eslint-plugin-chrome-extensions 2.4.2 → 2.5.0

package/README.md

@@ -1008,6 +1008,76 @@ If you intentionally target forks w/ relaxed CSPs. For individual patterns you s
 
 </details>
 
+<h3 id="no-sensitive-permissions">
+    <code>no-sensitive-permissions</code>
+    <a title="Included in recommended config" href="#usage">
+        <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Included in security config" href="#usage">
+        <img height=18 alt="[Security]" src="https://img.shields.io/badge/Security-e8357a?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json' config block" href="#usage">
+        <img height=18 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+    <a title="Copy rule URL" target="_blank" 
+       href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23no-sensitive-permissions">
+        <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
+</h3>
+
+<details>
+
+<summary>Flags sensitive manifest permissions that warrant security review.</summary>
+
+<h4 id="no-sensitive-permissions-options">Options</h4>
+
+- `allowedPermissions` (default `[]`) – sensitive permission names to explicitly allow, as a single string or array
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+
+```diff
+  {
+    "manifest_version": 3,
+!   "permissions": ["tabs", "cookies", "storage"]
+  }
+```
+
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+
+```diff
+  {
+    "manifest_version": 3,
+-   "permissions": ["tabs", "cookies", "storage"]
++   "permissions": ["storage"]
+  }
+```
+
+#### When not to use it
+
+If you legitimately require sensitive permissions, or prefer manual security review.
+
+#### Introduced in
+
+v2.5.0 (Unreleased)
+
+#### See also
+
+- [`no-invalid-permissions`](#no-invalid-permissions)
+    <a title="Included in recommended config" href="#usage"><img height=14 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json' config block" href="#usage"><img height=14 alt="[Manifest]" src="https://img.shields.io/badge/Manifest-999999?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#no-invalid-permissions-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
+- [`no-unused-permissions`](#no-unused-permissions)
+    <a title="Only works in 'json/json' config block" href="#usage"><img height=14 alt="[Manifest only]" src="https://img.shields.io/badge/Manifest_only-999999?style=flat-square" align="middle"></a>
+- <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">Chrome for Developers — Declare permissions</a>
+
+<div align="center">
+
+[Back to index ↑][epce-rules]
+
+</div>
+
+---
+
+</details>
+
 <h3 id="no-unrestricted-host-permissions">
     <code>no-unrestricted-host-permissions</code>
     <a title="Only works in 'json/json' config block" href="#usage">
@@ -1253,6 +1323,7 @@ If you intentionally omit a license, or it's injected at build time.
 
 - [`valid-license-file`](#valid-license-file)
     <a title="Only works in license config block" href="#usage"><img height=14 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix"><img height=14 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#valid-license-file-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 
 <div align="center">
@@ -1427,7 +1498,7 @@ If you primarily target a browser that doesn't support `short_name`.
 
 ```diff
   // files
-! /extension/_metadata/app.json
+! /extension/_metadata/extension.json
 ! /extension/content script.js
 
   // manifest.json
@@ -1440,8 +1511,8 @@ If you primarily target a browser that doesn't support `short_name`.
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
 
 ```diff
-- /extension/_metadata/app.json
-+ /extension/metadata/app.json
+- /extension/_metadata/extension.json
++ /extension/metadata/extension.json
 - /extension/content script.js
 + /extension/content-script.js
 
@@ -1484,6 +1555,8 @@ If you don't use conventional filenames or paths, or they're generated at build
     <code>valid-license-file</code>
     <a title="Only works in license config block" href="#usage">
         <img height=18 alt="[License only]" src="https://img.shields.io/badge/License_only-559bff?style=flat-square" align="middle"></a>
+    <a title="Accepts eslint --fix" target="_blank" href="https://eslint.org/docs/latest/use/command-line-interface#--fix">
+        <img height=18 alt="[Auto-fixable]" src="https://img.shields.io/badge/Auto--fixable-3b5bdb?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
@@ -1524,11 +1597,11 @@ If you don't use conventional filenames or paths, or they're generated at build
 
 #### Benefits
 
-Makes the license machine-readable by compliance scanners + SBOM generators + CI gates.
+Enables machine-readability for compliance scanners, SBOM generators & CI gates.
 
 #### When not to use it
 
-If your license is injected at build time, or you use a license w/ no SPDX identifier.
+If your license is injected at build time, or you use one w/ no existing SPDX identifier.
 
 #### Introduced in
 
@@ -1694,6 +1767,8 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
     <code>valid-service-worker</code>
     <a title="Included in recommended config" href="#usage">
         <img height=18 alt="[Recommended]" src="https://img.shields.io/badge/Recommended-f1f20a?style=flat-square" align="middle"></a>
+    <a title="Accepts array w/ options" href="#usage">
+        <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
     <a title="Copy rule URL" target="_blank" 
        href="https://copy-to-clipboard.onrender.com/copy/https%3A%2F%2Fcodeberg.org%2Fadamlui%2Feslint-plugin-chrome-extensions%2F%23valid-service-worker">
         <img height=16 width=21 alt="[Copy rule URL]" src="https://api.iconify.design/mdi/content-copy.svg?color=%23cccccc" align="middle"></a>
@@ -1703,6 +1778,12 @@ If you intentionally target MV2 for a browser that still supports it (e.g. Firef
 
 <summary>Enforces valid service worker lifecycle and isolation.</summary>
 
+<h4 id="mit-worker-options">Options</h4>
+
+- `checkListenerTopLevel` (default `true`) – require `chrome.*.addListener()` calls at module top level
+- `checkKeepaliveTimer` (default `true`) – flag sub-30s timers used as a keepalive workaround
+- `checkDOMglobals` (default `true`) – flag DOM globals (`window`, `document`, `localStorage`) inside the service worker
+
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
 
 ```diff
@@ -1919,7 +2000,7 @@ If you don't care about version format consistency, or your version is injected
 ## <img height=30 width=27 align="top" src="https://api.iconify.design/ic/baseline-account-balance.svg?color=%232b2b2a"> License
 
 <a target="_blank" href="https://codeberg.org/adamlui/eslint-plugin-chrome-extensions/src/branch/main/docs/LICENSE.md">
-    <img height=85 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
+    <img height=80 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/9e820e5d51/assets/images/logos/mit-license/red-pixelated.png"></a>
 <br><br>
 
 <details>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.4.2",
+  "version": "2.5.0",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -62,7 +62,8 @@
   },
   "dependencies": {
     "globals": "^17.13.0",
-    "spdx-license-ids": "^3.0.24"
+    "spdx-license-ids": "^3.0.24",
+    "spdx-license-list": "^6.12.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",

package/src/data/apis.js

@@ -1,116 +1,167 @@
-export const apiPermissionMap = new Map([
-    ['chrome.alarms',                'alarms'],
-    ['chrome.bookmarks',             'bookmarks'],
-    ['chrome.browsingData',          'browsingData'],
-    ['chrome.contextMenus',          'contextMenus'],
-    ['chrome.cookies',               'cookies'],
-    ['chrome.debugger',              'debugger'],
-    ['chrome.declarativeNetRequest', 'declarativeNetRequest'],
-    ['chrome.downloads',             'downloads'],
-    ['chrome.history',               'history'],
-    ['chrome.idle',                  'idle'],
-    ['chrome.management',            'management'],
-    ['chrome.menus',                 'menus'],
-    ['chrome.notifications',         'notifications'],
-    ['chrome.pageCapture',           'pageCapture'],
-    ['chrome.privacy',               'privacy'],
-    ['chrome.proxy',                 'proxy'],
-    ['chrome.scripting',             'scripting'],
-    ['chrome.sessions',              'sessions'],
-    ['chrome.storage',               'storage'],
-    ['chrome.tabCapture',            'tabCapture'],
-    ['chrome.tabs.query',            'tabs'],
-    ['chrome.topSites',              'topSites'],
-    ['chrome.webRequest',            'webRequest']
-])
-
-export const deprecatedAPIs = new Map([
-    ['chrome.pageAction.show',             'chrome.action.enable'],
-    ['chrome.pageAction.hide',             'chrome.action.disable'],
-    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
-    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
-    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
-    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
-    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-    ['chrome.browserAction',               'chrome.action'],
-    ['chrome.pageAction',                  'chrome.action'],
-    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
-    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
-    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
-    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
-    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
-    ['chrome.extension.connect',           'chrome.runtime.connect'],
-    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
-    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
-    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
-    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
-    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
-])
-
-export const externalMsgListeners = new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
-
-export const permlessAPIs = new Set([
-    // https://developer.chrome.com/docs/extensions/reference/api/management
-    'chrome.management.getPermissionWarningsByManifest',
-    'chrome.management.getSelf',
-    'chrome.management.uninstallSelf',
-    // https://developer.chrome.com/docs/extensions/reference/api/runtime
-    'chrome.runtime.connect',
-    'chrome.runtime.getManifest',
-    'chrome.runtime.getPlatformInfo',
-    'chrome.runtime.getURL',
-    'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
-    'chrome.runtime.onConnect',
-    'chrome.runtime.onConnectExternal',
-    'chrome.runtime.onInstalled',
-    'chrome.runtime.onMessage',
-    'chrome.runtime.onMessageExternal',
-    'chrome.runtime.onStartup',
-    'chrome.runtime.onSuspend',
-    'chrome.runtime.onSuspendCanceled',
-    'chrome.runtime.onUpdateAvailable',
-    'chrome.runtime.openOptionsPage',
-    'chrome.runtime.reload',
-    'chrome.runtime.requestUpdateCheck',
-    'chrome.runtime.restart',
-    'chrome.runtime.restartAfterDelay',
-    'chrome.runtime.sendMessage',
-    'chrome.runtime.setUninstallURL',
-    // https://developer.chrome.com/docs/extensions/reference/api/tabs
-    'chrome.tabs.captureVisibleTab',
-    'chrome.tabs.connect',
-    'chrome.tabs.create',
-    'chrome.tabs.detectLanguage',
-    'chrome.tabs.discard',
-    'chrome.tabs.duplicate',
-    'chrome.tabs.executeScript',
-    'chrome.tabs.get',
-    'chrome.tabs.getCurrent',
-    'chrome.tabs.goBack',
-    'chrome.tabs.goForward',
-    'chrome.tabs.highlight',
-    'chrome.tabs.insertCSS',
-    'chrome.tabs.move',
-    'chrome.tabs.reload',
-    'chrome.tabs.remove',
-    'chrome.tabs.removeCSS',
-    'chrome.tabs.sendMessage',
-    'chrome.tabs.update'
-])
-
-export function findDeprecated(api) {
-    for (const [deprecated, replacement] of deprecatedAPIs)
-        if (api == deprecated || api.startsWith(`${deprecated}.`))
-            return { deprecated, replacement }
-    return null
+export default {
+    deprecated: new Map([
+        ['chrome.browserAction',               'chrome.action'],
+        ['chrome.declarativeWebRequest',       'chrome.declarativeNetRequest'],
+        ['chrome.extension.connect',           'chrome.runtime.connect'],
+        ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
+        ['chrome.extension.getURL',            'chrome.runtime.getURL'],
+        ['chrome.extension.lastError',         'chrome.runtime.lastError'],
+        ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
+        ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
+        ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
+        ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
+        ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
+        ['chrome.fileBrowserHandler',          'File Handling API'],
+        ['chrome.pageAction.show',             'chrome.action.enable'],
+        ['chrome.pageAction.hide',             'chrome.action.disable'],
+        ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
+        ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
+        ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
+        ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
+        ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
+        ['chrome.pageAction',                  'chrome.action'], // must stay after pageAction.* — prefix match
+        ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
+        ['chrome.tabs.getAllInWindow',         'chrome.tabs.query({ currentWindow: true })'],
+        ['chrome.tabs.getSelected',            'chrome.tabs.query({ active: true })'],
+        ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
+        ['chrome.tabs.onActiveChanged',        'chrome.tabs.onActivated'],
+        ['chrome.tabs.onSelectionChanged',     'chrome.tabs.onActivated'],
+        ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS'],
+        ['chrome.tabs.sendRequest',            'chrome.tabs.sendMessage']
+    ]),
+    externalMsgListeners: new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal']),
+    permissionMap: new Map([
+        ['chrome.accessibilityFeatures.set',    'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures.clear',  'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures',        'accessibilityFeatures.read'],
+        ['chrome.alarms',                       'alarms'],
+        ['chrome.audio',                        'audio'],
+        ['chrome.bookmarks',                    'bookmarks'],
+        ['chrome.browsingData',                 'browsingData'],
+        ['chrome.certificateProvider',          'certificateProvider'],
+        ['chrome.contentSettings',              'contentSettings'],
+        ['chrome.contextMenus',                 'contextMenus'],
+        ['chrome.cookies',                      'cookies'],
+        ['chrome.debugger',                     'debugger'],
+        ['chrome.declarativeContent',           'declarativeContent'],
+        ['chrome.declarativeNetRequest',        'declarativeNetRequest'],
+        ['chrome.dns',                          'dns'],
+        ['chrome.desktopCapture',               'desktopCapture'],
+        ['chrome.documentScan',                 'documentScan'],
+        ['chrome.downloads.open',               'downloads.open'],
+        ['chrome.downloads.setUiOptions',       'downloads.ui'],
+        ['chrome.downloads',                    'downloads'],
+        ['chrome.enterprise.deviceAttributes',    'enterprise.deviceAttributes'],
+        ['chrome.enterprise.hardwarePlatform',    'enterprise.hardwarePlatform'],
+        ['chrome.enterprise.networkingAttributes','enterprise.networkingAttributes'],
+        ['chrome.enterprise.platformKeys',        'enterprise.platformKeys'],
+        ['chrome.favicon',                      'favicon'],
+        ['chrome.fileBrowserHandler',           'fileBrowserHandler'],
+        ['chrome.fontSettings',                 'fontSettings'],
+        ['chrome.gcm',                          'gcm'],
+        ['chrome.instanceID',                   'gcm'],
+        ['chrome.history',                      'history'],
+        ['chrome.identity.getProfileUserInfo',  'identity.email'],
+        ['chrome.identity',                     'identity'],
+        ['chrome.idle',                         'idle'],
+        ['chrome.loginState',                   'loginState'],
+        ['chrome.management',                   'management'],
+        ['chrome.runtime.connectNative',        'nativeMessaging'],
+        ['chrome.runtime.sendNativeMessage',    'nativeMessaging'],
+        ['chrome.notifications',                'notifications'],
+        ['chrome.offscreen',                    'offscreen'],
+        ['chrome.pageCapture',                  'pageCapture'],
+        ['chrome.platformKeys',                 'platformKeys'],
+        ['chrome.power',                        'power'],
+        ['chrome.printerProvider',              'printerProvider'],
+        ['chrome.printingMetrics',              'printingMetrics'],
+        ['chrome.printing',                     'printing'],
+        ['chrome.privacy',                      'privacy'],
+        ['chrome.processes',                    'processes'],
+        ['chrome.proxy',                        'proxy'],
+        ['chrome.publicSuffix',                 'publicSuffix'],
+        ['chrome.readingList',                  'readingList'],
+        ['chrome.scripting',                    'scripting'],
+        ['chrome.search',                       'search'],
+        ['chrome.sessions',                     'sessions'],
+        ['chrome.sidePanel',                    'sidePanel'],
+        ['chrome.storage',                      'storage'],
+        ['chrome.system.cpu',                   'system.cpu'],
+        ['chrome.system.display',               'system.display'],
+        ['chrome.system.memory',                'system.memory'],
+        ['chrome.system.storage',               'system.storage'],
+        ['chrome.tabCapture',                   'tabCapture'],
+        ['chrome.tabGroups',                    'tabGroups'],
+        ['chrome.tabs.query',                   'tabs'],
+        ['chrome.topSites',                     'topSites'],
+        ['chrome.ttsEngine',                    'ttsEngine'],
+        ['chrome.tts',                          'tts'],
+        ['chrome.userScripts',                  'userScripts'],
+        ['chrome.vpnProvider',                  'vpnProvider'],
+        ['chrome.wallpaper',                    'wallpaper'],
+        ['chrome.webAuthenticationProxy',       'webAuthenticationProxy'],
+        ['chrome.webNavigation',                'webNavigation'],
+        ['chrome.webRequest',                   'webRequest']
+    ]),
+    permless: new Set([
+        'chrome.i18n',
+        'chrome.management.getPermissionWarningsByManifest',
+        'chrome.management.getSelf',
+        'chrome.management.uninstallSelf',
+        'chrome.runtime.connect',
+        'chrome.runtime.getManifest',
+        'chrome.runtime.getPlatformInfo',
+        'chrome.runtime.getURL',
+        'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
+        'chrome.runtime.onConnect',
+        'chrome.runtime.onConnectExternal',
+        'chrome.runtime.onInstalled',
+        'chrome.runtime.onMessage',
+        'chrome.runtime.onMessageExternal',
+        'chrome.runtime.onStartup',
+        'chrome.runtime.onSuspend',
+        'chrome.runtime.onSuspendCanceled',
+        'chrome.runtime.onUpdateAvailable',
+        'chrome.runtime.openOptionsPage',
+        'chrome.runtime.reload',
+        'chrome.runtime.requestUpdateCheck',
+        'chrome.runtime.restart',
+        'chrome.runtime.restartAfterDelay',
+        'chrome.runtime.sendMessage',
+        'chrome.runtime.setUninstallURL',
+        'chrome.tabs.captureVisibleTab',
+        'chrome.tabs.connect',
+        'chrome.tabs.create',
+        'chrome.tabs.detectLanguage',
+        'chrome.tabs.discard',
+        'chrome.tabs.duplicate',
+        'chrome.tabs.executeScript',
+        'chrome.tabs.get',
+        'chrome.tabs.getCurrent',
+        'chrome.tabs.goBack',
+        'chrome.tabs.goForward',
+        'chrome.tabs.highlight',
+        'chrome.tabs.insertCSS',
+        'chrome.tabs.move',
+        'chrome.tabs.reload',
+        'chrome.tabs.remove',
+        'chrome.tabs.removeCSS',
+        'chrome.tabs.sendMessage',
+        'chrome.tabs.update',
+        'chrome.windows'
+    ]),
+    findDeprecated(api) {
+        for (const [deprecated, replacement] of this.deprecated)
+            if (api == deprecated || api.startsWith(`${deprecated}.`))
+                return { deprecated, replacement }
+        return null
+    },
+    findPermission(api) {
+        if (this.permless.has(api)) return null
+        for (const [prefix, permission] of this.permissionMap)
+            if (api == prefix || api.startsWith(`${prefix}.`))
+                return permission
+        return null
+    },
+    isExternalMsgListener(api) { return this.externalMsgListeners.has(api) }
 }
-
-export function findPermission(api) {
-    if (permlessAPIs.has(api)) return null
-    for (const [prefix, permission] of apiPermissionMap)
-        if (api == prefix || api.startsWith(`${prefix}.`))
-            return permission
-    return null
-}
-
-export function isExternalMessagingListener(api) { return externalMsgListeners.has(api) }

package/src/data/deprecations.js

@@ -1,10 +1,10 @@
 // Delete a line to end support
 
-export const bundles = {
-    'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
-    'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
-    'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
-    'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
+export default {
+    bundles: {
+        'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
+        'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
+        'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
+        'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
+    }
 }
-
-export default { bundles }

package/src/data/i18n.js

@@ -1,71 +1,13 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
-
-import fs from 'node:fs'
-import path from 'node:path'
-
-export const re = {
-    getMsgLiteral: /\b(?:chrome|browser)\.i18n\.getMessage\(\s*['"]([^'"]+)['"]/g,
-    getMsgTemplate: /\b(?:chrome|browser)\.i18n\.getMessage\(\s*`([^`]*)`/g,
-    msgPlaceholder: /__MSG_([\w@]+)__/g,
-    specialChars: /[.*+?^${}()|[\]\\]/g,
-    templateExpr: /\$\{[^}]*\}/g
-}
-
-export function collectUsedKeys(root, scanExtensions) {
-    const used = new Set(),
-          patterns = [],
-          exts = new Set(scanExtensions),
-          stack = [root]
-    while (stack.length) {
-        const dir = stack.pop()
-        let entries
-        try { entries = fs.readdirSync(dir, { withFileTypes: true }) } catch { continue }
-        for (const entry of entries) {
-            if (entry.name.startsWith('.') || entry.name == 'node_modules') continue
-            const full = path.join(dir, entry.name)
-            if (entry.isDirectory()) { stack.push(full) ; continue }
-            const ext = path.extname(entry.name).slice(1).toLowerCase()
-            if (!exts.has(ext)) continue
-            let text
-            try { text = fs.readFileSync(full, 'utf8') } catch { continue }
-            for (const match of text.matchAll(re.msgPlaceholder))
-                if (!isPredefined(match[1])) used.add(match[1])
-            for (const match of text.matchAll(re.getMsgLiteral))
-                used.add(match[1])
-            for (const match of text.matchAll(re.getMsgTemplate)) {
-                const body = match[1]
-                if (body.includes('${')) patterns.push(templateToPattern(body))
-                else used.add(body)
-            }
-        }
-    }
-    return { used, patterns }
-}
-
-export const defaultScanExtensions = [
-    'cjs', 'css', 'htm', 'html', 'js', 'json', 'jsx', 'md', 'mjs', 'svg', 'ts', 'tsx', 'txt']
-
-export function findExtensionRoot(startPath) {
-    let dir = path.dirname(startPath)
-    while (dir != path.dirname(dir)) {
-        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
-        dir = path.dirname(dir)
+export default {
+    defaultScanExtensions: ['cjs', 'css', 'htm', 'html', 'js', 'json', 'jsx', 'md', 'mjs', 'svg', 'ts', 'tsx', 'txt'],
+    re: {
+        getMsg: {
+            literal: /\b(?:browser|chrome)\.i18n\.getMessage\(\s*['"]([^'"]+)['"]/g,
+            path: /^(?:browser|chrome)\.i18n\.getMessage$/,
+            template: /\b(?:browser|chrome)\.i18n\.getMessage\(\s*`([^`]*)`/g
+        },
+        msgPlaceholder: /__MSG_([\w@]+)__/g,
+        specialChars: /[.*+?^${}()|[\]\\]/g,
+        templateExpr: /\$\{[^}]*\}/g
     }
 }
-
-export function isPredefined(key) { return key.startsWith('@@') }
-
-export function readDefaultLocaleMessages(manifest, root) {
-    const locale = manifest?.default_locale
-    if (typeof locale != 'string') return null
-    const filePath = path.join(root, '_locales', locale, 'messages.json')
-    let messages
-    try { messages = JSON.parse(fs.readFileSync(filePath, 'utf8')) } catch { return null }
-    if (!messages || typeof messages != 'object' || Array.isArray(messages)) return null
-    return { locale, messages }
-}
-
-export function templateToPattern(body) {
-    const parts = body.split(re.templateExpr).map(part => part.replace(re.specialChars, '\\$&'))
-    return new RegExp(`^${parts.join('.*')}$`) // eslint-disable-line security/detect-non-literal-regexp
-}