chore(deps): upgrade wxt to 0.21.2 and refresh security overrides

WXT 0.21 drops its bundled web-ext-run fork and takes web-ext, vite and
typescript as peer dependencies instead, so vite joins devDependencies
explicitly. web-ext and typescript were already direct devDependencies.

Migration work the 0.21 breaking changes required:

- The `wxt/testing` barrel export is gone. The fake browser and the Vitest
  plugin now come from `wxt/testing/fake-browser` and
  `wxt/testing/vitest-plugin`.

- The generated .wxt/tsconfig.json enables verbatimModuleSyntax,
  noUncheckedIndexedAccess and noImplicitOverride. Kept those rather than
  reverting them through the prepare:tsconfig hook, which took 19 fixes:
  three type-only imports, two `override` modifiers, and guards where an
  array or record lookup genuinely can be undefined. FALLBACK_ADAPTER
  needs a non-null assertion because ADAPTERS is indexed by a computed
  expression; it is a non-empty const tuple, so the element always exists.

- Sources zips are now `includeSources - excludeSources` and honour
  .gitignore, so stale dist/ and web-ext-artifacts/ output stops shipping
  to AMO. .gitignore did not cover CLAUDE.local.md (ignored globally, and
  symlinked into every worktree) or coverage/, which is now gitignored.

Security overrides, re-checked against each alert and each parent's
declared range:

- yauzl has a patched release now, closing the advisory #137 had to leave
  open. Scoped to the 3.x line: only 3.2.0 is affected, and addons-linter
  separately pulls an unaffected 2.10.0.

- shell-quote floor raised 1.8.5 -> 1.9.0. GHSA-395f-4hp3-45gv is patched
  in 1.9.0, so the old floor no longer covered the advisory it was for.

- brace-expansion pinned per major (1.1.17 / 2.1.3 / 5.0.8). A single
  >=5.0.8 floor collapses every consumer onto v5, which minimatch v9
  cannot call ("brace_expansion_1.default is not a function"), breaking
  `vitest run --coverage`. GHSA-mh99-v99m-4gvg is ignored via auditConfig
  because its single collapsed `<=5.0.7` range keeps matching the 1.x and
  2.x backports; both tarballs were unpacked and confirmed to carry the
  EXPANSION_MAX_LENGTH fix.

- yaml override dropped. It only ever arrived via web-ext-run, and
  nothing pulls it in now except vite's optional peer, which is not
  installed.

svelte, svelte-check and @playwright/test picked up in-range releases.
The majors left outstanding are the ones #137 deliberately held back
(vite 8, @sveltejs/vite-plugin-svelte 7, vitest 4) plus jsdom,
@types/node, prettier-plugin-svelte, typescript 7 and web-ext 10.

Verified: 87 unit tests, a coverage run, svelte-check, prettier, web-ext
lint (0 errors, same 5 warnings as dev), chrome and firefox builds, both
zips, and `pnpm install --frozen-lockfile`.

0.21 raises the Node floor to 22, so the README prerequisite (which said
18+) is now wrong in the source package AMO reviewers build from, and
package.json gained a matching `engines.node` so a wrong runtime fails
fast instead of midway through the build.

Reproducibility checked the way AMO checks it: extracting the sources zip
into a clean directory and running install + zip:firefox there produces
generated files that diff clean against the shipped build, all 14 file
hashes equal. The zip containers differ by 36 bytes, which are the DOS
timestamp fields in each entry header; the same is true of two
back-to-back builds on 0.20, so it is not a regression here.

The rest of the README was audited against the actual scripts while it was
open: the Android example passed `--s`, which the flag parser does not
accept (it takes `-s` or `--source-dir`); zip/test commands were not
documented at all; and the browser-startup section covered only
web-ext.config.ts, not the .webextrc file WXT also loads. `pnpm lint` was
broken outright — it ran `pnpm build`, which emits chrome-mv3, and then
linted .output/firefox-mv2, so on a clean checkout it failed with a
missing-directory error. It builds firefox now.

Author: Seismix

.gitignore

@@ -7,6 +7,7 @@ dist
 /playwright-report/
 /blob-report/
 /playwright/.cache/
+/coverage/
 web-ext-artifacts
 .env
 **repomix**.txt

README.md

@@ -30,7 +30,7 @@ about what happened in the last chapter of the story I just opened. More and mor
 chapter and scroll all the way down just to re-read the last few paragraphs as a refresher. This is especially annoying
 while on mobile, where I often read while on the train.
 
-That's when decided on trying to implement this little idea implementing a refresh of what happened in the last chapter.
+That's when I decided on trying to implement this little idea — a refresh of what happened in the last chapter.
 
 ## What is it?
 
@@ -92,7 +92,7 @@ marked with the `contributions welcome` label.
 
 ### Prerequisites
 
-- Node.js (version 18 or higher)
+- Node.js (version 22 or higher, required by WXT 0.21)
 - pnpm (package manager)
 
 ### Installation
@@ -127,7 +127,7 @@ connected with USB debugging enabled. You can pass additional `web-ext run` flag
 pnpm dev:android <device-id>
 
 # With custom source directory
-pnpm dev:android <device-id> --s ./custom-output
+pnpm dev:android <device-id> -s ./custom-output
 
 # With additional web-ext flags
 pnpm dev:android <device-id> --adb-remove-old-artifacts
@@ -150,6 +150,48 @@ To build specifically for Firefox:
 pnpm build:firefox
 ```
 
+Both write to `.output/`. To produce the store-ready archives instead:
+
+```bash
+pnpm zip
+pnpm zip:firefox
+```
+
+`pnpm zip:firefox` also emits `royalrefresh-<version>-sources.zip`, the source
+archive AMO requires alongside the add-on. Reviewers rebuild from it, so it has
+to install and build on its own: unpack it into an empty directory and run
+`pnpm install --frozen-lockfile && pnpm zip:firefox` there before submitting.
+
+### Testing
+
+Unit and component tests (Vitest, jsdom):
+
+```bash
+pnpm test:unit
+```
+
+End-to-end tests, which load the built extension into a real browser against a
+mocked RoyalRoad:
+
+```bash
+pnpm test
+```
+
+The canary suite checks the CSS selectors against the live site — this is what
+catches a RoyalRoad redesign:
+
+```bash
+pnpm test:canary
+```
+
+Type checking, add-on linting and formatting:
+
+```bash
+pnpm check
+pnpm lint
+pnpm format
+```
+
 ### Browser Configuration
 
 You can configure browser startup options using `web-ext.config.ts` files. For more information, see WXT's
@@ -161,7 +203,7 @@ For example, to set custom browser binaries or startup URLs, create a `web-ext.c
 import { defineWebExtConfig } from 'wxt';
 
 export default defineWebExtConfig({
-  startUrl: [
+  startUrls: [
     "https://www.royalroad.com/",
     "about:addons"
   ],
@@ -171,4 +213,9 @@ export default defineWebExtConfig({
 });
 ```
 
+The file is gitignored, so it stays machine-local — a fresh clone does not have
+one. WXT reads the same options from `$HOME/web-ext.config.ts` as well, as
+global defaults for every WXT project, which is handy if you keep several
+checkouts of this repo around.
+
 For a full list of options, see the [web-ext command reference](https://extensionworkshop.com/documentation/develop/web-ext-command-reference/).

package.json

@@ -7,6 +7,9 @@
         "doc": "docs"
     },
     "type": "module",
+    "engines": {
+        "node": ">=22"
+    },
     "scripts": {
         "dev": "wxt",
         "dev:firefox": "wxt -b firefox",
@@ -18,7 +21,7 @@
         "check": "svelte-check --tsconfig ./tsconfig.json",
         "chrome:token": "node scripts/chrome-refresh-token.ts",
         "postinstall": "wxt prepare",
-        "lint": "pnpm build && web-ext lint --source-dir .output/firefox-mv2",
+        "lint": "pnpm build:firefox && web-ext lint --source-dir .output/firefox-mv2",
         "test": "playwright test --project=e2e --reporter=list",
         "test:ui": "playwright test --ui",
         "test:detailed": "playwright test --project=e2e",
@@ -48,7 +51,7 @@
     },
     "homepage": "https://github.com/Seismix/royalrefresh#readme",
     "devDependencies": {
-        "@playwright/test": "^1.61.1",
+        "@playwright/test": "^1.62.0",
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@testing-library/jest-dom": "^6.10.0",
         "@testing-library/svelte": "^5.4.2",
@@ -60,13 +63,14 @@
         "jsdom": "^29.1.1",
         "prettier": "^3.9.6",
         "prettier-plugin-svelte": "^3.5.2",
-        "svelte": "^5.56.7",
-        "svelte-check": "^4.7.3",
+        "svelte": "^5.56.8",
+        "svelte-check": "^4.7.4",
         "tslib": "^2.8.1",
         "typescript": "^5.9.3",
+        "vite": "^7.3.6",
         "vitest": "^3.2.7",
         "web-ext": "^9.4.0",
-        "wxt": "^0.20.27"
+        "wxt": "^0.21.2"
     },
     "dependencies": {
         "dompurify": "^3.4.12"