@hominis/fireforge 0.43.0 → 0.44.0

package/dist/src/types/commands/options.d.ts

@@ -68,8 +68,8 @@ export interface BuildOptions {
     rewriteMozinfo?: boolean;
     /**
      * Refuse the build (rather than warn) when it would overwrite engine
-     * content recorded in neither a patch body nor the pristine baseline
-     *. The default is a loud warning, because an interactive
+     * content recorded in neither a patch body nor the pristine baseline.
+     * The default is a loud warning, because an interactive
      * operator often means to discard the drift; a scripted gate on a
      * multi-session checkout wants the hard stop.
      */
@@ -170,8 +170,7 @@ export interface ResetOptions {
 export interface DiscardOptions {
     /**
      * Restore to pristine upstream (HEAD) instead of the patch-applied
-     * baseline; deletes patch-created files (the pre-0.39.0 semantics —
-     *).
+     * baseline, deleting patch-created files.
      */
     toUpstream?: boolean;
     /** Show what would be discarded without doing it */
@@ -190,6 +189,11 @@ export interface PackageOptions {
  * Options for the import command.
  */
 export interface ImportOptions {
+    /**
+     * Answer the engine-drift prompt non-interactively. Unlike `force`,
+     * this does NOT waive the patch-integrity gate.
+     */
+    yes?: boolean;
     /** Specific patches to apply (by name) */
     patches?: string[];
     /** Continue applying patches even if one fails */
@@ -272,13 +276,10 @@ export interface ReExportOptions {
      */
     tier?: 'branding';
     /**
-     * Lint check IDs to suppress, **appended** (union) to the patch's
-     * existing `lintIgnore` list. De-duplicated. Mutually exclusive with
-     * `--all`. To remove an entry or clear the list entirely, use the
-     * `fireforge patch lint-ignore` subcommand (which has explicit
-     * `--add` / `--remove` / `--clear` modes); re-export's append-only
-     * semantics match the operator's most common intent ("I want this
-     * patch to also suppress X").
+     * Lint check IDs to suppress, **appended** (union) to the patch's existing
+     * `lintIgnore` list. De-duplicated. Mutually exclusive with `--all`. To
+     * remove an entry or clear the list, use `fireforge patch lint-ignore`,
+     * which has explicit `--add` / `--remove` / `--clear` modes.
      */
     lintIgnore?: string[];
     /**
@@ -298,10 +299,9 @@ export interface ReExportOptions {
      */
     refuseAdjacentUnmanaged?: boolean;
     /**
-     * Bypass per-patch lint result cache reads AND writes for this
-     * invocation (`--no-cache`). The cache is what makes a repeat
-     * re-export of an unchanged patch skip the checkJs program build
-     * entirely.
+     * Bypass per-patch lint result cache reads AND writes for this invocation
+     * (`--no-cache`). The cache is what lets a repeat re-export of an unchanged
+     * patch skip the checkJs program build entirely.
      */
     noCache?: boolean;
     /**
@@ -317,9 +317,9 @@ export interface ReExportOptions {
      * Engine-relative files whose drift is EXPECTED (`--expect`, repeatable;
      * requires `--refuse-foreign-drift`). The content-based drift detector
      * cannot tell the exporting session's own slice edits from another
-     * session's, so a real slice export under the refusal flag
-     * names its intended files here: drift confined to expected files
-     * proceeds, drift anywhere else still refuses.
+     * session's, so a slice export under the refusal flag names its intended
+     * files here: drift confined to expected files proceeds, drift anywhere
+     * else still refuses.
      */
     expect?: string[];
 }
@@ -329,6 +329,11 @@ export interface ReExportOptions {
  * `.patch` file body — the manifest is the only thing that changes.
  */
 export interface PatchTierOptions {
+    /**
+     * Seconds to wait for the patch directory lock. This command mutates patch
+     * metadata under that lock.
+     */
+    waitLock?: number | boolean;
     /** Force the named tier on the patch. Only `"branding"` is recognised. */
     tier?: 'branding';
     /** Remove the `tier` override entirely, restoring auto-detection. */
@@ -344,6 +349,11 @@ export interface PatchTierOptions {
  * be set per invocation.
  */
 export interface PatchLintIgnoreOptions {
+    /**
+     * Seconds to wait for the patch directory lock. This command mutates patch
+     * metadata under that lock.
+     */
+    waitLock?: number | boolean;
     /** Lint check IDs to add to the patch's `lintIgnore` list (union, de-duped). */
     add?: string[];
     /** Lint check IDs to remove from the patch's `lintIgnore` list. */
@@ -361,6 +371,11 @@ export interface PatchLintIgnoreOptions {
  * declarations, or clear all staged dependencies from the patch.
  */
 export interface PatchStagedDependencyOptions {
+    /**
+     * Seconds to wait for the patch directory lock. This command mutates patch
+     * metadata under that lock.
+     */
+    waitLock?: number | boolean;
     /** Add a staged dependency declaration. */
     add?: boolean;
     /** Remove matching staged dependency declarations. */
@@ -455,6 +470,11 @@ export interface PatchMoveFilesOptions {
  * Options for the rebase command.
  */
 export interface RebaseOptions {
+    /**
+     * Seconds to wait for the patch directory lock. The rebase loop rewrites
+     * patch bodies under that lock.
+     */
+    waitLock?: number | boolean;
     /** Resume a previously interrupted rebase session */
     continue?: boolean;
     /** Cancel the current rebase session and restore engine */
@@ -525,20 +545,29 @@ export interface TestOptions {
      * Run the scoped pre-test build (packaging exactly the requested paths,
      * MIXED harnesses allowed) and exit without dispatching tests. One
      * ~10-minute build then covers both an xpcshell and a browser-chrome
-     * half of a slice; run each harness afterwards without `--build`
-     *. Emits `FIREFORGE-VERDICT: PASS` on success.
+     * half of a slice; run each harness afterwards without `--build`.
+     * Emits `FIREFORGE-VERDICT: PASS` on success.
      */
     buildOnly?: boolean;
     /**
      * Union the paths this build packages onto the recorded coverage claim
-     * instead of REPLACING it, so successive scoped builds
-     * accumulate and an earlier slice's build-less runs stay covered. Valid
-     * only with `--build`/`--build-only` and explicit paths. Refused
-     * fail-closed unless the build anchor is unchanged: same engine HEAD,
-     * same `engine/mozconfig`, and every previously fingerprinted packageable
-     * file byte-identical. See `src/core/coverage-extend.ts`.
+     * instead of REPLACING it, so successive scoped builds accumulate and an
+     * earlier slice's build-less runs stay covered. Valid only with
+     * `--build`/`--build-only` and explicit paths. Refused fail-closed unless
+     * the build anchor is unchanged: same engine HEAD, same `engine/mozconfig`,
+     * and every previously fingerprinted packageable file byte-identical. See
+     * `src/core/coverage-extend.ts`.
      */
     extendCoverage?: boolean;
+    /**
+     * Forwarded to the PRE-TEST build: refuse (rather than warn) when that
+     * build would overwrite engine content recorded in neither a patch body
+     * nor the pristine baseline. Same meaning as `fireforge build`'s flag of
+     * the same name — a scripted `test --build` is exactly the shape the
+     * multi-session hazard shows up in, and until now it was the one shape
+     * that could not arm the refusal. Valid only with `--build`/`--build-only`.
+     */
+    refuseUnexportedDrift?: boolean;
     /** Forward mach's pathless auto-selection mode. Valid only with no explicit paths. */
     auto?: boolean;
     /**
@@ -591,7 +620,7 @@ export interface TestOptions {
      * single-suite run auto-selects. Escape hatch for the rare case where a
      * suite-specific command misbehaves; on a healthy host the generic command
      * is equivalent. The default (auto suite dispatch) skips the mozlog
-     * resource monitor that crashes `mach test` on a broken host (E1).
+     * resource monitor that crashes `mach test` on a broken host.
      */
     genericMachTest?: boolean;
     /**
@@ -804,13 +833,11 @@ export interface PatchDeleteOptions {
     waitLock?: number | boolean;
 }
 /**
- * Options for the `fireforge patch rename` subcommand. Updates the
- * patch's filename, manifest `name`, and (optionally) `description`
- * atomically without rewriting the `.patch` file body. Companion to
- * `re-export --files` for the case where the body is already correct
- * but the patch's identity (filename + description) describes a
- * pre-shrink scope; before this verb existed the only workaround was
- * `delete` + re-export, which briefly dropped the patch from the queue.
+ * Options for the `fireforge patch rename` subcommand. Updates the patch's
+ * filename, manifest `name`, and (optionally) `description` atomically
+ * without rewriting the `.patch` file body. Companion to `re-export --files`
+ * for the case where the body is already correct but the patch's identity
+ * describes a pre-shrink scope.
  */
 export interface PatchRenameOptions {
     /**
@@ -915,9 +942,9 @@ export interface StatusOptions {
      * `ownership` block — the flat path→owning-patch rows plus
      * managed/unmanaged/conflict counts — so a gate reads ownership,
      * classification, and the check verdict from ONE scan instead of three
-     * back-to-back `status` invocations. A modifier, not a mode:
-     * exit semantics are unchanged, so ownership conflicts still fail only
-     * the human `--ownership` mode. Refused without `--json`.
+     * back-to-back `status` invocations. A modifier, not a mode: exit
+     * semantics are unchanged, so ownership conflicts still fail only the
+     * human `--ownership` mode. Refused without `--json`.
      */
     includeOwnership?: boolean;
     /**
@@ -955,6 +982,11 @@ export interface TokenAddOptions {
  * Options for the doctor command.
  */
 export interface DoctorOptions {
+    /**
+     * Seconds to wait for the patch directory lock. This command can mutate
+     * the patch manifest under that lock.
+     */
+    waitLock?: number | boolean;
     repairPatchesManifest?: boolean;
     /**
      * Clear a stale `pendingResolution` marker, but only after the same
@@ -976,13 +1008,6 @@ export interface DoctorOptions {
     /** Run extra post-rebase checks for common Firefox registration surfaces. */
     postRebaseAudit?: boolean;
 }
-/**
- * Global CLI options available to all commands.
- */
-export interface GlobalOptions {
-    /** Enable verbose/debug output */
-    verbose?: boolean;
-}
 /** Options controlling how the lint command filters and tags its output. */
 export interface LintCommandOptions {
     /**
@@ -995,38 +1020,31 @@ export interface LintCommandOptions {
     since?: string;
     /**
      * When set together with {@link since}, scope the exit code to issues
-     * tagged `introduced`. Cumulative pre-existing errors still print (so
-     * the operator can still see the full queue state) but do not fail
-     * lint. Motivating case: a branch whose diff is clean but whose repo
-     * already carries unrelated `raw-color` / license-header errors from
-     * older patches. Without this flag, CI treats the clean branch as
-     * failing; with it, a branch "breaks the build" only when its own diff
-     * introduced a new error.
+     * tagged `introduced`. Cumulative pre-existing errors still print, so the
+     * operator sees the full queue state, but do not fail lint. This is for a
+     * branch whose own diff is clean but whose repo carries unrelated
+     * `raw-color` / license-header errors from older patches.
      *
-     * Requires {@link since}: without a revision to diff against there is
-     * no distinction between introduced and cumulative, so the flag is
-     * rejected up-front rather than silently ignored.
+     * Requires {@link since}: without a revision to diff against there is no
+     * distinction between introduced and cumulative, so the flag is rejected
+     * up-front rather than silently ignored.
      */
     onlyIntroduced?: boolean;
     /**
-     * Lint each patch in the queue as its own isolated diff, rather than
-     * the aggregate `git diff HEAD` across all applied patches.
+     * Lint each patch in the queue as its own isolated diff, rather than the
+     * aggregate `git diff HEAD` across all applied patches.
      *
-     * Motivating case: running `fireforge lint` (no args) on a repo where
-     * `fireforge import` or `fireforge rebase` has just applied the full
-     * patch queue produces an aggregate diff (every patch's changes
-     * summed). The patch-size advisory rules (`large-patch-lines`,
-     * `large-patch-files`) then fire against the sum — e.g. "Patch is
-     * 37529 lines" on a queue of 22 individually-fine patches — which
-     * reads as a task-specific regression when it is really an artefact
-     * of the aggregation. `--per-patch` rescopes the diff to each patch's
-     * own `filesAffected`, honours the patch's own `lintIgnore`, and runs
-     * the cross-patch rules once over the whole queue so queue-level
-     * findings (duplicate creations, forward imports) still surface.
+     * On a repo where `import` or `rebase` has just applied the full queue,
+     * the aggregate diff sums every patch's changes, and the patch-size
+     * advisory rules (`large-patch-lines`, `large-patch-files`) fire against
+     * that sum — "Patch is 37529 lines" for a queue of individually-fine
+     * patches. `--per-patch` rescopes the diff to each patch's own
+     * `filesAffected`, honours the patch's own `lintIgnore`, and runs the
+     * cross-patch rules once over the whole queue so queue-level findings
+     * still surface.
      *
-     * Positional file arguments change meaning under this flag: they are
-     * PATCH selectors resolved like {@link patches} entries, not engine
-     * file paths.
+     * Positional file arguments change meaning under this flag: they are PATCH
+     * selectors resolved like {@link patches} entries, not engine file paths.
      */
     perPatch?: boolean;
     /**

package/dist/src/types/commands/patches.d.ts

@@ -68,49 +68,39 @@ export interface PatchMetadata {
     /** Array of file paths affected by this patch */
     filesAffected: string[];
     /**
-     * Optional per-patch list of lint check IDs to suppress when this patch
-     * is the target of `export`, `export-all`, or `re-export`. Exists for
-     * the class of patch that is advisory-noisy by nature — a cohesive
-     * branding bundle, a localised-resource pack, an auto-generated
-     * manifest — where the generic `large-patch-lines` / `large-patch-files`
-     * thresholds do not apply but `--skip-lint` (which silences *all*
-     * errors, not just the one that does not apply) is too coarse a hammer.
+     * Optional per-patch list of lint check IDs to suppress when this patch is
+     * the target of `export`, `export-all`, or `re-export`. Exists for the
+     * class of patch that is advisory-noisy by nature — a cohesive branding
+     * bundle, a localised-resource pack, an auto-generated manifest — where
+     * the generic `large-patch-lines` / `large-patch-files` thresholds do not
+     * apply but `--skip-lint`, which silences every error rather than the one
+     * that does not apply, is too coarse.
      *
-     * Previously the only escape hatches were `--skip-lint` (blunt) or the
-     * full `rebase` flow (refreshes the same patch through a code path that
-     * silently skips `runPatchLint` — an asymmetry that forced operators
-     * through a multi-minute Firefox source re-download just to refresh
-     * one patch body).
-     *
-     * Values are free-form check IDs (e.g. `"large-patch-lines"`,
-     * `"large-patch-files"`). Checks not listed here still run normally.
-     * An entry for an unknown check ID is a no-op — the patch metadata
-     * documents the *intent* to suppress even if the check is later
-     * renamed or removed.
+     * Values are free-form check IDs (e.g. `"large-patch-lines"`). Checks not
+     * listed here still run normally. An entry for an unknown check ID is a
+     * no-op — the metadata documents the intent to suppress even if the check
+     * is later renamed or removed.
      */
     lintIgnore?: string[];
     /**
      * Optional per-patch threshold-tier override for the `large-patch-lines`
      * rule. Exists for branding patches that must touch a small number of
      * cross-cutting registration files alongside `browser/branding/<name>/`
-     * (notably `browser/moz.configure` to register the new branding flavor
-     * with the top-level configure). The narrow auto-detect allowlist in
-     * `isBrandingOnlyPatch` covers the canonical shape, but a fork whose
-     * branding patch also touches an unlisted sibling (for example a
-     * `browser/themes/<name>/` override or a vendor-specific icon
-     * resource) falls through to the general tier and trips the hard
-     * limit on what is legitimately one branding diff.
+     * (notably `browser/moz.configure`, which registers the new branding
+     * flavor with the top-level configure). The narrow auto-detect allowlist
+     * in `isBrandingOnlyPatch` covers the canonical shape; a fork whose
+     * branding patch also touches an unlisted sibling falls through to the
+     * general tier and trips the hard limit on what is legitimately one
+     * branding diff.
      *
-     * Declaring `tier: "branding"` here forces the branding thresholds
-     * (notice 8000 / warning 18000 / error 30000 lines, ≤60 files)
-     * regardless of `filesAffected`. The tier is the weaker claim than
-     * test — a patch of all-tests still lands in the test tier even if
-     * this field is set, because the test-tier thresholds are already
-     * more permissive and a test that is also branding-shaped is
-     * vanishingly rare.
+     * Declaring `tier: "branding"` forces the branding thresholds (notice
+     * 8000 / warning 18000 / error 30000 lines, ≤60 files) regardless of
+     * `filesAffected`. It is the weaker claim than test: an all-tests patch
+     * stays in the test tier even with this set, because those thresholds are
+     * already more permissive.
      *
-     * Only `"branding"` is currently recognised. Unknown values are
-     * rejected by the manifest validator, not silently stripped.
+     * Only `"branding"` is recognised. Unknown values are rejected by the
+     * manifest validator, not silently stripped.
      */
     tier?: 'branding';
     /**

package/dist/src/types/commands/project.d.ts

@@ -4,47 +4,18 @@
 /**
  * Result of a doctor check.
  *
- * Field precedence (consumers and producers must agree):
- *   1. `severity`, when present, is authoritative — `'error'` counts as a
- *      failure and `'warning'` as a warning REGARDLESS of `passed`.
- *   2. Without `severity`, `passed: false` is a failure unless
- *      `warning: true` downgrades it to a warning.
- * Producers should prefer setting `severity` explicitly; `warning` exists
- * for older checks that predate the field. Do not emit contradictory
- * combinations like `passed: true, severity: 'error'`.
+ * `severity` is the single source of truth; consumers that want a boolean
+ * derive it as `severity !== 'error'`.
  */
 export interface DoctorCheck {
     /** Name of the check */
     name: string;
-    /** Whether the check passed */
-    passed: boolean;
-    /** Severity of the result (authoritative when present — see above) */
-    severity?: 'ok' | 'warning' | 'error';
+    /** Outcome of the check. Authoritative and required. */
+    severity: 'ok' | 'warning' | 'error';
     /** Description of the result */
     message: string;
-    /** Suggested fix if check failed */
+    /** Suggested fix when the check did not pass */
     fix?: string;
-    /** Legacy warning flag for checks that predate `severity` */
-    warning?: boolean;
-}
-/**
- * Status of the project.
- */
-export interface ProjectStatus {
-    /** Whether fireforge.json exists */
-    hasConfig: boolean;
-    /** Whether engine/ exists */
-    hasEngine: boolean;
-    /** Whether patches/ exists */
-    hasPatches: boolean;
-    /** Number of patch files */
-    patchCount: number;
-    /** Whether build output exists */
-    hasBuild: boolean;
-    /** Firefox version from config */
-    firefoxVersion?: string;
-    /** Downloaded Firefox version */
-    downloadedVersion?: string;
 }
 /**
  * Per-file token coverage breakdown.

package/dist/src/types/config.d.ts

@@ -182,11 +182,10 @@ export interface TypecheckConfig {
      */
     projectOverrides?: Record<string, string | null>;
     /**
-     * How to report undefined free identifiers (TS2304/TS2552). These were
-     * historically suppressed as shim-gap noise, which also hid genuine
-     * missing imports until they crashed at runtime. Default
-     * `'warning'`: visible without failing the gate. `'error'` makes them
-     * blocking; `'off'` restores the historical suppression.
+     * How to report undefined free identifiers (TS2304/TS2552). Default
+     * `'warning'`: visible without failing the gate, since shim gaps produce
+     * the same diagnostic as a genuine missing import. `'error'` makes them
+     * blocking; `'off'` suppresses them.
      */
     undefinedIdentifiers?: PatchLintSeverityGate;
 }
@@ -235,9 +234,9 @@ export interface PatchLintConfig {
     checkJs?: boolean;
     /**
      * When true with `checkJs: true`, run checkJs with `strict` and
-     * `noImplicitAny` enabled (CI-style). Default false preserves the
-     * historical loose preset. Optional {@link checkJsCompilerOptions}
-     * can relax individual strict flags (e.g. `strictNullChecks: false`).
+     * `noImplicitAny` enabled (CI-style). Default false uses the loose preset.
+     * Optional {@link checkJsCompilerOptions} can relax individual strict
+     * flags (e.g. `strictNullChecks: false`).
      */
     checkJsStrict?: boolean;
     /**
@@ -249,27 +248,26 @@ export interface PatchLintConfig {
      * Project-relative path to an additional `.d.ts` file whose contents
      * are concatenated to the built-in `FIREFOX_GLOBALS_SHIM` for the
      * `patchLint.checkJs` pass. Same semantics as `typecheck.extraShim`
-     * but scoped to the patch-hygiene flow. Default unset = current
-     * behaviour (built-in shim only).
+     * but scoped to the patch-hygiene flow. Default unset: built-in shim only.
      */
     checkJsExtraShim?: string;
     /**
      * Extend the checkJs pass to patch-owned test `.js` files
      * (`browser_*` / `test_*` / `xpcshell_*` basenames and files under a
-     * `/test/` path), each checked as its own small script-scope program
-     * with same-directory patch-owned `head*.js` helpers included (FORGE
-     * G5 — a harness global that does not exist should fail at the patch
-     * boundary where the test was authored, not in a downstream
-     * jsconfig-project run). Opt-in: it is a new failure surface with
-     * nonzero compile cost. Requires `checkJs: true`.
+     * `/test/` path), each checked as its own small script-scope program with
+     * same-directory patch-owned `head*.js` helpers included, so a call to a
+     * harness global that does not exist fails at the patch boundary where the
+     * test was authored rather than in a downstream jsconfig-project run.
+     * Opt-in: it is a new failure surface with nonzero compile cost. Requires
+     * `checkJs: true`.
      */
     checkJsTestFiles?: boolean;
     /**
      * Project-relative `.d.ts` appended to the built-in test-harness shim
      * (loose `TestUtils`/`BrowserTestUtils`/`add_task`/… declarations) for
-     * the `checkJsTestFiles` pass — a consumer-typed `TestUtils` here is
-     * what turns a call to a nonexistent harness member into a TS2339 at
-     * export time. Requires `checkJsTestFiles: true`.
+     * the `checkJsTestFiles` pass. A consumer-typed `TestUtils` here is what
+     * turns a call to a nonexistent harness member into a TS2339 at export
+     * time. Requires `checkJsTestFiles: true`.
      */
     checkJsTestShim?: string;
     /** File paths exempt from the raw-color-value check (exact or basename match) */
@@ -291,16 +289,20 @@ export interface PatchLintConfig {
     chromeScriptJsDoc?: PatchLintSeverityGate;
     /**
      * How the checkJs pass reports undefined free identifiers
-     * (TS2304/TS2552). Same semantics as `typecheck.undefinedIdentifiers`
-     *; the two flows share the suppression policy so a patch
+     * (TS2304/TS2552). Same semantics as `typecheck.undefinedIdentifiers`;
+     * the two flows share the suppression policy so a patch
      * cannot pass one and fail the other. Default: 'warning'.
      */
     undefinedIdentifiers?: PatchLintSeverityGate;
 }
 /**
- * Build mode for mach.
+ * Build modes for mach.
+ *
+ * Derived from the list so the runtime allowlist cannot drift from the type.
  */
-export type BuildMode = 'dev' | 'debug' | 'release';
+export declare const BUILD_MODES: readonly ["dev", "debug", "release"];
+/** Build mode for mach. */
+export type BuildMode = (typeof BUILD_MODES)[number];
 /**
  * Runtime state stored in .fireforge/state.json.
  */

package/dist/src/types/config.js

@@ -1 +1,6 @@
-export {};
+/**
+ * Build modes for mach.
+ *
+ * Derived from the list so the runtime allowlist cannot drift from the type.
+ */
+export const BUILD_MODES = ['dev', 'debug', 'release'];

package/dist/src/types/furnace.d.ts

@@ -117,11 +117,10 @@ export interface FurnaceConfig {
     tokenAllowlist?: string[];
     /**
      * CSS custom-property prefixes that identify upstream / platform
-     * variables the fork does not own. `token coverage` counts matches
-     * as `allowlisted` rather than `unknown` so a copied upstream
-     * baseline doesn't drag fork-owned coverage percentages down.
-     * Defaults to `['--moz-']` when unset. Pass an explicit empty array
-     * to restore the pre-0.18.0 strict contract.
+     * variables the fork does not own. `token coverage` counts matches as
+     * `allowlisted` rather than `unknown` so a copied upstream baseline does
+     * not drag fork-owned coverage percentages down. Defaults to `['--moz-']`
+     * when unset; pass an explicit empty array to count every prefix.
      */
     platformPrefixes?: string[];
     /**
@@ -176,7 +175,13 @@ export interface FurnaceConfig {
  * state before clearing authoring markers. The string is surfaced in doctor's
  * failure message verbatim, so new entries should be self-explanatory.
  */
-export type FurnacePendingRepairOperation = 'preview-teardown' | 'apply-rollback' | 'deploy-rollback' | 'remove-rollback' | 'create-rollback' | 'override-rollback' | 'scan-rollback' | 'rename-rollback' | 'refresh-rollback' | 'chrome-doc-rollback';
+export declare const FURNACE_PENDING_REPAIR_OPERATIONS: readonly ["preview-teardown", "apply-rollback", "deploy-rollback", "remove-rollback", "create-rollback", "override-rollback", "scan-rollback", "rename-rollback", "refresh-rollback", "chrome-doc-rollback"];
+/**
+ * Operations that can leave a pending-repair marker when they fail to roll
+ * back cleanly. Derived from the list above so the runtime allowlist in
+ * `furnace-config.ts` cannot drift from the union.
+ */
+export type FurnacePendingRepairOperation = (typeof FURNACE_PENDING_REPAIR_OPERATIONS)[number];
 /**
  * Marker persisted into `.fireforge/furnace-state.json` when a furnace
  * mutation failed to roll back cleanly. Its presence tells the next
@@ -222,13 +227,10 @@ export interface StepError {
     step: string;
     error: string;
     /**
-     * Advisory step errors are reported as warnings and never trigger
-     * rollback or a non-zero exit. Used by the `.ftl` helpers, whose module
-     * contract is graceful degradation: a missing locale jar.mn on a fork
-     * without a locale package must not block a working `.mjs`/`.css` from
-     * shipping. Before this flag existed the contract was contradicted in
-     * practice — any FTL step error rolled back the entire apply, so a
-     * localized component on such a fork could never be applied at all.
+     * Advisory step errors are reported as warnings and never trigger rollback
+     * or a non-zero exit. Used by the `.ftl` helpers, whose module contract is
+     * graceful degradation: a missing locale jar.mn on a fork without a locale
+     * package must not block a working `.mjs`/`.css` from shipping.
      */
     advisory?: boolean;
 }
@@ -318,3 +320,25 @@ export interface ValidationIssue {
 }
 /** Resolved test-harness selection for a `furnace create` run. */
 export type ResolvedTestStyle = 'mochikit' | 'browser-chrome' | 'xpcshell' | 'none';
+/**
+ * The four paths and the name that every per-component apply, dry-run, FTL
+ * and drift helper needs some subset of.
+ *
+ * Passing these positionally is unsafe: they are all `string`, so any
+ * permutation typechecks against any other and a swap surfaces as a
+ * wrong-directory read at runtime. Helpers take
+ * `Pick<ComponentApplyContext, …>` of exactly the members they read, so a
+ * caller is never asked to invent a value it does not have.
+ */
+export interface ComponentApplyContext {
+    /** Project root — what registration consistency resolves against. */
+    root: string;
+    /** Firefox source directory the component deploys into. */
+    engineDir: string;
+    /** Component name as it appears in `furnace.json`. */
+    name: string;
+    /** Absolute path to the component's authoring directory. */
+    componentDir: string;
+    /** Engine-relative locale directory holding the component's `.ftl`. */
+    ftlDir: string;
+}

package/dist/src/types/furnace.js

@@ -1 +1,19 @@
-export {};
+/**
+ * Operations that can leave a pending-repair marker when they fail to roll
+ * back cleanly. The marker is consumed by `fireforge doctor`, which either
+ * re-runs apply for engine-side failures or validates the current authoring
+ * state before clearing authoring markers. The string is surfaced in doctor's
+ * failure message verbatim, so new entries should be self-explanatory.
+ */
+export const FURNACE_PENDING_REPAIR_OPERATIONS = [
+    'preview-teardown',
+    'apply-rollback',
+    'deploy-rollback',
+    'remove-rollback',
+    'create-rollback',
+    'override-rollback',
+    'scan-rollback',
+    'rename-rollback',
+    'refresh-rollback',
+    'chrome-doc-rollback',
+];

package/dist/src/types/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * Re-exports all type definitions.
  */
-export type { BuildOptions, DiscardOptions, DoctorCheck, DownloadOptions, ExportOptions, FurnaceCreateOptions, FurnaceOverrideOptions, FurnaceRemoveOptions, GlobalOptions, ImportOptions, ImportSummary, PackageOptions, PatchCategory, PatchesManifest, PatchInfo, PatchLintIssue, PatchMetadata, PatchResult, ProjectStatus, ReExportOptions, ResetOptions, RunOptions, SetupOptions, TestOptions, TokenCoverageFileEntry, TokenCoverageReport, } from './commands/index.js';
-export type { BuildConfig, BuildMode, FireForgeConfig, FireForgeState, FirefoxConfig, FirefoxProduct, ProjectLicense, ProjectPaths, WireConfig, } from './config.js';
-export type { ApplyResult, ComponentType, CustomComponentConfig, DryRunAction, FurnaceConfig, FurnaceState, OverrideComponentConfig, OverrideType, RegistrationStatus, ScannedComponent, StepError, SyncResult, ValidationIssue, } from './furnace.js';
+export type {} from './commands/index.js';
+export type { BuildConfig, FireForgeConfig, FirefoxConfig, FirefoxProduct, ProjectLicense, ProjectPaths, WireConfig, } from './config.js';
+export type { ApplyResult, ComponentType, CustomComponentConfig, DryRunAction, FurnaceConfig, FurnaceState, OverrideComponentConfig, OverrideType, StepError, ValidationIssue, } from './furnace.js';