eslint-plugin-chrome-extensions 2.4.1 → 2.5.0

package/README.md

@@ -4,7 +4,7 @@
 
 <a target="_blank" href="https://www.npmjs.com/package/eslint-plugin-chrome-extensions">
     <img alt="[Latest Build]" src="https://img.shields.io/npm/v/eslint-plugin-chrome-extensions?logo=icinga&style=for-the-badge&label=Latest%20Build&color=32fcee"></a>
-<a href="#license">
+<a href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
     <img alt="[License: MIT]" src="https://img.shields.io/badge/License-MIT-f1f20a.svg?logo=internetarchive&logoColor=white&labelColor=464646&style=for-the-badge"></a>
 <a target="_blank" href="https://eslint.org/">
     <img alt="[Requires ESLint >=9.6.0]" src="https://img.shields.io/badge/Requires-ESLint_%3E%3D9.6.0-4B32C3?style=for-the-badge&logo=eslint"></a>
@@ -54,7 +54,7 @@ export default [
             'chrome-extensions/manifest-spacing': ['warn', { spaces: 4 }]  // selectively tweak rule
         }
     },
-    { files: ['**/*LICENSE*'],             ...chromeExtensions.configs.license },
+    { files: ['**/*LICENSE*'],            ...chromeExtensions.configs.license },
     { files: ['**/extension/**/*.css'],   ...chromeExtensions.configs.css     },
     { files: ['**/extension/**/*.html'],  ...chromeExtensions.configs.html    },
     { files: ['**/extension/**/*.json'],  ...chromeExtensions.configs.json    },
@@ -386,9 +386,8 @@ If you don't want deprecation validation at all. For individual deprecated APIs
 -   "name": "Foo",
 -   "name": "Bar",
     "name": "My Extension",
--   "version": "1.0.0",
--   "version": "2.0.0"
     "version": "1.0.0"
+-   "version": "2.0.0"
   }
 ```
 
@@ -1009,6 +1008,76 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 
 </details>
 
+<h3 id="no-sensitive-permissions">
+    <code>no-sensitive-permissions</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-sensitive-permissions">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags sensitive manifest permissions that warrant security review.</summary>
+
+<h4 id="no-sensitive-permissions-options">Options</h4>
+
+- `allowedPermissions` (default `[]`) – sensitive permission names to explicitly allow, as a single string or array
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "permissions": ["tabs", "cookies", "storage"]
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "permissions": ["tabs", "cookies", "storage"]
++   "permissions": ["storage"]
+  }
+```
+
+#### When not to use it
+
+If you legitimately require sensitive permissions, or prefer manual security review.
+
+#### Introduced in
+
+v2.5.0 (Unreleased)
+
+#### See also
+
+- [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works in 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-unrestricted-host-permissions">
     <code>no-unrestricted-host-permissions</code>
     <a title="Only works in 'json/json' config block" href="#usage">
@@ -1228,14 +1297,14 @@ If you access the granted API through an alias or computed property rather than
 
 <summary>Requires a license file in the extension.</summary>
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect structure
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect directory structure
 
 ```diff
   /extension/manifest.json
 !
 ```
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct structure
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct directory structure
 
 ```diff
   /extension/manifest.json
@@ -1253,7 +1322,8 @@ If you intentionally omit a license, or it's injected at build time.
 #### See also
 
 - [`valid-license-file`](#valid-license-file)
-    <a title="Only works in 'license' config block" href="#usage"><img height=14 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Only works in license config block" href="#usage"><img height=14 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#valid-license-file-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 
 <div align="center">
@@ -1428,7 +1498,7 @@ If you primarily target a browser that doesn't support `short_name`.
 
 ```diff
   // files
-! /extension/_metadata/app.json
+! /extension/_metadata/extension.json
 ! /extension/content script.js
 
   // manifest.json
@@ -1441,8 +1511,8 @@ If you primarily target a browser that doesn't support `short_name`.
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
-- /extension/_metadata/app.json
-+ /extension/metadata/app.json
+- /extension/_metadata/extension.json
++ /extension/metadata/extension.json
 - /extension/content script.js
 + /extension/content-script.js
 
@@ -1483,8 +1553,10 @@ If you don't use conventional filenames or paths, or they're generated at build
 
 <h3 id="valid-license-file">
     <code>valid-license-file</code>
-    <a title="Only works in 'license' config block" href="#usage">
+    <a title="Only works in license config block" href="#usage">
         <img height=18 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
+        <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -1506,13 +1578,9 @@ If you don't use conventional filenames or paths, or they're generated at build
 ```diff
   /* eslint chrome-extensions/valid-license-file: ['error', { requireSPDX: true, allowedLicenses: ['MIT'] }] */
 
-  // LICENSE.md
-
-  MIT License
-  
+! MIT License
+  -----------
   Copyright © 2026 You
-
-!
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -1520,18 +1588,20 @@ If you don't use conventional filenames or paths, or they're generated at build
 ```diff
   /* eslint chrome-extensions/valid-license-file: ['error', { requireSPDX: true, allowedLicenses: ['MIT'] }] */
 
-  // LICENSE.md
-
   MIT License
-
+  -----------
   Copyright © 2026 You
-
++
 + SPDX-License-Identifier: MIT
 ```
 
+#### Benefits
+
+Enables machine-readability for compliance scanners, SBOM generators & CI gates.
+
 #### When not to use it
 
-If your license is injected at build time, or you use a license w/ no SPDX identifier.
+If your license is injected at build time, or you use one w/ no existing SPDX identifier.
 
 #### Introduced in
 
@@ -1697,6 +1767,8 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
     <code>valid-service-worker</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-service-worker">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -1706,6 +1778,12 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 
 <summary>Enforces valid service worker lifecycle and isolation.</summary>
 
+<h4 id="mit-worker-options">Options</h4>
+
+- `checkListenerTopLevel` (default `true`) – require `chrome.*.addListener()` calls at module top level
+- `checkKeepaliveTimer` (default `true`) – flag sub-30s timers used as a keepalive workaround
+- `checkDOMglobals` (default `true`) – flag DOM globals (`window`, `document`, `localStorage`) inside the service worker
+
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
@@ -1922,7 +2000,7 @@ If you don't care about version format consistency, or your version is injected
 ## <img height=30 width=27 align="top" src="https://api.iconify.design/ic/baseline-account-balance.svg?color=%232b2b2a"> License
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
-    <img height=85 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
+    <img height=80 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
 <br><br>
 
 <details>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.4.1",
+  "version": "2.5.0",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -17,7 +17,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
+    "url": "https://codeberg.org/adamlui/eslint-plugin-chrome-extensions.git"
   },
   "funding": [
     {
@@ -62,7 +62,8 @@
   },
   "dependencies": {
     "globals": "^17.13.0",
-    "spdx-license-ids": "^3.0.24"
+    "spdx-license-ids": "^3.0.24",
+    "spdx-license-list": "^6.12.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",

package/src/data/apis.js

@@ -1,116 +1,167 @@
-export const apiPermissionMap = new Map([
-    ['chrome.alarms',                'alarms'],
-    ['chrome.bookmarks',             'bookmarks'],
-    ['chrome.browsingData',          'browsingData'],
-    ['chrome.contextMenus',          'contextMenus'],
-    ['chrome.cookies',               'cookies'],
-    ['chrome.debugger',              'debugger'],
-    ['chrome.declarativeNetRequest', 'declarativeNetRequest'],
-    ['chrome.downloads',             'downloads'],
-    ['chrome.history',               'history'],
-    ['chrome.idle',                  'idle'],
-    ['chrome.management',            'management'],
-    ['chrome.menus',                 'menus'],
-    ['chrome.notifications',         'notifications'],
-    ['chrome.pageCapture',           'pageCapture'],
-    ['chrome.privacy',               'privacy'],
-    ['chrome.proxy',                 'proxy'],
-    ['chrome.scripting',             'scripting'],
-    ['chrome.sessions',              'sessions'],
-    ['chrome.storage',               'storage'],
-    ['chrome.tabCapture',            'tabCapture'],
-    ['chrome.tabs.query',            'tabs'],
-    ['chrome.topSites',              'topSites'],
-    ['chrome.webRequest',            'webRequest']
-])
-
-export const deprecatedAPIs = new Map([
-    ['chrome.pageAction.show',             'chrome.action.enable'],
-    ['chrome.pageAction.hide',             'chrome.action.disable'],
-    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
-    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
-    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
-    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
-    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-    ['chrome.browserAction',               'chrome.action'],
-    ['chrome.pageAction',                  'chrome.action'],
-    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
-    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
-    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
-    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
-    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
-    ['chrome.extension.connect',           'chrome.runtime.connect'],
-    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
-    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
-    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
-    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
-    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
-])
-
-export const externalMsgListeners = new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
-
-export const permlessAPIs = new Set([
-    // https://developer.chrome.com/docs/extensions/reference/api/management
-    'chrome.management.getPermissionWarningsByManifest',
-    'chrome.management.getSelf',
-    'chrome.management.uninstallSelf',
-    // https://developer.chrome.com/docs/extensions/reference/api/runtime
-    'chrome.runtime.connect',
-    'chrome.runtime.getManifest',
-    'chrome.runtime.getPlatformInfo',
-    'chrome.runtime.getURL',
-    'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
-    'chrome.runtime.onConnect',
-    'chrome.runtime.onConnectExternal',
-    'chrome.runtime.onInstalled',
-    'chrome.runtime.onMessage',
-    'chrome.runtime.onMessageExternal',
-    'chrome.runtime.onStartup',
-    'chrome.runtime.onSuspend',
-    'chrome.runtime.onSuspendCanceled',
-    'chrome.runtime.onUpdateAvailable',
-    'chrome.runtime.openOptionsPage',
-    'chrome.runtime.reload',
-    'chrome.runtime.requestUpdateCheck',
-    'chrome.runtime.restart',
-    'chrome.runtime.restartAfterDelay',
-    'chrome.runtime.sendMessage',
-    'chrome.runtime.setUninstallURL',
-    // https://developer.chrome.com/docs/extensions/reference/api/tabs
-    'chrome.tabs.captureVisibleTab',
-    'chrome.tabs.connect',
-    'chrome.tabs.create',
-    'chrome.tabs.detectLanguage',
-    'chrome.tabs.discard',
-    'chrome.tabs.duplicate',
-    'chrome.tabs.executeScript',
-    'chrome.tabs.get',
-    'chrome.tabs.getCurrent',
-    'chrome.tabs.goBack',
-    'chrome.tabs.goForward',
-    'chrome.tabs.highlight',
-    'chrome.tabs.insertCSS',
-    'chrome.tabs.move',
-    'chrome.tabs.reload',
-    'chrome.tabs.remove',
-    'chrome.tabs.removeCSS',
-    'chrome.tabs.sendMessage',
-    'chrome.tabs.update'
-])
-
-export function findDeprecated(api) {
-    for (const [deprecated, replacement] of deprecatedAPIs)
-        if (api == deprecated || api.startsWith(`${deprecated}.`))
-            return { deprecated, replacement }
-    return null
+export default {
+    deprecated: new Map([
+        ['chrome.browserAction',               'chrome.action'],
+        ['chrome.declarativeWebRequest',       'chrome.declarativeNetRequest'],
+        ['chrome.extension.connect',           'chrome.runtime.connect'],
+        ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
+        ['chrome.extension.getURL',            'chrome.runtime.getURL'],
+        ['chrome.extension.lastError',         'chrome.runtime.lastError'],
+        ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
+        ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
+        ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
+        ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
+        ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
+        ['chrome.fileBrowserHandler',          'File Handling API'],
+        ['chrome.pageAction.show',             'chrome.action.enable'],
+        ['chrome.pageAction.hide',             'chrome.action.disable'],
+        ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
+        ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
+        ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
+        ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
+        ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
+        ['chrome.pageAction',                  'chrome.action'], // must stay after pageAction.* — prefix match
+        ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
+        ['chrome.tabs.getAllInWindow',         'chrome.tabs.query({ currentWindow: true })'],
+        ['chrome.tabs.getSelected',            'chrome.tabs.query({ active: true })'],
+        ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
+        ['chrome.tabs.onActiveChanged',        'chrome.tabs.onActivated'],
+        ['chrome.tabs.onSelectionChanged',     'chrome.tabs.onActivated'],
+        ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS'],
+        ['chrome.tabs.sendRequest',            'chrome.tabs.sendMessage']
+    ]),
+    externalMsgListeners: new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal']),
+    permissionMap: new Map([
+        ['chrome.accessibilityFeatures.set',    'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures.clear',  'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures',        'accessibilityFeatures.read'],
+        ['chrome.alarms',                       'alarms'],
+        ['chrome.audio',                        'audio'],
+        ['chrome.bookmarks',                    'bookmarks'],
+        ['chrome.browsingData',                 'browsingData'],
+        ['chrome.certificateProvider',          'certificateProvider'],
+        ['chrome.contentSettings',              'contentSettings'],
+        ['chrome.contextMenus',                 'contextMenus'],
+        ['chrome.cookies',                      'cookies'],
+        ['chrome.debugger',                     'debugger'],
+        ['chrome.declarativeContent',           'declarativeContent'],
+        ['chrome.declarativeNetRequest',        'declarativeNetRequest'],
+        ['chrome.dns',                          'dns'],
+        ['chrome.desktopCapture',               'desktopCapture'],
+        ['chrome.documentScan',                 'documentScan'],
+        ['chrome.downloads.open',               'downloads.open'],
+        ['chrome.downloads.setUiOptions',       'downloads.ui'],
+        ['chrome.downloads',                    'downloads'],
+        ['chrome.enterprise.deviceAttributes',    'enterprise.deviceAttributes'],
+        ['chrome.enterprise.hardwarePlatform',    'enterprise.hardwarePlatform'],
+        ['chrome.enterprise.networkingAttributes','enterprise.networkingAttributes'],
+        ['chrome.enterprise.platformKeys',        'enterprise.platformKeys'],
+        ['chrome.favicon',                      'favicon'],
+        ['chrome.fileBrowserHandler',           'fileBrowserHandler'],
+        ['chrome.fontSettings',                 'fontSettings'],
+        ['chrome.gcm',                          'gcm'],
+        ['chrome.instanceID',                   'gcm'],
+        ['chrome.history',                      'history'],
+        ['chrome.identity.getProfileUserInfo',  'identity.email'],
+        ['chrome.identity',                     'identity'],
+        ['chrome.idle',                         'idle'],
+        ['chrome.loginState',                   'loginState'],
+        ['chrome.management',                   'management'],
+        ['chrome.runtime.connectNative',        'nativeMessaging'],
+        ['chrome.runtime.sendNativeMessage',    'nativeMessaging'],
+        ['chrome.notifications',                'notifications'],
+        ['chrome.offscreen',                    'offscreen'],
+        ['chrome.pageCapture',                  'pageCapture'],
+        ['chrome.platformKeys',                 'platformKeys'],
+        ['chrome.power',                        'power'],
+        ['chrome.printerProvider',              'printerProvider'],
+        ['chrome.printingMetrics',              'printingMetrics'],
+        ['chrome.printing',                     'printing'],
+        ['chrome.privacy',                      'privacy'],
+        ['chrome.processes',                    'processes'],
+        ['chrome.proxy',                        'proxy'],
+        ['chrome.publicSuffix',                 'publicSuffix'],
+        ['chrome.readingList',                  'readingList'],
+        ['chrome.scripting',                    'scripting'],
+        ['chrome.search',                       'search'],
+        ['chrome.sessions',                     'sessions'],
+        ['chrome.sidePanel',                    'sidePanel'],
+        ['chrome.storage',                      'storage'],
+        ['chrome.system.cpu',                   'system.cpu'],
+        ['chrome.system.display',               'system.display'],
+        ['chrome.system.memory',                'system.memory'],
+        ['chrome.system.storage',               'system.storage'],
+        ['chrome.tabCapture',                   'tabCapture'],
+        ['chrome.tabGroups',                    'tabGroups'],
+        ['chrome.tabs.query',                   'tabs'],
+        ['chrome.topSites',                     'topSites'],
+        ['chrome.ttsEngine',                    'ttsEngine'],
+        ['chrome.tts',                          'tts'],
+        ['chrome.userScripts',                  'userScripts'],
+        ['chrome.vpnProvider',                  'vpnProvider'],
+        ['chrome.wallpaper',                    'wallpaper'],
+        ['chrome.webAuthenticationProxy',       'webAuthenticationProxy'],
+        ['chrome.webNavigation',                'webNavigation'],
+        ['chrome.webRequest',                   'webRequest']
+    ]),
+    permless: new Set([
+        'chrome.i18n',
+        'chrome.management.getPermissionWarningsByManifest',
+        'chrome.management.getSelf',
+        'chrome.management.uninstallSelf',
+        'chrome.runtime.connect',
+        'chrome.runtime.getManifest',
+        'chrome.runtime.getPlatformInfo',
+        'chrome.runtime.getURL',
+        'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
+        'chrome.runtime.onConnect',
+        'chrome.runtime.onConnectExternal',
+        'chrome.runtime.onInstalled',
+        'chrome.runtime.onMessage',
+        'chrome.runtime.onMessageExternal',
+        'chrome.runtime.onStartup',
+        'chrome.runtime.onSuspend',
+        'chrome.runtime.onSuspendCanceled',
+        'chrome.runtime.onUpdateAvailable',
+        'chrome.runtime.openOptionsPage',
+        'chrome.runtime.reload',
+        'chrome.runtime.requestUpdateCheck',
+        'chrome.runtime.restart',
+        'chrome.runtime.restartAfterDelay',
+        'chrome.runtime.sendMessage',
+        'chrome.runtime.setUninstallURL',
+        'chrome.tabs.captureVisibleTab',
+        'chrome.tabs.connect',
+        'chrome.tabs.create',
+        'chrome.tabs.detectLanguage',
+        'chrome.tabs.discard',
+        'chrome.tabs.duplicate',
+        'chrome.tabs.executeScript',
+        'chrome.tabs.get',
+        'chrome.tabs.getCurrent',
+        'chrome.tabs.goBack',
+        'chrome.tabs.goForward',
+        'chrome.tabs.highlight',
+        'chrome.tabs.insertCSS',
+        'chrome.tabs.move',
+        'chrome.tabs.reload',
+        'chrome.tabs.remove',
+        'chrome.tabs.removeCSS',
+        'chrome.tabs.sendMessage',
+        'chrome.tabs.update',
+        'chrome.windows'
+    ]),
+    findDeprecated(api) {
+        for (const [deprecated, replacement] of this.deprecated)
+            if (api == deprecated || api.startsWith(`${deprecated}.`))
+                return { deprecated, replacement }
+        return null
+    },
+    findPermission(api) {
+        if (this.permless.has(api)) return null
+        for (const [prefix, permission] of this.permissionMap)
+            if (api == prefix || api.startsWith(`${prefix}.`))
+                return permission
+        return null
+    },
+    isExternalMsgListener(api) { return this.externalMsgListeners.has(api) }
 }
-
-export function findPermission(api) {
-    if (permlessAPIs.has(api)) return null
-    for (const [prefix, permission] of apiPermissionMap)
-        if (api == prefix || api.startsWith(`${prefix}.`))
-            return permission
-    return null
-}
-
-export function isExternalMessagingListener(api) { return externalMsgListeners.has(api) }

package/src/data/deprecations.js

@@ -1,10 +1,10 @@
 // Delete a line to end support
 
-export const bundles = {
-    'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
-    'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
-    'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
-    'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
+export default {
+    bundles: {
+        'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
+        'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
+        'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
+        'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
+    }
 }
-
-export default { bundles }