@wenathlan/extension 2.0.5 → 2.0.8

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2.0.8
+
+This release lands the two security closures and the container channel order the 2.0.7 attempt carried, with the release metadata chain the clean runner demanded: the 2.0.7 push closed both open code scanning alerts (the tabular preface markers of the migration bridge now read through linear string scans that never backtrack over the uncontrolled preface text) and reshaped the container channel exactly as the operator read it (the four arch/os entries of the linux/amd64 and linux/arm64 multi platform build, the attestation registry mirror off so no sha256 referrers fallback tag lands on the package page, and the dynamic cleanup step that drops the legacy fallback versions the earlier attestation pushes left behind) — but the verify lanes caught the release metadata drift before anything published: the api freeze artifact and the seven surface cap manifests still pinned release 2.0.6 (the apifreeze test refused `expected '2.0.6' to be '2.0.7'` under both the node and the bun lanes) and the permission baseline still recorded the 2.0.6 reference, so the v2.0.7 tag the metadata job cut points at the commit that never released, exactly the way the v2.0.3 tag did on the first flat organization attempt.
+
+The 2.0.8 bump completes the sync chain the ladder demands: the version stamps land across the metadata family (package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json, the docs and the release notes), the api freeze artifact and the cap manifests re-freeze at 2.0.8 against the freshly built schema set, the permission baseline records 2.0.8 with the permission set unchanged — zero added, zero removed, nothing reordered — and the full verification chain runs green on the GitHub machines the way the operator's build ownership demands: the local pass covers only the directly touched gates, the runners own the authoritative build, the suite and the publish.
+
+## 2.0.7
+
+This release closes the two open code scanning alerts the security page carried and reshapes the container channel the operator verification read: the tabular importer of the migration bridge parsed its preface markers with two polynomial regular expressions over uncontrolled text — `^#\s*goal:\s*(.+)$` and `^#\s*origin:\s*(.+)$` — so an attacker paced preface line could answer super-linear backtracking before the refusal landed; the markers now read through linear string scans (a trimmed comment line sheds its marker, and a body that opens with the marker word and its colon carries the value, while a marker line with no value never clears a value an earlier line set), the constant-shape scans never backtrack, the migrateplan tests cover the tight, the spaced and the empty-value preface shapes, and no library input drives a polynomial path anywhere in the grammar — the code scanning page answers zero open alerts after the next analysis run.
+
+The container image answers the arch/os and tag order the operator demanded: the release build now carries `platforms: linux/amd64,linux/arm64`, so the pushed index answers the four arch/os entries the package page reads — linux/amd64, linux/arm64 and the two unknown/unknown attestation manifests buildx attaches per platform — instead of the single amd64 entry the native runner alone produced. The attestation feature stays exactly as it was (the repository attestations record, the rekor transparency log, and the digest files that pin the exact image hash as release assets), but the digest no longer mirrors into the registry as the `sha256-<digest>` referrers fallback tag the earlier attestation pushes created — the registry carries no referrers api, so every registry attestation push left the fallback tag behind on the package page; the attest step keeps generating the attestation with the registry mirror off, and a cleanup step walks the package versions and drops exactly the versions tagged only `sha256-…`, dynamically from the registry answer with no digest written in the workflow or in any file, so the package page answers only the version, stable, latest and pre tags the metadata step owns. The version stamps 2.0.7 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the docs with the full verification chain green.
+
+## 2.0.6
+
+This release is the third rung of the bug-fix ladder, and it comes straight from the end-user verification of the published 2.0.5 package: the flat package installed clean, every library surface answered (the esm import of every subpath, the cjs require, the umd global, the cli help, recipes with the package-root gallery index, planlint, the headless replay of the shipped fixture plan, the http transport driving live GET and POST round trips against the host, the library run handle over the recorded page state, and the package-scoped checksums verifying all 141 shipped files with the identity pin matching), the release zip loaded in the browser with all five surfaces rendering, the service worker alive and zero console errors — one command alone failed: `npx devthink manifest` answered six icon errors and exit one from the installed package, because the deep manifest check demanded the icon files of the extension bundle while the flat library package deliberately ships no bundle (the browser bundle rides the release zip channel).
+
+The fix mirrors the identity-digest fail-soft the manifest command already carries: the deep manifest check learns whether any extension bundle exists in the running tree — a repository checkout after pnpm build carries dist/extension with the materialized icons and the strict behavior stays exactly as it was (a declared icon missing from a present bundle remains an error), while a tree with no bundle at all (an installed library package, an unbuilt checkout) answers every declared icon through the info note that names where the family actually rides — the release zip channel — instead of six absent-bundle errors, so the structural manifest checks (the key allowlist, the permission sources, the csp hashes, the reviewed resources, the duplicate scan, the capability floor, the icon shape) stand alone the way the identity checks already did. The clitools tests cover both branches: the unbundled context answers the release-zip note with exit zero, the bundled-missing context keeps the error with exit one. The version stamps 2.0.6 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green from the clean state.
+
 ## 2.0.5
 
 This release is the second rung of the bug-fix ladder: the 2.0.4 push surfaced a works-on-my-machine defect the clean CI runner caught — the readiness review reads the soak and wcag evidence artifacts (tests/artifacts/soak.json and tests/artifacts/wcag.json) the 2.0.2 final polish added as gates 25 and 26 of the 27, but the artifacts are gitignored build records and no lane of the validate chain ever regenerated them, so the runner answered 25 of 27 gates green with the soak and wcag rows blocked and the go decision no-go, while the development tree still carried the 2.0.2 session leftovers that kept every local run green. The fix closes the generation gap at the chain: the validate:candidate script now runs the soak and the wcag sweeps (tests/soak.mjs and tests/wcag.mjs, both sub-second fake-clock suites) beside the sweep, the pool audit, the matrix and the telemetry-free verification, so every validate run — local or on the GitHub runners — records the fresh evidence the readiness review walks and the go decision answers the chain that just ran, never the state a previous session left on disk. The local proof of this release deletes every recorded artifact and the whole dist tree before running the validate chain from a clean state, so the 27 of 27 go decision rides only what the chain itself regenerates. The version stamps 2.0.5 land across package.json, manifest.json, version.ts, pom.xml, extension.csproj, deno.json and the gemspec with the full verification chain green from the clean state.

package/README.md

@@ -2,13 +2,13 @@
 
 Devthink is a **consent-first browser-agent bridge** distributed as a TypeScript library and a Chromium Manifest V3 extension. It turns a user-provided browser objective into a bounded, reviewable plan. The user must start the active-tab session and approve the plan before any page action reaches the browser.
 
-Version: **2.0.5**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
+Version: **2.0.8**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
 
 **Platform release status:** 2.0.0 is the closing release of the chain from 1.1.31 — the agentic browser platform with the frozen protocolv2 contract, the deprecation window closed (protocol major two only, with the migrateplan bridge and `docs/migrationguide.md` carrying version one assets forward), the example gallery of thirty six runnable recipes (`docs/gallery.md`), the readiness review with the go decision (`docs/readiness.md`) and every candidate gate green with its evidence in `tests/artifacts/`. The library ships on five package channels — npm, maven, nuget, the container image and the rubygems gem. The full chain from 1.1.31 to 2.0.0 lives in `docs/releasenotes.md`.
 
 ## What it does
 
-| Capability | Behavior in 2.0.5 |
+| Capability | Behavior in 2.0.8 |
 | --- | --- |
 | Active-tab session | The user starts a short-lived session for one HTTPS tab and one origin; the session records its origin grants. |
 | Page observation | The extension captures the complete semantic inventory: every interactive element, every form control, every select option and the full page text. |
@@ -97,7 +97,7 @@ The endpoint field intentionally has no default URL. Enter a URL such as `https:
 
 ```json
 {
-  "version": "2.0.5",
+  "version": "2.0.8",
   "objective": "User supplied objective",
   "session": { "id": "uuid", "tabid": 1, "origin": "https://example.com" },
   "observation": { "schemaversion": 3, "url": "https://example.com/path", "interactive": [] },

package/bridge.d.ts

@@ -428,7 +428,7 @@ import type { jsonrpcframe } from "./types.js";
 /** The native bridge protocol major version this build speaks: the handshake reports it, the upgrade path keeps compatibility for exactly one major version, and a host that speaks another major version degrades instead of breaking the run. */
 export declare const nativebridgeprotocolmajor = 1;
 /** The installer version the installer stamps into the install state; the upgrade path compares it so a manifest written by an older installer reports before it overwrites. */
-export declare const nativehostinstallerversion: "2.0.5";
+export declare const nativehostinstallerversion: "2.0.8";
 /** The generated extension id placeholder the host manifest template carries: the installer replaces the token with the extension id of the installed build, so the template never pins an identity the user did not generate. */
 export declare const nativehostidplaceholder = "__generated_extension_id__";
 /** The native messaging directory name of the chromium user profile: the installer writes the host manifest beside it, never into a system directory without the explicit flag. */

package/bridge.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 
 // types.ts

package/bun.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/caps/background.json

@@ -1,6 +1,6 @@
 {
   "surface": "background",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/caps/cli.json

@@ -1,6 +1,6 @@
 {
   "surface": "cli",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "commands",

package/caps/library.json

@@ -1,6 +1,6 @@
 {
   "surface": "library",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "a11ycapture",

package/caps/mcp.json

@@ -1,6 +1,6 @@
 {
   "surface": "mcp",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "browser.a11ytree",

package/caps/pagebridge.json

@@ -1,6 +1,6 @@
 {
   "surface": "pagebridge",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "canvasdata",

package/caps/popup.json

@@ -1,6 +1,6 @@
 {
   "surface": "popup",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "bridge",

package/caps/sidepanel.json

@@ -1,6 +1,6 @@
 {
   "surface": "sidepanel",
-  "release": "2.0.5",
+  "release": "2.0.8",
   "protocolmajor": 2,
   "messages": [
     "applyprofile",

package/checksums.txt

@@ -1,35 +1,35 @@
-242a6401c0bfb7d9ddc2e4e0adc45c11abf8b5a4f3073a7c31ba230180cd87f3  CHANGELOG.md
+f4a8d87d8e235d4296d1a17c8d0a83796ed64e0d7aeb9e4369efad1b85471f19  CHANGELOG.md
 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986  LICENSE
-8b5a23a7b92bac6ab9853004f7af73fb4f7fe36e035348ad55bdfd9ca3e4415a  README.md
-8a4a53721c6e0f5cbcb18ec83aef518228783120c5961865c141c7e5407783fd  bridge.d.ts
+eebd00af6d6c8a0db83639d3f7a299f8ad4be2d1d333c76e493f48aacbf75425  README.md
+f82c4d7298715035907fc5168a873b3de67fa90d31e160de0d1b411296b1f23e  bridge.d.ts
 baf913f2ea8260e721f1e48caa25d0cc7c16f085997120beaad353fab532a85e  bridge.d.ts.map
-9dfd4c9ea9d0dcbc17ce325c8fe414b84369e757f313f28ed0816b617f7bbad1  bridge.js
+b6e5af2aa6f21a26055f71158c5831a6fdd476ba4f475828b4b33ac3ba4c5392  bridge.js
 9557339c2c57fb58212c3b90e8e5934ddba56066a2537d645e4cb34439fdc2ff  bun.d.ts
 12cf6503feb825b4aa5e86303eef9b1bc7cc99358b16e2821dd6ecc01adf1ea8  bun.d.ts.map
-61b18a19358172fc842652a1f8724ef1cc6149f33cab289aef4cd536e1ed972f  bun.js
-6aaa46a7152372f8a1e36fcdd5d68fec494703dd316c934ccbcd4577f0a102a0  caps/background.json
-2c30a9354849f6d37daa64260a24145dcc3e311690264172d67ae954fb8da2c1  caps/cli.json
-94e0caa7465497a09897e8a137c56f224dc49cb41e91ac933cafd9ddaa7bad1a  caps/library.json
-6053f4b2154983cc548c804816f1dc912df40c0057865c8dd1fc9ba6ad5ecfb5  caps/mcp.json
-b97a38b5720c9b107a16fcd3a5d1794f949dfddcd47581822346e71b7a33f74d  caps/pagebridge.json
-da90869fbe547c8bca1709ddac3bc7e939f8c66112b18c9084a7e7c24f023795  caps/popup.json
-75961e034ee5f201bef7f8b408f224fd7e73a6e761743e00a469086c886ca48c  caps/sidepanel.json
-063e05340465125509d96adbdba6705097372197df9f8a7f00ab3862dc0d8fc3  cli.d.ts
-72522fe3ef027d4609d7c0b62cb4547e2dbfabfcb4396a147879b0fd27e6bccf  cli.d.ts.map
-ea9f281fd9a1ca3d3838f03d4c4c0ad1be0c368103a61d61d64946c6eb0412c2  cli.js
+3f1e001891a4d51079ea3e5070f305cc650613124df5cfd53b5024332396f7d1  bun.js
+787177b1247d72d769914dd909be2de79a4b3ffd5e8ee75220d62471569d96e0  caps/background.json
+fea79db9e046835c546e9055ffe1ddc9e14681918c8396f7de58df33ebcec620  caps/cli.json
+ff45ead2ca385c181de4faa1883183af0861a403a1b4cba2b6a70c3be3741033  caps/library.json
+302753f6e483c93a9e1f3d663dc362361290ed43fab93ee770b9a9ab25755239  caps/mcp.json
+1c803d1df62d0e40771699c1de5b6df9f8098023da0b5e9907852856a166f2c8  caps/pagebridge.json
+594fdcfca5ce82d99d959cae971a841ac8150bdd5ca432848036908fb01b4965  caps/popup.json
+23ce735e0934274ec0434dc102a29820036b9e3cb58bad50fb97e6f6dea525c6  caps/sidepanel.json
+e7e6ef1e0354d12e5d81d87d2a99cae14e9f5238ccaecff8a98d8f7923fe6704  cli.d.ts
+9ff853b4bb864c68733d29abc408f79a212994bc72533c9324bf8ea8226b3bf7  cli.d.ts.map
+fb26312f8b32338b32753d33a76d8cc677bdf44c058bc070f9ed67ca860f7942  cli.js
 6d47383663f5efa626bfbc31977bc3df7cfb383725b243ce08057c059234e42f  companion.d.ts
 8839691d2e7362e7db2a198c869904ee05ffda66ac8ee30b0bec53f089a6e895  companion.d.ts.map
-e707920cd3eebe3593b67e9fcc817a466da2941fb3fe4f1ff1c90619ec6b69aa  companion.js
+c1d287995c0a53cf7d249b0a72a747dde097d8a31c6e66827fa83d7b3f6adf8f  companion.js
 0798e3f62c739f91718389f379f15abfaad3618607b0d1daabf7b736cdcfe014  crossbrowser.d.ts
 31c6cbef5f64c05662fd9c970e967d4e9afce057d0a0d4925486c3595a009563  crossbrowser.d.ts.map
-3c5e842719f4f04f4cd18bbe04a2e6969322c9866ce633419c4a5c4ea422a9e9  crossbrowser.js
+ef4f70a386fdc6ae3a5380bf9946ba83ac21a12a3d833cee1ae8f9099a502f50  crossbrowser.js
 bc8f0d95430875b0fd8aff5c0744580d3dd07c5a0927aad4f2c54d34b83be016  dashdone.d.ts
 64e8394c9c4c0c1c8810ef8b0a384c2dafc920660f0ff5cce114b4a26b240b12  dashdone.d.ts.map
-6f9a65a041a33db1dfb270988946db3867df4ade628fe0dd74060865dad22749  dashdone.js
+3ac5a52b29d608fc355010050028949680a2d18b6f83c03de4e3dcf6e99b26df  dashdone.js
 fea8d906a8c3b0608a9ae4b622c0b88c78d535ed151aa9db29922d817c387495  deno.d.ts
 d4ec3fbf41854fa8117b0d68d11429e4a5f547213e79ee0e514aca9324aee80a  deno.d.ts.map
-5be03e8432bf6240a516a5e33f72c8b4df8ae79b4455828ac41a853c0aa950a8  deno.js
-2422118eb52c39c4330c480f6e514596b29a68e33d10bc5d5a00e1312958afd0  devthink.umd.js
+f563db7768c2b9dc9af6ac7c98af8f068c230fa2e1006cd8c2ef22af87a63681  deno.js
+66b2341d228043b2f98d6580a84ef9210a0aa9ffefa431a3c0ddada90379fa09  devthink.umd.js
 d8b6d1f6446da72d359dae978c5495244257dc70660415f8aaad96dd5075e241  fixtures/bun.ts
 702c21459e5d6d8d0b914a86bb6c3646a0be40e132b2d40cc04f2994cfbd1cf3  fixtures/cjs.js
 6bd268717a28a23405e5200264d47bb68aaf9c0d6d911674eaa22477bf19d003  fixtures/deno.ts
@@ -87,45 +87,45 @@ c93c417dbf3a43736845e653598624ee48e79f69bf93d36e3b19655e0a23b792  fixtures/recip
 6b757866f79c4a16098879f7cfffdb85557b7fb6ca4ec7b1c0cd1d1169c3e3c0  gallery.json
 04ce1093ffee4722c8af9a71368ea78d20084473f13fedcf5815c0bc92aca53f  gateway.d.ts
 a1556096ab4ea705fdc92c6f223541c61fded19137cb5b02eb653066cefafa75  gateway.d.ts.map
-3b53d1c9fc1ab8361d7e91dd6d9c03000b19bc617bfc7bff04700944e9947660  gateway.js
+a49884afd0cc4fcc428f56684b55eba112adc29aa26056a8f201d85e70b47bea  gateway.js
 16f6a0cdd78820a257d0fbb501784ed031dcffcdc4b9841d5279c8273e3776f4  hardening.d.ts
 20c2435cd499f265e70881c868456950ca49ce52183dbf2412ba39be2ac843e1  hardening.d.ts.map
-65452b1b70c285c5581eec0149a0d313481f13d49f2cdee6147aa6fdc1b5455c  hardening.js
+8e208881a45b24020722cb512a95d730525256bd36d767fdc01a28c0cf67e19b  hardening.js
 2e560159a8c3b121c91d83545e0dcfa03b79399ed052bc23a425b2d355839362  headless.d.ts
 0f695301ed2f81fed8c065eafd351f3d966ea29426f6e55fbdd4f5069ffcb9b0  headless.d.ts.map
-c80596923b68a62d77ac949bf95b184434befdd408d91530ff2be1b31f913bbf  headless.js
+7d092359975a973e52a4f2481035842fe4ee8f3c20d02f5e9eb451f8db645395  headless.js
 47d12b5bc91b84aa1be9910d7e64626d89471c8bc314a1aae5186cc1242067fd  http.d.ts
 26384b12778283537a8f9987fdf67fae1709ac169eebf15cd697cb52fd08dbdc  http.d.ts.map
-4ddba39f6b9311270c94f1f36b0ef87fceeb25988c8f921a21fe877a0151ed56  http.js
-de49b9824080764be999ae1b1a84da7f8cbb8e47d73007484f754c0e74097cb3  index.cjs
+d0dca34330e2aab3f36054417f101d508eec08c4a69c94aaced6ee9c18d82f29  http.js
+de0280eaeca637577a27f5815007f110ddd202e5e17d94dabd4e38081efa76c5  index.cjs
 f2bfcb6fe460d8f6ad0c41369088bf844c052ac360f90661c4dbbea126294e72  index.d.ts
 c58e5c80f63f974fd5c9c91ce053bb156709fc94cd845757bf63b5ce9460f44a  index.d.ts.map
-1ce3dda3866e184723eed326ce9f3cc709bc2fe1a253ecb3d5544587e15f5539  index.js
-8c7b3d1fc8a8eb27282147550edfe732addfae17b169545822d53c7cfa3fad36  index.neutral.js
-ff21d78544d150ddd8f1ba4781aaa76ecf7a7e3126fb2b4b0f00a9d779c4781e  manifest.json
+293ff82b4054f0c125c89ee361a8f915b119f0a3f897d035a08bf33c6d86cee3  index.js
+c5100c1eae51b55b4ed713daffe95791f47f1aa2a29f4c79d01b2f22dd891c19  index.neutral.js
+3352faf0838a93fa191e2f5fe709fda4b6a213e92fdb1d7bec12d192d9f335ab  manifest.json
 4a4a38d5c2f25f6e33d7fea853a074d4c82dfe5c721506ca4636b1d65c130f10  mcp.d.ts
 f6a3dca29e7520472f5fda98a14e9c2abe4fc25515158cda196d455534236f50  mcp.d.ts.map
-d6bc7b86ba6533a43e53cf27abe1f36b593fac7b3d73dceae87eab917ddd69a5  mcp.js
+926f5ee5f4f93324d4b1100bcc0e665550e9215fe69aecc54d9acab013a78da9  mcp.js
 ce98408283eccac2d435ac0e0ceb6bb5456e1eb70edb03a03e347a9f82f99c69  memory.d.ts
 11e58fde47bb2b5bcbbb2e8a7ac4d793f661f006f9ad3b0b58b6e26b2c0ab80d  memory.d.ts.map
-92fddad737db51af2cfc26459f932c7e614fdc051213cb9521b3c3b011ab8f73  memory.js
-b23287c3e814128a7102074caeba48b836361fac1c88beae5573296204616dd6  nativehost.template.json
-07879dcc9b6b076645e2e0762d98fe0a8a966c5e571831f558b17b84a0ad9acc  node.cjs
+8148ead7861e8c0790e342b67d8159cb7550c4157d77f240ccad2c3515bfbe35  memory.js
+6f1cde52414e77d4e45be4007871daf27898303b0654c6f9a615cd335e4174cd  nativehost.template.json
+d9506c807132e4425e18942a2fbd58480d0ab2b077a7cd5c60c702b9458292ec  node.cjs
 705d895c58fe6816958f0fed4bef0a6f79e5fc521ab49d9cf83e0fbcd9d71afe  node.d.ts
 36b9946ee17e28ccbd83b7260bf0e26031261b268eeb2ff8a0e8784840712a00  node.d.ts.map
 c40cdda184911cd77067737bbc91295de77535d09970dd540eeeacac2fbc33d9  pack.d.ts
 ddd8f8ca5410b77ce699ca52560c7a3ab4beabc88ae37e1f6c8d9ab8a5f6697b  pack.d.ts.map
-f58d3b0c19e6ef48961f9215a27a7e224d99e4cf60adbffddaa797e3bea99588  pack.js
-ddc5752125344c7910bbfe307f1d6cb3bd573905fbbb3591bc8bcf115847fd9f  package.json
+596f855fdd1b43b1d30c2e8ea4ce5598b541ed0a903b7c674825b2ed008f6b90  pack.js
+31c2a381760d49e22f38b2c458b16eb435ed5ea67306bad4c481d666061beee2  package.json
 e3a2ed944a0bc1ef4943ee250a57e428ce49d781d30de6072571e0bc5d8c0259  policy.d.ts
 bf6531ec1b14a79cd95bddca0933208570157b0ddc514a6692c0a96734de9efa  policy.d.ts.map
-dce980f30b20ac199bd63603685f194d1299e33f38333ecbebe6738bb2af7cef  policy.js
+e170b76ed618144001f4de58e250ea651d12464cf92392a75dd4884c80b41e5c  policy.js
 ea621ab35e610fbe8acb8e91f21ed2c74a6b20bba537c5982f31458d6878b90b  progress.d.ts
 a8638ca8a7376ef42055b934f3ce865c740a26b06c417445005c1f15ebe66eb5  progress.d.ts.map
-f2611a8aeddc66a47c91dd883826479c227d310770107e29b88050c79d769358  progress.js
+3219337fee2e580f1300f721ab78f6925fe46eba30d084515ec7a0a6fee3c68e  progress.js
 d2e54016f0cad51928752882d780066ccf2267d383deb2407ea7b2f97dfd26e7  protocol.d.ts
 7185f297b17b448828568d7d6fdfb81efe9c961f692fd2375a3d0e457f69cb77  protocol.d.ts.map
-c35813b17a428e09f0b95779b59660e7a618949b57a3f486ed38f95b9d2fb574  protocol.js
+3801b9f9f6bc09638c0f3556fa2d95c9bb723eb0b75bbbed15d706a558c829a7  protocol.js
 456c4a26fd65c728f2dcb9e615ec6e4d446d7e4228bfa3f70ce2b17ee3d6a2c2  schemas/audit.schema.json
 ea272aa6bf4df585ae1ca8ca63e36d7ec713c46187f37ed86ff3620a0e8509b2  schemas/capability.schema.json
 6e9d2291dc54f7d01463e5f70c8f0793d952a63f4096d61ee4dbc4bfd6f6b0a0  schemas/envelope.schema.json
@@ -136,7 +136,7 @@ a02073c153d1248638fa3cbb5f0749534382cf262d09671018cdfc538ae74430  schemas/progre
 8e104f945a846463c1020cbed21c655f233a943d6e2a18c88b37c7ab56b86de1  schemas/proposal.schema.json
 d0e0365a7641c0127338c14a5318c4591dc598b7d2a36b7b2944219921d1ce4e  schemas/session.schema.json
 5bb7d16534b52ca3a7171178065fb7b283947accd1b616ce89e330eb7a91b82e  schemas/tool.schema.json
-ee3bb29a0b9594e6b6d882a6135df52f5c2ad6254a2d8231557f412dd88bc07d  umd-example.html
+ca14204a84ffe295b1d160e74e00f2b03bb4947722b4074706fdbbaeb4853635  umd-example.html
 16f66af22e038e4f9328420a0ed0ee34145ca79c938940e8c2e6d232e25a7c09  umd.d.ts
 ac25f7481155ac9321c5a657e7c4a53570bee8b3f63fe3527045260523a494c8  umd.d.ts.map
 58e21373cec5ade3e6698da5b36ecc2bf7e7e2f755c6fb5e3a6605b535b93985  manifest.json key

package/cli.d.ts

@@ -42,6 +42,7 @@ export declare function deepmanifestchecks(input: {
         minchrome: number;
     }>;
     digestof: (bytes: Uint8Array) => string;
+    bundlepresent?: boolean;
 }): {
     findings: manifestcheckfinding[];
     exitcode: number;

package/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../cli.ts"],"names":[],"mappings":"AAAA,sLAAsL;AA2BtL,OAAO,KAAK,EAAc,gBAAgB,EAAiC,eAAe,EAAsC,QAAQ,EAAgB,kBAAkB,EAAmB,WAAW,EAA+G,YAAY,EAA0B,oBAAoB,EAAgB,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAqzBxe;;;;GAIG;AAEH,kTAAkT;AAClT,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CA4B/D;AAED,oHAAoH;AACpH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAsF,CAAC;AAEnI,4IAA4I;AAC5I,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,uOAAuO;AACvO,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAKvD;AAED,gZAAgZ;AAChZ,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOjD,CAAC;AAEF,oLAAoL;AACpL,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAqB,CAAC;AAExE,mQAAmQ;AACnQ,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpG;AAED,8IAA8I;AAC9I,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlF;AAED,qJAAqJ;AACrJ,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhH;AAED,qJAAqJ;AACrJ,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpD;AAED,6hBAA6hB;AAC7hB,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,YAAY,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAqF5S;AAED,6TAA6T;AAC7T,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,kBAAkB,EAAE,CAwC/H;AAED,qJAAqJ;AACrJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,eAAe,CAWjE;AAED,yLAAyL;AACzL,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAyBtE;AAED,6PAA6P;AAC7P,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAmB/F;AAED,+MAA+M;AAC/M,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,kBAAkB,CAYvH;AAED,0LAA0L;AAC1L,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,WAAW,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGtH;AAED,2QAA2Q;AAC3Q,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQtJ;AAED,sPAAsP;AACtP,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAYnI;AAED,oNAAoN;AACpN,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMvP;AAED,6PAA6P;AAC7P,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAgBpE;AAED,yJAAyJ;AACzJ,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAI3F;AAID;;;GAGG;AAEH,mWAAmW;AACnW,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAqDD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAiEtF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAyFtF;AA6BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAsExF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAqDxF;AAED,6TAA6T;AAC7T,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6BrD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAmDpF;AAED,qVAAqV;AACrV,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAW5G;AAED,wNAAwN;AACxN,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgBrL"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../cli.ts"],"names":[],"mappings":"AAAA,sLAAsL;AA2BtL,OAAO,KAAK,EAAc,gBAAgB,EAAiC,eAAe,EAAsC,QAAQ,EAAgB,kBAAkB,EAAmB,WAAW,EAA+G,YAAY,EAA0B,oBAAoB,EAAgB,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyzBxe;;;;GAIG;AAEH,kTAAkT;AAClT,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CA4B/D;AAED,oHAAoH;AACpH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAsF,CAAC;AAEnI,4IAA4I;AAC5I,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,uOAAuO;AACvO,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAKvD;AAED,gZAAgZ;AAChZ,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAOjD,CAAC;AAEF,oLAAoL;AACpL,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAqB,CAAC;AAExE,mQAAmQ;AACnQ,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpG;AAED,8IAA8I;AAC9I,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKlF;AAED,qJAAqJ;AACrJ,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKhH;AAED,qJAAqJ;AACrJ,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpD;AAED,6hBAA6hB;AAC7hB,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,YAAY,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAwFrU;AAED,6TAA6T;AAC7T,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,kBAAkB,EAAE,CAwC/H;AAED,qJAAqJ;AACrJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG,eAAe,CAWjE;AAED,yLAAyL;AACzL,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAyBtE;AAED,6PAA6P;AAC7P,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAmB/F;AAED,+MAA+M;AAC/M,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,EAAE,CAAA;CAAE,GAAG,kBAAkB,CAYvH;AAED,0LAA0L;AAC1L,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,WAAW,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGtH;AAED,2QAA2Q;AAC3Q,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQtJ;AAED,sPAAsP;AACtP,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAYnI;AAED,oNAAoN;AACpN,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMvP;AAED,6PAA6P;AAC7P,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAgBpE;AAED,yJAAyJ;AACzJ,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAI3F;AAID;;;GAGG;AAEH,mWAAmW;AACnW,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAqDD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAiEtF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAyFtF;AA6BD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAsExF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAqDxF;AAED,6TAA6T;AAC7T,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CA6BrD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAqDpF;AAED,qVAAqV;AACrV,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAW5G;AAED,wNAAwN;AACxN,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAgBrL"}

package/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // cli.ts
 import { createInterface } from "node:readline/promises";
@@ -248,7 +248,7 @@ function endcall(input) {
 }
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 
@@ -12315,9 +12315,11 @@ async function main() {
     if (worlds.some((world) => world !== "ISOLATED")) throw new Error("Content scripts stay registered in the isolated world by default; no main world registration exists.");
     if ((manifest["content_scripts"] ?? []).some((script) => (script.matches ?? []).length > 0)) throw new Error("Content script registrations carry no matches because injection stays behind the granted scripting calls on reviewed origins.");
     const filebytes = {};
+    let bundlepresent = false;
     try {
       const distdir = resolve("dist/extension");
       for (const entry of await readdir(distdir)) if (entry.endsWith(".js")) filebytes[entry] = new Uint8Array(await readFile(join(distdir, entry)));
+      bundlepresent = true;
       const iconsdir = resolve("dist/extension/icons");
       for (const entry of await readdir(iconsdir)) if (entry.endsWith(".png")) filebytes[`icons/${entry}`] = new Uint8Array(await readFile(join(iconsdir, entry)));
     } catch {
@@ -12328,7 +12330,9 @@ async function main() {
       manifestfile: "manifest.json",
       filebytes,
       capabilities: capabilityapireport([...permissions, ...optional]),
-      digestof: (bytes) => createHash("sha256").update(bytes).digest("base64")
+      digestof: (bytes) => createHash("sha256").update(bytes).digest("base64"),
+      /* the 2.0.6 fail-soft: a running tree without any dist/extension bundle (an installed library package, an unbuilt checkout) answers the icon family through the release-zip note instead of six absent-bundle errors — the bundle-present error stays for a built tree whose bundle misses a declared icon. */
+      bundlepresent
     });
     if (deep.exitcode !== 0) {
       for (const finding of deep.findings.filter((entry) => entry.severity === "error")) console.error(`${finding.severity.toUpperCase()} ${finding.rule} at ${finding.path}${finding.source !== void 0 ? ` (${finding.source})` : ""}: ${finding.message}`);
@@ -12589,6 +12593,10 @@ function deepmanifestchecks(input) {
       }
       const bytes = input.filebytes[path];
       if (bytes === void 0) {
+        if (input.bundlepresent === false) {
+          findings.push({ rule: "manifest.icons", path: `icons.${size}`, severity: "info", message: `The icon ${path} of size ${size} rides the browser bundle of the release zip channel; the running tree carries no bundle to verify against \u2014 a repository checkout verifies it after pnpm build and an installed library package carries the manifest structure alone.` });
+          continue;
+        }
         const source = manifestsourceline(input.manifesttext, input.manifestfile, path);
         findings.push({ rule: "manifest.icons", path: `icons.${size}`, ...source !== void 0 ? { source } : {}, severity: "error", message: `The icon ${path} of size ${size} ships no file in the bundle.` });
         continue;
@@ -13191,10 +13199,11 @@ function importtabular(input) {
   let origin;
   while (cursor < rawlines.length && (rawlines[cursor] ?? "").trim().startsWith("#")) {
     const comment = (rawlines[cursor] ?? "").trim();
-    const goalmatch = /^#\s*goal:\s*(.+)$/u.exec(comment);
-    if (goalmatch !== null) goal = goalmatch[1]?.trim();
-    const originmatch = /^#\s*origin:\s*(.+)$/u.exec(comment);
-    if (originmatch !== null) origin = originmatch[1]?.trim();
+    const body = comment.slice(1).trim();
+    const goalvalue = body.startsWith("goal:") ? body.slice("goal:".length).trim() : "";
+    if (goalvalue !== "") goal = goalvalue;
+    const originvalue = body.startsWith("origin:") ? body.slice("origin:".length).trim() : "";
+    if (originvalue !== "") origin = originvalue;
     cursor += 1;
   }
   if (goal === void 0 || goal === "") throw new Error("The tabular source carries no `# goal:` preface line; a csv row set holds no metadata of its own, so the goal must ride the preface the conversion reads.");

package/companion.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
+/*! devthink 2.0.8 companion — the optional native host of the native bridge — GPL-3.0-only — built with plain node, no native compiler */
 
 // companion.ts
 import { createHash, randomBytes } from "node:crypto";
@@ -16,7 +16,7 @@ var nativehosttemplatejson = `{
   "devthinkBanner": "devthink __devthink_version__ native host manifest template \u2014 GPL-3.0-only \u2014 the chromium host manifest of the optional companion process"
 }
 `;
-var companionbuild = "2.0.5";
+var companionbuild = "2.0.8";
 var companionprotocol = 1;
 var companionsurfaces = ["osdialog", "notification"];
 var maxnativemessage = 1024 * 1024;

package/crossbrowser.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // crossbrowser.ts
 var browserpolyfillflags = ["sidepanel", "scripting", "storage.session", "tabs.executeScript", "notifications", "contextMenus", "clipboard", "downloads", "runtime.messaging", "runtime.geturl"];

package/dashdone.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // dashdone.ts
 function dashboardviewerof(input) {

package/deno.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/devthink.umd.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 (function (root, factory) {
   if (typeof define === "function" && define.amd) { define([], factory); }
   else if (typeof module === "object" && module.exports) { module.exports = factory(); }
@@ -2365,7 +2365,7 @@ __export(umd_exports, {
 module.exports = __toCommonJS(umd_exports);
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/gateway.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // auth.ts
 function urlencodeform(fields) {

package/hardening.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // security.ts
 var maskmarker = "[redacted]";

package/headless.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 
 // runtime.ts

package/http.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 
 // types.ts

package/index.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2356,7 +2356,7 @@ __export(cjs_exports, {
 module.exports = __toCommonJS(cjs_exports);
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/index.neutral.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // debug.ts
 var cdpkinds = ["attachcdp", "detachcdp", "cdpcmd", "watchcdp", "setbreakpoint", "stepcode", "watchexpr", "overridescript"];
@@ -1284,7 +1284,7 @@ function sessionbundleof(input) {
 }
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": 3,
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnOEjO8Z0PDgQyfvawGcaO2j+o0GLCFTLNj7TkYC/Avo9l2NenMRq7gp90Nfd7E9MViv/OMcCKSYZ5unv12QPRtv31C+a5UQWDFAOP/cH5mwMd6hsayElrSoW8ta+FwFqmr9dIFkn7cQEU3YhZr4Gcbs+ycUHOxVgDA4NBKB0rQ6e9VW5LvTw0isRYUrqM+M72vKxHk9zUIYYn/LGPvottKBYi2GLr0PHSeC2UE+Shmq7vcFIXj6hDjvD4kLJ5sKoUllEcZ1TPuBcnHUQ9ndKA5iktXDQOIJCUJmi7a0YJ2PGg7fvpYfT9k0ai/qZ+pIoRfoOEwE01bPoDn7NjeYnNQIDAQAB",
   "name": "Devthink",
-  "version": "2.0.5",
+  "version": "2.0.8",
   "description": "A consent-first bridge for reviewed browser-agent tasks.",
   "icons": {
     "16": "icons/16.png",

package/mcp.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/memory.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // debug.ts
 function expireprofilerecords(input) {

package/nativehost.template.json

@@ -6,5 +6,5 @@
   "allowed_origins": [
     "chrome-extension://__generated_extension_id__/"
   ],
-  "devthinkBanner": "devthink 2.0.5 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
+  "devthinkBanner": "devthink 2.0.8 native host manifest template — GPL-3.0-only — the chromium host manifest of the optional companion process"
 }

package/node.cjs

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -2357,7 +2357,7 @@ __export(node_exports, {
 module.exports = __toCommonJS(node_exports);
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/pack.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // pack.ts
 function artifactchannels() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenathlan/extension",
-  "version": "2.0.5",
+  "version": "2.0.8",
   "description": "Consent-first browser agent bridge and Manifest V3 extension.",
   "type": "module",
   "license": "GPL-3.0-only",

package/policy.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -316,7 +316,7 @@ function sessionrecordvalid(value) {
 }
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 var protocolfloormajor = 2;
 

package/progress.js

@@ -1,7 +1,7 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 
 // progress.ts

package/protocol.js

@@ -1,4 +1,4 @@
-/*! devthink 2.0.5 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
+/*! devthink 2.0.8 — consent-first browser agent library — GPL-3.0-only — https://github.com/wenathlan/extension */
 
 // debug.ts
 var cdpdomains = ["Runtime", "Log", "Debugger", "DOM", "Network", "Page"];
@@ -987,7 +987,7 @@ function cronvalue(value, min, max, names) {
 }
 
 // version.ts
-var packageversion = "2.0.5";
+var packageversion = "2.0.8";
 var protocolmajor = 2;
 
 // types.ts

package/umd-example.html

@@ -1,4 +1,4 @@
-<!-- devthink 2.0.5 umd example page — GPL-3.0-only -->
+<!-- devthink 2.0.8 umd example page — GPL-3.0-only -->
 <!doctype html>
 <html lang="en">
 <head>