@hominis/fireforge 0.42.0 → 0.43.1

package/dist/src/types/commands/options.d.ts

@@ -66,6 +66,14 @@ export interface BuildOptions {
      * for any mismatch the rewriter cannot prove safe.
      */
     rewriteMozinfo?: boolean;
+    /**
+     * Refuse the build (rather than warn) when it would overwrite engine
+     * content recorded in neither a patch body nor the pristine baseline
+     *. The default is a loud warning, because an interactive
+     * operator often means to discard the drift; a scripted gate on a
+     * multi-session checkout wants the hard stop.
+     */
+    refuseUnexportedDrift?: boolean;
     /**
      * Parsed `--wait-lock [seconds]` value (`true` for the bare flag, meaning
      * 60). Consumed at the CLI layer to bound the engine-session-lock wait;
@@ -163,7 +171,7 @@ export interface DiscardOptions {
     /**
      * Restore to pristine upstream (HEAD) instead of the patch-applied
      * baseline; deletes patch-created files (the pre-0.39.0 semantics —
-     * FORGE F1).
+     *).
      */
     toUpstream?: boolean;
     /** Show what would be discarded without doing it */
@@ -293,7 +301,7 @@ export interface ReExportOptions {
      * Bypass per-patch lint result cache reads AND writes for this
      * invocation (`--no-cache`). The cache is what makes a repeat
      * re-export of an unchanged patch skip the checkJs program build
-     * entirely (FORGE J1).
+     * entirely.
      */
     noCache?: boolean;
     /**
@@ -309,7 +317,7 @@ export interface ReExportOptions {
      * Engine-relative files whose drift is EXPECTED (`--expect`, repeatable;
      * requires `--refuse-foreign-drift`). The content-based drift detector
      * cannot tell the exporting session's own slice edits from another
-     * session's (FORGE L6), so a real slice export under the refusal flag
+     * session's, so a real slice export under the refusal flag
      * names its intended files here: drift confined to expected files
      * proceeds, drift anywhere else still refuses.
      */
@@ -518,12 +526,12 @@ export interface TestOptions {
      * MIXED harnesses allowed) and exit without dispatching tests. One
      * ~10-minute build then covers both an xpcshell and a browser-chrome
      * half of a slice; run each harness afterwards without `--build`
-     * (FORGE J9). Emits `FIREFORGE-VERDICT: PASS` on success.
+     *. Emits `FIREFORGE-VERDICT: PASS` on success.
      */
     buildOnly?: boolean;
     /**
      * Union the paths this build packages onto the recorded coverage claim
-     * instead of REPLACING it (FORGE L1), so successive scoped builds
+     * instead of REPLACING it, so successive scoped builds
      * accumulate and an earlier slice's build-less runs stay covered. Valid
      * only with `--build`/`--build-only` and explicit paths. Refused
      * fail-closed unless the build anchor is unchanged: same engine HEAD,
@@ -871,6 +879,14 @@ export interface PatchCompactOptions {
  */
 export interface StatusOptions {
     raw?: boolean;
+    /**
+     * Report the engine-session lock instead of file status:
+     * holder pid, the command it is running, how long it has held the lock,
+     * and how many waiters are queued behind it. Read-only — it never
+     * acquires the lock, so it is safe to run while a build or test holds
+     * it, which is exactly when an operator asks.
+     */
+    lock?: boolean;
     unmanaged?: boolean;
     /**
      * Render a flat file→owning-patch ownership table instead of the three-
@@ -882,7 +898,7 @@ export interface StatusOptions {
     /**
      * Print the recorded test-packaging coverage of the last build baseline
      * (scope, timestamp, recording invocation) and exit. Read-only — the
-     * counterpart to the out-of-coverage test refusal (FORGE F11).
+     * counterpart to the out-of-coverage test refusal.
      */
     testCoverage?: boolean;
     /** Output machine-readable JSON instead of human-readable text. */
@@ -891,7 +907,7 @@ export interface StatusOptions {
      * With `--json`: emit only the summary counts (plus the offending
      * files per fail-set classification when the `--check`/`--fail-on`
      * policy is active), omitting the per-file `files[]` payload that
-     * grows with the queue (FORGE K8). Refused without `--json`.
+     * grows with the queue. Refused without `--json`.
      */
     summary?: boolean;
     /**
@@ -899,7 +915,7 @@ export interface StatusOptions {
      * `ownership` block — the flat path→owning-patch rows plus
      * managed/unmanaged/conflict counts — so a gate reads ownership,
      * classification, and the check verdict from ONE scan instead of three
-     * back-to-back `status` invocations (FORGE L3). A modifier, not a mode:
+     * back-to-back `status` invocations. A modifier, not a mode:
      * exit semantics are unchanged, so ownership conflicts still fail only
      * the human `--ownership` mode. Refused without `--json`.
      */
@@ -908,7 +924,7 @@ export interface StatusOptions {
      * Exit non-zero when any classification in the fail policy is
      * non-empty (default policy: unmanaged, patch-owned-drift, conflict).
      * Composes with the default view and `--json`; refused alongside
-     * `--raw`/`--unmanaged`/`--ownership`/`--test-coverage` (FORGE G1).
+     * `--raw`/`--unmanaged`/`--ownership`/`--test-coverage`.
      */
     check?: boolean;
     /**
@@ -1010,7 +1026,7 @@ export interface LintCommandOptions {
      *
      * Positional file arguments change meaning under this flag: they are
      * PATCH selectors resolved like {@link patches} entries, not engine
-     * file paths (FORGE G14).
+     * file paths.
      */
     perPatch?: boolean;
     /**
@@ -1035,7 +1051,7 @@ export interface LintCommandOptions {
     /**
      * With `--per-patch`, write a machine-readable JSON report (schemaVersion
      * 1: per-patch lineCount, filesAffected, tier, thresholds, issues, and
-     * lintIgnore-suppressed issues) to this path (FORGE G9/G10). Requires
+     * lintIgnore-suppressed issues) to this path. Requires
      * {@link perPatch}.
      */
     report?: string;

package/dist/src/types/commands/patches.d.ts

@@ -217,7 +217,7 @@ export interface PatchLintIssue {
      * patch, or every creator for a duplicate-creation clash). Used by the
      * export placement gate to attribute projected errors to the exported
      * patch vs pre-existing patches without parsing messages or the
-     * rename-sensitive fingerprint (FORGE K9).
+     * rename-sensitive fingerprint.
      */
     patches?: string[];
     /** Severity: errors block export, warnings are advisory, notices are informational (not counted) */

package/dist/src/types/config.d.ts

@@ -184,7 +184,7 @@ export interface TypecheckConfig {
     /**
      * How to report undefined free identifiers (TS2304/TS2552). These were
      * historically suppressed as shim-gap noise, which also hid genuine
-     * missing imports until they crashed at runtime (FORGE F12). Default
+     * missing imports until they crashed at runtime. Default
      * `'warning'`: visible without failing the gate. `'error'` makes them
      * blocking; `'off'` restores the historical suppression.
      */
@@ -292,7 +292,7 @@ export interface PatchLintConfig {
     /**
      * How the checkJs pass reports undefined free identifiers
      * (TS2304/TS2552). Same semantics as `typecheck.undefinedIdentifiers`
-     * (FORGE F12); the two flows share the suppression policy so a patch
+     *; the two flows share the suppression policy so a patch
      * cannot pass one and fail the other. Default: 'warning'.
      */
     undefinedIdentifiers?: PatchLintSeverityGate;

package/dist/src/types/furnace.d.ts

@@ -263,7 +263,7 @@ export interface ApplyResult {
     /**
      * Operator-facing warnings, printed by `logApplyResult`. Populated when
      * apply overwrote a deployed, patch-owned file whose engine bytes
-     * differed from the component source (FORGE J6) — the case where a
+     * differed from the component source — the case where a
      * shipped engine-only fix is silently reverted by the copy.
      */
     warnings?: string[];

package/dist/src/types/json.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Domain types for raw JSON documents (fireforge.json, furnace.json).
+ *
+ * FireForge deliberately reads and writes some documents in their raw,
+ * unvalidated form — e.g. `fireforge config --force` round-trips keys that
+ * the validated `FireForgeConfig` schema would strip. These types give that
+ * pipeline a concrete value contract: every value is JSON data, never a
+ * function, class instance, symbol, or other non-serializable runtime value.
+ */
+/**
+ * Any value representable in a JSON document.
+ */
+export type JsonValue = string | number | boolean | null | JsonValue[] | JsonObject;
+/**
+ * A JSON object node. `undefined` is admitted as a property value (not a
+ * `JsonValue`) so in-memory documents can be built field-by-field from
+ * optional inputs; `JSON.stringify` drops such properties on write, exactly
+ * like an absent key.
+ */
+export interface JsonObject {
+    [key: string]: JsonValue | undefined;
+}

package/dist/src/types/json.js

@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Domain types for raw JSON documents (fireforge.json, furnace.json).
+ *
+ * FireForge deliberately reads and writes some documents in their raw,
+ * unvalidated form — e.g. `fireforge config --force` round-trips keys that
+ * the validated `FireForgeConfig` schema would strip. These types give that
+ * pipeline a concrete value contract: every value is JSON data, never a
+ * function, class instance, symbol, or other non-serializable runtime value.
+ */
+export {};

package/dist/src/utils/assert.d.ts

@@ -0,0 +1,46 @@
+/**
+ * A failure description, or a thunk producing one.
+ *
+ * The thunk form exists so a hot call site pays nothing on the passing
+ * path — `assert(ok, () => \`bad state: ${JSON.stringify(x)}\`)` builds
+ * the string only when the assertion actually fails, where a plain
+ * template literal would build it on every call.
+ */
+export type AssertionMessage = string | (() => string);
+/**
+ * Asserts that an internal invariant holds.
+ *
+ * @param condition - The invariant. Falsy means it was violated.
+ * @param message - What was supposed to be true, phrased as the invariant
+ *   rather than the symptom (e.g. "rollback journal registered before
+ *   first mutation", not "journal is undefined"). Pass a thunk on a hot
+ *   path.
+ * @throws {@link InternalInvariantError} when `condition` is falsy.
+ */
+export declare function assert(condition: unknown, message: AssertionMessage): asserts condition;
+/**
+ * Asserts that a value is neither `null` nor `undefined`, narrowing it in
+ * place for the statements that follow.
+ *
+ * Use this in statement position, where the value is already bound to a
+ * name. Use {@link expectDefined} in expression position, where it is not.
+ *
+ * @param value - The value that should be present
+ * @param message - What was supposed to be present, and why
+ * @throws {@link InternalInvariantError} when `value` is `null` or `undefined`.
+ */
+export declare function assertDefined<T>(value: T, message: AssertionMessage): asserts value is NonNullable<T>;
+/**
+ * Returns a value that must be present, throwing if it is not.
+ *
+ * The expression-position counterpart to {@link assertDefined}: it checks
+ * and returns in one step, so an indexed read can be asserted inline
+ * (`push({ content: expectDefined(lines[k], …) })`) without first binding
+ * it to a local.
+ *
+ * @param value - The value that should be present
+ * @param message - What was supposed to be present, and why
+ * @returns `value`, narrowed to exclude `null` and `undefined`
+ * @throws {@link InternalInvariantError} when `value` is `null` or `undefined`.
+ */
+export declare function expectDefined<T>(value: T, message: AssertionMessage): NonNullable<T>;

package/dist/src/utils/assert.js

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Runtime assertions for FireForge's own internal invariants.
+ *
+ * These check state that FireForge itself established — a journal was
+ * registered before the first mutation, a lock is held before a write,
+ * manifest ordering is contiguous after a renumber. They are NOT input
+ * validation: anything derived from user input, the filesystem, or a
+ * subprocess belongs in a typed error from `src/errors/` with a
+ * `userMessage` that tells the operator what to do. An assertion failure
+ * says the opposite — that nothing the operator could have done would
+ * have prevented it.
+ *
+ * Every check routes through a helper here rather than being open-coded
+ * as `if (!condition) throw`. That is deliberate: an inline throw adds a
+ * permanently-uncovered branch to every function it appears in, and the
+ * per-module coverage floors in `scripts/check-coverage-thresholds.mjs`
+ * would pay for it in ~40 places. Routed through a call, the branch lives
+ * here once and is covered here once, and the `complexity` ceiling in
+ * `eslint.config.js` does not see it at all.
+ *
+ * This module is a leaf: it imports the error class and nothing else, per
+ * the dependency-direction note in `src/utils/errors.ts`.
+ */
+import { InternalInvariantError } from '../errors/base.js';
+/**
+ * Resolves an {@link AssertionMessage} at failure time.
+ * @param message - Literal description, or a thunk producing one
+ * @returns The description text
+ */
+function resolveMessage(message) {
+    return typeof message === 'function' ? message() : message;
+}
+/**
+ * Asserts that an internal invariant holds.
+ *
+ * @param condition - The invariant. Falsy means it was violated.
+ * @param message - What was supposed to be true, phrased as the invariant
+ *   rather than the symptom (e.g. "rollback journal registered before
+ *   first mutation", not "journal is undefined"). Pass a thunk on a hot
+ *   path.
+ * @throws {@link InternalInvariantError} when `condition` is falsy.
+ */
+export function assert(condition, message) {
+    if (!condition) {
+        throw new InternalInvariantError(resolveMessage(message));
+    }
+}
+/**
+ * Asserts that a value is neither `null` nor `undefined`, narrowing it in
+ * place for the statements that follow.
+ *
+ * Use this in statement position, where the value is already bound to a
+ * name. Use {@link expectDefined} in expression position, where it is not.
+ *
+ * @param value - The value that should be present
+ * @param message - What was supposed to be present, and why
+ * @throws {@link InternalInvariantError} when `value` is `null` or `undefined`.
+ */
+export function assertDefined(value, message) {
+    if (value === null || value === undefined) {
+        throw new InternalInvariantError(resolveMessage(message));
+    }
+}
+/**
+ * Returns a value that must be present, throwing if it is not.
+ *
+ * The expression-position counterpart to {@link assertDefined}: it checks
+ * and returns in one step, so an indexed read can be asserted inline
+ * (`push({ content: expectDefined(lines[k], …) })`) without first binding
+ * it to a local.
+ *
+ * @param value - The value that should be present
+ * @param message - What was supposed to be present, and why
+ * @returns `value`, narrowed to exclude `null` and `undefined`
+ * @throws {@link InternalInvariantError} when `value` is `null` or `undefined`.
+ */
+export function expectDefined(value, message) {
+    if (value === null || value === undefined) {
+        throw new InternalInvariantError(resolveMessage(message));
+    }
+    return value;
+}

package/dist/src/utils/build-info.d.ts

@@ -4,7 +4,7 @@ export interface BuildIdentity {
     dirty: boolean;
     /**
      * Content hash of the uncommitted diff, present only for a DIRTY
-     * installed build (FORGE L8). Two packs from the same HEAD with
+     * installed build. Two packs from the same HEAD with
      * different uncommitted content share `shortCommit` and the `.dirty`
      * marker, so without this they report byte-identical `--version`
      * strings — which is what made a field report against

package/dist/src/utils/build-info.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * Build identity for `--version` (FORGE K2/K3/L8). Three distinct builds
+ * Build identity for `--version`. Three distinct builds
  * shipped as plain "0.41.0" — consumers had to fingerprint tarballs by
  * sha256 to know which build a claim was verified against. `--version`
  * now reports `<semver>+g<short-sha>[.dirty[.<content-hash>]]`:

package/dist/src/utils/logger.d.ts

@@ -38,6 +38,26 @@ export declare function info(message: string): void;
 export declare function success(message: string): void;
 /** Logs a warning message. */
 export declare function warn(message: string): void;
+/**
+ * Prefix that marks a line as FireForge's own explanatory output rather
+ * than a defect. Kept greppable so downstream filters can whitelist it.
+ */
+export declare const NOTICE_PREFIX = "[FireForge] NOTICE:";
+/**
+ * Logs one of FireForge's own "why this is happening / why this is slow"
+ * explanations at WARNING severity.
+ *
+ * These lines are not warnings about the operator's code — they explain a
+ * decision FireForge just made (escalating an incremental build to a full
+ * one, sharding a run, skipping a step). Emitted through `info` they were
+ * silently dropped by agent-facing output filters that keep only warnings
+ * and errors, leaving a multi-minute build with no explanation and reading
+ * as a hang. There are very few such lines and they are exactly the ones a
+ * non-interactive operator needs, so they ride the warning channel and
+ * carry {@link NOTICE_PREFIX} so a reader can still tell them apart from a
+ * real warning.
+ */
+export declare function notice(message: string): void;
 /** Logs an error message. */
 export declare function error(message: string): void;
 /** Logs an in-progress step message. */

package/dist/src/utils/logger.js

@@ -117,6 +117,32 @@ export function warn(message) {
     }
     p.log.warn(message);
 }
+/**
+ * Prefix that marks a line as FireForge's own explanatory output rather
+ * than a defect. Kept greppable so downstream filters can whitelist it.
+ */
+export const NOTICE_PREFIX = '[FireForge] NOTICE:';
+/**
+ * Logs one of FireForge's own "why this is happening / why this is slow"
+ * explanations at WARNING severity.
+ *
+ * These lines are not warnings about the operator's code — they explain a
+ * decision FireForge just made (escalating an incremental build to a full
+ * one, sharding a run, skipping a step). Emitted through `info` they were
+ * silently dropped by agent-facing output filters that keep only warnings
+ * and errors, leaving a multi-minute build with no explanation and reading
+ * as a hang. There are very few such lines and they are exactly the ones a
+ * non-interactive operator needs, so they ride the warning channel and
+ * carry {@link NOTICE_PREFIX} so a reader can still tell them apart from a
+ * real warning.
+ */
+export function notice(message) {
+    if (routeToStderr()) {
+        writeDiagnostic('warning: ', `${NOTICE_PREFIX} ${message}`);
+        return;
+    }
+    p.log.warn(`${NOTICE_PREFIX} ${message}`);
+}
 /** Logs an error message. */
 export function error(message) {
     if (routeToStderr()) {

package/dist/src/utils/options.d.ts

@@ -49,6 +49,18 @@ export declare function stringListOption(): [(value: string, previous: string[])
  * invalid-argument channel).
  */
 export declare function resolveWaitLockSeconds(value: string | number | boolean | undefined): number | undefined;
+/**
+ * True when `command` already declares `--wait-lock` itself. Used by the
+ * CLI wiring to add the accept-and-ignore variant only where the honoring
+ * one is absent.
+ */
+export declare function hasWaitLockOption(command: Command): boolean;
+/**
+ * Recursively gives every command in the tree a `--wait-lock` flag: the
+ * honoring registration where one already exists, the accept-and-ignore
+ * one everywhere else.
+ */
+export declare function ensureWaitLockOptionEverywhere(command: Command): void;
 /**
  * Registers the shared `--wait-lock [seconds]` flag on a lock-taking
  * command (the engine session lock for engine-mutating commands, the patch

package/dist/src/utils/options.js

@@ -86,6 +86,45 @@ export function resolveWaitLockSeconds(value) {
     }
     return n;
 }
+/**
+ * Registers `--wait-lock [seconds]` on a command that takes NO lock, so a
+ * scripted sequence can blanket-append the flag without hitting a usage
+ * error.
+ *
+ * `export` / `re-export` / `build` / `test` / `patch move-files` all
+ * accept the flag; `status` and `patch staged-dependency` used to reject
+ * it with "unknown option", which killed the whole sequence with a usage
+ * error instead of a lock message. The flag is accepted and ignored here —
+ * never silently repurposed — and the help text says so, so nobody reads
+ * its presence as evidence that this command waits for anything.
+ *
+ * The value is parsed and validated exactly as the honoring variant does:
+ * `--wait-lock nonsense` must still be a usage error everywhere, or the
+ * uniformity would be a lie.
+ */
+function addAcceptedWaitLockOption(command) {
+    return command.option('--wait-lock [seconds]', 'Accepted for scripting uniformity and ignored: this command takes no FireForge lock', commanderArgParser((raw) => resolveWaitLockSeconds(raw)));
+}
+/**
+ * True when `command` already declares `--wait-lock` itself. Used by the
+ * CLI wiring to add the accept-and-ignore variant only where the honoring
+ * one is absent.
+ */
+export function hasWaitLockOption(command) {
+    return command.options.some((option) => option.long === '--wait-lock');
+}
+/**
+ * Recursively gives every command in the tree a `--wait-lock` flag: the
+ * honoring registration where one already exists, the accept-and-ignore
+ * one everywhere else.
+ */
+export function ensureWaitLockOptionEverywhere(command) {
+    for (const sub of command.commands) {
+        if (!hasWaitLockOption(sub))
+            addAcceptedWaitLockOption(sub);
+        ensureWaitLockOptionEverywhere(sub);
+    }
+}
 /**
  * Registers the shared `--wait-lock [seconds]` flag on a lock-taking
  * command (the engine session lock for engine-mutating commands, the patch

package/dist/src/utils/stdio-drain.d.ts

@@ -1,5 +1,5 @@
 /**
- * Bounded stdio drain for delayed process exits (FORGE I1).
+ * Bounded stdio drain for delayed process exits.
  *
  * `process.exit()` discards whatever is still queued in an async writable —
  * and stdout IS async when it is a pipe, with a 64 KiB kernel buffer on

package/dist/src/utils/stdio-drain.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * Bounded stdio drain for delayed process exits (FORGE I1).
+ * Bounded stdio drain for delayed process exits.
  *
  * `process.exit()` discards whatever is still queued in an async writable —
  * and stdout IS async when it is a pipe, with a 64 KiB kernel buffer on

package/dist/src/utils/validation.d.ts

@@ -1,4 +1,5 @@
 import type { FirefoxProduct } from '../types/config.js';
+import type { JsonObject, JsonValue } from '../types/json.js';
 /**
  * Checks whether a value is a string.
  * @param value - Value to check
@@ -53,6 +54,16 @@ export declare function isObject(value: unknown): value is Record<string, unknow
  * @returns True if value is an array
  */
 export declare function isArray(value: unknown): value is unknown[];
+/**
+ * Narrows a JSON value to a JSON object node (excludes arrays and `null`).
+ *
+ * Unlike {@link isObject} this accepts only values already known to be JSON
+ * data, so the narrowed `JsonObject` keeps its concrete value contract —
+ * use it when walking a `JsonValue` tree rather than at `unknown` boundaries.
+ * @param value - JSON value to check
+ * @returns True if value is a JSON object node
+ */
+export declare function isJsonObject(value: JsonValue | undefined): value is JsonObject;
 /**
  * Validates a Firefox version string.
  * Accepts formats like "140.9.0", "140.9.1", "140.9.0esr", "147.0b1"
@@ -150,7 +161,7 @@ export declare function validateTokenName(name: string): string | undefined;
  */
 export declare function normalizeTokenName(name: string): string;
 /**
- * Normalizes a patch display name against its category (FORGE G13):
+ * Normalizes a patch display name against its category:
  * strips a trailing `.patch` and any redundant `NNN-<category>-` /
  * `<category>-` prefixes, case-insensitively and repeatedly, mirroring
  * the filename slug pipeline's require-the-category-token rule — a bare

package/dist/src/utils/validation.js

@@ -79,6 +79,18 @@ export function isObject(value) {
 export function isArray(value) {
     return Array.isArray(value);
 }
+/**
+ * Narrows a JSON value to a JSON object node (excludes arrays and `null`).
+ *
+ * Unlike {@link isObject} this accepts only values already known to be JSON
+ * data, so the narrowed `JsonObject` keeps its concrete value contract —
+ * use it when walking a `JsonValue` tree rather than at `unknown` boundaries.
+ * @param value - JSON value to check
+ * @returns True if value is a JSON object node
+ */
+export function isJsonObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 /**
  * Validates a Firefox version string.
  * Accepts formats like "140.9.0", "140.9.1", "140.9.0esr", "147.0b1"
@@ -278,7 +290,7 @@ export function normalizeTokenName(name) {
     return `--${stripped}`;
 }
 /**
- * Normalizes a patch display name against its category (FORGE G13):
+ * Normalizes a patch display name against its category:
  * strips a trailing `.patch` and any redundant `NNN-<category>-` /
  * `<category>-` prefixes, case-insensitively and repeatedly, mirroring
  * the filename slug pipeline's require-the-category-token rule — a bare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hominis/fireforge",
-  "version": "0.42.0",
+  "version": "0.43.1",
   "description": "FireForge — a build tool for customizing Firefox",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -69,11 +69,11 @@
     "dpdm": "4.3.0",
     "eslint": "^10.0.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^63.0.0",
+    "eslint-plugin-jsdoc": "^64.1.0",
     "eslint-plugin-simple-import-sort": "^14.0.0",
     "fast-check": "^4.6.0",
     "husky": "^9.1.7",
-    "knip": "6.32.0",
+    "knip": "6.32.2",
     "lint-staged": "^17.0.4",
     "prettier": "3.9.6",
     "tsx": "^4.7.0",