@hominis/fireforge 0.27.1 → 0.27.3

package/dist/src/core/ownership-table.js

@@ -28,7 +28,7 @@ import { info } from '../utils/logger.js';
  *   {@link import('../core/patch-lint.js').collectNewFileCreatorsByPath};
  *   paths with a `.length > 1` owner list become duplicate-create conflicts
  */
-export function buildOwnershipTable(manifestPatches, worktreeFiles, newFileCreatorsByPath) {
+export function buildOwnershipTable(manifestPatches, worktreeFiles, newFileCreatorsByPath, classifications = new Map()) {
     const ownersByPath = new Map();
     for (const patch of manifestPatches) {
         for (const file of patch.filesAffected) {
@@ -86,6 +86,13 @@ export function buildOwnershipTable(manifestPatches, worktreeFiles, newFileCreat
             conflict: isFilesAffectedConflict || isDuplicateCreateConflict,
             conflictReason,
             unmanaged: false,
+            state: isFilesAffectedConflict || isDuplicateCreateConflict
+                ? 'conflict'
+                : classifications.get(path) === 'patch-backed'
+                    ? 'patch-backed'
+                    : classifications.get(path) === 'patch-owned-drift'
+                        ? 'patch-owned-drift'
+                        : 'owned',
         });
     }
     for (const path of unmanagedOnly) {
@@ -95,6 +102,7 @@ export function buildOwnershipTable(manifestPatches, worktreeFiles, newFileCreat
             conflict: false,
             conflictReason: null,
             unmanaged: true,
+            state: 'unmanaged',
         });
     }
     rows.sort((a, b) => a.path.localeCompare(b.path));
@@ -115,6 +123,22 @@ function renderConflictCell(row) {
         return 'CONFLICT (dup-create)';
     return 'CONFLICT';
 }
+function renderStateCell(row) {
+    if (row.conflict)
+        return renderConflictCell(row);
+    switch (row.state) {
+        case 'owned':
+            return 'owned';
+        case 'patch-backed':
+            return 'patch-backed';
+        case 'patch-owned-drift':
+            return 'patch-owned drift';
+        case 'unmanaged':
+            return 'unmanaged';
+        case 'conflict':
+            return renderConflictCell(row);
+    }
+}
 /**
  * Renders the ownership table as a GitHub-flavored Markdown pipe table.
  * Using markdown-table's own serializer would require a seed document to
@@ -128,17 +152,17 @@ export function renderOwnershipTable(rows) {
     }
     const pathHeader = 'path';
     const ownerHeader = 'owning patch';
-    const conflictHeader = 'conflict';
+    const stateHeader = 'state';
     const pathWidth = Math.max(pathHeader.length, ...rows.map((r) => r.path.length));
     const ownerWidth = Math.max(ownerHeader.length, ...rows.map((r) => (r.unmanaged ? 1 : r.owners.join(', ').length)));
-    const conflictWidth = Math.max(conflictHeader.length, ...rows.map((r) => renderConflictCell(r).length), 8);
+    const stateWidth = Math.max(stateHeader.length, ...rows.map((r) => renderStateCell(r).length), 8);
     const pad = (text, width) => text + ' '.repeat(width - text.length);
-    info(`| ${pad(pathHeader, pathWidth)} | ${pad(ownerHeader, ownerWidth)} | ${pad(conflictHeader, conflictWidth)} |`);
-    info(`| ${'-'.repeat(pathWidth)} | ${'-'.repeat(ownerWidth)} | ${'-'.repeat(conflictWidth)} |`);
+    info(`| ${pad(pathHeader, pathWidth)} | ${pad(ownerHeader, ownerWidth)} | ${pad(stateHeader, stateWidth)} |`);
+    info(`| ${'-'.repeat(pathWidth)} | ${'-'.repeat(ownerWidth)} | ${'-'.repeat(stateWidth)} |`);
     for (const row of rows) {
         const ownerCell = row.unmanaged ? '-' : row.owners.join(', ');
-        const conflictCell = renderConflictCell(row);
-        info(`| ${pad(row.path, pathWidth)} | ${pad(ownerCell, ownerWidth)} | ${pad(conflictCell, conflictWidth)} |`);
+        const stateCell = renderStateCell(row);
+        info(`| ${pad(row.path, pathWidth)} | ${pad(ownerCell, ownerWidth)} | ${pad(stateCell, stateWidth)} |`);
     }
 }
 //# sourceMappingURL=ownership-table.js.map

package/dist/src/core/patch-export.d.ts

@@ -36,6 +36,8 @@ export interface CommitExportedPatchInput {
     diff: string;
     filesAffected: string[];
     sourceEsrVersion: string;
+    sourceProduct?: FireForgeConfig['firefox']['product'];
+    sourceVersion?: string;
     /** Optional `PatchMetadata.tier` opt-in (only `"branding"` recognised). */
     tier?: 'branding';
     /** Optional `PatchMetadata.lintIgnore` (empty array treated as absent). */
@@ -126,6 +128,8 @@ export interface PlanExportInput {
     description: string;
     filesAffected: string[];
     sourceEsrVersion: string;
+    sourceProduct?: FireForgeConfig['firefox']['product'];
+    sourceVersion?: string;
     /**
      * Optional `PatchMetadata.tier` opt-in carried from the CLI flag.
      * Only `"branding"` is currently recognised. When provided the field

package/dist/src/core/patch-export.js

@@ -75,6 +75,8 @@ export async function commitExportedPatch(input) {
             description: input.description,
             filesAffected: input.filesAffected,
             sourceEsrVersion: input.sourceEsrVersion,
+            ...(input.sourceProduct !== undefined ? { sourceProduct: input.sourceProduct } : {}),
+            ...(input.sourceVersion !== undefined ? { sourceVersion: input.sourceVersion } : {}),
             ...(input.tier !== undefined ? { tier: input.tier } : {}),
             ...(input.lintIgnore !== undefined ? { lintIgnore: input.lintIgnore } : {}),
             ...(input.config !== undefined ? { config: input.config } : {}),
@@ -262,6 +264,8 @@ async function computeExportPlanUnderLock(input) {
         description: input.description,
         createdAt: new Date().toISOString(),
         sourceEsrVersion: input.sourceEsrVersion,
+        ...(input.sourceProduct !== undefined ? { sourceProduct: input.sourceProduct } : {}),
+        sourceVersion: input.sourceVersion ?? input.sourceEsrVersion,
         filesAffected: input.filesAffected,
         ...(input.tier !== undefined ? { tier: input.tier } : {}),
         ...(input.lintIgnore !== undefined && input.lintIgnore.length > 0

package/dist/src/core/patch-manifest-consistency.d.ts

@@ -37,7 +37,7 @@ export interface RebuildPatchesManifestResult {
  * Existing metadata is preserved when possible; missing entries are recovered
  * from filename structure, patch contents, and file mtimes.
  * @param patchesDir - Path to the patches directory
- * @param fallbackSourceEsrVersion - ESR version to use for recovered entries
+ * @param fallbackSourceEsrVersion - source version to use for recovered legacy entries
  * @returns {@link RebuildPatchesManifestResult} — the persisted manifest
  *   plus the filenames that were reconstructed from generic defaults.
  */

package/dist/src/core/patch-manifest-consistency.js

@@ -84,7 +84,7 @@ export async function validatePatchesManifestConsistency(patchesDir) {
  * Existing metadata is preserved when possible; missing entries are recovered
  * from filename structure, patch contents, and file mtimes.
  * @param patchesDir - Path to the patches directory
- * @param fallbackSourceEsrVersion - ESR version to use for recovered entries
+ * @param fallbackSourceEsrVersion - source version to use for recovered legacy entries
  * @returns {@link RebuildPatchesManifestResult} — the persisted manifest
  *   plus the filenames that were reconstructed from generic defaults.
  */
@@ -135,9 +135,11 @@ export async function rebuildPatchesManifest(patchesDir, fallbackSourceEsrVersio
             category: existing?.category ?? inferred.category,
             name: existing?.name ?? inferred.name,
             description: existing?.description ??
-                `Recovered manifest entry for ${patch.filename}. Review description and ESR version.`,
+                `Recovered manifest entry for ${patch.filename}. Review description and source version.`,
             createdAt: existing?.createdAt ?? new Date(patchStats.mtimeMs).toISOString(),
             sourceEsrVersion: existing?.sourceEsrVersion ?? fallbackSourceEsrVersion,
+            sourceVersion: existing?.sourceVersion ?? existing?.sourceEsrVersion ?? fallbackSourceEsrVersion,
+            ...(existing?.sourceProduct !== undefined ? { sourceProduct: existing.sourceProduct } : {}),
             filesAffected,
         };
         if (existing?.lintIgnore !== undefined)

package/dist/src/core/patch-manifest-query.d.ts

@@ -2,6 +2,7 @@
  * Query helpers: finding patches by file, integrity checks, version compat, stamping.
  */
 import type { PatchesManifest, PatchInfo, PatchMetadata } from '../types/commands/index.js';
+import type { FirefoxProduct } from '../types/config.js';
 /**
  * Gets all file paths claimed by patches other than the excluded one.
  * @param manifest - The patches manifest
@@ -10,7 +11,7 @@ import type { PatchesManifest, PatchInfo, PatchMetadata } from '../types/command
  */
 export declare function getClaimedFiles(manifest: PatchesManifest, excludeFilename: string): Set<string>;
 /**
- * Checks ESR version compatibility.
+ * Checks Firefox source version compatibility.
  * @param patchVersion - Version the patch was created for
  * @param currentVersion - Current project version
  * @returns Warning message if versions differ, null if compatible
@@ -39,10 +40,10 @@ export declare function validatePatchIntegrity(patchesDir: string, engineDir: st
     targetFile: string | null;
 }>>;
 /**
- * Stamps multiple patches with a new `sourceEsrVersion` in a single
+ * Stamps multiple patches with a new source version in a single
  * manifest read-modify-write cycle.
  * @param patchesDir - Path to the patches directory
  * @param filenames - Patch filenames to update
  * @param newVersion - Version string to set (e.g. "140.9.0esr")
  */
-export declare function stampPatchVersions(patchesDir: string, filenames: string[], newVersion: string): Promise<void>;
+export declare function stampPatchVersions(patchesDir: string, filenames: string[], newVersion: string, newProduct?: FirefoxProduct): Promise<void>;

package/dist/src/core/patch-manifest-query.js

@@ -25,7 +25,7 @@ export function getClaimedFiles(manifest, excludeFilename) {
     return claimed;
 }
 /**
- * Checks ESR version compatibility.
+ * Checks Firefox source version compatibility.
  * @param patchVersion - Version the patch was created for
  * @param currentVersion - Current project version
  * @returns Warning message if versions differ, null if compatible
@@ -99,21 +99,29 @@ export async function validatePatchIntegrity(patchesDir, engineDir) {
     return issues;
 }
 /**
- * Stamps multiple patches with a new `sourceEsrVersion` in a single
+ * Stamps multiple patches with a new source version in a single
  * manifest read-modify-write cycle.
  * @param patchesDir - Path to the patches directory
  * @param filenames - Patch filenames to update
  * @param newVersion - Version string to set (e.g. "140.9.0esr")
  */
-export async function stampPatchVersions(patchesDir, filenames, newVersion) {
+export async function stampPatchVersions(patchesDir, filenames, newVersion, newProduct) {
     const manifest = await loadPatchesManifest(patchesDir);
     if (!manifest)
         return;
     const filenameSet = new Set(filenames);
     let modified = false;
     for (const patch of manifest.patches) {
-        if (filenameSet.has(patch.filename) && patch.sourceEsrVersion !== newVersion) {
+        if (!filenameSet.has(patch.filename))
+            continue;
+        if (patch.sourceEsrVersion !== newVersion ||
+            patch.sourceVersion !== newVersion ||
+            (newProduct !== undefined && patch.sourceProduct !== newProduct)) {
             patch.sourceEsrVersion = newVersion;
+            patch.sourceVersion = newVersion;
+            if (newProduct !== undefined) {
+                patch.sourceProduct = newProduct;
+            }
             modified = true;
         }
     }

package/dist/src/core/patch-manifest-validate.js

@@ -3,7 +3,7 @@
  * Schema validation for patches.json manifest data.
  */
 import { parseObject } from '../utils/parse.js';
-import { isArray, isObject, isValidFirefoxVersion, PATCH_CATEGORIES } from '../utils/validation.js';
+import { isArray, isObject, isValidFirefoxProduct, isValidFirefoxVersion, PATCH_CATEGORIES, } from '../utils/validation.js';
 function parseForwardImports(data, label) {
     if (!isArray(data)) {
         throw new Error(`${label} must be an array`);
@@ -45,10 +45,25 @@ export function validatePatchMetadata(data, index) {
     const name = rec.string('name');
     const description = rec.string('description');
     const createdAt = rec.string('createdAt');
-    const sourceEsrVersion = rec.string('sourceEsrVersion');
+    const sourceEsrVersion = rec.optionalString('sourceEsrVersion');
+    const sourceVersion = rec.optionalString('sourceVersion') ?? sourceEsrVersion;
+    if (sourceVersion === undefined) {
+        throw new Error(`patches[${index}] must include sourceVersion or legacy sourceEsrVersion`);
+    }
+    const sourceProductRaw = rec.optionalString('sourceProduct');
+    let sourceProduct;
+    if (sourceProductRaw !== undefined) {
+        if (!isValidFirefoxProduct(sourceProductRaw)) {
+            throw new Error(`patches[${index}].sourceProduct must be one of: firefox, firefox-esr, firefox-beta, firefox-devedition`);
+        }
+        sourceProduct = sourceProductRaw;
+    }
     const order = rec.nonNegativeInteger('order');
     const category = rec.validatedString('category', (value) => /^[a-z][a-z0-9-]*$/.test(value), 'a lowercase category identifier (letters, numbers, hyphens)');
-    if (!isValidFirefoxVersion(sourceEsrVersion)) {
+    if (!isValidFirefoxVersion(sourceVersion)) {
+        throw new Error(`patches[${index}].sourceVersion must be a valid Firefox version string`);
+    }
+    if (sourceEsrVersion !== undefined && !isValidFirefoxVersion(sourceEsrVersion)) {
         throw new Error(`patches[${index}].sourceEsrVersion must be a valid Firefox version string`);
     }
     const filesAffected = rec.stringArray('filesAffected');
@@ -78,9 +93,12 @@ export function validatePatchMetadata(data, index) {
         name,
         description,
         createdAt,
-        sourceEsrVersion,
+        sourceEsrVersion: sourceEsrVersion ?? sourceVersion,
+        sourceVersion,
         filesAffected,
     };
+    if (sourceProduct !== undefined)
+        result.sourceProduct = sourceProduct;
     if (lintIgnore !== undefined)
         result.lintIgnore = lintIgnore;
     if (tier !== undefined)

package/dist/src/core/patch-source-metadata.d.ts

@@ -0,0 +1,8 @@
+import type { PatchMetadata } from '../types/commands/index.js';
+import type { FirefoxConfig, FirefoxProduct } from '../types/config.js';
+/** Metadata fields stamped on new or refreshed patch entries. */
+export declare function buildPatchSourceMetadata(firefox: Pick<FirefoxConfig, 'product' | 'version'>): Pick<PatchMetadata, 'sourceEsrVersion' | 'sourceProduct' | 'sourceVersion'>;
+/** Backward-compatible source version reader for legacy manifests. */
+export declare function getPatchSourceVersion(patch: Pick<PatchMetadata, 'sourceEsrVersion' | 'sourceVersion'>): string;
+/** Backward-compatible source product reader for legacy manifests. */
+export declare function getPatchSourceProduct(patch: Pick<PatchMetadata, 'sourceProduct'>): FirefoxProduct | undefined;

package/dist/src/core/patch-source-metadata.js

@@ -0,0 +1,17 @@
+/** Metadata fields stamped on new or refreshed patch entries. */
+export function buildPatchSourceMetadata(firefox) {
+    return {
+        sourceEsrVersion: firefox.version,
+        sourceProduct: firefox.product,
+        sourceVersion: firefox.version,
+    };
+}
+/** Backward-compatible source version reader for legacy manifests. */
+export function getPatchSourceVersion(patch) {
+    return patch.sourceVersion ?? patch.sourceEsrVersion;
+}
+/** Backward-compatible source product reader for legacy manifests. */
+export function getPatchSourceProduct(patch) {
+    return patch.sourceProduct;
+}
+//# sourceMappingURL=patch-source-metadata.js.map

package/dist/src/core/rebase-session.d.ts

@@ -1,9 +1,10 @@
 /**
- * Rebase session persistence for multi-patch ESR version upgrades.
+ * Rebase session persistence for multi-patch Firefox source upgrades.
  * Session state is stored at `.fireforge/rebase-session.json` and
  * survives across CLI invocations so the user can fix conflicts and
  * resume with `fireforge rebase --continue`.
  */
+import type { FirefoxProduct } from '../types/config.js';
 export type RebasePatchStatus = 'pending' | 'applied-clean' | 'applied-fuzz' | 'failed' | 'resolved' | 'skipped';
 export interface RebasePatchEntry {
     filename: string;
@@ -18,9 +19,13 @@ export interface RebasePatchEntry {
 export interface RebaseSession {
     /** ISO timestamp when the rebase started. */
     startedAt: string;
-    /** ESR version being rebased FROM. */
+    /** Source product being rebased FROM. */
+    fromProduct?: FirefoxProduct;
+    /** Source product being rebased TO. */
+    toProduct?: FirefoxProduct;
+    /** Source version being rebased FROM. */
     fromVersion: string;
-    /** ESR version being rebased TO. */
+    /** Source version being rebased TO. */
     toVersion: string;
     /** Commit hash recorded before the rebase started (for --abort). */
     preRebaseCommit: string;

package/dist/src/core/rebase-session.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * Rebase session persistence for multi-patch ESR version upgrades.
+ * Rebase session persistence for multi-patch Firefox source upgrades.
  * Session state is stored at `.fireforge/rebase-session.json` and
  * survives across CLI invocations so the user can fix conflicts and
  * resume with `fireforge rebase --continue`.

package/dist/src/core/status-classify.d.ts

@@ -9,6 +9,9 @@
  * Classification buckets for engine file changes:
  * - `patch-backed`: content matches the expected post-patch state —
  *   normal after `fireforge import`.
+ * - `patch-owned-drift`: the file is claimed by exactly one patch, but
+ *   the live engine content no longer matches that patch's expected
+ *   post-apply content.
  * - `unmanaged`: edits not explained by any patch or tool — local
  *   drift to export or discard.
  * - `branding`: files under tool-managed branding paths, written by
@@ -23,7 +26,7 @@
  *   in `--json`, which misled scripts built on top of the JSON view
  *   into treating the file as routine local drift.
  */
-export type FileClassification = 'patch-backed' | 'unmanaged' | 'branding' | 'furnace' | 'conflict';
+export type FileClassification = 'patch-backed' | 'patch-owned-drift' | 'unmanaged' | 'branding' | 'furnace' | 'conflict';
 export interface StatusFile {
     status: string;
     file: string;

package/dist/src/core/status-classify.js

@@ -123,7 +123,7 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
             const expected = await computePatchedContent(patchesDir, engineDir, entry.file);
             results.push({
                 ...entry,
-                classification: expected === null ? 'patch-backed' : 'unmanaged',
+                classification: expected === null ? 'patch-backed' : 'patch-owned-drift',
             });
             continue;
         }
@@ -135,13 +135,12 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
             ]);
             results.push({
                 ...entry,
-                classification: actual === expected ? 'patch-backed' : 'unmanaged',
+                classification: actual === expected ? 'patch-backed' : 'patch-owned-drift',
             });
         }
         catch (error) {
-            verbose(`Treating ${entry.file} as unmanaged because patch-backed classification failed: ${toError(error).message}`);
-            // If we can't read the file, treat as unmanaged
-            results.push({ ...entry, classification: 'unmanaged' });
+            verbose(`Treating ${entry.file} as patch-owned drift because patch-backed classification failed: ${toError(error).message}`);
+            results.push({ ...entry, classification: 'patch-owned-drift' });
         }
     }
     return results;

package/dist/src/errors/download.d.ts

@@ -1,3 +1,4 @@
+import type { FirefoxProduct } from '../types/config.js';
 import { FireForgeError } from './base.js';
 /**
  * Error thrown when Firefox source download fails.
@@ -8,6 +9,16 @@ export declare class DownloadError extends FireForgeError {
     constructor(message: string, url?: string | undefined, cause?: Error);
     get userMessage(): string;
 }
+/**
+ * Error thrown when a pinned Firefox source archive checksum does not match.
+ */
+export declare class ChecksumMismatchError extends DownloadError {
+    readonly product: FirefoxProduct;
+    readonly expectedSha256: string;
+    readonly actualSha256: string;
+    constructor(product: FirefoxProduct, expectedSha256: string, actualSha256: string, url: string);
+    get userMessage(): string;
+}
 /**
  * Error thrown when extraction of the downloaded archive fails.
  */

package/dist/src/errors/download.js

@@ -1,4 +1,3 @@
-// SPDX-License-Identifier: EUPL-1.2
 import { FireForgeError } from './base.js';
 import { ExitCode } from './codes.js';
 /**
@@ -23,6 +22,39 @@ export class DownloadError extends FireForgeError {
         return msg;
     }
 }
+/**
+ * Error thrown when a pinned Firefox source archive checksum does not match.
+ */
+export class ChecksumMismatchError extends DownloadError {
+    product;
+    expectedSha256;
+    actualSha256;
+    constructor(product, expectedSha256, actualSha256, url) {
+        super(`Downloaded archive SHA-256 mismatch: expected ${expectedSha256}, got ${actualSha256}`, url);
+        this.product = product;
+        this.expectedSha256 = expectedSha256;
+        this.actualSha256 = actualSha256;
+    }
+    get userMessage() {
+        let msg = `Download Error: Firefox source archive checksum mismatch.\n\n` +
+            `Product: ${this.product}\n` +
+            `URL: ${this.url}\n` +
+            `Expected SHA-256: ${this.expectedSha256}\n` +
+            `Actual SHA-256: ${this.actualSha256}`;
+        msg += '\n\nTo fix this:\n';
+        msg += '  1. Verify firefox.product, firefox.version, and firefox.sha256 in fireforge.json\n';
+        msg += '  2. Compare the pinned hash with Mozilla SHA256SUMMARY for the resolved archive\n';
+        if (this.product === 'firefox-devedition') {
+            msg +=
+                '  3. Developer Edition archives should resolve under https://archive.mozilla.org/pub/devedition/releases/\n';
+            msg += '  4. Re-run "fireforge download --force" after correcting the source settings';
+        }
+        else {
+            msg += '  3. Re-run "fireforge download --force" after correcting the source settings';
+        }
+        return msg;
+    }
+}
 /**
  * Error thrown when extraction of the downloaded archive fails.
  */

package/dist/src/types/commands/patches.d.ts

@@ -1,6 +1,7 @@
 /**
  * Types for the patch system: patch metadata, manifests, lint, and import results.
  */
+import type { FirefoxProduct } from '../config.js';
 /**
  * Patch categories for organizational classification.
  */
@@ -47,8 +48,15 @@ export interface PatchMetadata {
     description: string;
     /** ISO timestamp of when the patch was created */
     createdAt: string;
-    /** ESR version the patch was created against (e.g., "140.9.0esr") */
+    /**
+     * Deprecated compatibility alias for the source version the patch was
+     * created against. New writes also include `sourceVersion`.
+     */
     sourceEsrVersion: string;
+    /** Firefox source product the patch was created against. */
+    sourceProduct?: FirefoxProduct;
+    /** Firefox source version the patch was created against. */
+    sourceVersion?: string;
     /** Array of file paths affected by this patch */
     filesAffected: string[];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.27.1",
+  "version": "0.27.3",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",