extension 4.1.19 → 4.1.20

package/README.md

@@ -6,12 +6,10 @@
 [action-url]: https://github.com/extension-js/extension.js/actions
 [discord-image]: https://img.shields.io/discord/1253608412890271755?label=Discord&logo=discord&style=flat&color=0971fe
 [discord-url]: https://discord.gg/v9h2RgeTSN
-[snyk-image]: https://snyk.io/test/github/extension-js/extension.js/badge.svg?color=0971fe
-[snyk-url]: https://snyk.io/test/github/extension-js/extension.js
-[scorecard-image]: https://img.shields.io/ossf-scorecard/github.com/extension-js/extension.js?label=OpenSSF%20Scorecard&style=flat&color=0971fe
-[scorecard-url]: https://scorecard.dev/viewer/?uri=github.com/extension-js/extension.js
+[bestpractices-image]: https://img.shields.io/cii/level/14662?label=OpenSSF%20Best%20Practices&style=flat&color=0971fe
+[bestpractices-url]: https://www.bestpractices.dev/projects/14662
 
-# Extension.js [![Version][npm-version-image]][npm-version-url] [![Stars][stars-image]][stars-url] [![CI][action-image]][action-url] [![Discord][discord-image]][discord-url] [![OpenSSF Scorecard][scorecard-image]][scorecard-url]
+# Extension.js [![Version][npm-version-image]][npm-version-url] [![Stars][stars-image]][stars-url] [![CI][action-image]][action-url] [![Discord][discord-image]][discord-url] [![OpenSSF Best Practices][bestpractices-image]][bestpractices-url]
 
 > The cross-browser extension framework. Build for Chrome, Edge, Firefox, and Safari with no build config required.
 
@@ -25,7 +23,9 @@ npm run dev
 
 Works with `npm`, `pnpm`, `yarn`, `bun`, and `deno`.
 
-[Documentation](https://extension.js.org) · [Templates](https://templates.extension.dev) · [Examples](https://github.com/extension-js/examples) · [Discord](https://discord.gg/v9h2RgeTSN)
+The CLI itself runs on Node.js 22.12+ and Deno 2.5+. Bun installs and launches it, and it runs on Node.js from there.
+
+[Documentation](https://extension.js.org/docs) · [Templates](https://templates.extension.dev/?utm_source=readme&utm_campaign=nav-templates) · [Showcase](https://extension.js.org/showcase) · [Blog](https://extension.js.org/blog)
 
 ## Why Extension.js
 
@@ -181,6 +181,16 @@ npx extension@latest dev https://github.com/GoogleChrome/chrome-extensions-sampl
 
 </div>
 
+Each of these installs Extension.js, launches it, and runs its scripts. Which runtime the CLI then executes on is a separate question.
+
+## Runtimes
+
+| Runtime | Status | Notes |
+| :-- | :-- | :-- |
+| Node.js | ✅ 22.12 and newer | The default. `npx`, `pnpm dlx`, `yarn dlx` and `bunx` all land here through the published bin |
+| Deno | ✅ 2.5 and newer | `deno run -A npm:extension@latest`. Deno 2.8.0 is refused because it cannot load `node:querystring`, fixed in 2.8.1 |
+| Bun | ❌ Not a runtime for the CLI | Bun installs and launches Extension.js, which then runs on Node.js. `bunx --bun` and `bun run --bun` are refused |
+
 ## Community
 
 - Star the repo if Extension.js helped you ship faster
@@ -193,15 +203,6 @@ npx extension@latest dev https://github.com/GoogleChrome/chrome-extensions-sampl
 Sponsors help the project ship faster releases, better developer experience, and long-term reliability for extension teams.
 
 <div align="center">
-  <p>
-    <a href="https://www.testmuai.com/?utm_medium=sponsor&utm_source=extensionjs" target="_blank" rel="noopener noreferrer">
-      <picture>
-        <source media="(prefers-color-scheme: dark)" srcset="https://extension.js.org/images/sponsors/testmuai_dark.svg" />
-        <source media="(prefers-color-scheme: light)" srcset="https://extension.js.org/images/sponsors/testmuai.svg" />
-        <img src="https://extension.js.org/images/sponsors/testmuai.svg" width="220" alt="TestMu AI" />
-      </picture>
-    </a>
-  </p>
   <p>
     <a href="https://extension.dev/?utm_medium=sponsor&utm_source=extensionjs" target="_blank" rel="noopener noreferrer">
       <picture>

package/bin/extension.cjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+
 //  ██████╗██╗     ██╗
 // ██╔════╝██║     ██║
 // ██║     ██║     ██║
@@ -38,6 +39,7 @@ if (fs.existsSync(distCjsEntry)) {
     console.error(
       '[Extension.js] CLI not built. Run "pnpm --filter extension compile".'
     )
+
     process.exit(1)
   }
 } else {

package/dist/browsers.cjs

@@ -740,16 +740,19 @@ var __webpack_modules__ = {
             const tail = outputTail.trim().length ? `\n${pintor__rspack_import_8_default().gray('── last output ──')}\n${outputTail}` : `\n${pintor__rspack_import_8_default().gray('(no output captured)')}`;
             return `${getLoggingPrefix('error')} Safari packaging tool ${pintor__rspack_import_8_default().underline(tool)} failed (${pintor__rspack_import_8_default().red(code)}).${tail}`;
         }
+        const SAFARI_KEPT_ON_PURPOSE = {
+            world: 'Safari has honored the MAIN world since Safari 18, so the key stays'
+        };
         function safariConverterWarnings(warnings) {
-            return `${getLoggingPrefix('warn')} safari-web-extension-converter reported ${pintor__rspack_import_8_default().yellow(String(warnings.length))} ${1 === warnings.length ? 'warning' : 'warnings'}, some manifest keys/APIs may not be supported by Safari:\n` + warnings.map((line)=>`  ${pintor__rspack_import_8_default().gray('•')} ${line}`).join('\n');
+            const kept = warnings.map((line)=>line.trim()).filter((line)=>line in SAFARI_KEPT_ON_PURPOSE);
+            const keptLines = kept.map((line)=>`  ${pintor__rspack_import_8_default().yellow(line)} ${pintor__rspack_import_8_default().gray(SAFARI_KEPT_ON_PURPOSE[line])}`).join('\n');
+            return `${getLoggingPrefix('warn')} safari-web-extension-converter reported ${pintor__rspack_import_8_default().yellow(String(warnings.length))} ${1 === warnings.length ? 'warning' : 'warnings'}, some manifest keys/APIs may not be supported by Safari:\n` + warnings.map((line)=>`  ${pintor__rspack_import_8_default().gray('•')} ${line}`).join('\n') + (kept.length ? `\nExtension.js kept ${1 === kept.length ? 'one of these keys' : 'some of these keys'} on purpose:\n${keptLines}` : '');
         }
         function safariDefaultBundleIdNote(bundleId) {
             return `${getLoggingPrefix('warn')} The bundle id ${pintor__rspack_import_8_default().gray(bundleId)} is generated from the app name.\nEvery project built from the same source shares this id, and the first team to register it takes it.\nSet your own with ${pintor__rspack_import_8_default().blue('--bundle-id')} before your first submission.\nAfter a submission, a new id is a new extension with none of your users.`;
         }
-        function safariOpenHint(appPath, appName, signed) {
-            const launch = `${getLoggingPrefix('info')} Launch it once to register with Safari: ${pintor__rspack_import_8_default().blue('open')} ${pintor__rspack_import_8_default().underline(`"${appPath}"`)}\n`;
-            if (signed) return launch + `Then turn on ${pintor__rspack_import_8_default().yellow(appName)} in Safari ▸ Settings ▸ Extensions.`;
-            return launch + `Then enable ${pintor__rspack_import_8_default().yellow(appName)} via Safari ▸ Develop ▸ ` + `${pintor__rspack_import_8_default().yellow('Allow Unsigned Extensions')} and Safari ▸ Settings ▸ Extensions.`;
+        function safariOpenHint(appPath, appName) {
+            return `${getLoggingPrefix('info')} Launch it once to register with Safari: ${pintor__rspack_import_8_default().blue('open')} ${pintor__rspack_import_8_default().underline(`"${appPath}"`)}\nThen turn on ${pintor__rspack_import_8_default().yellow(appName)} in Safari ▸ Settings ▸ Extensions.`;
         }
         function safariDryRunNotBuilding() {
             return `${getLoggingPrefix('info')} Dry run: skip the Safari app build.`;
@@ -761,8 +764,9 @@ var __webpack_modules__ = {
             return `${getLoggingPrefix('info')} xcodebuild: ${pintor__rspack_import_8_default().gray(cmd)}.`;
         }
         function safariNextSteps(appName, signed) {
-            if (signed) return `${getLoggingPrefix('info')} One-time setup to load ${pintor__rspack_import_8_default().yellow(appName)} in Safari:\n  ${pintor__rspack_import_8_default().gray('1.')} Safari ▸ Settings ▸ Extensions ▸ turn on ${pintor__rspack_import_8_default().yellow(appName)}\n  ${pintor__rspack_import_8_default().gray('→')} Signed with your team id, so this survives a restart.`;
-            return `${getLoggingPrefix('info')} One-time setup to load ${pintor__rspack_import_8_default().yellow(appName)} in Safari:\n  ${pintor__rspack_import_8_default().gray('1.')} Safari ▸ Settings ▸ Advanced ▸ check ${pintor__rspack_import_8_default().yellow('“Show features for web developers”')}\n  ${pintor__rspack_import_8_default().gray('2.')} Safari ▸ Develop ▸ ${pintor__rspack_import_8_default().yellow('Allow Unsigned Extensions')} ${pintor__rspack_import_8_default().gray('(resets each launch)')}\n  ${pintor__rspack_import_8_default().gray('3.')} Safari ▸ Settings ▸ Extensions ▸ turn on ${pintor__rspack_import_8_default().yellow(appName)}\n  ${pintor__rspack_import_8_default().gray('→')} The app window that just opened can also take you there.`;
+            const steps = `${getLoggingPrefix('info')} One-time setup to load ${pintor__rspack_import_8_default().yellow(appName)} in Safari:\n  ${pintor__rspack_import_8_default().gray('1.')} Safari ▸ Settings ▸ Extensions ▸ turn on ${pintor__rspack_import_8_default().yellow(appName)}\n`;
+            if (signed) return steps + `  ${pintor__rspack_import_8_default().gray('→')} Signed with your team id, so the identity is stable for distribution.`;
+            return steps + `  ${pintor__rspack_import_8_default().gray('→')} Ad-hoc signed, so it stays enabled across restarts.`;
         }
         function safariRegistered(appName) {
             return `${getLoggingPrefix('success')} Safari recognizes ${pintor__rspack_import_8_default().yellow(appName)}, finish enabling it with the steps above.`;
@@ -771,7 +775,7 @@ var __webpack_modules__ = {
             return `${getLoggingPrefix('info')} Safari hasn't picked up ${pintor__rspack_import_8_default().yellow(appName)} yet.\nOpen the app once, then check Safari ▸ Settings ▸ Extensions.`;
         }
         function safariRebuilt(appName) {
-            return `${getLoggingPrefix('success')} Rebuilt ${pintor__rspack_import_8_default().yellow(appName)}, reload the page (or toggle the extension) in Safari to see changes.`;
+            return `${getLoggingPrefix('success')} Rebuilt ${pintor__rspack_import_8_default().yellow(appName)}.`;
         }
         function safariProjectStale() {
             return `${getLoggingPrefix('info')} Regenerating the Xcode project, manifest.json or identity options changed since it was generated.`;
@@ -5936,7 +5940,24 @@ var __webpack_modules__ = {
             });
         }
         function converterWarnings(output) {
-            return output.split(/\r?\n/).filter((line)=>/warning/i.test(line)).map((line)=>line.trim()).filter((line)=>line.length > 0);
+            const lines = output.split(/\r?\n/);
+            const collected = [];
+            let inWarning = false;
+            for (const line of lines){
+                const trimmed = line.trim();
+                if (/warning/i.test(line)) {
+                    inWarning = true;
+                    if (trimmed.length > 0) collected.push(trimmed);
+                    continue;
+                }
+                const isContinuation = inWarning && /^\s/.test(line) && trimmed.length > 0;
+                if (isContinuation) {
+                    collected.push(trimmed);
+                    continue;
+                }
+                inWarning = false;
+            }
+            return collected;
         }
         async function confirmRegisteredWithSafari(bundleIdentifier) {
             const needle = `${bundleIdentifier}.Extension`;
@@ -6067,7 +6088,7 @@ var __webpack_modules__ = {
                 if (preservedKeys.length > 0) logger.info?.(messages.oB(preservedKeys));
                 (0, safari_config.x7)(config);
                 logger.info?.(messages.l_(config.projectLocation));
-            } else logger.info?.(messages.oM());
+            } else if ('full' === mode) logger.info?.(messages.oM());
             if ('full' === mode) logger.info?.(messages.jR((0, safari_config.aD)(config)));
             const built = await runTool('xcodebuild', xcodebuildArgs);
             if (!built.ok) {
@@ -6082,7 +6103,7 @@ var __webpack_modules__ = {
             }
             logger.info?.(messages.Rl(appPath));
             if (!config.open) {
-                logger.info?.(messages.aO(appPath, config.appName, isSigned));
+                logger.info?.(messages.aO(appPath, config.appName));
                 if (host.announceDevReady) await announceSafariDevSession(host, config, appPath);
                 return describePackage(config);
             }
@@ -6227,36 +6248,55 @@ var __webpack_modules__ = {
         function manifestFingerprintPath(config) {
             return node_path__rspack_import_1.join(config.projectLocation, '.manifest-fingerprint');
         }
-        function stableStringify(obj) {
-            if (null == obj) return JSON.stringify(obj);
-            if ('object' != typeof obj) return JSON.stringify(obj);
-            if (Array.isArray(obj)) return `[${obj.map(stableStringify).join(',')}]`;
-            const keys = Object.keys(obj).sort();
-            return `{${keys.map((k)=>`${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(',')}}`;
-        }
-        function readManifestRaw(extensionDir) {
+        function topLevelEntries(extensionDir) {
             try {
-                return node_fs__rspack_import_0.readFileSync(node_path__rspack_import_1.join(extensionDir, 'manifest.json'), 'utf8');
+                return node_fs__rspack_import_0.readdirSync(extensionDir).sort();
             } catch  {
-                return '';
+                return [];
             }
         }
-        function normalizeManifest(raw) {
+        function iconsFingerprint(extensionDir) {
             try {
-                return stableStringify(JSON.parse(raw));
+                const raw = node_fs__rspack_import_0.readFileSync(node_path__rspack_import_1.join(extensionDir, 'manifest.json'), 'utf8');
+                const icons = JSON.parse(raw).icons;
+                if (!icons || 'object' != typeof icons) return '';
+                return Object.keys(icons).sort().map((size)=>`${size}:${String(icons[size])}`).join(',');
             } catch  {
-                return raw;
+                return '';
+            }
+        }
+        function asRecord(value) {
+            return value && 'object' == typeof value && !Array.isArray(value) ? value : {};
+        }
+        function judgedManifestSurface(extensionDir) {
+            const manifest = readManifest(extensionDir);
+            const parts = [
+                Object.keys(manifest).sort().join(',')
+            ];
+            for (const listName of [
+                'permissions',
+                'optional_permissions'
+            ]){
+                const list = manifest[listName];
+                const names = Array.isArray(list) ? list.filter((entry)=>'string' == typeof entry).sort() : [];
+                parts.push(`${listName}:${names.join(',')}`);
             }
+            const contentScripts = manifest.content_scripts;
+            if (Array.isArray(contentScripts)) parts.push(contentScripts.map((entry)=>Object.keys(asRecord(entry)).sort().join('+')).join(';'));
+            parts.push(Object.keys(asRecord(manifest.options_ui)).sort().join(','));
+            return parts.join('|');
         }
         function composeProjectFingerprint(config) {
             return JSON.stringify({
-                v: 2,
+                v: 4,
                 identity: {
                     appName: config.appName,
                     bundleId: config.bundleIdentifier,
                     macOsOnly: config.macOsOnly
                 },
-                manifest: normalizeManifest(readManifestRaw(config.extensionDir))
+                entries: topLevelEntries(config.extensionDir),
+                icons: iconsFingerprint(config.extensionDir),
+                judged: judgedManifestSurface(config.extensionDir)
             });
         }
         function saveManifestFingerprint(config) {