@hominis/fireforge 0.34.2 → 0.36.0

package/dist/src/core/firefox-cache.js

@@ -9,8 +9,8 @@ import { join } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { ChecksumMismatchError } from '../errors/download.js';
 import { toError } from '../utils/errors.js';
-import { pathExists, readJson, removeFile, writeJson } from '../utils/fs.js';
-import { verbose } from '../utils/logger.js';
+import { pathExistsStrict, readJson, removeFile, writeJson } from '../utils/fs.js';
+import { verbose, warn } from '../utils/logger.js';
 import { createSiblingLockPath, withFileLock } from './file-lock.js';
 import { validateArchiveMetadata } from './firefox-archive.js';
 import { downloadFile } from './firefox-download.js';
@@ -24,6 +24,39 @@ async function sha256File(filePath) {
     await pipeline(stream, hash);
     return hash.digest('hex');
 }
+/**
+ * Fetches Mozilla's published SHA256SUMS for the release and extracts the
+ * digest for this archive. Returns null when the checksum file cannot be
+ * fetched or does not list the archive — the caller warns loudly and
+ * continues (offline mirrors and staging hosts legitimately lack it), while
+ * a FETCHED-but-mismatching digest always fails closed.
+ *
+ * Line format (both variants appear in the wild):
+ *   `<64-hex-digest>  <release-relative-path>`
+ *   `<64-hex-digest> *<release-relative-path>`
+ */
+async function fetchPublishedSha256(archive) {
+    try {
+        const response = await fetch(archive.checksumsUrl);
+        if (!response.ok) {
+            verbose(`SHA256SUMS fetch returned HTTP ${String(response.status)} for ${archive.checksumsUrl}`);
+            return null;
+        }
+        const body = await response.text();
+        for (const line of body.split('\n')) {
+            const match = /^([0-9a-f]{64})\s+\*?(.+)$/.exec(line.trim());
+            if (match?.[1] && match[2] === archive.pathInChecksums) {
+                return match[1];
+            }
+        }
+        verbose(`SHA256SUMS at ${archive.checksumsUrl} does not list ${archive.pathInChecksums}`);
+        return null;
+    }
+    catch (error) {
+        verbose(`SHA256SUMS fetch failed for ${archive.checksumsUrl}: ${toError(error).message}`);
+        return null;
+    }
+}
 /**
  * Ensures a valid cached archive exists, downloading it if needed.
  * @param archive - Resolved archive descriptor
@@ -49,8 +82,8 @@ export async function ensureCachedArchive(archive, cacheDir, onProgress, expecte
     });
 }
 async function cacheEntryExists(archive, cacheDir) {
-    return ((await pathExists(join(cacheDir, archive.filename))) ||
-        (await pathExists(join(cacheDir, archive.metadataFilename))));
+    return ((await pathExistsStrict(join(cacheDir, archive.filename))) ||
+        (await pathExistsStrict(join(cacheDir, archive.metadataFilename))));
 }
 /**
  * Validates a cached archive using sidecar metadata and SHA-256 checksum.
@@ -61,7 +94,10 @@ async function cacheEntryExists(archive, cacheDir) {
 async function validateCachedArchive(archive, cacheDir, expectedSha256) {
     const tarballPath = join(cacheDir, archive.filename);
     const metadataPath = join(cacheDir, archive.metadataFilename);
-    if (!(await pathExists(tarballPath)) || !(await pathExists(metadataPath))) {
+    // Deliberately outside the try/catch below: a permission error probing the
+    // cache must propagate instead of reading as "invalid cache" and triggering
+    // a re-download into a directory we cannot write anyway.
+    if (!(await pathExistsStrict(tarballPath)) || !(await pathExistsStrict(metadataPath))) {
         return false;
     }
     try {
@@ -114,8 +150,32 @@ async function downloadToCache(archive, cacheDir, onProgress, expectedSha256, on
         promotedTarball = true;
         onCacheProgress?.(`Calculating source archive SHA-256 for ${archive.filename}...`);
         const sha256 = await sha256File(tarballPath);
-        if (expectedSha256 && sha256 !== expectedSha256) {
-            throw new ChecksumMismatchError(archive.product, expectedSha256, sha256, archive.url);
+        if (expectedSha256) {
+            // Operator-pinned digest (firefox.sha256 config): takes precedence
+            // and always fails closed.
+            if (sha256 !== expectedSha256) {
+                throw new ChecksumMismatchError(archive.product, expectedSha256, sha256, archive.url);
+            }
+        }
+        else {
+            // Default integrity check: verify against Mozilla's published
+            // SHA256SUMS. TLS alone is thin trust for the artifact that becomes
+            // the git baseline every patch is built on — a compromised CDN
+            // response would otherwise be trusted with no signal. Mismatch fails
+            // closed (the catch below deletes the artifact); an unfetchable
+            // SHA256SUMS degrades to a loud warning so offline/mirror workflows
+            // keep working (pin firefox.sha256 in fireforge.json to fail closed
+            // even then).
+            onCacheProgress?.(`Verifying archive against published SHA256SUMS...`);
+            const publishedSha256 = await fetchPublishedSha256(archive);
+            if (publishedSha256 === null) {
+                warn(`Could not verify ${archive.filename} against Mozilla's published SHA256SUMS ` +
+                    `(${archive.checksumsUrl} unavailable). The download is trusted on TLS alone — ` +
+                    'set firefox.sha256 in fireforge.json to require checksum verification.');
+            }
+            else if (sha256 !== publishedSha256) {
+                throw new ChecksumMismatchError(archive.product, publishedSha256, sha256, archive.url);
+            }
         }
         onCacheProgress?.(`Writing source archive cache metadata for ${archive.metadataFilename}...`);
         await writeJson(metadataPath, {
@@ -164,4 +224,3 @@ async function removeArchivePartFiles(archive, cacheDir) {
         // Cache dir may not exist yet — that's fine.
     }
 }
-//# sourceMappingURL=firefox-cache.js.map

package/dist/src/core/firefox-download.js

@@ -134,4 +134,3 @@ export async function downloadFile(url, destPath, onProgress) {
     }
     return totalSize > 0 ? totalSize : undefined;
 }
-//# sourceMappingURL=firefox-download.js.map

package/dist/src/core/firefox-extract.d.ts

@@ -2,7 +2,27 @@
  * Firefox source extraction and installed version detection.
  */
 /**
- * Extracts a tar.xz archive.
+ * Validates entry names from a `tar -tf` listing.
+ * @param names - Listing lines (one member name per line)
+ * @returns The first unsafe member name, or null when all are safe
+ */
+export declare function findUnsafeArchiveEntryName(names: readonly string[]): string | null;
+/**
+ * Validates symlink and hardlink targets from a `tar -tvf` listing.
+ *
+ * A relative link target without `..` segments can only resolve inside the
+ * extraction root, so only absolute or `..`-containing targets are rejected.
+ * Symlinks are `l`-typed lines with a ` -> target` suffix (the LAST arrow is
+ * taken, so a link whose own name contains ` -> ` still parses to its real
+ * target); hardlinks print ` link to target` on GNU tar and bsdtar alike.
+ *
+ * @param verboseLines - `tar -tvf` listing lines
+ * @returns A description of the first unsafe link found, or null
+ */
+export declare function findUnsafeArchiveLink(verboseLines: readonly string[]): string | null;
+/**
+ * Extracts a tar.xz archive after a listing preflight that rejects
+ * path-traversal member names and escaping link targets.
  * @param archivePath - Path to the archive
  * @param destDir - Destination directory
  */

package/dist/src/core/firefox-extract.js

@@ -6,9 +6,173 @@ import { join } from 'node:path';
 import { ExtractionError } from '../errors/download.js';
 import { elapsedSince } from '../utils/elapsed.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
-import { exec, executableExists } from '../utils/process.js';
+import { exec, execStream, executableExists } from '../utils/process.js';
 /**
- * Extracts a tar.xz archive.
+ * Returns true when an archive member path could land outside the
+ * extraction root: absolute (POSIX or Windows drive/backslash rooted) or
+ * containing a `..` segment.
+ */
+function isUnsafeArchivePath(path) {
+    if (path.startsWith('/') || path.startsWith('\\'))
+        return true;
+    if (/^[A-Za-z]:[\\/]/.test(path))
+        return true;
+    return path.split(/[\\/]/).includes('..');
+}
+/**
+ * Validates entry names from a `tar -tf` listing.
+ * @param names - Listing lines (one member name per line)
+ * @returns The first unsafe member name, or null when all are safe
+ */
+export function findUnsafeArchiveEntryName(names) {
+    for (const raw of names) {
+        const name = raw.trim();
+        if (name.length === 0)
+            continue;
+        if (isUnsafeArchivePath(name))
+            return name;
+    }
+    return null;
+}
+/**
+ * Validates symlink and hardlink targets from a `tar -tvf` listing.
+ *
+ * A relative link target without `..` segments can only resolve inside the
+ * extraction root, so only absolute or `..`-containing targets are rejected.
+ * Symlinks are `l`-typed lines with a ` -> target` suffix (the LAST arrow is
+ * taken, so a link whose own name contains ` -> ` still parses to its real
+ * target); hardlinks print ` link to target` on GNU tar and bsdtar alike.
+ *
+ * @param verboseLines - `tar -tvf` listing lines
+ * @returns A description of the first unsafe link found, or null
+ */
+export function findUnsafeArchiveLink(verboseLines) {
+    for (const line of verboseLines) {
+        if (line.startsWith('l')) {
+            const arrow = line.lastIndexOf(' -> ');
+            if (arrow !== -1) {
+                const target = line.slice(arrow + 4).trim();
+                if (isUnsafeArchivePath(target))
+                    return `symlink target: ${target}`;
+                continue;
+            }
+        }
+        const hardlink = line.lastIndexOf(' link to ');
+        if (hardlink !== -1) {
+            const target = line.slice(hardlink + 9).trim();
+            if (isUnsafeArchivePath(target))
+                return `hardlink target: ${target}`;
+        }
+    }
+    return null;
+}
+/**
+ * Lists the archive and rejects members that could escape the extraction
+ * root before anything is written to disk: absolute names, `..` traversal,
+ * and symlink/hardlink targets that are absolute or `..`-escaping. Modern
+ * GNU tar / bsdtar refuse most of these at extraction time; the preflight
+ * makes the guarantee explicit and independent of the host tar's defaults.
+ *
+ * Two listings are needed because they answer different questions and
+ * neither is safe to derive from the other: member names come from `-tf`,
+ * where the whole line IS the name, while link targets only appear in
+ * `-tvf`. Names are deliberately NOT parsed out of the `-tvf` columns — the
+ * adjacent uname/gname fields are attacker-controlled in a crafted archive,
+ * so a date-shaped owner name could shift the column boundary and hide an
+ * absolute member name from the check. Each listing pass costs one full
+ * decompression, so the two run concurrently and overlap almost perfectly
+ * (they are CPU-bound on separate cores). Measured on a real Firefox ESR
+ * 140.9 source tarball (601 MB, bsdtar 3.5.3, macOS): -tf 21.7 s, -tvf
+ * 22.1 s, both concurrent 22 s wall, extraction itself 58 s (file-creation
+ * syscalls dominate it, not decompression) — so the preflight adds ~22 s
+ * (~38%) to this one-time extraction step, versus ~44 s if run
+ * sequentially.
+ */
+/**
+ * Incremental line splitter for streamed listings. Keeps only the current
+ * partial line in memory, so a 350k-entry Firefox listing costs O(longest
+ * line), not O(listing).
+ */
+function createLineScanner(onLine) {
+    let buffer = '';
+    return {
+        push(chunk) {
+            buffer += chunk;
+            let idx;
+            while ((idx = buffer.indexOf('\n')) !== -1) {
+                onLine(buffer.slice(0, idx));
+                buffer = buffer.slice(idx + 1);
+            }
+        },
+        flush() {
+            if (buffer.length > 0) {
+                onLine(buffer);
+                buffer = '';
+            }
+        },
+    };
+}
+/**
+ * Runs one tar listing pass, streaming lines through `checkLine` and
+ * returning the first unsafe finding (or null) plus the exit code.
+ *
+ * Streaming matters for safety, not just memory: the buffered `exec`
+ * collector silently truncates at 50 MB, and a full Firefox `-tvf` listing
+ * already sits in the 40–50 MB range — so the buffered implementation could
+ * scan only the head of the listing while reporting the archive safe. A
+ * crafted archive could exploit exactly that by padding benign entries
+ * first and hiding a traversal name or absolute link target past the cap.
+ * With per-line streaming EVERY entry is scanned, with bounded memory.
+ */
+async function runListingScan(archivePath, tarFlag, checkLine) {
+    // LC_ALL=C keeps the -tvf column format stable for the link parse.
+    const listEnv = { LC_ALL: 'C', LANG: 'C' };
+    let unsafe = null;
+    let stderrTail = '';
+    const scanner = createLineScanner((line) => {
+        if (unsafe === null) {
+            unsafe = checkLine(line);
+        }
+    });
+    const exitCode = await execStream('tar', [tarFlag, archivePath], {
+        env: listEnv,
+        onStdout: (chunk) => {
+            scanner.push(chunk);
+        },
+        onStderr: (chunk) => {
+            // Keep a small diagnostic tail; the listing itself is the big stream.
+            stderrTail = (stderrTail + chunk).slice(-4096);
+        },
+    });
+    scanner.flush();
+    return { unsafe, exitCode, stderrTail };
+}
+async function preflightArchiveEntries(archivePath) {
+    const [nameScan, linkScan] = await Promise.all([
+        runListingScan(archivePath, '-tf', (line) => {
+            const name = line.trim();
+            if (name.length === 0)
+                return null;
+            return isUnsafeArchivePath(name) ? name : null;
+        }),
+        runListingScan(archivePath, '-tvf', (line) => findUnsafeArchiveLink([line])),
+    ]);
+    if (nameScan.exitCode !== 0) {
+        throw new ExtractionError(archivePath, new Error(`tar -tf preflight exited with code ${nameScan.exitCode}:\n${nameScan.stderrTail}`));
+    }
+    if (nameScan.unsafe !== null) {
+        throw new ExtractionError(archivePath, new Error(`Archive rejected: member name could escape the extraction root: ${nameScan.unsafe}`));
+    }
+    if (linkScan.exitCode !== 0) {
+        throw new ExtractionError(archivePath, new Error(`tar -tvf preflight exited with code ${linkScan.exitCode}:\n${linkScan.stderrTail}`));
+    }
+    if (linkScan.unsafe !== null) {
+        throw new ExtractionError(archivePath, new Error(`Archive rejected: link could escape the extraction root (${linkScan.unsafe})`));
+    }
+}
+/**
+ * Extracts a tar.xz archive after a listing preflight that rejects
+ * path-traversal member names and escaping link targets.
  * @param archivePath - Path to the archive
  * @param destDir - Destination directory
  */
@@ -18,18 +182,24 @@ export async function extractTarXz(archivePath, destDir, onProgress) {
     }
     await ensureDir(destDir);
     const startedAt = Date.now();
-    onProgress?.(`Extracting source archive (${elapsedSince(startedAt)} elapsed)...`);
+    onProgress?.(`Validating source archive entries (${elapsedSince(startedAt)} elapsed)...`);
     const heartbeat = onProgress
         ? setInterval(() => {
             onProgress(`Extracting source archive (${elapsedSince(startedAt)} elapsed)...`);
         }, 15_000)
         : null;
     heartbeat?.unref();
-    const result = await exec('tar', ['-xf', archivePath, '-C', destDir]);
-    if (heartbeat)
-        clearInterval(heartbeat);
-    if (result.exitCode !== 0) {
-        throw new ExtractionError(archivePath, new Error(`tar exited with code ${result.exitCode}:\n${result.stderr}`));
+    try {
+        await preflightArchiveEntries(archivePath);
+        onProgress?.(`Extracting source archive (${elapsedSince(startedAt)} elapsed)...`);
+        const result = await exec('tar', ['-xf', archivePath, '-C', destDir]);
+        if (result.exitCode !== 0) {
+            throw new ExtractionError(archivePath, new Error(`tar exited with code ${result.exitCode}:\n${result.stderr}`));
+        }
+    }
+    finally {
+        if (heartbeat)
+            clearInterval(heartbeat);
     }
     onProgress?.(`Source archive extracted (${elapsedSince(startedAt)} elapsed)`);
 }
@@ -62,4 +232,3 @@ export function formatBytes(bytes) {
     }
     return `${size.toFixed(1)} ${units[unitIndex]}`;
 }
-//# sourceMappingURL=firefox-extract.js.map

package/dist/src/core/firefox-ignorefile.js

@@ -28,4 +28,3 @@ export async function ensureFirefoxIgnorefileCompatibility(engineDir) {
     await writeText(hgignorePath, await readText(gitignorePath));
     return 'created';
 }
-//# sourceMappingURL=firefox-ignorefile.js.map

package/dist/src/core/firefox.d.ts

@@ -35,6 +35,18 @@ export type FirefoxSourcePhase = 'download' | 'extract';
 /** Callback fired at phase transitions during {@link downloadFirefoxSource}. */
 export type FirefoxSourcePhaseCallback = (phase: FirefoxSourcePhase) => void;
 export type FirefoxSourceProgressCallback = (message: string) => void;
+/**
+ * Sweeps orphaned working directories left behind by interrupted downloads
+ * (`<engine>.tmp-*` from extraction, `<engine>.replacement-*` from --force
+ * replacement). Both hold multi-GB partial trees, are worthless after the
+ * owning process died, and nothing else ever reclaimed them. Deliberately
+ * does NOT touch `<engine>.backup-*`: a backup may hold the operator's
+ * previous engine after a failed forced replacement and is their recovery
+ * copy — callers should surface its existence instead.
+ *
+ * @returns names of the directories that were removed
+ */
+export declare function sweepOrphanedEngineWorkDirs(destDir: string): Promise<string[]>;
 /**
  * Downloads and extracts Firefox source.
  * @param version - Firefox version to download

package/dist/src/core/firefox.js

@@ -33,6 +33,63 @@ export function getDownloadUrl(version, product = 'firefox') {
 export function getTarballFilename(version, product = 'firefox') {
     return resolveArchive(version, product).filename;
 }
+/**
+ * Classifies an extraction failure as archive corruption (invalidate the
+ * cache and re-download) versus an environmental problem (keep the cached
+ * archive; the retry can reuse it). Environmental signatures are the
+ * conservative list — anything unrecognized is treated as corruption so a
+ * genuinely bad archive can never survive in the cache.
+ */
+function isLikelyArchiveCorruptionError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error instanceof Error ? error.code : undefined;
+    if (code === 'ENOSPC' || code === 'EACCES' || code === 'EPERM' || code === 'EDQUOT') {
+        return false;
+    }
+    if (/No space left on device|Permission denied|Disk quota exceeded/i.test(message)) {
+        return false;
+    }
+    // Missing tar binary / preflight refusing an unsafe archive both carry
+    // ExtractionError text that names the condition; a missing tar is
+    // environmental, an unsafe-entry rejection indicts the archive.
+    if (/"tar" command was not found/i.test(message)) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Sweeps orphaned working directories left behind by interrupted downloads
+ * (`<engine>.tmp-*` from extraction, `<engine>.replacement-*` from --force
+ * replacement). Both hold multi-GB partial trees, are worthless after the
+ * owning process died, and nothing else ever reclaimed them. Deliberately
+ * does NOT touch `<engine>.backup-*`: a backup may hold the operator's
+ * previous engine after a failed forced replacement and is their recovery
+ * copy — callers should surface its existence instead.
+ *
+ * @returns names of the directories that were removed
+ */
+export async function sweepOrphanedEngineWorkDirs(destDir) {
+    const { readdir } = await import('node:fs/promises');
+    const { basename, dirname } = await import('node:path');
+    const parent = dirname(destDir);
+    const enginePrefixTmp = `${basename(destDir)}.tmp-`;
+    const enginePrefixReplacement = `${basename(destDir)}.replacement-`;
+    let entries;
+    try {
+        entries = await readdir(parent);
+    }
+    catch {
+        return [];
+    }
+    const removed = [];
+    for (const name of entries) {
+        if (name.startsWith(enginePrefixTmp) || name.startsWith(enginePrefixReplacement)) {
+            await removeDir(join(parent, name));
+            removed.push(name);
+        }
+    }
+    return removed;
+}
 /**
  * Downloads and extracts Firefox source.
  * @param version - Firefox version to download
@@ -60,7 +117,13 @@ export async function downloadFirefoxSource(version, product, destDir, cacheDir,
     }
     catch (error) {
         await removeDir(tempDir);
-        await invalidateArchiveCache(archive, cacheDir);
+        // Only throw away the ~600 MB cached archive when the failure indicts
+        // the ARCHIVE, not the environment. ENOSPC, a permission problem in
+        // destDir, or tar disappearing mid-run used to invalidate a perfectly
+        // good download and force a full re-fetch on retry.
+        if (isLikelyArchiveCorruptionError(error)) {
+            await invalidateArchiveCache(archive, cacheDir);
+        }
         throw error;
     }
     // Firefox source extracts to a subdirectory (e.g., firefox-140.0/)
@@ -80,4 +143,3 @@ export async function downloadFirefoxSource(version, product, destDir, cacheDir,
         await rename(tempDir, destDir);
     }
 }
-//# sourceMappingURL=firefox.js.map

package/dist/src/core/furnace-apply-dry-run.js

@@ -102,4 +102,3 @@ export async function buildCustomDryRunActions(name, componentDir, engineDir, co
     }
     return { actions, stepErrors };
 }
-//# sourceMappingURL=furnace-apply-dry-run.js.map

package/dist/src/core/furnace-apply-ftl.d.ts

@@ -4,9 +4,13 @@
  * per-file LOC budget.
  *
  * Every helper here degrades gracefully: if the locale jar.mn is missing or
- * the FTL tree is non-standard, apply logs a `stepError` rather than
- * aborting the whole command. Missing jar.mn on a fork without a locale
- * package should not block a working `.mjs`/`.css` from shipping.
+ * the FTL tree is non-standard, apply logs an ADVISORY `stepError`
+ * (`advisory: true`) rather than aborting the whole command. Advisory step
+ * errors are reported as warnings and never trigger rollback — missing
+ * jar.mn on a fork without a locale package should not block a working
+ * `.mjs`/`.css` from shipping (the blocking/advisory split exists because
+ * this contract used to be contradicted: any FTL step error rolled back
+ * the whole apply).
  */
 import type { CustomComponentConfig, DryRunAction, StepError } from '../types/furnace.js';
 import { type RollbackJournal } from './furnace-rollback.js';

package/dist/src/core/furnace-apply-ftl.js

@@ -5,9 +5,13 @@
  * per-file LOC budget.
  *
  * Every helper here degrades gracefully: if the locale jar.mn is missing or
- * the FTL tree is non-standard, apply logs a `stepError` rather than
- * aborting the whole command. Missing jar.mn on a fork without a locale
- * package should not block a working `.mjs`/`.css` from shipping.
+ * the FTL tree is non-standard, apply logs an ADVISORY `stepError`
+ * (`advisory: true`) rather than aborting the whole command. Advisory step
+ * errors are reported as warnings and never trigger rollback — missing
+ * jar.mn on a fork without a locale package should not block a working
+ * `.mjs`/`.css` from shipping (the blocking/advisory split exists because
+ * this contract used to be contradicted: any FTL step error rolled back
+ * the whole apply).
  */
 import { join, relative } from 'node:path';
 import { toError } from '../utils/errors.js';
@@ -86,7 +90,7 @@ export async function applySharedFtlPrune(engineDir, name, ftlDir, config, affec
             affectedPaths.push(prunedPath);
     }
     catch (error) {
-        stepErrors.push({ step: 'locale jar.mn prune', error: toError(error).message });
+        stepErrors.push({ step: 'locale jar.mn prune', error: toError(error).message, advisory: true });
     }
 }
 /**
@@ -139,6 +143,7 @@ export async function applyCustomFtlFile(engineDir, name, componentDir, ftlDir,
         stepErrors.push({
             step: 'locale jar.mn registration',
             error: `Locale jar.mn not found at ${localeJarRel}; component "${name}" ships without a chrome URI for ${ftlFile}. Add the file manually or set furnace.json "ftlBasePath" to a tree that owns a jar.mn.`,
+            advisory: true,
         });
         return;
     }
@@ -155,6 +160,7 @@ export async function applyCustomFtlFile(engineDir, name, componentDir, ftlDir,
         stepErrors.push({
             step: 'locale jar.mn registration',
             error: toError(error).message,
+            advisory: true,
         });
     }
 }
@@ -199,4 +205,3 @@ export async function removeCustomFtlJarMnEntry(engineDir, fileName, ftlDir, con
     }
     await removeLocaleFtlJarMnEntry(engineDir, localeJarRel, tagName, chromeSubPath);
 }
-//# sourceMappingURL=furnace-apply-ftl.js.map

package/dist/src/core/furnace-apply-helpers.js

@@ -421,4 +421,3 @@ export async function applyOverrideComponent(engineDir, name, componentDir, conf
     return { affectedPaths };
 }
 export { diffDeletedFiles, extractComponentChecksums, prefixChecksums, } from './furnace-checksum-utils.js';
-//# sourceMappingURL=furnace-apply-helpers.js.map

package/dist/src/core/furnace-apply-output.js

@@ -45,7 +45,8 @@ export function logApplyResult(result, isDryRun) {
         for (const applied of result.applied) {
             if (applied.stepErrors && applied.stepErrors.length > 0) {
                 for (const stepErr of applied.stepErrors) {
-                    warn(`${applied.name}: [${stepErr.step}] ${stepErr.error}`);
+                    const advisoryPrefix = stepErr.advisory === true ? '(advisory) ' : '';
+                    warn(`${applied.name}: ${advisoryPrefix}[${stepErr.step}] ${stepErr.error}`);
                 }
             }
         }
@@ -54,4 +55,3 @@ export function logApplyResult(result, isDryRun) {
         error(`${err.name} — ${err.error}`);
     }
 }
-//# sourceMappingURL=furnace-apply-output.js.map

package/dist/src/core/furnace-apply.d.ts

@@ -31,4 +31,10 @@ export declare function applyAllComponents(root: string, dryRun?: boolean, optio
 }): Promise<ApplyResult & {
     actions?: DryRunAction[];
     rollbackJournal?: RollbackJournal;
-}>;
+}>; /**
+ * Shared context threaded through the batch apply loops. Bundles the state
+ * both loops mutate (result/actions/checksums) with the immutable run
+ * parameters — the previous 12–13 positional parameters let call sites
+ * drift (the named-apply state-wipe bug) and made every new parameter a
+ * two-signature change.
+ */