (synced copy for the BFF build)
  * because the published @extenshi/cli npm package cannot depend on unpublished
- * workspace packages, and dojo's Docker build does not build the CLI package.
+ * workspace packages, and neither dojo's nor the BFF's Docker build builds the
+ * CLI package. The BFF copy is the load-bearing one for welcome pages: it
+ * sanitizes agent-authored SVG *before it is persisted*, so a hostile block can
+ * never reach the database, let alone a rendered page.
  * A test in tools/extenshi-cli/src/icon.test.ts fails CI when the copies drift;
- * after editing, run: cp tools/extenshi-cli/src/svg-scrub.ts dojo/src/lib/tools/svg-scrub.ts
+ * after editing, run:
+ *   cp tools/extenshi-cli/src/svg-scrub.ts dojo/src/lib/tools/svg-scrub.ts
+ *   cp tools/extenshi-cli/src/svg-scrub.ts catalog/catalog-bff/src/lib/svg-scrub.ts
  *
  * This is the same rationale as icon-preview.ts (see the note there).
  */

package/dist/svg-scrub.js.map

@@ -1 +1 @@
-{"version":3,"file":"svg-scrub.js","sourceRoot":"","sources":["../src/svg-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,eAAe;IACf,KAAK;CACI,CAAA;AAEV,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,CACN,GAAG;QACF,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,sEAAsE;SACrE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;SAChD,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACnC,2EAA2E;QAC3E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;SACvE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,QAAQ,kCAAkC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SAClF,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,QAAQ,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/D,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QAC1C,sDAAsD;SACrD,OAAO,CAAC,4DAA4D,EAAE,EAAE,CAAC;SACzE,OAAO,CAAC,4DAA4D,EAAE,EAAE,CAAC;SACzE,IAAI,EAAE,CACR,CAAA;AACF,CAAC"}
+{"version":3,"file":"svg-scrub.js","sourceRoot":"","sources":["../src/svg-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,eAAe;IACf,KAAK;CACI,CAAA;AAEV,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,OAAO,CACN,GAAG;QACF,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,sEAAsE;SACrE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC;SAChD,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACnC,2EAA2E;QAC3E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;SACvE,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,QAAQ,kCAAkC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SAClF,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,QAAQ,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/D,8DAA8D;SAC7D,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QAC1C,sDAAsD;SACrD,OAAO,CAAC,4DAA4D,EAAE,EAAE,CAAC;SACzE,OAAO,CAAC,4DAA4D,EAAE,EAAE,CAAC;SACzE,IAAI,EAAE,CACR,CAAA;AACF,CAAC"}