eslint-plugin-chrome-extensions 2.4.0 → 2.4.2

package/README.md

@@ -4,7 +4,7 @@
 
 <a target="_blank" href="https://www.npmjs.com/package/eslint-plugin-chrome-extensions">
     <img alt="[Latest Build]" src="https://img.shields.io/npm/v/eslint-plugin-chrome-extensions?logo=icinga&style=for-the-badge&label=Latest%20Build&color=32fcee"></a>
-<a href="#license">
+<a href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
     <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 <a target="_blank" href="https://eslint.org/">
     <img alt="[Requires ESLint >=9.6.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.6.0-4B32C3?style=for-the-badge&logo=eslint"></a>
@@ -40,7 +40,7 @@ import chromeExtensions from 'eslint-plugin-chrome-extensions'
 export default [
     // other configs
     {
-        files: ['**/*extension/**/*.{cjs,js,jsx,mjs,ts,tsx}'],
+        files: ['**/extension/**/*.{cjs,js,jsx,mjs,ts,tsx}'],
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
@@ -54,12 +54,12 @@ export default [
             'chrome-extensions/manifest-spacing': ['warn', { spaces: 4 }]  // selectively tweak rule
         }
     },
-    { files: ['**/*LICENSE*'],             ...chromeExtensions.configs.license },
-    { files: ['**/*extension/**/*.css'],   ...chromeExtensions.configs.css     },
-    { files: ['**/*extension/**/*.html'],  ...chromeExtensions.configs.html    },
-    { files: ['**/*extension/**/*.json'],  ...chromeExtensions.configs.json    },
-    { files: ['**/*extension/**/*.json5'], ...chromeExtensions.configs.json5   },
-    { files: ['**/*extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc   }
+    { files: ['**/*LICENSE*'],            ...chromeExtensions.configs.license },
+    { files: ['**/extension/**/*.css'],   ...chromeExtensions.configs.css     },
+    { files: ['**/extension/**/*.html'],  ...chromeExtensions.configs.html    },
+    { files: ['**/extension/**/*.json'],  ...chromeExtensions.configs.json    },
+    { files: ['**/extension/**/*.json5'], ...chromeExtensions.configs.json5   },
+    { files: ['**/extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc   }
 ]
 ```
 
@@ -386,9 +386,8 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 -   "name": "Foo",
 -   "name": "Bar",
     "name": "My Extension",
--   "version": "1.0.0",
--   "version": "2.0.0"
     "version": "1.0.0"
+-   "version": "2.0.0"
   }
 ```
 
@@ -488,7 +487,7 @@ If you intentionally target HTTP endpoints.
 
 <details>
 
-<summary>Requires sender/origin validation + filtered <code>tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
+<summary>Requires sender/origin validation + filtered <code>chrome.tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
 
 <h4 id="no-insecure-messaging-options">Options</h4>
 
@@ -728,9 +727,9 @@ If your `_locales/` is externally populated at build time.
         <img height=18 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
         <img height=18 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage">
+    <a title="Works in 'json/json5' config block" href="#usage">
         <img height=18 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage">
+    <a title="Works in 'json/jsonc' config block" href="#usage">
         <img height=18 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
@@ -760,7 +759,7 @@ If your `_locales/` is externally populated at build time.
   }
 
   // _locales/en/messages.json
-  { "unrelated": { "message": "…" }}
+  { "unrelated": { "message": "sup" }}
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -776,7 +775,7 @@ If your `_locales/` is externally populated at build time.
   }
 
   // _locales/en/messages.json
-- { "unrelated": { "message": "…" }}
+- { "unrelated": { "message": "sup" }}
 + {
 +   "greeting": { "message": "Hello" },
 +   "extName": { "message": "My Extension" }
@@ -1135,8 +1134,8 @@ If your i18n keys are referenced dynamically.
     <a title="Works in 'css/css' config block" href="#usage"><img height=14 alt="[CSS]" src="https://img.shields.io/badge/CSS-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Works in 'html/html' config block" href="#usage"><img height=14 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage"><img height=14 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage"><img height=14 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage"><img height=14 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json5' config block" href="#usage"><img height=14 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/jsonc' config block" href="#usage"><img height=14 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#no-missing-i18n-keys-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/i18n">Chrome for Developers — `i18n`</a>
 
@@ -1228,20 +1227,18 @@ If you access the granted API through an alias or computed property rather than
 
 <summary>Requires a license file in the extension.</summary>
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect directory structure
 
 ```diff
-  // files
   /extension/manifest.json
 !
 ```
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct directory structure
 
 ```diff
-  // files
   /extension/manifest.json
-+ /extension/LICENSE
++ /extension/LICENSE.md
 ```
 
 #### When not to use it
@@ -1255,7 +1252,7 @@ If you intentionally omit a license, or it's injected at build time.
 #### See also
 
 - [`valid-license-file`](#valid-license-file)
-    <a title="Only works in 'license' config block" href="#usage"><img height=14 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Only works in license config block" href="#usage"><img height=14 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#valid-license-file-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 
 <div align="center">
@@ -1403,9 +1400,9 @@ If you primarily target a browser that doesn't support `short_name`.
         <img height=18 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
         <img height=18 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage">
+    <a title="Works in 'json/json5' config block" href="#usage">
         <img height=18 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage">
+    <a title="Works in 'json/jsonc' config block" href="#usage">
         <img height=18 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
@@ -1485,7 +1482,7 @@ If you don't use conventional filenames or paths, or they're generated at build
 
 <h3 id="valid-license-file">
     <code>valid-license-file</code>
-    <a title="Only works in 'license' config block" href="#usage">
+    <a title="Only works in license config block" href="#usage">
         <img height=18 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
@@ -1508,13 +1505,9 @@ If you don't use conventional filenames or paths, or they're generated at build
 ```diff
   /* eslint chrome-extensions/valid-license-file: ['error', { requireSPDX: true, allowedLicenses: ['MIT'] }] */
 
-  // LICENSE.md
-
-  MIT License
-  
+! MIT License
+  -----------
   Copyright © 2026 You
-
-!
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -1522,15 +1515,17 @@ If you don't use conventional filenames or paths, or they're generated at build
 ```diff
   /* eslint chrome-extensions/valid-license-file: ['error', { requireSPDX: true, allowedLicenses: ['MIT'] }] */
 
-  // LICENSE.md
-
   MIT License
-
+  -----------
   Copyright © 2026 You
-
++
 + SPDX-License-Identifier: MIT
 ```
 
+#### Benefits
+
+Makes the license machine-readable by compliance scanners + SBOM generators + CI gates.
+
 #### When not to use it
 
 If your license is injected at build time, or you use a license w/ no SPDX identifier.
@@ -1776,7 +1771,7 @@ If your background context isn't a service worker.
 <h4 id="valid-url-fields-options">Options</h4>
 
 - `checkURLfields` (default `true`) – validate URL fields (<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/chrome-settings-override">`chrome_settings_overrides`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/homepage-url">`homepage_url`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/oauth2">`oauth2.scopes`</a>, <a target="_blank" href="https://developer.chrome.com/docs/apps/autoupdate#update_url">`update_url`</a>)
-- `checkMatchPatterns` (default `true`) – validate match patterns (in <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-scripts">`content_scripts`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable">`externally_connectable`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions#host-permissions">`host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">`optional_host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">`web_accessible_resources`</a>)
+- `checkMatchPatterns` (default `true`) – validate <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">match patterns</a> (in <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-scripts">`content_scripts`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable">`externally_connectable`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions#host-permissions">`host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">`optional_host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">`web_accessible_resources`</a>)
 - `allowedSchemes` (default `['https', 'file']`) – permitted URL schemes for <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">match patterns</a>
 - `allowAllURLs` (default `false`) – allow unrestricted patterns (<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`<all_urls>`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`https://*/*`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`*://*/*`</a>)
 
@@ -1810,7 +1805,7 @@ If your background context isn't a service worker.
 
 #### When not to use it
 
-If your URLs or match patterns are generated at build time.
+If your URLs or patterns are generated at build time.
 
 #### Introduced in
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -17,7 +17,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
+    "url": "https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
   },
   "funding": [
     {
@@ -66,12 +66,14 @@
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
+    "@eslint/css": "^2.0.0",
     "@eslint/js": "^10.0.1",
     "@eslint/json": "^2.1.1",
     "@eslint/markdown": "^7.5.1",
+    "@html-eslint/eslint-plugin": "^0.66.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.2",
+    "eslint-plugin-constructors": "^1.4.3",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",

package/src/data/license.js

@@ -3,7 +3,8 @@ import path from 'node:path'
 
 export const re = {
     licenseFilename: // e.g. LICENSE.md, LICENSE-MIT, MIT-LICENSE.md, COPYING.LESSER, LICENSE-2.0.txt
-        /^(?:[\w.-]*-)?(?:LICEN[SC]E|COPYING)(?:[-.][\w.-]+)?$/i, // eslint-disable-line security/detect-unsafe-regex
+        // eslint-disable-next-line security/detect-unsafe-regex
+        /^(?!.*\.(?:[cm]?js|[cm]?ts)x?$)(?:[\w.-]*-)?(?:LICEN[SC]E|COPYING)(?:[-.][\w.-]+)?$/i,
     spdxTag: /SPDX-License-Identifier:\s*([\w.+-]+)/i
 }
 

package/src/data/manifest.js

@@ -36,9 +36,26 @@ export const manifestKeyOrder = [
     'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
 
+export const matchPaths = new Set([
+    'content_scripts.matches', 'externally_connectable.matches',
+    'host_permissions', 'optional_host_permissions', 'web_accessible_resources.matches'
+])
+
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [
     'eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']
 
 export const serviceWorkerKeepaliveMinMS = 30000
+
+export const urlPaths = new Set([
+    'homepage_url', 'update_url', 'oauth2.scopes',
+    'chrome_settings_overrides.homepage',
+    'chrome_settings_overrides.search_provider.alternate_urls',
+    'chrome_settings_overrides.search_provider.favicon_url',
+    'chrome_settings_overrides.search_provider.image_url',
+    'chrome_settings_overrides.search_provider.instant_url',
+    'chrome_settings_overrides.search_provider.search_url',
+    'chrome_settings_overrides.search_provider.suggest_url',
+    'chrome_settings_overrides.startup_pages'
+])

package/src/index.js

@@ -31,7 +31,8 @@ import validServiceWorker from './rules/valid-service-worker.js'
 import validURLfields from './rules/valid-url-fields.js'
 import validVersionField from './rules/valid-version-field.js'
 
-import { bundleRules, initBundleDeprecation } from './utils.js'
+import { bundle as bundleRules } from './utils/rules.js'
+import { initDeprecation as initBundleDeprecation } from './utils/bundle.js'
 import { textParser } from './data/text-parser.js'
 
 const plugin = {

package/src/rules/manifest-key-order.js

@@ -1,5 +1,5 @@
 import { manifestKeyOrder } from '../data/manifest.js'
-import { getFilename } from '../utils.js'
+import { file } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -43,7 +43,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const custom = context.options[0]?.order ?? [],
               master = custom.length ? manifestKeyOrder.filter(key => !custom.includes(key))
                      : manifestKeyOrder

package/src/rules/manifest-spacing.js

@@ -1,4 +1,4 @@
-import { getFilename } from '../utils.js'
+import { file } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/, leadingWhitespace: /^[ \t]+/ },
       brackets = { open: new Set(['LBrace', 'LBracket']), close: new Set(['RBrace', 'RBracket']) }
@@ -57,7 +57,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const opts = context.options[0] || {},
               spaces = opts.spaces ?? 2,
               checkColons = opts.checkColons ?? true,

package/src/rules/no-content-style-leak.js

@@ -1,4 +1,4 @@
-import { readManifest, isContentScriptFile } from '../utils.js'
+import { file, readManifest } from '../utils/extension.js'
 
 const re = { appendMethod: /^append(?:Child)?$/ }
 
@@ -17,7 +17,7 @@ export default {
     },
 
     create(context) {
-        const manifest = readManifest(context) ; if (!manifest || !isContentScriptFile(context, manifest)) return {}
+        const manifest = readManifest(context) ; if (!manifest || !file.isContentScript(context, manifest)) return {}
         const styleElems = new Set(), docAliases = new Set()
         function isCreateStyle(node) {
             return node?.type == 'CallExpression'

package/src/rules/no-deprecated-apis.js

@@ -1,5 +1,5 @@
 import { findDeprecated } from '../data/apis.js'
-import { getMemberPath } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
 
 export default {
     meta: {

package/src/rules/no-duplicate-manifest-keys.js

@@ -1,4 +1,4 @@
-import { getFilename } from '../utils.js'
+import { file } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -18,7 +18,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         return {
             Object(node) {
                 const members = node.members || node.properties || [],

package/src/rules/no-insecure-messaging.js

@@ -1,4 +1,4 @@
-import { getMemberPath } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
 import { isExternalMessagingListener } from '../data/apis.js'
 
 const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }

package/src/rules/no-invalid-permissions.js

@@ -1,4 +1,4 @@
-import { getFilename, readManifest } from '../utils.js'
+import { file, readManifest } from '../utils/extension.js'
 import { isValidPermission } from '../data/permissions.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -49,16 +49,16 @@ export default {
             if (allowed.has(permission) || isValidPermission(permission, target)) return
             context.report({ node, messageId: 'invalidPermission', data: { permission, target }})
         }
-        if (re.manifestFilename.test(getFilename(context))) // lint it directly
+        if (re.manifestFilename.test(file.getName(context))) // lint it directly
             return {
                 '*'(node) {
                     const keyNode = node.name || node.key ; if (!keyNode) return
                     const keyName = keyNode.value ?? keyNode.name
                     if (keyName != 'permissions' && keyName != 'optional_permissions') return
                     const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                    const elements = arrNode.elements || arrNode.items || []
-                    for (const el of elements) {
-                        const valueNode = el.value || el
+                    const elems = arrNode.elements || arrNode.items || []
+                    for (const elem of elems) {
+                        const valueNode = elem.value || elem
                         checkPermission(valueNode, valueNode?.value)
                     }
                 }

package/src/rules/no-missing-default-locale.js

@@ -4,7 +4,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 
 import { findExtensionRoot, isPredefined } from '../data/i18n.js'
-import { readManifest } from '../utils.js'
+import { readManifest } from '../utils/extension.js'
 
 const re = { manifestFile: /manifest\.json$/ }
 

package/src/rules/no-missing-i18n-keys.js

@@ -1,4 +1,5 @@
-import { getMemberPath, readManifest } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
+import { readManifest } from '../utils/extension.js'
 import { findExtensionRoot, isPredefined, readDefaultLocaleMessages, re as i18nRe } from '../data/i18n.js'
 
 const re = { file: { js: /\.(cjs|js|jsx|mjs|ts|tsx)$/i, manifest: /manifest\.json$/, text: /\.(css|htm|html)$/i }}

package/src/rules/no-missing-permissions.js

@@ -1,5 +1,6 @@
 import { findPermission } from '../data/apis.js'
-import { getMemberPath, readManifest } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
+import { readManifest } from '../utils/extension.js'
 
 function queriesActiveTab(node) {
     const arg = node.arguments[0] ; if (arg?.type != 'ObjectExpression') return false

package/src/rules/no-missing-web-accessible-resources.js

@@ -1,4 +1,5 @@
-import { getMemberPath, isContentScriptFile, readManifest } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
+import { file, readManifest } from '../utils/extension.js'
 
 const re = { leadingSlash: /^\//, regexSpecial: /[.+?^${}()|[\]\\]/g }
 
@@ -35,7 +36,7 @@ export default {
 
     create(context) {
         const manifest = readManifest(context) ; if (!manifest) return {}
-        if (!isContentScriptFile(context, manifest)) return {}
+        if (!file.isContentScript(context, manifest)) return {}
         const regexes = collectWARpatterns(manifest).map(patternToRegex)
         return {
             CallExpression(node) {

package/src/rules/no-remote-code.js

@@ -1,5 +1,5 @@
 import { remoteCodePatterns } from '../data/manifest.js'
-import { getMemberPath } from '../utils.js'
+import { getMemberPath } from '../utils/node.js'
 
 const re = { url: /^https?:\/\// }
 

package/src/rules/no-unrestricted-host-permissions.js

@@ -1,4 +1,4 @@
-import { getFilename } from '../utils.js'
+import { file } from '../utils/extension.js'
 
 const re = { broadHost: /^(?:<all_urls>|\*:\/\/\*\/\*|\w+:\/\/\*\/\*)$/, manifestFilename: /manifest\.json$/ },
       hostKeys = new Set(['host_permissions', 'optional_host_permissions', 'optional_permissions', 'permissions'])
@@ -31,7 +31,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const allowed = new Set(context.options[0]?.allowedPatterns || [])
         return {
             '*'(node) {

package/src/rules/no-unused-i18n-keys.js

@@ -1,5 +1,5 @@
-import { readManifest } from '../utils.js'
 import { collectUsedKeys, defaultScanExtensions, findExtensionRoot, readDefaultLocaleMessages } from '../data/i18n.js'
+import { readManifest } from '../utils/extension.js'
 
 const re = { manifestFile: /manifest\.json$/ }
 

package/src/rules/no-unused-permissions.js

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 
 import { apiPermissionMap, findPermission } from '../data/apis.js'
-import { findExtensionRoot, getFilename, readManifest } from '../utils.js'
+import { file, findRoot as findExtensionRoot, readManifest } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -44,7 +44,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const manifest = readManifest(context) ; if (!manifest) return {}
         const root = findExtensionRoot(context) ; if (!root) return {}
         const usedAPIs = collectUsedAPIs(manifest, root)
@@ -64,9 +64,9 @@ export default {
                 const keyName = keyNode.value ?? keyNode.name
                 if (keyName != 'permissions' && keyName != 'optional_permissions') return
                 const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const elements = arrNode.elements || arrNode.items || []
-                for (const el of elements) {
-                    const valueNode = el.value || el
+                const elems = arrNode.elements || arrNode.items || []
+                for (const elem of elems) {
+                    const valueNode = elem.value || elem
                     const perm = valueNode?.value
                     if (typeof perm != 'string') continue
                     if (!permissionNodes.has(perm)) permissionNodes.set(perm, [])

package/src/rules/require-license-file.js

@@ -1,6 +1,7 @@
 import path from 'node:path'
 
 import { findLicenseFile } from '../data/license.js'
+import { findRoot as findPkgRoot } from '../utils/pkg.js'
 
 export default {
     meta: {
@@ -13,15 +14,16 @@ export default {
         schema: [],
         messages: {
             missingFile: 'No license file found. Add one of: LICENSE, LICENSE.md, LICENSE.txt, COPYING '
-                       + '(at extension root or in a subdir).'
+                       + '(at the package root or in a subdir).'
         }
     },
     create(context) {
-        const { filename } = context,
-              check = node => {
-                  if (!findLicenseFile(path.dirname(filename)))
-                      context.report({ node, messageId: 'missingFile' })
-              }
+        const { filename } = context
+        function check(node) {
+            const pkgRoot = findPkgRoot(path.dirname(filename))
+            if (!pkgRoot || !findLicenseFile(pkgRoot))
+                context.report({ node, messageId: 'missingFile' })
+        }
         return { Program: check, Document: check }
     }
 }

package/src/rules/require-mv3.js

@@ -1,4 +1,4 @@
-import { getFilename, readManifest } from '../utils.js'
+import { file, readManifest } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -18,7 +18,7 @@ export default {
     },
 
     create(context) {
-        if (re.manifestFilename.test(getFilename(context))) { // lint it directly
+        if (re.manifestFilename.test(file.getName(context))) { // lint it directly
             let foundVersion = null, versionNode = null
             return {
                 '*'(node) {

package/src/rules/require-short-name-when-useful.js

@@ -1,4 +1,4 @@
-import { getFilename } from '../utils.js'
+import { file } from '../utils/extension.js'
 
 const defaults = { maxNameLength: 12 },
       re = { i18nPlaceholder: /^__MSG_.+__$/, manifestFilename: /manifest\.json$/ }
@@ -43,7 +43,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const opts = context.options[0] || {},
               maxNameLength = opts.maxNameLength ?? defaults.maxNameLength,
               always = opts.always ?? false,

package/src/rules/valid-filenames.js

@@ -62,6 +62,7 @@ export default {
             category: 'Possible Errors',
             recommended: true,
             manifest: true,
+            css: true,
             html: true,
             json: true
         },

package/src/rules/valid-manifest-icons.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 
-import { findExtensionRoot, getFilename } from '../utils.js'
+import { findRoot as findExtensionRoot, file } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/, svg: /\.svg$/i },
       sizes = { recommended: ['16', '32', '48', '128'], required: '128' }
@@ -47,7 +47,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const opts = context.options[0] || {},
               requireRecommended = opts.requireRecommendedSizes !== false,
               checkFiles = opts.checkIconExists !== false,

package/src/rules/valid-mv3-schema.js

@@ -1,7 +1,7 @@
 import { mv2OnlyKeys, forbiddenCSPdirectives, ffMV3bgKeys, ffDataCollectionRequired, ffDataCollectionOptional }
     from '../data/manifest.js'
 
-import { getFilename, readManifest } from '../utils.js'
+import { file, readManifest } from '../utils/extension.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -24,7 +24,7 @@ export default {
     },
 
     create(context) {
-        if (re.manifestFilename.test(getFilename(context))) { // lint it directly
+        if (re.manifestFilename.test(file.getName(context))) { // lint it directly
             const ancestors = [], pendingReports = [], deferredMV2 = []
             let isMV3 = false, isFF = false
             function keyOf(node) {
@@ -64,12 +64,12 @@ export default {
                                         data: { directive }})
                         if (inDataCollection && (keyName == 'required' || keyName == 'optional')
                             && Array.isArray(node.value?.elements)
-                        ) for (const el of node.value.elements) {
-                            const value = typeof el.value == 'string' ? el.value : el.value?.value
+                        ) for (const elem of node.value.elements) {
+                            const value = typeof elem.value == 'string' ? elem.value : elem.value?.value
                             if (typeof value == 'string') {
                                 const set = keyName == 'required' ? ffDataCollectionRequired : ffDataCollectionOptional
                                 if (!set.has(value))
-                                    pendingReports.push({ node: el, messageId: 'invalidDataCollectionValue',
+                                    pendingReports.push({ node: elem, messageId: 'invalidDataCollectionValue',
                                         data: { value, kind: keyName }})
                             }
                         }

package/src/rules/valid-service-worker.js

@@ -1,5 +1,7 @@
 import { domGlobals, serviceWorkerKeepaliveMinMS } from '../data/manifest.js'
-import { isServiceWorkerFile, isInsideNestedFunction, readManifest } from '../utils.js'
+
+import { isInsideNestedFunction } from '../utils/node.js'
+import { file, readManifest } from '../utils/extension.js'
 
 export default {
     meta: {
@@ -19,7 +21,7 @@ export default {
     },
 
     create(context) {
-        const manifest = readManifest(context) ; if (!manifest || !isServiceWorkerFile(context, manifest)) return {}
+        const manifest = readManifest(context) ; if (!manifest || !file.isServiceWorker(context, manifest)) return {}
         return {
             CallExpression(node) {
                 if (node.callee.type == 'MemberExpression'
@@ -35,12 +37,13 @@ export default {
                 ) context.report({ node, messageId: 'keepaliveTimer', data: { fn: node.callee.name }})
             },
             Identifier(node) {
-                if (node.parent?.type == 'MemberExpression' && node.parent.property === node) return
-                if (node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed) return
-                if (!domGlobals.has(node.name)) return
-                for (let scope = context.sourceCode.getScope(node) ;
-                    scope && scope.type != 'global' ;
-                    scope = scope.upper
+                if (node.parent?.type == 'MemberExpression' && node.parent.property === node
+                    || node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed
+                    || !domGlobals.has(node.name)
+                ) return
+                for (let scope = context.sourceCode.getScope(node)
+                    ;scope && scope.type != 'global'
+                    ;scope = scope.upper
                 ) if (scope.set.has(node.name)) return // shadowed by a local binding
                 context.report({ node, messageId: 'domInSW', data: { global: node.name }})
             }

package/src/rules/valid-url-fields.js

@@ -1,32 +1,16 @@
-import { getFilename } from '../utils.js'
+import { matchPaths, urlPaths } from '../data/manifest.js'
+import { file } from '../utils/extension.js'
 
 const re = {
     absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i, manifestFilename: /manifest\.json$/,
     match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/, template: /\{[^}]+\}/g
 }
 
-const matchPaths = new Set([
-    'content_scripts.matches', 'externally_connectable.matches',
-    'host_permissions', 'optional_host_permissions', 'web_accessible_resources.matches'
-])
-
-const urlPaths = new Set([
-    'homepage_url', 'update_url', 'oauth2.scopes',
-    'chrome_settings_overrides.homepage',
-    'chrome_settings_overrides.search_provider.alternate_urls',
-    'chrome_settings_overrides.search_provider.favicon_url',
-    'chrome_settings_overrides.search_provider.image_url',
-    'chrome_settings_overrides.search_provider.instant_url',
-    'chrome_settings_overrides.search_provider.search_url',
-    'chrome_settings_overrides.search_provider.suggest_url',
-    'chrome_settings_overrides.startup_pages'
-])
-
 function collectStrings(obj, path = [], out = []) {
     if (obj == null) return out
     if (typeof obj == 'string') out.push({ path: path.join('.'), value: obj })
     else if (Array.isArray(obj))
-        for (const el of obj) collectStrings(el, path, out)
+        for (const elem of obj) collectStrings(elem, path, out)
     else if (typeof obj == 'object')
         for (const key of Object.keys(obj)) // eslint-disable-next-line security/detect-object-injection
             collectStrings(obj[key], [...path, key], out)
@@ -83,7 +67,7 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(getFilename(context))) return {}
+        if (!re.manifestFilename.test(file.getName(context))) return {}
         const opts = context.options[0] || {},
               checkURLfields = opts.checkURLfields ?? true,
               checkMatchPatterns = opts.checkMatchPatterns ?? true,

package/src/rules/valid-version-field.js

@@ -1,4 +1,4 @@
-import { getFilename, readManifest } from '../utils.js'
+import { file, readManifest } from '../utils/extension.js'
 
 const re = { /* eslint-disable security/detect-unsafe-regex */
     chromeParts: /^\d+(?:\.\d+){0,3}$/,
@@ -79,7 +79,7 @@ export default {
                 }
             }
         }
-        if (re.manifestFilename.test(getFilename(context))) // lint it directly
+        if (re.manifestFilename.test(file.getName(context))) // lint it directly
             return {
                 '*'(node) {
                     const keyNode = node.name || node.key ; if (!keyNode) return

package/src/utils/bundle.js

@@ -0,0 +1,10 @@
+export function initDeprecation(plugin, [ruleId, bundleNames], pluginName) {
+    for (const bundleName of bundleNames) {
+        /* eslint-disable security/detect-object-injection */
+        if (plugin.configs[bundleName])
+            plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
+        /* eslint-enable security/detect-object-injection */
+        if (process.env.DEBUG_MODE)
+            console.warn(`[${pluginName}] '${ruleId}' will be removed from '${bundleName}' in a future major release`)
+    }
+}

package/src/utils/extension.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+const manifestCache = new Map()
+
+export function findRoot(context) {
+    let dir = path.dirname(file.getName(context))
+    while (dir) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
+        const parent = path.dirname(dir)
+        if (parent == dir) break // reached fs root
+        dir = parent
+    }
+    return null
+}
+
+export const file = {
+    getName(context) { return context.filename || context.getFilename() },
+
+    isContentScript(context, manifest) {
+        const scripts = (manifest?.content_scripts || []).flatMap(cs => cs.js || []) ; if (!scripts.length) return false
+        const root = findRoot(context) ; if (!root) return false
+        const filename = path.resolve(file.getName(context))
+        return scripts.some(script => filename == path.resolve(root, script))
+    },
+
+    isServiceWorker(context, manifest) {
+        const worker = manifest?.background?.service_worker ; if (!worker) return false
+        const root = findRoot(context) ; if (!root) return false
+        return path.resolve(file.getName(context)) == path.resolve(root, worker)
+    }
+}
+
+export function readManifest(context) {
+    const root = findRoot(context)
+    if (!root) return null
+    if (manifestCache.has(root)) return manifestCache.get(root)
+    let parsed
+    try { // eslint-disable-next-line security/detect-non-literal-fs-filename
+        parsed = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8'))
+    } catch { parsed = null }
+    manifestCache.set(root, parsed)
+    return parsed
+}

package/src/utils/node.js

@@ -0,0 +1,22 @@
+export function getMemberPath(node) {
+    const parts = []
+    let cur = node
+    while (cur?.type == 'MemberExpression') {
+        if (cur.computed || cur.property.type != 'Identifier') return null
+        parts.unshift(cur.property.name)
+        cur = cur.object
+    }
+    if (cur?.type != 'Identifier') return null
+    parts.unshift(cur.name)
+    return parts.join('.')
+}
+
+export function isInsideNestedFunction(node) {
+    let current = node.parent
+    while (current) {
+        if (['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression'].includes(current.type))
+            return true
+        current = current.parent
+    }
+    return false
+}

package/src/utils/pkg.js

@@ -0,0 +1,19 @@
+import fs from 'node:fs'
+import path from 'node:path'
+
+export function findRoot(dir) {
+    let current = path.resolve(dir)
+    while (true) {
+        if (current.split(path.sep).includes('node_modules')) {
+            const parent = path.dirname(current)
+            if (parent === current) return null
+            current = parent
+            continue
+        }
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        if (fs.existsSync(path.join(current, 'package.json'))) return current
+        const parent = path.dirname(current)
+        if (parent === current) return null
+        current = parent
+    }
+}

package/src/utils/rules.js

@@ -0,0 +1,5 @@
+export function bundle(rules, predicate, pluginName) {
+    return Object.fromEntries(Object.entries(rules)
+        .filter(([, rule]) => predicate(rule))
+        .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
+}

package/src/utils.js

@@ -1,95 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-const re = { chromeAPI: /\bchrome(?:\.\w+)+/g }, // eslint-disable-line security/detect-unsafe-regex
-      manifestCache = new Map()
-
-export function bundleRules(rules, predicate, pluginName) {
-    return Object.fromEntries(Object.entries(rules)
-        .filter(([, rule]) => predicate(rule))
-        .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
-}
-
-export function findExtensionRoot(context) {
-    let dir = path.dirname(getFilename(context))
-    while (dir) {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
-        const parent = path.dirname(dir)
-        if (parent == dir) break // reached filesystem root or a stuck relative "."
-        dir = parent
-    }
-    return null
-}
-
-export function getChromeAPIcalls(sourceCode) {
-    const calls = new Set()
-    for (const match of sourceCode.getText().matchAll(re.chromeAPI))
-        calls.add(match[0])
-    return calls
-}
-
-export function getFilename(context) { return context.filename || context.getFilename() }
-
-export function getMemberPath(node) {
-    const parts = []
-    let cur = node
-    while (cur?.type == 'MemberExpression') {
-        if (cur.computed || cur.property.type != 'Identifier') return null
-        parts.unshift(cur.property.name)
-        cur = cur.object
-    }
-    if (cur?.type != 'Identifier') return null
-    parts.unshift(cur.name)
-    return parts.join('.')
-}
-
-export function initBundleDeprecation(plugin, [ruleId, bundleNames], pluginName) {
-    for (const bundleName of bundleNames) {
-        /* eslint-disable security/detect-object-injection */
-        if (plugin.configs[bundleName])
-            plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
-        /* eslint-enable security/detect-object-injection */
-        if (process.env.DEBUG_MODE)
-            console.warn(`[${pluginName}] '${ruleId}' will be removed from '${bundleName}' in a future major release`)
-    }
-}
-
-export function isContentScriptFile(context, manifest) {
-    const scripts = (manifest?.content_scripts || []).flatMap(cs => cs.js || [])
-    if (!scripts.length) return false
-    const root = findExtensionRoot(context)
-    if (!root) return false
-    const filename = path.resolve(getFilename(context))
-    return scripts.some(s => filename == path.resolve(root, s))
-}
-
-export function isInsideNestedFunction(node) {
-    let cur = node.parent
-    while (cur) {
-        if (['FunctionDeclaration', 'FunctionExpression', 'ArrowFunctionExpression'].includes(cur.type))
-            return true
-        cur = cur.parent
-    }
-    return false
-}
-
-export function isServiceWorkerFile(context, manifest) {
-    const sw = manifest?.background?.service_worker
-    if (!sw) return false
-    const root = findExtensionRoot(context)
-    if (!root) return false
-    return path.resolve(getFilename(context)) == path.resolve(root, sw)
-}
-
-export function readManifest(context) {
-    const root = findExtensionRoot(context)
-    if (!root) return null
-    if (manifestCache.has(root)) return manifestCache.get(root)
-    let parsed
-    try { // eslint-disable-next-line security/detect-non-literal-fs-filename
-        parsed = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8'))
-    } catch { parsed = null }
-    manifestCache.set(root, parsed)
-    return parsed
-}