eslint-plugin-greasemonkey 1.8.4 → 1.9.0

package/docs/LICENSE.md

@@ -1,4 +1,4 @@
-# 🏛️ MIT License
+# MIT License
 
 **Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui) & contributors.**
 

package/package.json

@@ -1,22 +1,26 @@
 {
   "name": "eslint-plugin-greasemonkey",
-  "version": "1.8.4",
+  "version": "1.9.0",
   "description": "ESLint rules for Greasemonkey/Tampermonkey userscripts",
-  "type": "module",
-  "engines": {
-    "node": ">=18.18.0"
-  },
-  "author": {
-    "name": "Adam Lui",
-    "email": "adam@kudoai.org",
-    "url": "https://codeberg.org/adamlui"
-  },
+  "keywords": [
+    "eslint",
+    "eslint-plugin",
+    "eslintplugin",
+    "greasemonkey",
+    "metadata",
+    "security",
+    "tampermonkey",
+    "userscript"
+  ],
   "homepage": "https://codeberg.org/adamlui/eslint-plugin-greasemonkey/#readme",
   "bugs": {
     "url": "https://codeberg.org/adamlui/eslint-plugin-greasemonkey/issues",
     "email": "support@adamlui.com"
   },
-  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://codeberg.org/adamlui/eslint-plugin-greasemonkey.git"
+  },
   "funding": [
     {
       "type": "ko-fi",
@@ -27,39 +31,34 @@
       "url": "https://paypal.me/adamlui"
     }
   ],
-  "main": "src/index.js",
+  "license": "MIT",
+  "author": {
+    "name": "Adam Lui",
+    "email": "adam@kudoai.org",
+    "url": "https://codeberg.org/adamlui"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
   "files": [
     "docs/",
     "src/"
   ],
-  "types": "src/index.d.ts",
   "scripts": {
-    "lint": "eslint . --cache && yamllint .",
-    "lint:all": "eslint . && yamllint .",
-    "lint:fix": "eslint . --fix --cache && yamllint .",
-    "lint:fix-all": "eslint . --fix && yamllint .",
-    "test": "node tests/run.js",
-    "demo": "node demo/run.js",
-    "bump:patch": "bash utils/bump.sh patch",
-    "bump:minor": "bash utils/bump.sh minor",
     "bump:feat": "npm run bump:minor",
-    "bump:major": "bash utils/bump.sh major"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://codeberg.org/adamlui/eslint-plugin-greasemonkey.git"
-  },
-  "keywords": [
-    "eslint",
-    "eslint-plugin",
-    "eslintplugin",
-    "greasemonkey",
-    "metadata",
-    "tampermonkey",
-    "userscript"
-  ],
-  "peerDependencies": {
-    "eslint": ">=9.0.0"
+    "bump:major": "bash utils/bump.sh major",
+    "bump:minor": "bash utils/bump.sh minor",
+    "bump:patch": "bash utils/bump.sh patch",
+    "demo": "eslint demo",
+    "lint": "pre-commit run",
+    "lint:all": "pre-commit run --all-files",
+    "test": "node tests/run"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
@@ -68,16 +67,23 @@
     "@eslint/markdown": "^7.5.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.2",
+    "eslint-plugin-constructors": "^1.4.3",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
+    "eslint-plugin-package-json": "^1.10.1",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
     "eslint-plugin-security": "^4.2.0",
-    "globals": "^17.13.0",
-    "yamllint-js": "^0.2.4"
+    "eslint-plugin-woodpecker": "^1.0.1",
+    "globals": "^17.13.0"
+  },
+  "peerDependencies": {
+    "eslint": ">=9.0.0"
+  },
+  "engines": {
+    "node": ">=18.18.0"
   }
 }

package/src/data/headers.js

@@ -34,3 +34,27 @@ for (const manager of managers) {
         .map(([header]) => header)
     validHeaders.set(manager, new Set([...universalHeaders, ...specific]))
 }
+
+const urlHeaderTypes = {
+    connect:         'host-pattern',
+    contributionURL: 'url',
+    defaulticon:     'url',
+    downloadURL:     'url',
+    exclude:         'pattern',
+    'exclude-match': 'pattern',
+    homepage:        'url',
+    homepageURL:     'url',
+    icon:            'url',
+    icon64:          'url',
+    include:         'pattern',
+    match:           'pattern',
+    require:         'url',
+    'require-css':   'url',
+    resource:        'named-url',
+    source:          'url',
+    supportURL:      'url',
+    updateURL:       'url',
+    website:         'url'
+}
+const knownHeaders = new Set([...universalHeaders, ...managerHeaders.keys()])
+export const urlHeaders = new Map(Object.entries(urlHeaderTypes).filter(([name]) => knownHeaders.has(name)))

package/src/index.d.ts

@@ -1,6 +1,36 @@
+type RuleSeverity = 0 | 1 | 2 | 'off' | 'warn' | 'error'
+type RuleSetting = RuleSeverity | [RuleSeverity, ...unknown[]]
+
+type ConfigName =
+    | 'recommended'
+    | 'strict'
+    | 'problem'
+    | 'tampermonkey'
+    | 'violentmonkey'
+    | 'greasemonkey'
+    | 'scriptcat'
+    | 'adguard'
+
+interface PluginConfig {
+    plugins: Record<string, unknown>
+    rules: Record<string, RuleSetting>
+}
+
+interface PluginRule {
+    meta: {
+        type?: 'problem' | 'suggestion' | 'layout'
+        deprecated?: boolean | {
+            message?: string
+            replacedBy?: Array<{ rule: { name: string } }>
+        }
+        docs?: Record<string, unknown>
+    }
+    create: (context: unknown) => Record<string, (...args: unknown[]) => void>
+}
+
 declare const plugin: {
-    rules: Record<string, unknown>
-    configs: { recommended: Record<string, unknown> }
+    rules: Record<string, PluginRule>
+    configs: Record<ConfigName, PluginConfig>
 }
 
-export default plugin
+export { plugin as default, plugin as greasemonkey }

package/src/index.js

@@ -1,84 +1,9 @@
-/* eslint-disable security/detect-object-injection -- false positives */
+import init from './utils/init.js'
 
-import { rules as oldRules } from './data/deprecations.js'
+const plugin = init.plugin()
 
-import metaOrder from './rules/meta-order.js'
-import metaSpacing from './rules/meta-spacing.js'
-import noDuplicateKeys from './rules/no-duplicate-keys.js'
-import noInvalidGrants from './rules/no-invalid-grants.js'
-import noInvalidHeaders from './rules/no-invalid-headers.js'
-import noMissingGrants from './rules/no-missing-grants.js'
-import noMissingResources from './rules/no-missing-resources.js'
-import noUnusedGrants from './rules/no-unused-grants.js'
-import noUnusedResources from './rules/no-unused-resources.js'
-import preferMatch from './rules/prefer-match.js'
-import requireBlankLineAfterMetaBlock from './rules/require-blank-line-after-meta-block.js'
-import requireHomepagePair from './rules/require-homepage-pair.js'
-import requireMatchingLocalizedFields from './rules/require-matching-localized-fields.js'
-import requireRequiredFields from './rules/require-required-fields.js'
-import requireSpaceBeforeMetaKey from './rules/require-space-before-meta-key.js'
-import requireSRIhashing from './rules/require-sri-hashing.js'
-import requireUpdateDownloadPair from './rules/require-update-download-pair.js'
-import requireUserJsFilename from './rules/require-user-js-filename.js'
-import validFieldValues from './rules/valid-field-values.js'
-
-import { bundleRules, initDeprecatedAlias } from './utils.js'
-
-const plugin = {
-    rules: {
-        'meta-order': metaOrder,
-        'meta-spacing': metaSpacing,
-        'no-duplicate-keys': noDuplicateKeys,
-        'no-invalid-grants': noInvalidGrants,
-        'no-invalid-headers': noInvalidHeaders,
-        'no-missing-grants': noMissingGrants,
-        'no-unused-grants': noUnusedGrants,
-        'no-missing-resources': noMissingResources,
-        'no-unused-resources': noUnusedResources,
-        'prefer-match': preferMatch,
-        'require-blank-line-after-meta-block': requireBlankLineAfterMetaBlock,
-        'require-homepage-pair': requireHomepagePair,
-        'require-matching-localized-fields': requireMatchingLocalizedFields,
-        'require-required-fields': requireRequiredFields,
-        'require-space-before-meta-key': requireSpaceBeforeMetaKey,
-        'require-sri-hashing': requireSRIhashing,
-        'require-update-download-pair': requireUpdateDownloadPair,
-        'require-user-js-filename': requireUserJsFilename,
-        'valid-field-values': validFieldValues
-    }
-}
-
-for (const [ruleId, rule] of Object.entries(plugin.rules))
-    rule.meta.docs.url = `https://codeberg.org/adamlui/eslint-plugin-greasemonkey/#${ruleId}`
-
-for (const entry of Object.entries(oldRules))
-    initDeprecatedAlias(plugin, entry)
-
-plugin.configs = {
-    recommended: {
-        plugins: { greasemonkey: plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended, 'greasemonkey')
-    },
-    strict: {
-        plugins: { greasemonkey: plugin },
-        rules: bundleRules(plugin.rules, () => true, 'greasemonkey')
-    },
-    problem: {
-        plugins: { greasemonkey: plugin },
-        rules: bundleRules(plugin.rules, rule => rule.meta.type == 'problem', 'greasemonkey')
-    }
-}
-
-for (const manager of ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard'])
-    plugin.configs[manager] = {
-        plugins: { greasemonkey: plugin },
-        rules: {
-            ...plugin.configs.recommended.rules,
-            'greasemonkey/no-invalid-grants': ['error', { target: manager }],
-            'greasemonkey/no-invalid-headers': ['error', { target: manager }],
-            ...(['tampermonkey', 'scriptcat', 'adguard'].includes(manager) &&
-                { 'greasemonkey/require-update-download-pair': 'error' })
-        }
-    }
+init.rules(plugin)
+init.deprecations(plugin)
+init.configs(plugin)
 
 export { plugin as default, plugin as greasemonkey }

package/src/rules/meta-order.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 const defaultOrder = [
     'name', 'description', 'author', 'namespace', 'version', 'license', 'icon', 'icon64',
@@ -30,8 +30,7 @@ export default {
         type: 'layout',
         docs: {
             description: 'Enforce an order for metadata keys',
-            category: 'Stylistic Issues',
-            recommended: false
+            category: 'Stylistic Issues'
         },
         fixable: 'code',
         schema: [{
@@ -54,7 +53,7 @@ export default {
         return {
             Program() {
                 const sourceCode = context.sourceCode,
-                      entries = extractMetadata(sourceCode),
+                      entries = metadata.extract(sourceCode),
                       violation = findViolation(entries, master) ?? (custom.length && findViolation(entries, custom))
                 if (!violation) return
                 const [first, second] = violation

package/src/rules/meta-spacing.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 const re = { leadingWhitespace: /^\s*/, whitespace: /\s+/ }
 
@@ -30,7 +30,7 @@ export default {
         return {
             Program() {
                 const sourceCode = context.sourceCode,
-                      metaEntries = extractMetadata(sourceCode)
+                      metaEntries = metadata.extract(sourceCode)
                 if (!metaEntries.length) return
                 let targetCol = metaEntries.reduce((max, entry) => Math.max(max, entry.key.length), 0) + minSpaces +4
                 for (const entry of metaEntries)

package/src/rules/no-duplicate-keys.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 const multiValKeys = new Set([
     'compatible', 'connect', 'description', 'exclude', 'exclude-match', 'grant',
@@ -20,7 +20,7 @@ export default {
     create(context) {
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       seenEntries = new Set()
                 for (const entry of metaEntries) {
                     const baseKey = entry.key.split(':')[0]

package/src/rules/no-insecure-fetch.js

@@ -0,0 +1,109 @@
+import { urlHeaders } from '../data/headers.js'
+
+const re = {
+    insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i,
+    meta: {
+        end:   /^\/\/\s*==\/UserScript==\s*$/,
+        line:  /^\/\/\s*@([\w-]+)(?::[\w-]+)?\s+(\S.*)$/, // eslint-disable-line security/detect-unsafe-regex
+        start: /^\/\/\s*==UserScript==\s*$/
+    },
+    newline: /\r?\n/,
+    whitespace: /\s+/
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags `fetch()`, `XMLHttpRequest.open()`, `GM_xmlhttpRequest()`, `GM.xmlHttpRequest()` calls and URL fields that use `http://`',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        schema: [],
+        messages: {
+            insecureFetch: '`fetch()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureXHR: '`XMLHttpRequest.open()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureGMXHR: '`{{callee}}()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureMetadata: '`@{{key}}` URL "{{url}}" insecure. Use HTTPS instead.'
+        }
+    },
+
+    create(context) {
+        const xhrVars = new Set(),
+              sourceCode = context.sourceCode ?? context.getSourceCode()
+        function isInsecure(url) { return typeof url == 'string' && re.insecureURL.test(url) }
+        function reportMetadata() {
+            const lines = sourceCode.text.split(re.newline)
+            let inBlock = false
+            for (const [i, rawLine] of lines.entries()) {
+                const line = rawLine.trimEnd()
+                if (re.meta.start.test(line.trim())) { inBlock = true ; continue }
+                if (inBlock && re.meta.end.test(line.trim())) break
+                if (!inBlock) continue
+                const match = line.match(re.meta.line) ; if (!match) continue
+                const key = match[1]
+                const type = urlHeaders.get(key) ; if (!type) continue
+                const tokens = match[2].split(re.whitespace),
+                      url = type == 'named-url' ? tokens[1] : tokens[0]
+                if (!url || !isInsecure(url)) continue
+                const col = line.lastIndexOf(url)
+                context.report({
+                    loc: { start: { line: i +1, column: col },
+                           end:   { line: i +1, column: col + url.length }},
+                    messageId: 'insecureMetadata', data: { key, url }
+                })
+            }
+        }
+        function reportGMXHR(node) {
+            const url = urlFromLiteral(node.arguments[0]) ?? urlFromOptions(node.arguments[0]) ; if (!url) return
+            const callee = node.callee.type == 'MemberExpression'
+                ? `${node.callee.object.name}.${node.callee.property.name}`
+                : node.callee.name
+            context.report({ node: node.arguments[0], messageId: 'insecureGMXHR', data: { callee, url }})
+        }
+        function urlFromLiteral(node) {
+            return (node?.type == 'Literal'
+                && typeof node.value == 'string'
+                && isInsecure(node.value)
+            ) ? node.value : null
+        }
+        function urlFromOptions(node) {
+            if (node?.type != 'ObjectExpression') return null
+            for (const prop of node.properties)
+                if (prop.type == 'Property' && (prop.key?.name == 'url' || prop.key?.value == 'url')) {
+                    const val = prop.value
+                    if (val?.type == 'Literal' && isInsecure(val.value)) return val.value
+                }
+            return null
+        }
+
+        return {
+            Program() { reportMetadata() },
+            VariableDeclarator(node) {
+                if (node.init?.type == 'NewExpression'
+                    && node.init.callee?.name == 'XMLHttpRequest'
+                    && node.id.type == 'Identifier'
+                ) xhrVars.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type == 'Identifier' && node.callee.name == 'fetch') {
+                    const url = urlFromLiteral(node.arguments[0])
+                    if (url) context.report({ node: node.arguments[0], messageId: 'insecureFetch', data: { url }})
+                } else if (node.callee.type == 'MemberExpression'
+                    && node.callee.property?.name == 'open'
+                    && node.callee.object?.type == 'Identifier'
+                    && xhrVars.has(node.callee.object.name)
+                ) { // xhr.open('GET', 'http://…')
+                    const url = urlFromLiteral(node.arguments[1])
+                    if (url) context.report({ node: node.arguments[1], messageId: 'insecureXHR', data: { url }})
+                } else if (node.callee.type == 'Identifier'
+                    && node.callee.name == 'GM_xmlhttpRequest'
+                    || node.callee.type == 'MemberExpression'
+                        && node.callee.object?.name == 'GM'
+                        && node.callee.property?.name == 'xmlHttpRequest'
+                ) reportGMXHR(node)
+            }
+        }
+    }
+}

package/src/rules/no-insecure-messaging.js

@@ -0,0 +1,68 @@
+const re = {
+    messageTargets: new Set(['window', 'self', 'unsafeWindow']),
+    postmsgValidation: /\b\w+\.(?:origin|source)\b/
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Requires origin/source validation + explicit `postMessage()` target',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        defaultOptions: [{ disallowWildcardTarget: true }],
+        schema: [{
+            type: 'object',
+            properties: {
+                disallowWildcardTarget: {
+                    type: 'boolean',
+                    description: 'Flag postMessage calls that use "*" as targetOrigin'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            unvalidatedPostMessage: '`{{target}}` message handler must validate `event.origin`/`event.source` '
+                                  + 'before processing messages.',
+            wildcardTarget: '`postMessage` to `"*"` leaks data to any origin. '
+                          + 'Explicitly specify `targetOrigin` instead.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              disallowWildcard = opts.disallowWildcardTarget !== false,
+              sourceCode = context.sourceCode ?? context.getSourceCode()
+        function checkPostMessageHandler(node, handlerNode, target) {
+            if (!handlerNode) return
+            const body = sourceCode.getText(handlerNode)
+            if (re.postmsgValidation.test(body)) return
+            context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
+        }
+        function isMessageTarget(obj) {
+            return obj?.type == 'Identifier' && re.messageTargets.has(obj.name)
+        }
+        return {
+            CallExpression(node) {
+                if (node.callee.type != 'MemberExpression') return
+                if (node.callee.property?.name == 'addEventListener'
+                    && node.arguments[0]?.value == 'message'
+                    && isMessageTarget(node.callee.object)
+                ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
+                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
+                    const target = node.arguments[1]
+                    if (target?.type == 'Literal' && target.value == '*')
+                        context.report({ node: target, messageId: 'wildcardTarget' })
+                }
+            },
+            AssignmentExpression(node) {
+                if (node.left.type == 'MemberExpression'
+                    && node.left.property?.name == 'onmessage'
+                    && isMessageTarget(node.left.object)
+                ) checkPostMessageHandler(node, node.right, node.left.object.name)
+            }
+        }
+    }
+}

package/src/rules/no-invalid-grants.js

@@ -1,6 +1,6 @@
-import { allAPIs, supportsAPI } from '../data/apis.js'
+import metadata from '../utils/metadata.js'
 
-import { extractMetadata } from '../utils.js'
+import { allAPIs, supportsAPI } from '../data/apis.js'
 
 const managers = ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard'],
       specialGrants = new Set(['none', 'unsafeWindow', 'window.close', 'window.focus', 'window.onurlchange']),
@@ -51,7 +51,7 @@ export default {
               allowedGrants = new Set(Array.isArray(rawAllowed) ? rawAllowed : [rawAllowed])
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       grantEntries = metaEntries.filter(entry => entry.key == 'grant')
                 for (const grant of grantEntries) {
                     const grantName = grant.value.trim()

package/src/rules/no-invalid-headers.js

@@ -1,6 +1,6 @@
-import { managerHeaders, managers, localizedHeaders, validHeaders } from '../data/headers.js'
+import metadata from '../utils/metadata.js'
 
-import { extractMetadata } from '../utils.js'
+import { managerHeaders, managers, localizedHeaders, validHeaders } from '../data/headers.js'
 
 function parseAllowedPattern(entry) {
     if (typeof entry != 'string' || !entry.startsWith('/')) return null
@@ -62,7 +62,7 @@ export default {
         }
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode)
+                const metaEntries = metadata.extract(context.sourceCode)
                 for (const entry of metaEntries) {
                     if (allowedExact.has(entry.key)) continue
                     if (allowedRegexes.some(re => re.test(entry.key))) continue

package/src/rules/no-missing-grants.js

@@ -1,6 +1,6 @@
-import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../data/apis.js'
+import metadata from '../utils/metadata.js'
 
-import { extractMetadata } from '../utils.js'
+import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../data/apis.js'
 
 const apis = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs]),
       grantlessAPIs = new Set(['GM_info', 'GM.info']) // always available, no grant required
@@ -37,7 +37,7 @@ export default {
             'Program:exit'() {
                 if (!usedAPIs.size) return
                 const declared = new Set(
-                    extractMetadata(context.sourceCode)
+                    metadata.extract(context.sourceCode)
                         .filter(entry => entry.key == 'grant')
                         .map(entry => entry.value.trim())
                 )

package/src/rules/no-missing-resources.js

@@ -1,4 +1,5 @@
-import { extractMetadata, resolveTemplate } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import template from '../utils/template.js'
 
 const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
       re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
@@ -24,7 +25,7 @@ export default {
             if (arg?.type == 'Literal' && typeof arg.value == 'string')
                 usedRefs.push({ names: [arg.value], pattern: null, node })
             else if (arg?.type == 'TemplateLiteral') {
-                const resolved = resolveTemplate(arg)
+                const resolved = template.resolve(arg)
                 if (resolved) usedRefs.push({ names: resolved, pattern: null, node })
                 else usedRefs.push({
                     names: null,
@@ -42,7 +43,7 @@ export default {
             'Program:exit'() {
                 if (!usedRefs.length) return
                 const declared = new Set(
-                    extractMetadata(context.sourceCode)
+                    metadata.extract(context.sourceCode)
                         .filter(entry => entry.key == 'resource')
                         .map(entry => entry.value.trim().split(re.whitespace)[0])
                 )

package/src/rules/no-unused-grants.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -30,7 +30,7 @@ export default {
             },
             'Program:exit'() {
                 const sourceCode = context.sourceCode,
-                      metaEntries = extractMetadata(sourceCode),
+                      metaEntries = metadata.extract(sourceCode),
                       grants = metaEntries.filter(entry => entry.key == 'grant')
                 if (!grants.length) return
                 for (const grant of grants) {

package/src/rules/no-unused-resources.js

@@ -1,7 +1,8 @@
-import { extractMetadata, resolveTemplate } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import template from '../utils/template.js'
 
-const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
-      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
+const re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ },
+      resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL'])
 
 export default {
     meta: {
@@ -25,7 +26,7 @@ export default {
                 if (arg?.type == 'Literal' && typeof arg.value == 'string')
                     usedResources.add(arg.value)
                 else if (arg?.type == 'TemplateLiteral') {
-                    const resolved = resolveTemplate(arg)
+                    const resolved = template.resolve(arg)
                     if (resolved)
                         for (const name of resolved) usedResources.add(name)
                     else usedPatterns.push(new RegExp( // eslint-disable-line security/detect-non-literal-regexp
@@ -33,7 +34,7 @@ export default {
                 }
             },
             'Program:exit'() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       resources = metaEntries.filter(entry => entry.key == 'resource')
                 if (!resources.length) return
                 for (const res of resources) {