eslint-plugin-chrome-extensions 2.4.2 → 2.6.0

package/src/rules/valid-license-file.js

@@ -1,18 +1,22 @@
-import { createRequire } from 'node:module'
+import license from '../utils/license.js'
 import path from 'node:path'
 
-import { re } from '../data/license.js'
-
-const require = createRequire(import.meta.url),
-      spdxLicenseIDs = require('spdx-license-ids')
+import regex from '../data/regex.js'
 
 function toArray(value) { return value == null ? [] : Array.isArray(value) ? value : [value] }
 
 function validateContent(context, node, { requireSPDX, allowedLicenses }) {
-    const match = context.sourceCode.text.match(re.spdxTag)
-    if (!match) return void (requireSPDX && context.report({ node, messageId: 'missingSPDX' }))
-    const id = match[1]
-    if (!spdxLicenseIDs.includes(id))
+    const text = context.sourceCode.text,
+          id = license.spdx.parse(text)
+    if (!id) {
+        if (!requireSPDX) return
+        const inferredID = license.spdx.find(text),
+              report = { node, messageId: 'missingSPDX' }
+        if (inferredID && (!allowedLicenses.length || allowedLicenses.includes(inferredID)))
+            report.fix = fixer => license.spdx.appendTag(fixer, text, inferredID)
+        return context.report(report)
+    }
+    if (!license.spdx.isValid(id))
         return context.report({ node, messageId: 'invalidSPDX', data: { id }})
     if (allowedLicenses.length && !allowedLicenses.includes(id))
         context.report({ node, messageId: 'disallowedSPDX', data: { id, allowed: allowedLicenses.join(', ') }})
@@ -21,6 +25,7 @@ function validateContent(context, node, { requireSPDX, allowedLicenses }) {
 export default {
     meta: {
         type: 'problem',
+        fixable: 'code',
         docs: {
             description: 'Validates SPDX identifiers in license files',
             recommended: false,
@@ -47,13 +52,15 @@ export default {
             disallowedSPDX: 'License `{{id}}` is not in allowed list: {{allowed}}.'
         }
     },
+
     create(context) {
         const opts = context.options[0],
-              { requireSPDX } = opts,
+            { requireSPDX } = opts,
               allowedLicenses = toArray(opts.allowedLicenses),
             { filename } = context,
               basename = path.basename(filename)
-        if (!re.licenseFilename.test(basename)) return {}
+        if (!regex.filename.license.test(basename) || regex.filename.script.test(basename))
+            return {}
         return { Program: node => validateContent(context, node, { requireSPDX, allowedLicenses })}
     }
 }

package/src/rules/valid-manifest-icons.js

@@ -1,18 +1,38 @@
+import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import path from 'node:path'
 
-import { findRoot as findExtensionRoot, file } from '../utils/extension.js'
+import regex from '../data/regex.js'
 
-const re = { manifestFilename: /manifest\.json$/, svg: /\.svg$/i },
+const re = { svg: /\.svg$/i },
       sizes = { recommended: ['16', '32', '48', '128'], required: '128' }
 
+function validateIcons(context, icons, root, opts, loc) {
+    const { requireRecommended, checkFiles, checkSVG } = opts,
+            declaredSizes = new Set(Object.keys(icons))
+    if (requireRecommended) {
+        for (const size of sizes.recommended)
+            if (!declaredSizes.has(size))
+                context.report({ loc, messageId: 'missingSize', data: { size }})
+    } else if (!declaredSizes.has(sizes.required))
+        context.report({ loc, messageId: 'missingRequiredSize' })
+    for (const file of Object.values(icons)) {
+        if (typeof file != 'string') continue
+        if (checkSVG && re.svg.test(file))
+            context.report({ loc, messageId: 'svgNotSupported' })
+        else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+            && !fs.existsSync(path.resolve(root, file))
+        ) context.report({ loc, messageId: 'missingFile', data: { file }})
+    }
+}
+
 export default {
     meta: {
         type: 'problem',
         docs: {
             description: 'Validate manifest icons: sizes, existing files, no SVG',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         defaultOptions: [{
@@ -47,12 +67,21 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(file.getName(context))) return {}
+        const filename = extension.file.getName(context)
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const opts = context.options[0] || {},
               requireRecommended = opts.requireRecommendedSizes !== false,
               checkFiles = opts.checkIconExists !== false,
-              checkSVG = opts.noSVG !== false
-        const root = checkFiles ? findExtensionRoot(context) : null
+              checkSVG = opts.noSVG !== false,
+              root = checkFiles ? extension.findRoot(context) : null,
+              resolved = { requireRecommended, checkFiles, checkSVG }
+        if (!regex.filename.manifest.test(filename)) {
+            const manifest = extension.manifest.read(context) ; if (!manifest) return {}
+            const icons = manifest.icons
+            if (!icons || typeof icons != 'object' || Array.isArray(icons)) return {}
+            validateIcons(context, icons, root, resolved, { line: 1, column: 1 })
+            return {}
+        }
         return {
             '*'(node) {
                 const keyNode = node.name || node.key ; if (!keyNode) return

package/src/rules/valid-mv3-schema.js

@@ -1,9 +1,7 @@
-import { mv2OnlyKeys, forbiddenCSPdirectives, ffMV3bgKeys, ffDataCollectionRequired, ffDataCollectionOptional }
-    from '../data/manifest.js'
+import extension from '../utils/extension.js'
 
-import { file, readManifest } from '../utils/extension.js'
-
-const re = { manifestFilename: /manifest\.json$/ }
+import manifestData from '../data/manifest.js'
+import regex from '../data/regex.js'
 
 export default {
     meta: {
@@ -11,7 +9,7 @@ export default {
         docs: {
             description: 'Validate manifest against the MV3 schema',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [],
@@ -24,7 +22,7 @@ export default {
     },
 
     create(context) {
-        if (re.manifestFilename.test(file.getName(context))) { // lint it directly
+        if (regex.filename.manifest.test(extension.file.getName(context))) { // lint it directly
             const ancestors = [], pendingReports = [], deferredMV2 = []
             let isMV3 = false, isFF = false
             function keyOf(node) {
@@ -44,10 +42,10 @@ export default {
                             keyOf(ancestor) == 'data_collection_permissions')
                         if (keyName == 'manifest_version' && node.value?.value == 3) isMV3 = true
                         if (isTopLevel && keyName == 'browser_specific_settings') isFF = true
-                        if (isTopLevel && mv2OnlyKeys.has(keyName))
+                        if (isTopLevel && manifestData.keys.mv2Only.has(keyName))
                             pendingReports.push({ node, messageId: 'mv2Key',
                                 data: { key: keyName, reason: 'MV2-only key' }})
-                        if (inBackground && ffMV3bgKeys.has(keyName))
+                        if (inBackground && manifestData.keys.ff.mv3BG.has(keyName))
                             deferredMV2.push({ node, messageId: 'mv2Key',
                                 data: { key: `background.${keyName}`,
                                         reason: 'Use background.service_worker instead' }})
@@ -58,7 +56,7 @@ export default {
                         if (isTopLevel && keyName == 'content_security_policy' && node.value?.type == 'String')
                             pendingReports.push({ node: node.value, messageId: 'wrongCSPType' })
                         if (inCSP && keyName == 'extension_pages' && typeof node.value?.value == 'string')
-                            for (const directive of forbiddenCSPdirectives)
+                            for (const directive of manifestData.csp.forbiddenDirectives)
                                 if (node.value.value.includes(directive))
                                     pendingReports.push({ node: node.value, messageId: 'unsafeCSP',
                                         data: { directive }})
@@ -67,8 +65,9 @@ export default {
                         ) for (const elem of node.value.elements) {
                             const value = typeof elem.value == 'string' ? elem.value : elem.value?.value
                             if (typeof value == 'string') {
-                                const set = keyName == 'required' ? ffDataCollectionRequired : ffDataCollectionOptional
-                                if (!set.has(value))
+                                const allowedVals = manifestData.keys.ff[
+                                    `dataCollection${ keyName == 'required' ? 'Required' : 'Optional' }`]
+                                if (!allowedVals.has(value))
                                     pendingReports.push({ node: elem, messageId: 'invalidDataCollectionValue',
                                         data: { value, kind: keyName }})
                             }
@@ -86,14 +85,14 @@ export default {
                 }
             }
         }
-        const manifest = readManifest(context) ; if (!manifest || manifest.manifest_version != 3) return {}
+        const manifest = extension.manifest.read(context) ; if (!manifest || manifest.manifest_version != 3) return {}
         const isFF = manifest.browser_specific_settings != null
         return {
             Program(node) { /* eslint-disable security/detect-object-injection */
                 for (const key of Object.keys(manifest))
-                    if (mv2OnlyKeys.has(key))
+                    if (manifestData.keys.mv2Only.has(key))
                         context.report({ node, messageId: 'mv2Key', data: { key, reason: 'MV2-only key' }})
-                for (const key of ffMV3bgKeys)
+                for (const key of manifestData.keys.ff.mv3BG)
                     if (manifest.background?.[key] && !isFF)
                         context.report({ node, messageId: 'mv2Key',
                             data: { key: `background.${key}`, reason: 'Use background.service_worker instead' }})
@@ -105,17 +104,18 @@ export default {
                     context.report({ node, messageId: 'wrongCSPType' })
                 const cspPages = csp?.extension_pages
                 if (typeof cspPages == 'string')
-                    for (const directive of forbiddenCSPdirectives)
+                    for (const directive of manifestData.csp.forbiddenDirectives)
                         if (cspPages.includes(directive))
                             context.report({ node, messageId: 'unsafeCSP', data: { directive }})
                 if (isFF) { // validate data collection permissions
                     const dcp = manifest.browser_specific_settings?.gecko?.data_collection_permissions
-                    for (const [kind, set] of [['required', ffDataCollectionRequired], ['optional', ffDataCollectionOptional]])
-                        if (Array.isArray(dcp?.[kind]))
-                            for (const value of dcp[kind])
-                                if (!set.has(value))
-                                    context.report({ node, messageId: 'invalidDataCollectionValue',
-                                        data: { value, kind }})
+                    for (const [kind, set] of [
+                        ['required', manifestData.keys.ff.dataCollectionRequired],
+                        ['optional', manifestData.keys.ff.dataCollectionOptional]
+                    ]) if (Array.isArray(dcp?.[kind]))
+                        for (const value of dcp[kind])
+                            if (!set.has(value))
+                                context.report({ node, messageId: 'invalidDataCollectionValue', data: { value, kind }})
                 }
             } /* eslint-enable security/detect-object-injection */
         }

package/src/rules/valid-service-worker.js

@@ -1,7 +1,7 @@
-import { domGlobals, serviceWorkerKeepaliveMinMS } from '../data/manifest.js'
+import extension from '../utils/extension.js'
+import nodeUtils from '../utils/node.js'
 
-import { isInsideNestedFunction } from '../utils/node.js'
-import { file, readManifest } from '../utils/extension.js'
+import manifestData from '../data/manifest.js'
 
 export default {
     meta: {
@@ -11,7 +11,23 @@ export default {
             category: 'Possible Errors',
             recommended: true
         },
-        schema: [],
+        schema: [{
+            type: 'object',
+            properties: {
+                checkListenerTopLevel: { type: 'boolean',
+                    description: 'Flag `chrome.*.addListener()` calls not registered at module top level' },
+                checkKeepaliveTimer: { type: 'boolean',
+                    description: 'Flag sub-30s `setTimeout`/`setInterval` calls used as a keepalive workaround' },
+                checkDOMglobals: { type: 'boolean',
+                    description: 'Flag DOM globals (`window`, `document`, `localStorage`) inside the service worker' }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{
+            checkListenerTopLevel: true,
+            checkKeepaliveTimer: true,
+            checkDOMglobals: true
+        }],
         messages: {
             listenerNotTopLevel: '`chrome.*.addListener()` must be registered at module top level'
                                + ' so it attaches on service worker wake-up.',
@@ -21,29 +37,34 @@ export default {
     },
 
     create(context) {
-        const manifest = readManifest(context) ; if (!manifest || !file.isServiceWorker(context, manifest)) return {}
+        const { checkListenerTopLevel, checkKeepaliveTimer, checkDOMglobals } = context.options[0],
+                manifest = extension.manifest.read(context)
+        if (!manifest || !extension.file.isServiceWorker(context, manifest)) return {}
         return {
             CallExpression(node) {
-                if (node.callee.type == 'MemberExpression'
+                if (checkListenerTopLevel
+                    && node.callee.type == 'MemberExpression'
                     && node.callee.property.name == 'addListener'
-                    && isInsideNestedFunction(node)
+                    && nodeUtils.isInsideNestedFunction(node)
                 ) context.report({ node, messageId: 'listenerNotTopLevel' })
-                if (node.callee.type == 'Identifier'
+                if (checkKeepaliveTimer
+                    && node.callee.type == 'Identifier'
                     && ['setTimeout', 'setInterval'].includes(node.callee.name)
                     && node.arguments[1]?.type == 'Literal'
                     && typeof node.arguments[1].value == 'number'
-                    && node.arguments[1].value < serviceWorkerKeepaliveMinMS
-                    && !isInsideNestedFunction(node)
+                    && node.arguments[1].value < 30000
+                    && !nodeUtils.isInsideNestedFunction(node)
                 ) context.report({ node, messageId: 'keepaliveTimer', data: { fn: node.callee.name }})
             },
             Identifier(node) {
+                if (!checkDOMglobals) return
                 if (node.parent?.type == 'MemberExpression' && node.parent.property === node
                     || node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed
-                    || !domGlobals.has(node.name)
+                    || !manifestData.globals.dom.has(node.name)
                 ) return
                 for (let scope = context.sourceCode.getScope(node)
-                    ;scope && scope.type != 'global'
-                    ;scope = scope.upper
+                    ; scope && scope.type != 'global'
+                    ; scope = scope.upper
                 ) if (scope.set.has(node.name)) return // shadowed by a local binding
                 context.report({ node, messageId: 'domInSW', data: { global: node.name }})
             }

package/src/rules/valid-url-fields.js

@@ -1,9 +1,12 @@
-import { matchPaths, urlPaths } from '../data/manifest.js'
-import { file } from '../utils/extension.js'
+import extension from '../utils/extension.js'
+
+import manifestData from '../data/manifest.js'
+import regex from '../data/regex.js'
 
 const re = {
-    absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i, manifestFilename: /manifest\.json$/,
-    match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/, template: /\{[^}]+\}/g
+    absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i,
+    match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/,
+    template: /\{[^}]+\}/g
 }
 
 function collectStrings(obj, path = [], out = []) {
@@ -19,6 +22,39 @@ function collectStrings(obj, path = [], out = []) {
 
 function isURL(value) { return re.absoluteURL.test(value.replace(re.template, 'x')) }
 
+function validateManifest(context, manifest, opts) {
+    const { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs } = opts,
+          loc = { line: 1, column: 1 }
+    for (const { path, value } of collectStrings(manifest)) {
+        if (checkURLfields && manifestData.paths.url.has(path)) {
+            if (!isURL(value))
+                context.report({ loc, messageId: 'invalidURL', data: { field: path, value }})
+        } else if (checkMatchPatterns && manifestData.paths.match.has(path)) {
+            if (value == '<all_urls>') {
+                if (!allowAllURLs)
+                    context.report({ loc, messageId: 'allURLs', data: { field: path }})
+                continue
+            }
+            const match = value.match(re.match)
+            if (!match) {
+                context.report({ loc, messageId: 'invalidMatchPattern', data: { field: path, value }})
+                continue
+            }
+            const [, scheme, host] = match
+            if (scheme != '*' && !allowedSchemes.includes(scheme))
+                context.report({ loc, messageId: 'invalidScheme', data: { field: path, value }})
+            else if (scheme == 'file' && host != '')
+                context.report({ loc, messageId: 'invalidFileHost', data: { field: path, value }})
+            else if (path == 'externally_connectable.matches' && host.includes('*'))
+                context.report({ loc, messageId: 'invalidExternalHost', data: { field: path, value }})
+            else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
+                context.report({ loc, messageId: 'invalidHost', data: { field: path, value }})
+            else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
+                context.report({ loc, messageId: 'invalidWARPath', data: { field: path, value }})
+        }
+    }
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -67,53 +103,25 @@ export default {
     },
 
     create(context) {
-        if (!re.manifestFilename.test(file.getName(context))) return {}
+        const filename = extension.file.getName(context)
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const opts = context.options[0] || {},
               checkURLfields = opts.checkURLfields ?? true,
               checkMatchPatterns = opts.checkMatchPatterns ?? true,
               allowedSchemes = opts.allowedSchemes ?? ['https', 'file'],
               allowAllURLs = opts.allowAllURLs ?? false
         if (!checkURLfields && !checkMatchPatterns) return {}
+        const resolved = { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs }
+        if (!regex.filename.manifest.test(filename)) {
+            const manifest = extension.manifest.read(context) ; if (!manifest) return {}
+            validateManifest(context, manifest, resolved)
+            return {}
+        }
         return {
             'Document:exit'() {
                 let manifest
                 try { manifest = JSON.parse(context.sourceCode.text) } catch { return }
-                for (const { path, value } of collectStrings(manifest)) {
-                    if (checkURLfields && urlPaths.has(path)) {
-                        if (!isURL(value))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidURL',
-                                data: { field: path, value }})
-                    } else if (checkMatchPatterns && matchPaths.has(path)) {
-                        if (value == '<all_urls>') {
-                            if (!allowAllURLs)
-                                context.report({ loc: { line: 1, column: 1 }, messageId: 'allURLs',
-                                    data: { field: path }})
-                            continue
-                        }
-                        const match = value.match(re.match)
-                        if (!match) {
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidMatchPattern',
-                                data: { field: path, value }})
-                            continue
-                        }
-                        const [, scheme, host] = match
-                        if (scheme != '*' && !allowedSchemes.includes(scheme))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidScheme',
-                                data: { field: path, value }})
-                        else if (scheme == 'file' && host != '')
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidFileHost',
-                                data: { field: path, value }})
-                        else if (path == 'externally_connectable.matches' && host.includes('*'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidExternalHost',
-                                data: { field: path, value }})
-                        else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidHost',
-                                data: { field: path, value }})
-                        else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidWARPath',
-                                data: { field: path, value }})
-                    }
-                }
+                validateManifest(context, manifest, resolved)
             }
         }
     }

package/src/rules/valid-version-field.js

@@ -1,9 +1,9 @@
-import { file, readManifest } from '../utils/extension.js'
+import extension from '../utils/extension.js'
+import regex from '../data/regex.js'
 
 const re = { /* eslint-disable security/detect-unsafe-regex */
     chromeParts: /^\d+(?:\.\d+){0,3}$/,
     date: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/,
-    manifestFilename: /manifest\.json$/,
     semver: /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/
 } /* eslint-enable security/detect-unsafe-regex */
 
@@ -13,7 +13,7 @@ export default {
         docs: {
             description: 'Validate the manifest version field format',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [{
@@ -79,7 +79,7 @@ export default {
                 }
             }
         }
-        if (re.manifestFilename.test(file.getName(context))) // lint it directly
+        if (regex.filename.manifest.test(extension.file.getName(context))) // lint it directly
             return {
                 '*'(node) {
                     const keyNode = node.name || node.key ; if (!keyNode) return
@@ -88,10 +88,6 @@ export default {
                     validate(valueNode, valueNode.value)
                 }
             }
-        return {
-            Program(node) {
-                validate(node, readManifest(context)?.version)
-            }
-        }
+        return { Program(node) { validate(node, extension.manifest.read(context)?.version) }}
     }
 }

package/src/utils/extension.js

@@ -1,45 +1,64 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time test fixtures only */
+
 import fs from 'node:fs'
 import path from 'node:path'
 
+import permissions from '../data/permissions.js'
+import regex from '../data/regex.js'
+
 const manifestCache = new Map()
 
-export function findRoot(context) {
-    let dir = path.dirname(file.getName(context))
-    while (dir) {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
-        const parent = path.dirname(dir)
-        if (parent == dir) break // reached fs root
-        dir = parent
-    }
-    return null
-}
+const utils = {
+    file: {
+        getName(context) { return context.filename || context.getFilename() },
 
-export const file = {
-    getName(context) { return context.filename || context.getFilename() },
+        isContentScript(context, manifest) {
+            const scripts = (manifest?.content_scripts || []).flatMap(cs => cs.js || [])
+            if (!scripts.length) return false
+            const root = utils.findRoot(context) ; if (!root) return false
+            const filename = path.resolve(utils.file.getName(context))
+            return scripts.some(script => filename == path.resolve(root, script))
+        },
 
-    isContentScript(context, manifest) {
-        const scripts = (manifest?.content_scripts || []).flatMap(cs => cs.js || []) ; if (!scripts.length) return false
-        const root = findRoot(context) ; if (!root) return false
-        const filename = path.resolve(file.getName(context))
-        return scripts.some(script => filename == path.resolve(root, script))
+        isServiceWorker(context, manifest) {
+            const worker = manifest?.background?.service_worker ; if (!worker) return false
+            const root = utils.findRoot(context) ; if (!root) return false
+            return path.resolve(utils.file.getName(context)) == path.resolve(root, worker)
+        }
     },
 
-    isServiceWorker(context, manifest) {
-        const worker = manifest?.background?.service_worker ; if (!worker) return false
-        const root = findRoot(context) ; if (!root) return false
-        return path.resolve(file.getName(context)) == path.resolve(root, worker)
+    findRoot(context) {
+        let dir = path.dirname(utils.file.getName(context))
+        while (dir) {
+            if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
+            const parent = path.dirname(dir)
+            if (parent == dir) break // reached fs root
+            dir = parent
+        }
+        return null
+    },
+
+    manifest: {
+        permission: {
+            valid: permissions.valid,
+            sensitive: permissions.sensitive,
+            isValid(name, target = 'mv3') {
+                if (permissions.valid.has(name)) return true
+                if (target == 'mv3') return false
+                return regex.url.test(name) || name.startsWith('<') || name == '*://*/*'
+            }
+        },
+
+        read(context) {
+            const root = utils.findRoot(context) ; if (!root) return null
+            if (manifestCache.has(root)) return manifestCache.get(root)
+            let parsed
+            try { parsed = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8')) }
+            catch { parsed = null }
+            manifestCache.set(root, parsed)
+            return parsed
+        }
     }
 }
 
-export function readManifest(context) {
-    const root = findRoot(context)
-    if (!root) return null
-    if (manifestCache.has(root)) return manifestCache.get(root)
-    let parsed
-    try { // eslint-disable-next-line security/detect-non-literal-fs-filename
-        parsed = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8'))
-    } catch { parsed = null }
-    manifestCache.set(root, parsed)
-    return parsed
-}
+export default utils

package/src/utils/i18n.js

@@ -0,0 +1,58 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time test fixtures only */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+import i18n from '../data/i18n.js'
+
+function templateToPattern(body) {
+    const parts = body.split(i18n.re.templateExpr).map(part => part.replace(i18n.re.specialChars, '\\$&'))
+    return new RegExp(`^${parts.join('.*')}$`) // eslint-disable-line security/detect-non-literal-regexp
+}
+
+export default {
+    collectUsedKeys(root, scanExtensions) {
+        const used = new Set(),
+              patterns = [],
+              exts = new Set(scanExtensions),
+              stack = [root]
+        while (stack.length) {
+            const dir = stack.pop() ; let entries
+            try { entries = fs.readdirSync(dir, { withFileTypes: true }) } catch { continue }
+            for (const entry of entries) {
+                if (entry.name.startsWith('.') || entry.name == 'node_modules') continue
+                const fullPath = path.join(dir, entry.name)
+                if (entry.isDirectory()) { stack.push(fullPath) ; continue }
+                const ext = path.extname(entry.name).slice(1).toLowerCase()
+                if (!exts.has(ext)) continue
+                let text
+                try { text = fs.readFileSync(fullPath, 'utf8') } catch { continue }
+                for (const match of text.matchAll(i18n.re.msgPlaceholder))
+                    if (!this.isPredefined(match[1])) used.add(match[1])
+                for (const match of text.matchAll(i18n.re.getMsg.literal))
+                    used.add(match[1])
+                for (const match of text.matchAll(i18n.re.getMsg.template)) {
+                    const body = match[1]
+                    if (body.includes('${')) patterns.push(templateToPattern(body))
+                    else used.add(body)
+                }
+            }
+        }
+        return { used, patterns }
+    },
+
+    isPredefined(key) { return key.startsWith('@@') },
+
+    localeIsValid(code, allowed = new Set()) {
+        return typeof code == 'string' && (allowed.has(code) || i18n.locales.supported.has(code)) },
+
+    readDefaultLocaleMessages(manifest, root) {
+        const locale = manifest?.default_locale
+        if (typeof locale != 'string') return null
+        const filePath = path.join(root, '_locales', locale, 'messages.json')
+        let messages
+        try { messages = JSON.parse(fs.readFileSync(filePath, 'utf8')) } catch { return null }
+        if (!messages || typeof messages != 'object' || Array.isArray(messages)) return null
+        return { locale, messages }
+    }
+}