@kubohiroya/turbowarp-extension-security-dialog 0.2.0 → 0.3.0

package/NOTICE.md

@@ -32,3 +32,9 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 `assets/screenshots/required-modes-{en,ja}-20261025.png` are unmodified browser captures of the public Editor on 25 October 2026, showing Camera Source 0.19.3, Asset Cache 0.3.1 and Bubble 0.13.4. Their origin, Editor revisions and hashes are recorded in `assets/screenshots/capture-20261025.json`. The captured UI, icons and banners retain their respective rights holders and applicable licenses; this package does not relicense those elements.
 
 `assets/screenshots/localized-descriptions-{en,ja}-20261025.png` are unmodified captures of the updated public Editor on 25 October 2026, showing localized descriptions for Camera Source 0.19.4, Asset Cache 0.3.2 and Bubble 0.13.5. Their origin, revisions and hashes are recorded in `assets/screenshots/localized-descriptions-20261025.json`. The captured UI, icons and banners retain their respective rights holders and applicable licenses.
+
+`assets/screenshots/required-approval-{en,ja}-20261028.png` are unmodified captures of the public Editor on 28 October 2026 after the required-mode approval update, showing Camera Source 0.19.4, Asset Cache 0.3.2 and Bubble 0.13.5 with Deny and With sandbox disabled. Their origin, verified distribution hashes, Editor revisions and image hashes are recorded in `assets/screenshots/required-approval-20261028.json`. The captured UI, icons and banners retain their respective rights holders and applicable licenses.
+
+`assets/screenshots/preselected-required-{en,ja}-20261028.png` are unmodified captures of the public Editor on 28 October 2026 after automatic preselection was added when all listed extensions require unsandboxed execution. Camera Source 0.19.4, Asset Cache 0.3.2 and Bubble 0.13.5 have Without sandbox preselected and still require OK before execution. Origin, verified distribution hashes, Editor revisions and image hashes are recorded in `assets/screenshots/preselected-required-20261028.json`. The captured UI, icons and banners retain their respective rights holders and applicable licenses.
+
+`assets/screenshots/hidden-bulk-required-{en,ja}-20261028.png` are unmodified captures of the public Editor on 28 October 2026 with Without sandbox preselected for all three required extensions and the redundant bulk selection section hidden. Camera Source 0.19.4, Asset Cache 0.3.2 and Bubble 0.13.5 still require OK before execution. Origin, verified distribution hashes, Editor revisions and image hashes are recorded in `assets/screenshots/hidden-bulk-required-20261028.json`. The captured UI, icons and banners retain their respective rights holders and applicable licenses.

package/README.ja.md

@@ -5,17 +5,99 @@
 TurboWarpの複数の機能拡張を、1つの一覧で確認するための共通パッケージです。
 関連タスクと受け入れ基準は [scratch-gui #33](https://github.com/kubohiroya/scratch-gui/issues/33) に記録しています。
 
+## Pagesのカタログから機能拡張を選択する
+
+`ExtensionSelectionList` は既存のバナー・メタデータ・詳細表示を共有し、各行の右端へチェックボックスを1つ表示します。
+TurboWarp Plus一覧の対応範囲は [#28](https://github.com/kubohiroya/turbowarp-extension-security-dialog/issues/28) に記録しています。
+ホスト側でGitHub PagesのJSONをHTTPS取得し、このコンポーネントへ渡します。
+
+```jsx
+import {loadExtensionCatalog} from '@kubohiroya/turbowarp-extension-security-dialog';
+import {ExtensionSelectionList} from '@kubohiroya/turbowarp-extension-security-dialog/react';
+
+const controller = new AbortController();
+const entries = await loadExtensionCatalog(
+  'https://kubohiroya.github.io/turbowarp-plus-packages/extensions-v1.json',
+  controller.signal
+);
+
+const list = <ExtensionSelectionList entries={entries} locale="ja"
+  filterQuery={searchText} loadedIds={loadedExtensionIds} busy={loading}
+  onCancel={closeLibrary}
+  onComplete={ordered => host.reviewAndLoadInOrder(ordered)} />;
+```
+
+例の `host.reviewAndLoadInOrder` はホスト側で実装する実行許可確認・VM読み込み処理です。
+`onComplete` は依存先を先に並べた重複のない配列を返し、`loadedIds` は除外します。
+ある拡張を選ぶと推移的な依存先すべてがchecked・disabledになります。
+親を解除すると依存関係を再計算し、ほかの選択やユーザー自身の明示選択が必要としている拡張は選択を保ちます。
+読み込み済みの行はchecked・disabledです。検索と表示言語を切り替えても選択を保ちます。
+`busy` で選択・フッター操作を無効にします。取得失敗・再試行・カタログの取得中止・VMエラーの表示と、
+読み込み成功に応じた `loadedIds` 更新はホスト側の担当です。
+
+各行は「手動で選択」（青）・「依存関係で自動選択」（紫）・「未選択」（中立色）を、背景・左枠・
+アイコン・状態名で区別します。「読み込み済み」も独立した表示です。一覧の上部には凡例を表示します。
+自動選択した行には「Bubble、Sprite に必要」のように、必要としている明示選択元すべてを表示します。
+手動で選んだ拡張がほかの選択元の依存先になった場合も、「手動で選択」を維持し、依存元を併記して
+チェックボックスを解除不可にします。DOMの `data-selection-state` は順に `selected` / `dependency` /
+`unselected` / `loaded` です。
+
+任意のカテゴリ定義がある場合、ダッシュボードと同じ順序でカテゴリ見出し（`h2`）を表示します。
+日本語は `titleJa` があれば使用し、なければ `title` にフォールバックします。
+検索で空になったカテゴリは非表示になりますが、選択状態と「詳細」の対象は維持します。
+カテゴリのない旧JSONは従来の平坦な一覧です。カテゴリ付きと未指定の項目が混在する場合、未指定分は
+末尾の「その他の機能拡張」へ表示します。配色はホストのモーダル背景色・文字色に従います。
+強調色は `--twextsec-manual-accent` / `--twextsec-dependency-accent` /
+`--twextsec-unselected-accent` / `--twextsec-loaded-accent` で調整できます。
+
+一覧の表示・選択だけでは機能拡張のコードを読み込み・実行しません。
+JSONのメタデータを直ちに表示し、「詳細」を開いたときだけソースを文字列として取得します。
+取得に失敗してもカタログのメタデータと選択は利用できます。
+実行許可確認には `ExtensionSecurityDialog context="catalog"` を使用でき、キャンセル文言が選択一覧へ戻る案内になります。
+既定の `context="project"` はプロジェクト読み込み用の文言を維持します。
+ホストは確定された実行モードと独自のセキュリティ方針を尊重して読み込んでください。
+
+JSON契約は `schemaVersion: 1` と `extensions` 配列です。各要素の必須項目は次のとおりです。
+
+| 項目 | 内容 |
+| --- | --- |
+| `id` | ASCII英数字の機能拡張ID |
+| `name` | 表示名 |
+| `version` | 配布バージョン |
+| `url` | バージョン固定の公開済み機能拡張JSへのHTTPS URL |
+| `dependencies` | 同じJSONに含まれる依存先の機能拡張ID配列。npmパッケージ名ではない |
+
+`package`・`description`・`descriptions`（`ja`等の小文字言語タグをキーとする説明）・`author`・`license`・
+`banner`・`repository`・`unsandboxed`（例: `required`）は任意のメタデータです。
+完全なJSON例は[英語版のAPI例](README.md#selecting-extensions-from-a-pages-catalog)を参照してください。
+生成側でパッケージ依存を拡張IDへ変換し、ビルド専用パッケージを除外します。
+
+カテゴリはトップレベルの任意項目 `categories: [{id, title, titleJa?}]` としてダッシュボード順に定義し、
+各 `extensions[].category` にそのIDを指定します。カテゴリIDの重複・不正な定義・未定義IDの参照は拒否します。
+`parseExtensionCatalog` の返り値は従来どおり配列で、カテゴリ参照は各要素の
+`category: {id, title, titleJa?, order}` へ解決します。`order` は定義の配列順です。
+
+`parseExtensionCatalog` は未対応schema、ID/URL重複、存在しない依存先、循環依存、HTTPS以外や認証情報付きのURLを拒否します。
+`resolveExtensionSelection(entries, explicitIds, loadedIds)` はReactなしでも同じ選択集合・依存順を計算します。
+返り値の `requiredBy` は依存先IDをキー、必要としている明示選択元IDの集合を値とするMapです。
+推移的依存・共有依存を含め、選択を解除すると依存元の集合も再計算します。
+`loadExtensionCatalog` は任意のAbortSignalを受け付け、認証情報・Refererを送らずに取得し、HTTP失敗や不正なJSON契約を例外として返します。
+
+切り戻しはホストの起動時固定・既定OFFのフラグをOFFにして再読み込みするか、カタログ接続差分をrevertします。
+既存の3つの実行モードを持つセキュリティ確認は、そのまま利用できます。
+
 ## 公開Editorのスクリーンショット
 
 [英語版](./README.md)と日本語版は、同じダイアログの表示言語を切り替え、ラベルと拡張の説明文を各言語で表示しています。
-2026年10月25日の[公開Editor](https://kubohiroya.github.io/turbowarp-extension-data-editor/editor.html?lang=ja)で、
-Camera Source 0.19.4・Asset Cache 0.3.2・Bubble 0.13.5を開いた実画面です。
+全件必須時の自動選択と一括選択欄の非表示に対応した[公開Editor](https://kubohiroya.github.io/turbowarp-extension-data-editor/editor.html?lang=ja)で、
+2026年10月28日にCamera Source 0.19.4・Asset Cache 0.3.2・Bubble 0.13.5を開いた実画面です。
 
-![Camera Source・Asset Cache・Bubbleの説明が日本語で表示された確認画面。サンドボックスありは非対応で無効、サンドボックスなしは動作に必要。サンドボックス内では動作しない理由を表示](https://raw.githubusercontent.com/kubohiroya/turbowarp-extension-security-dialog/main/assets/screenshots/localized-descriptions-ja-20261025.png)
+![Camera Source・Asset Cache・Bubbleの説明が日本語で表示された修正後の確認画面。拒否とサンドボックスありは無効、サンドボックスなしを選択済みで動作に必要と表示。一括選択欄は非表示。OKで読み込むかキャンセルで中止できる](https://raw.githubusercontent.com/kubohiroya/turbowarp-extension-security-dialog/main/assets/screenshots/hidden-bulk-required-ja-20261028.png)
 
-3拡張とも`Unsandboxed: required`を宣言しています。「サンドボックスあり」は無効化され、
-「この拡張はサンドボックス内では動作しません。」と理由が表示されます。
-「サンドボックスなし」には「動作に必要」と表示します。拒否は選択でき、実行には自分での選択とOKが必要です。
+3拡張とも`Unsandboxed: required`を宣言しています。「拒否」と「サンドボックスあり」は無効化され、
+理由が表示されます。「サンドボックスなし」だけが有効で、「動作に必要」と表示します。
+全拡張がこのモードを必要とする場合、全件のメタデータ取得後に選択済みになり、一括選択欄は非表示になります。
+「OK」で続行するか、「キャンセル」でプロジェクトの読み込みを中止します。
 必要なモードの表示は、安全性や配布元の信頼性の認定ではありません。
 
 | 機能拡張 | サンドボックスなしが必要な理由 |
@@ -25,7 +107,7 @@ Camera Source 0.19.4・Asset Cache 0.3.2・Bubble 0.13.5を開いた実画面で
 | Bubble | ホストの実行環境と描画機能へ直接アクセスして、ステージ上に重ねた吹き出しや立ち絵を描画・更新します。 |
 
 画像はダイアログ部分をブラウザーで直接撮影したもので、加工していません。
-取得元の版・Editor build・画像hashは[撮影台帳](./assets/screenshots/localized-descriptions-20261025.json)に記録しています。
+取得元の版・Editor build・画像hashは[撮影台帳](./assets/screenshots/hidden-bulk-required-20261028.json)に記録しています。
 
 ## 連動するパッケージ
 
@@ -207,12 +289,15 @@ HTTP/HTTPSの出所URLは完全なURLを表示し、別タブで開きます。
 個別選択・一括選択・一覧の見出しは、禁止アイコンの「拒否」、盾の「サンドボックスあり」、
 警告の「サンドボックスなし」の順です。アイコンと色は文字ラベルを補助し、安全性の認定には使いません。
 
-先頭の宣言コメントに `// Unsandboxed: required` があれば、「サンドボックスあり」を無効化して
-動作しない理由を表示し、「サンドボックスなし」に「動作に必要」を付けます。拒否は選択できます。
+先頭の宣言コメントに `// Unsandboxed: required` があれば、「拒否」と「サンドボックスあり」を無効化して
+理由を表示し、選択できる唯一のモード「サンドボックスなし」に「動作に必要」を付けます。
+選択したモードを「OK」で承認するか、「キャンセル」でプロジェクトの読み込みを中止します。
 この宣言は作者の自己申告であり、未宣言・取得失敗から必須モードを推測しません。
 
-実行する選択の確定はメタデータ取得の完了または失敗後です。遅れて取得した宣言に対応しない選択は、
-保存済みの復元値も含めて解除し、選び直しを案内します。権限の広いモードへ自動で変更しません。
+「拒否」を含む選択の確定はメタデータ取得の完了または失敗後です。全拡張の取得が成功し、すべてが
+この必須モードを宣言していれば、非対応の保存済み選択も含めて「サンドボックスなし」を選択済みにします。
+「OK」を押すまで拡張は実行せず、「キャンセル」で中止できます。取得中・未宣言・任意指定・取得失敗が
+1件でもあれば、この一括初期選択は行いません。混在する一覧では、非対応の選択を解除して選び直しを案内します。
 一括選択は対応する拡張だけに適用し、全件が非対応の一括ボタンは無効化します。
 
 ## 接続例

package/README.md

@@ -12,14 +12,15 @@ Related tasks and acceptance criteria are tracked in
 [English](./README.md) and [Japanese](./README.ja.md) use the same dialog with localized labels and extension descriptions.
 This capture shows Camera Source 0.19.4, Asset Cache 0.3.2 and Bubble 0.13.5 in the
 [public Editor](https://kubohiroya.github.io/turbowarp-extension-data-editor/editor.html?lang=en)
-on 25 October 2026.
+on 28 October 2026, with **Without sandbox** already selected for all three extensions and the unnecessary bulk selection section hidden.
 
-![English descriptions for Camera Source, Asset Cache and Bubble: With sandbox is disabled as Unsupported for all three extensions; Without sandbox is marked Required to run, with the reason This extension cannot run inside the sandbox.](https://raw.githubusercontent.com/kubohiroya/turbowarp-extension-security-dialog/main/assets/screenshots/localized-descriptions-en-20261025.png)
+![English descriptions for Camera Source, Asset Cache and Bubble: Deny and With sandbox are disabled for all three extensions; Without sandbox is preselected and marked Required to run. The bulk selection section is hidden. Choose OK to load the project or Cancel to stop.](https://raw.githubusercontent.com/kubohiroya/turbowarp-extension-security-dialog/main/assets/screenshots/hidden-bulk-required-en-20261028.png)
 
-All three extensions declare `Unsandboxed: required`. **With sandbox** is disabled, with
-**This extension cannot run inside the sandbox.** shown as the reason. **Without sandbox**
-is marked **Required to run**. Deny remains available, and running still requires an explicit
-choice and OK. These labels describe execution requirements, not a safety certification.
+All three extensions declare `Unsandboxed: required`. **Deny** and **With sandbox** are
+disabled, with the reason shown. **Without sandbox** is enabled and marked **Required to run**.
+When every listed extension requires this mode, it is preselected after all metadata loads, and the bulk selection section is hidden.
+Press OK to continue, or **Cancel** to stop loading the project.
+These labels describe execution requirements, not a safety certification.
 
 | Extension | Why it needs to run without a sandbox |
 | --- | --- |
@@ -28,7 +29,7 @@ choice and OK. These labels describe execution requirements, not a safety certif
 | Bubble | Accesses the host runtime and renderer directly to draw and update layered speech bubbles and portraits on the stage. |
 
 The PNG is an unmodified, modal-only browser capture. Source versions, Editor build and image
-hashes are recorded in [the capture manifest](./assets/screenshots/localized-descriptions-20261025.json).
+hashes are recorded in [the capture manifest](./assets/screenshots/hidden-bulk-required-20261028.json).
 
 ## How it fits together
 
@@ -222,15 +223,19 @@ Per-row choices, the bulk choices and the list heading are ordered: **Deny** (pr
 icon), **With sandbox** (shield), **Without sandbox** (warning). Icons and colour support the
 text labels; they are not a safety certification.
 
-If the leading declaration comment contains `// Unsandboxed: required`, *With sandbox* is
-disabled with the reason shown, and *Without sandbox* is marked *Required to run*. Deny stays
-selectable. This declaration is the author's own claim; a required mode is never inferred from
+If the leading declaration comment contains `// Unsandboxed: required`, *Deny* and *With sandbox*
+are disabled with the reason shown, and *Without sandbox* is the only available mode, marked
+*Required to run*. Press OK to approve the selected modes, or Cancel to stop loading
+the project. This declaration is the author's own claim; a required mode is never inferred from
 a missing declaration or a failed fetch.
 
-A choice to run is only committed once metadata has loaded or failed. A selection that
-contradicts a late-arriving declaration is cleared — including a restored saved value — and
-the user is asked to choose again. The mode is never silently widened. A bulk choice applies
-only to extensions that support it, and a bulk button is disabled when no listed extension does.
+A choice, including Deny, is only committed once metadata has loaded or failed. When every
+listed extension has loaded metadata declaring this requirement, *Without sandbox* is
+preselected for all entries, including entries with incompatible saved choices. Nothing runs
+until the user presses OK; Cancel still stops loading the project. Pending, missing, optional
+or failed declarations prevent this batch default. In mixed batches, incompatible choices
+are cleared and the user is asked to choose again. A bulk choice applies only to extensions
+that support it, and a bulk button is disabled when no listed extension does.
 
 ## Wiring it up
 
@@ -251,6 +256,107 @@ surfacing as a VM error is identified with `isExtensionSecurityCancelled(error)`
 Under Webpack 4 with CSS Modules, load `webpack4.css` instead of `styles.css`; root-level
 compatibility entries resolve for older Webpack 4 setups that do not read package exports.
 
+## Selecting extensions from a Pages catalog
+
+`ExtensionSelectionList` shares the security dialog's banners, metadata and Details view,
+with one checkbox at the right of each row. This API supports the TurboWarp Plus library
+tracked in [#28](https://github.com/kubohiroya/turbowarp-extension-security-dialog/issues/28).
+The host fetches a versioned JSON catalog over HTTPS:
+
+```jsx
+import {loadExtensionCatalog} from '@kubohiroya/turbowarp-extension-security-dialog';
+import {ExtensionSelectionList} from '@kubohiroya/turbowarp-extension-security-dialog/react';
+
+const controller = new AbortController();
+const entries = await loadExtensionCatalog(
+  'https://kubohiroya.github.io/turbowarp-plus-packages/extensions-v1.json',
+  controller.signal
+);
+
+const list = <ExtensionSelectionList entries={entries} locale="en"
+  filterQuery={searchText} loadedIds={loadedExtensionIds} busy={loading}
+  onCancel={closeLibrary}
+  onComplete={ordered => host.reviewAndLoadInOrder(ordered)} />;
+```
+
+`host.reviewAndLoadInOrder` represents the host's permission review and VM loading path.
+The callback receives dependencies before their dependants, each once, excluding
+`loadedIds`. Selecting an extension checks and disables all transitive dependencies.
+Removing its selection recomputes the closure; dependencies remain checked if another
+selection needs them or the user selected them explicitly. Loaded rows are checked and
+disabled. Search and locale changes preserve selection. `busy` disables selection and the
+footer controls. The host owns fetch errors, retry, catalog cancellation, VM errors, and
+updating `loadedIds` after each successful load.
+
+Rows distinguish **Selected by you** (blue), **Selected automatically** (purple), and
+**Not selected** (neutral), using a background, left border, icon and label together.
+Already loaded rows have their own label and accent. A legend explains the states above
+the list. Automatically selected dependencies name every selected root that needs them,
+for example “Required by Bubble, Sprite”. An explicitly selected dependency keeps its
+“Selected by you” state while another root requires it; its checkbox stays disabled and
+the dependency reason is also shown. The row's `data-selection-state` is `selected`,
+`dependency`, `unselected` or `loaded`.
+
+Optional catalog categories render as semantic `h2` sections in dashboard order. Japanese
+uses `titleJa` when available, otherwise `title`; other locales use `title`. Search hides
+empty sections without changing selection or source controls. Catalogs without categories
+keep a flat list. If categorized and uncategorized entries are mixed, the latter appear
+under “Other extensions” at the end. Theme colors use the host's modal background and
+foreground; accent overrides are `--twextsec-manual-accent`, `--twextsec-dependency-accent`,
+`--twextsec-unselected-accent`, and `--twextsec-loaded-accent`.
+
+The selection list never loads or runs extension code. Catalog metadata renders immediately;
+only Details fetches the source as text. Source failures leave catalog metadata and selection
+usable. `ExtensionSecurityDialog context="catalog"` provides permission review with cancel
+wording that returns to this list; its default `context="project"` retains project wording.
+The host must respect the committed execution modes and its own security policy.
+
+The Pages document has the following contract (`schemaVersion: 1`):
+
+```json
+{
+  "schemaVersion": 1,
+  "categories": [{"id": "camera", "title": "Camera", "titleJa": "カメラ"}],
+  "extensions": [
+    {
+      "id": "cameraSource",
+      "name": "Camera Source",
+      "category": "camera",
+      "version": "1.2.3",
+      "package": "@example/camera-source",
+      "url": "https://cdn.jsdelivr.net/npm/@example/camera-source@1.2.3/dist/extension.js",
+      "description": "Share a camera stream.",
+      "descriptions": {"ja": "カメラ映像を共有します。"},
+      "repository": "https://github.com/example/camera-source",
+      "banner": "https://example.com/camera-source.svg",
+      "unsandboxed": "required",
+      "dependencies": []
+    }
+  ]
+}
+```
+
+IDs contain ASCII letters and digits. `name`, `version`, `url`, and `dependencies` are
+required. Dependencies are extension IDs in this document, not npm package names;
+the generator resolves package dependencies to these IDs. `package`, descriptions, author,
+license, banner, repository and execution requirement are optional metadata. The generator
+uses version-pinned, published distribution URLs and excludes build-only packages.
+`parseExtensionCatalog` rejects unsupported schemas, duplicate IDs/URLs, missing dependencies,
+cycles, and non-HTTPS or credential-bearing URLs before the UI or VM receives entries.
+`resolveExtensionSelection(entries, explicitIds, loadedIds)` exposes the same closure and
+load order independently of React. Its `requiredBy` map associates each dependency ID with
+a set of the explicit root IDs that require it, including transitive and shared dependencies.
+Optional `categories: [{id, title, titleJa?}]` are declared once, in dashboard order;
+`extensions[].category` references one of those IDs. Duplicate category IDs, invalid
+definitions and unknown references are rejected. `parseExtensionCatalog` retains its array
+return type and resolves each reference to `entry.category: {id, title, titleJa?, order}`.
+`loadExtensionCatalog` accepts an optional AbortSignal,
+omits credentials/referrers, and rejects failed HTTP responses or invalid JSON contracts.
+
+To roll back catalog integration, turn off the host's startup flag (off by default) and
+reload, or revert the catalog wiring. The existing three-way security dialog remains
+available without the catalog API.
+
 ## Stored preferences
 
 Preferences are saved only when OK was pressed **and** the project then opened successfully.

package/dist/index.cjs

@@ -50,12 +50,15 @@ __export(index_exports, {
   getExtensionDescription: () => getExtensionDescription,
   getGitHubRepository: () => getGitHubRepository,
   getPreviewCandidates: () => getPreviewCandidates,
+  loadExtensionCatalog: () => loadExtensionCatalog,
   loadExtensionInfo: () => loadExtensionInfo,
   messages: () => messages,
+  parseExtensionCatalog: () => parseExtensionCatalog,
   parseExtensionMetadata: () => parseExtensionMetadata,
   preferences: () => preferences_default,
   projectFingerprint: () => projectFingerprint,
   readPreferences: () => readPreferences,
+  resolveExtensionSelection: () => resolveExtensionSelection,
   restoreChoices: () => restoreChoices,
   writePreferences: () => writePreferences
 });
@@ -334,8 +337,28 @@ var preferences_default = preferences;
 // src/messages.js
 var messages = {
   "en": {
+    "selectionIntro": "Choose extensions to add. Required extensions are selected automatically.",
+    "selectionRequired": "Requires running without a sandbox.",
+    "selectedState": "Selected by you",
+    "dependencyState": "Selected automatically",
+    "unselectedState": "Not selected",
+    "loadedState": "Already loaded",
+    "selectionLegend": "Selection states",
+    "requiredBy": "Required by {names}",
+    "otherCategory": "Other extensions",
+    "catalogRequiredIntro": "All selected extensions require Without sandbox, which is already selected. Choose OK to load them, or Cancel to return to the selection list.",
+    "catalogRequired": "This extension cannot run inside the sandbox. Choose Without sandbox, or Cancel to return to the selection list.",
+    "catalogCancelQuestion": "Cancel loading the selected extensions and return to the selection list?",
+    "selectExtension": "Select",
+    "dependency": "Required by another selection",
+    "alreadyLoaded": "Already loaded",
+    "noResults": "No matching extensions",
+    "selectedSummary": "{count} extensions to load",
+    "loadSelected": "Load selected extensions",
+    "loadingExtensions": "Loading\u2026",
     "title": "Extension Security",
     "intro": "Choose how to run each extension (you can choose while metadata loads).",
+    "allRequiredIntro": "All extensions require Without sandbox, which is already selected. Choose OK to load the project, or Cancel to stop.",
     "progress": "Extension information: {done}/{total}",
     "bulk": "Apply to all listed extensions",
     "extension": "Extension",
@@ -350,7 +373,7 @@ var messages = {
     "embedded": "Embedded in this project",
     "pending": "Getting metadata\u2026",
     "failed": "Could not retrieve metadata",
-    "required": "This extension cannot run inside the sandbox.",
+    "required": "This extension cannot run inside the sandbox. Choose Without sandbox, or Cancel to stop loading the project.",
     "requiredToRun": "Required to run",
     "unsupported": "Unsupported",
     "choiceReset": "The incompatible selection was cleared. Choose how to run this extension again.",
@@ -371,8 +394,28 @@ var messages = {
     "warning": "Extensions without a sandbox can access your project and browser information."
   },
   "ja": {
+    "selectionIntro": "\u8FFD\u52A0\u3059\u308B\u6A5F\u80FD\u62E1\u5F35\u3092\u9078\u3093\u3067\u304F\u3060\u3055\u3044\u3002\u4F9D\u5B58\u3059\u308B\u6A5F\u80FD\u62E1\u5F35\u3082\u81EA\u52D5\u3067\u9078\u629E\u3055\u308C\u307E\u3059\u3002",
+    "selectionRequired": "\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u306A\u3057\u3067\u306E\u5B9F\u884C\u304C\u5FC5\u8981\u3067\u3059\u3002",
+    "selectedState": "\u624B\u52D5\u3067\u9078\u629E",
+    "dependencyState": "\u4F9D\u5B58\u95A2\u4FC2\u3067\u81EA\u52D5\u9078\u629E",
+    "unselectedState": "\u672A\u9078\u629E",
+    "loadedState": "\u8AAD\u307F\u8FBC\u307F\u6E08\u307F",
+    "selectionLegend": "\u9078\u629E\u72B6\u614B\u306E\u51E1\u4F8B",
+    "requiredBy": "{names} \u306B\u5FC5\u8981",
+    "otherCategory": "\u305D\u306E\u4ED6\u306E\u6A5F\u80FD\u62E1\u5F35",
+    "catalogRequiredIntro": "\u9078\u629E\u3057\u305F\u3059\u3079\u3066\u306E\u6A5F\u80FD\u62E1\u5F35\u3067\u5FC5\u8981\u306A\u300C\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u306A\u3057\u300D\u3092\u9078\u629E\u6E08\u307F\u3067\u3059\u3002\u300COK\u300D\u3067\u8AAD\u307F\u8FBC\u3080\u304B\u3001\u300C\u30AD\u30E3\u30F3\u30BB\u30EB\u300D\u3067\u9078\u629E\u4E00\u89A7\u306B\u623B\u308A\u307E\u3059\u3002",
+    "catalogRequired": "\u3053\u306E\u62E1\u5F35\u306F\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u5185\u3067\u306F\u52D5\u4F5C\u3057\u307E\u305B\u3093\u3002\u300C\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u306A\u3057\u300D\u3092\u9078\u3076\u304B\u3001\u300C\u30AD\u30E3\u30F3\u30BB\u30EB\u300D\u3067\u9078\u629E\u4E00\u89A7\u306B\u623B\u308A\u307E\u3059\u3002",
+    "catalogCancelQuestion": "\u9078\u629E\u3057\u305F\u6A5F\u80FD\u62E1\u5F35\u306E\u8AAD\u307F\u8FBC\u307F\u3092\u53D6\u308A\u6D88\u3057\u3066\u3001\u9078\u629E\u4E00\u89A7\u306B\u623B\u308A\u307E\u3059\u304B\uFF1F",
+    "selectExtension": "\u9078\u629E",
+    "dependency": "\u9078\u629E\u3057\u305F\u62E1\u5F35\u306B\u5FC5\u8981",
+    "alreadyLoaded": "\u8AAD\u307F\u8FBC\u307F\u6E08\u307F",
+    "noResults": "\u4E00\u81F4\u3059\u308B\u6A5F\u80FD\u62E1\u5F35\u304C\u3042\u308A\u307E\u305B\u3093",
+    "selectedSummary": "\u8AAD\u307F\u8FBC\u3080\u6A5F\u80FD\u62E1\u5F35 {count} \u4EF6",
+    "loadSelected": "\u9078\u629E\u3057\u305F\u62E1\u5F35\u3092\u8AAD\u307F\u8FBC\u3080",
+    "loadingExtensions": "\u8AAD\u307F\u8FBC\u307F\u4E2D\u2026",
     "title": "\u6A5F\u80FD\u62E1\u5F35\u30BB\u30AD\u30E5\u30EA\u30C6\u30A3",
     "intro": "\u5B9F\u884C\u65B9\u6CD5\u3092\u9078\u3093\u3067\u304F\u3060\u3055\u3044\uFF08\u53D6\u5F97\u4E2D\u3067\u3082\u9078\u629E\u3067\u304D\u307E\u3059\uFF09",
+    "allRequiredIntro": "\u3059\u3079\u3066\u306E\u6A5F\u80FD\u62E1\u5F35\u3067\u5FC5\u8981\u306A\u300C\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u306A\u3057\u300D\u3092\u9078\u629E\u6E08\u307F\u3067\u3059\u3002\u300COK\u300D\u3067\u8AAD\u307F\u8FBC\u3080\u304B\u3001\u300C\u30AD\u30E3\u30F3\u30BB\u30EB\u300D\u3067\u4E2D\u6B62\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
     "progress": "\u6A5F\u80FD\u62E1\u5F35\u306E\u60C5\u5831\uFF1A{done}/{total} \u4EF6\u3092\u78BA\u8A8D",
     "bulk": "\u8868\u793A\u4E2D\u306E\u3059\u3079\u3066\u306B\u9069\u7528",
     "extension": "\u6A5F\u80FD\u62E1\u5F35",
@@ -387,7 +430,7 @@ var messages = {
     "embedded": "\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u5185\u306B\u57CB\u3081\u8FBC\u307F",
     "pending": "\u30E1\u30BF\u30C7\u30FC\u30BF\u3092\u53D6\u5F97\u4E2D\u2026",
     "failed": "\u30E1\u30BF\u30C7\u30FC\u30BF\u3092\u53D6\u5F97\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F",
-    "required": "\u3053\u306E\u62E1\u5F35\u306F\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u5185\u3067\u306F\u52D5\u4F5C\u3057\u307E\u305B\u3093\u3002",
+    "required": "\u3053\u306E\u62E1\u5F35\u306F\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u5185\u3067\u306F\u52D5\u4F5C\u3057\u307E\u305B\u3093\u3002\u300C\u30B5\u30F3\u30C9\u30DC\u30C3\u30AF\u30B9\u306A\u3057\u300D\u3092\u9078\u3076\u304B\u3001\u300C\u30AD\u30E3\u30F3\u30BB\u30EB\u300D\u3067\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u306E\u8AAD\u307F\u8FBC\u307F\u3092\u4E2D\u6B62\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
     "requiredToRun": "\u52D5\u4F5C\u306B\u5FC5\u8981",
     "unsupported": "\u975E\u5BFE\u5FDC",
     "choiceReset": "\u975E\u5BFE\u5FDC\u306E\u9078\u629E\u3092\u89E3\u9664\u3057\u307E\u3057\u305F\u3002\u5B9F\u884C\u65B9\u6CD5\u3092\u9078\u3073\u76F4\u3057\u3066\u304F\u3060\u3055\u3044\u3002",
@@ -413,3 +456,112 @@ var formatMessage = (locale, key, values = {}) => {
   const template = messages[language][key] || messages.en[key] || key;
   return template.replace(/\{(\w+)\}/g, (match, name) => String(values[name] === void 0 ? match : values[name]));
 };
+
+// src/selection.js
+var httpsURL = (value) => {
+  if (typeof value !== "string" || !value.trim()) throw new Error("Expected an HTTPS URL");
+  const url = new URL(value);
+  if (url.protocol !== "https:" || url.username || url.password) throw new Error("Expected an HTTPS URL");
+  return url.href;
+};
+var resolveExtensionSelection = (entries, explicitIds = [], loadedIds = []) => {
+  const byId = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (!entry || typeof entry.id !== "string" || !entry.id || byId.has(entry.id)) {
+      throw new Error(`Duplicate or missing extension ID: ${entry && entry.id}`);
+    }
+    if (entry.dependencies !== void 0 && (!Array.isArray(entry.dependencies) || entry.dependencies.some((id) => typeof id !== "string" || !id))) {
+      throw new Error(`Invalid extension dependencies: ${entry.id}`);
+    }
+    byId.set(entry.id, entry);
+  }
+  const selected = /* @__PURE__ */ new Set();
+  const required = /* @__PURE__ */ new Set();
+  const requiredBy = /* @__PURE__ */ new Map();
+  const visiting = /* @__PURE__ */ new Set();
+  const ordered = [];
+  const visit = (id) => {
+    const entry = byId.get(id);
+    if (!entry) throw new Error(`Missing extension dependency: ${id}`);
+    if (visiting.has(id)) throw new Error(`Cyclic extension dependency: ${id}`);
+    if (selected.has(id)) return;
+    visiting.add(id);
+    for (const dependency of entry.dependencies || []) {
+      required.add(dependency);
+      visit(dependency);
+    }
+    visiting.delete(id);
+    selected.add(id);
+    ordered.push(entry);
+  };
+  const roots = [...explicitIds].filter((id) => byId.has(id));
+  for (const id of roots) visit(id);
+  for (const root of roots) {
+    const seen = /* @__PURE__ */ new Set();
+    const describeDependencies = (id) => {
+      for (const dependency of byId.get(id).dependencies || []) {
+        if (seen.has(dependency)) continue;
+        seen.add(dependency);
+        if (!requiredBy.has(dependency)) requiredBy.set(dependency, /* @__PURE__ */ new Set());
+        requiredBy.get(dependency).add(root);
+        describeDependencies(dependency);
+      }
+    };
+    describeDependencies(root);
+  }
+  const loaded = new Set(loadedIds);
+  return { selected, required, requiredBy, loaded, ordered: ordered.filter((entry) => !loaded.has(entry.id)) };
+};
+var parseExtensionCatalog = (data) => {
+  if (!data || data.schemaVersion !== 1 || !Array.isArray(data.extensions)) {
+    throw new Error("Unsupported extension catalog");
+  }
+  const categories = /* @__PURE__ */ new Map();
+  if (data.categories !== void 0) {
+    if (!Array.isArray(data.categories)) throw new Error("Invalid extension catalog categories");
+    data.categories.forEach((category, order) => {
+      if (!category || typeof category.id !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(category.id) || typeof category.title !== "string" || !category.title.trim() || category.titleJa !== void 0 && (typeof category.titleJa !== "string" || !category.titleJa.trim())) {
+        throw new Error("Invalid extension catalog category");
+      }
+      if (categories.has(category.id)) throw new Error(`Duplicate extension category: ${category.id}`);
+      categories.set(category.id, __spreadValues({
+        id: category.id,
+        title: category.title,
+        order
+      }, category.titleJa !== void 0 ? { titleJa: category.titleJa } : {}));
+    });
+  }
+  const urls = /* @__PURE__ */ new Set();
+  const entries = data.extensions.map((item) => {
+    if (!item || typeof item.id !== "string" || !/^[a-zA-Z0-9]+$/.test(item.id) || typeof item.name !== "string" || !item.name.trim() || typeof item.version !== "string" || !item.version || !Array.isArray(item.dependencies) || item.dependencies.some((id) => typeof id !== "string" || !/^[a-zA-Z0-9]+$/.test(id))) {
+      throw new Error("Invalid extension catalog entry");
+    }
+    const url = httpsURL(item.url);
+    if (urls.has(url)) throw new Error(`Duplicate extension URL: ${url}`);
+    urls.add(url);
+    const metadata = { name: item.name, id: item.id, version: item.version };
+    for (const field of ["description", "author", "license", "updatedAt", "unsandboxed"]) {
+      if (typeof item[field] === "string") metadata[field] = item[field];
+    }
+    if (item.descriptions && typeof item.descriptions === "object") {
+      metadata.descriptions = Object.fromEntries(Object.entries(item.descriptions).filter(([locale, text]) => /^[a-z]{2,8}(?:-[a-z0-9]{1,8})*$/.test(locale) && typeof text === "string"));
+    }
+    if (item.banner) metadata.banner = httpsURL(item.banner);
+    if (item.repository) metadata.repository = httpsURL(item.repository);
+    const entry = { id: item.id, ids: [item.id], url, dependencies: [...new Set(item.dependencies)], metadata };
+    if (item.category !== void 0) {
+      if (typeof item.category !== "string" || !categories.has(item.category)) {
+        throw new Error(`Missing extension category: ${item.category}`);
+      }
+      entry.category = categories.get(item.category);
+    }
+    return entry;
+  });
+  resolveExtensionSelection(entries, entries.map((entry) => entry.id));
+  return entries;
+};
+var loadExtensionCatalog = async (url, signal) => {
+  const response = await fetch(httpsURL(url), { signal, credentials: "omit", referrerPolicy: "no-referrer" });
+  if (!response.ok) throw new Error(`Extension catalog HTTP ${response.status}`);
+  return parseExtensionCatalog(await response.json());
+};

package/dist/index.d.ts

@@ -24,3 +24,17 @@ export const preferences: {
 };
 export const messages: Record<string, Record<string, string>>;
 export function formatMessage(locale: string, key: string, values?: Record<string, string | number>): string;
+
+export interface ExtensionCategory {
+    id: string; title: string; titleJa?: string; order?: number;
+}
+export interface SelectableExtension extends ExtensionEntry {
+    id: string; dependencies: string[]; metadata: ExtensionMetadata; category?: ExtensionCategory;
+}
+export interface ExtensionSelection {
+    selected: Set<string>; required: Set<string>; requiredBy: Map<string, Set<string>>;
+    loaded: Set<string>; ordered: SelectableExtension[];
+}
+export function resolveExtensionSelection(entries: SelectableExtension[], explicitIds?: Iterable<string>, loadedIds?: Iterable<string>): ExtensionSelection;
+export function parseExtensionCatalog(data: unknown): SelectableExtension[];
+export function loadExtensionCatalog(url: string, signal?: AbortSignal): Promise<SelectableExtension[]>;