@hominis/fireforge 0.44.4 → 0.46.0

package/dist/src/core/build-jar-escalation.js

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Decides whether a changed `jar.mn` really forces the pre-test build to
+ * escalate from `mach build faster` to a full `mach build`.
+ *
+ * The 0.41.0 rule was `any changed jar.mn ⇒ full build`, which costs ~10
+ * minutes against ~20 s for a chrome-only slice and is paid TWICE per
+ * green/no-change pair on a Furnace-touching slice. A downstream experiment
+ * (two clean runs, 2026-08-29, against 0.44.4) showed the rule is over-broad
+ * for the common case: a jar-only registration of a NEW content file added
+ * to an EXISTING `dist/bin` manifest was installed by a plain
+ * `fireforge build --ui` both times — `faster/install_dist_bin_browser` named
+ * the destination, the file landed in `dist/bin/…/content/browser/` and in
+ * the `.app` bundle, and a plain `fireforge test` fetched it over
+ * `chrome://` at runtime. Neither run escalated, and neither needed to.
+ *
+ * What the experiment did NOT exercise, and what therefore still escalates:
+ *
+ *  - a NEW `jar.mn` file. The install manifest for a manifest the backend
+ *    has never seen does not exist yet, and `mach build faster` consumes
+ *    install manifests rather than regenerating the backend that writes
+ *    them.
+ *  - a manifest whose jar declaration carries a bracketed base-directory
+ *    prefix (`[some/dir] name.jar:`), which redirects the install
+ *    destination away from the default chrome root. That redirect is the
+ *    "non-dist/bin target" half nobody has run.
+ *
+ * Everything else about the rule is unchanged, and every failure to read or
+ * parse a manifest escalates: this narrows a conservative rule, so its
+ * error direction stays the slow-but-correct one.
+ */
+import { join } from 'node:path';
+import { toError } from '../utils/errors.js';
+import { readText } from '../utils/fs.js';
+import { verbose } from '../utils/logger.js';
+import { isJarManifestPath } from './build-audit.js';
+import { getUntrackedFilesInDir } from './git-status.js';
+/**
+ * A jar declaration line: an optional bracketed base-directory prefix, then
+ * the jar name. Matched at column zero because entry lines inside a section
+ * are indented — an indented `foo.jar:` is content, not a declaration.
+ */
+const JAR_DECLARATION_PATTERN = /^(\[[^\]]*\]\s*)?[^\s[\]]+\.jar:\s*$/;
+/** True when the jar declaration redirects the install base directory. */
+function declaresNonDefaultBase(line) {
+    const match = JAR_DECLARATION_PATTERN.exec(line);
+    if (!match)
+        return false;
+    return match[1] !== undefined;
+}
+/**
+ * True when a changed `jar.mn` is NEW to the last successful build.
+ *
+ * Untracked in the engine repo is the reliable tell: a fork's engine tree is
+ * a checkout of upstream with patches applied to the WORKTREE, so a manifest
+ * a patch created is untracked and one that shipped upstream is tracked. The
+ * baseline's fingerprints cannot answer this on their own — they record only
+ * the paths that were DIRTY at the last build, so a clean pre-existing
+ * manifest has no entry either.
+ */
+async function isNewJarManifest(engineDir, path) {
+    const untracked = await getUntrackedFilesInDir(engineDir, path);
+    return untracked.includes(path);
+}
+/**
+ * Evaluates every changed `jar.mn` against the narrowed rule.
+ *
+ * @param engineDir - Absolute engine directory
+ * @param changedPaths - Engine-relative paths changed since the last
+ *   successful build (non-`jar.mn` entries are ignored)
+ * @param baseline - Last successful build's baseline (reserved: the
+ *   fingerprint map already gated which paths reach here)
+ * @returns The escalation decision with per-manifest causes
+ */
+export async function evaluateJarManifestEscalation(engineDir, changedPaths, baseline) {
+    void baseline;
+    const causes = [];
+    const cleared = [];
+    for (const path of changedPaths.filter(isJarManifestPath)) {
+        let isNew;
+        try {
+            isNew = await isNewJarManifest(engineDir, path);
+        }
+        catch (error) {
+            // Fail closed: an unanswerable "is this new?" keeps the old rule.
+            verbose(`jar escalation: could not classify engine/${path} (${toError(error).message}); escalating.`);
+            causes.push({ path, reason: 'could not determine whether the manifest is new' });
+            continue;
+        }
+        if (isNew) {
+            causes.push({ path, reason: 'new jar.mn (no install manifest exists for it yet)' });
+            continue;
+        }
+        let body;
+        try {
+            body = await readText(join(engineDir, path));
+        }
+        catch (error) {
+            verbose(`jar escalation: could not read engine/${path} (${toError(error).message}); escalating.`);
+            causes.push({ path, reason: 'manifest could not be read' });
+            continue;
+        }
+        const redirected = body
+            .split(/\r?\n/)
+            .filter((line) => declaresNonDefaultBase(line))
+            .map((line) => line.trim());
+        if (redirected.length > 0) {
+            causes.push({
+                path,
+                reason: `jar declaration redirects the install base directory (${redirected[0] ?? ''})`,
+            });
+            continue;
+        }
+        cleared.push(path);
+    }
+    return { escalate: causes.length > 0, causes, cleared };
+}
+/**
+ * Renders the operator-facing escalation notice. Names the manifest AND the
+ * reason: "a jar.mn changed" is the sentence that made the previous rule
+ * impossible to argue with from outside.
+ */
+export function formatJarEscalationNotice(decision) {
+    const detail = decision.causes.map((c) => `engine/${c.path} (${c.reason})`).join('; ');
+    return (`Escalating this pre-test build to a full mach build so new install-manifest destinations ` +
+        `are created: ${detail}. A changed jar.mn that merely adds entries to an existing ` +
+        `dist/bin manifest no longer escalates.`);
+}

package/dist/src/core/build-overwrite-guard.js

@@ -143,7 +143,7 @@ export function formatUnexportedDriftWarning(files) {
         const owner = entry.owner !== undefined ? ` (owned by ${entry.owner})` : '';
         return `  ${entry.file} [${entry.classification}]${owner}`;
     });
-    return (`This build is about to rewrite ${String(files.length)} engine file(s) from FireForge-owned ` +
+    return (`This build is about to rewrite ${files.length} engine file(s) from FireForge-owned ` +
         'sources, and their current content matches NEITHER a patch body NOR the pristine ' +
         'baseline — so the edits below are recorded nowhere and the build will destroy them:\n' +
         `${rows.join('\n')}\n\n` +

package/dist/src/core/build-prepare.d.ts

@@ -14,6 +14,11 @@ export interface BuildPreparation {
     reconfigured: boolean;
     /** A changed packaging manifest cannot be safely handled by `mach build faster`. */
     fullBuildRequired?: boolean;
+    /**
+     * Operator-facing explanation for {@link fullBuildRequired}, naming the
+     * manifest and why it still escalates. Absent when no escalation applies.
+     */
+    fullBuildReason?: string;
 }
 /** Options for {@link prepareBuildEnvironment}. */
 export interface PrepareBuildOptions {
@@ -31,8 +36,6 @@ export interface PrepareBuildOptions {
      */
     refuseUnexportedDrift?: boolean | undefined;
 }
-/** Packaging manifests whose graph/destination directories need a full build. */
-export declare function requiresFullBuildForIncrementalTest(path: string): boolean;
 /**
  * Describes an exit code in the shell's 128+N signal convention. Truncated
  * configure/build logs with a signal-shaped exit (e.g. 144 = 128+16, SIGURG

package/dist/src/core/build-prepare.js

@@ -12,6 +12,7 @@ import { pathExists } from '../utils/fs.js';
 import { info, notice, spinner, verbose, warn } from '../utils/logger.js';
 import { isBrandingSetup, setupBranding } from './branding.js';
 import { isBuildInputPath, isJarManifestPath } from './build-audit.js';
+import { evaluateJarManifestEscalation, formatJarEscalationNotice, } from './build-jar-escalation.js';
 import { findUnexportedDriftAtRisk, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
 import { collectChangedEnginePaths, dropPathsMatchingFingerprints } from './engine-changes.js';
 import { applyAllComponents } from './furnace-apply.js';
@@ -23,10 +24,6 @@ import { generateMozconfig, runMachCapture } from './mach.js';
 import { explainMachError } from './mach-error-hints.js';
 /** Path fragments of files whose edits invalidate the recursive-make backend. */
 const BACKEND_INVALIDATING_SUFFIXES = ['moz.build', 'moz.configure', 'Makefile.in'];
-/** Packaging manifests whose graph/destination directories need a full build. */
-export function requiresFullBuildForIncrementalTest(path) {
-    return isJarManifestPath(path);
-}
 /**
  * Build-input manifests changed since the last SUCCESSFUL build — not
  * merely dirty against HEAD. `collectChangedEnginePaths` unions the
@@ -107,6 +104,29 @@ function buildConfigureFailureError(captured) {
         (hints.length > 0 ? `\n\n${hints.map((hint) => `Hint: ${hint}`).join('\n')}` : '') +
         '\n\nBuild stopped because continuing would hide the real configure failure.', 'mach configure');
 }
+/**
+ * Runs the narrowed `jar.mn` escalation rule over this run's changed build
+ * inputs and returns the operator-facing reason when a full build is still
+ * required, or undefined when the narrowing cleared every changed manifest.
+ *
+ * Extracted so `prepareBuildEnvironment` stays under the complexity budget.
+ *
+ * @param engineDir - Absolute engine directory
+ * @param changed - Build inputs changed since the last successful build
+ * @param baseline - Last successful build's baseline
+ */
+async function decideJarEscalation(engineDir, changed, baseline) {
+    // Packaging manifests whose graph/destination directories MAY need a full
+    // build. Path-shape only: `evaluateJarManifestEscalation` decides whether a
+    // given changed manifest actually forces one (a new manifest, or one that
+    // redirects its install base directory), so an entry added to an existing
+    // `dist/bin` manifest no longer costs a ~10-minute build.
+    const decision = await evaluateJarManifestEscalation(engineDir, changed.filter(isJarManifestPath), baseline);
+    if (decision.cleared.length > 0) {
+        verbose(`jar escalation: ${decision.cleared.length} changed jar.mn add entries to an existing dist/bin manifest; not escalating for ${decision.cleared.join(', ')}.`);
+    }
+    return decision.escalate ? formatJarEscalationNotice(decision) : undefined;
+}
 /**
  * Returns true when the file path matches a pattern that forces
  * `mach configure` to regenerate the backend. Exported for testing.
@@ -177,10 +197,13 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
     // work against a stale recursive-make backend.
     let reconfigured = false;
     let fullBuildRequired = false;
+    let fullBuildReason;
     if (options.previousBaseline) {
         const changed = await collectChangedBuildInputs(paths.engine, options.previousBaseline);
         const invalidating = changed.filter(isBackendInvalidatingFile);
-        fullBuildRequired = changed.some(requiresFullBuildForIncrementalTest);
+        const jarEscalation = await decideJarEscalation(paths.engine, changed, options.previousBaseline);
+        fullBuildRequired = jarEscalation !== undefined;
+        fullBuildReason = jarEscalation;
         if (invalidating.length > 0) {
             // Warning severity: this is the "why is this run slow" explanation,
             // and an info-level line does not survive an agent output filter that
@@ -300,5 +323,10 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         mozconfigSpinner.error('Failed to generate mozconfig');
         throw error;
     }
-    return { furnaceApplied, reconfigured, fullBuildRequired };
+    return {
+        furnaceApplied,
+        reconfigured,
+        fullBuildRequired,
+        ...(fullBuildReason !== undefined ? { fullBuildReason } : {}),
+    };
 }

package/dist/src/core/config-paths.d.ts

@@ -2,16 +2,12 @@
  * Project path derivation from a root directory.
  */
 import type { ProjectPaths } from '../types/config.js';
-/** Name of the configuration file */
-export declare const CONFIG_FILENAME = "fireforge.json";
 /** Name of the fireforge data directory */
 export declare const FIREFORGE_DIR = ".fireforge";
-/** Name of the state file */
-export declare const STATE_FILENAME = "state.json";
 /** Supported top-level fireforge.json keys backed by the current schema. */
-export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "test", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment"];
+export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -4,11 +4,11 @@
  */
 import { join } from 'node:path';
 /** Name of the configuration file */
-export const CONFIG_FILENAME = 'fireforge.json';
+const CONFIG_FILENAME = 'fireforge.json';
 /** Name of the fireforge data directory */
 export const FIREFORGE_DIR = '.fireforge';
 /** Name of the state file */
-export const STATE_FILENAME = 'state.json';
+const STATE_FILENAME = 'state.json';
 /** Name of the engine directory */
 const ENGINE_DIR = 'engine';
 /** Name of the patches directory */
@@ -25,6 +25,7 @@ export const SUPPORTED_CONFIG_ROOT_KEYS = [
     'binaryName',
     'firefox',
     'build',
+    'buildAudit',
     'test',
     'externalToolchains',
     'license',
@@ -46,6 +47,7 @@ export const SUPPORTED_CONFIG_PATHS = [
     'firefox.product',
     'firefox.sha256',
     'firefox.candidate',
+    'firefox.allowUnverifiedDownload',
     'build',
     'build.jobs',
     'test',

package/dist/src/core/config-state.d.ts

@@ -8,12 +8,6 @@ import type { FireForgeState } from '../types/config.js';
  * @returns FireForge state
  */
 export declare function loadState(root: string): Promise<FireForgeState>;
-/**
- * Saves the fireforge state.
- * @param root - Root directory of the project
- * @param state - State to save
- */
-export declare function saveState(root: string, state: FireForgeState): Promise<void>;
 /**
  * Updates specific fields in the fireforge state.
  * @param root - Root directory of the project

package/dist/src/core/config-state.js

@@ -24,13 +24,7 @@ function sanitizeProjectState(data) {
     const state = {};
     const issues = [];
     const recoveredFields = [];
-    const stringFields = [
-        'brand',
-        'buildMode',
-        'lastBuild',
-        'downloadedVersion',
-        'baseCommit',
-    ];
+    const stringFields = ['brand', 'buildMode', 'downloadedVersion', 'baseCommit'];
     for (const key of stringFields) {
         const value = data[key];
         if (value === undefined) {
@@ -132,18 +126,6 @@ export async function loadState(root) {
     const paths = getProjectPaths(root);
     return loadStateFromPath(paths.state);
 }
-/**
- * Saves the fireforge state.
- * @param root - Root directory of the project
- * @param state - State to save
- */
-export async function saveState(root, state) {
-    const paths = getProjectPaths(root);
-    const validatedState = validateFireForgeState(state);
-    await withStateFileLock(paths.state, async () => {
-        await writeJson(paths.state, validatedState);
-    });
-}
 /**
  * Updates specific fields in the fireforge state.
  * @param root - Root directory of the project

package/dist/src/core/config-validate-build-audit.d.ts

@@ -0,0 +1,8 @@
+import type { BuildAuditConfig } from '../types/config.js';
+/**
+ * Parses the `buildAudit` block.
+ *
+ * @param raw - The raw `buildAudit` value from fireforge.json
+ * @returns The validated block
+ */
+export declare function parseBuildAuditConfig(raw: unknown): BuildAuditConfig;

package/dist/src/core/config-validate-build-audit.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Validation for the `buildAudit` block.
+ *
+ * Split out of `config-validate.ts`, which is at its per-file line budget,
+ * following the `config-validate-file-size.ts` precedent.
+ *
+ * The rules here are stricter than the schema strictly needs, and
+ * deliberately so: every entry is a standing suppression of a warning the
+ * audit would otherwise raise. A malformed one must fail loudly at config
+ * load rather than quietly admit nothing (leaving the operator believing a
+ * path is carved out) or quietly admit everything.
+ */
+import { ConfigError } from '../errors/config.js';
+import { isContainedRelativePath } from '../utils/paths.js';
+import { isObject } from '../utils/validation.js';
+/** Parses one `buildAudit.unpackaged[]` entry. */
+function parseUnpackagedEntry(raw, field) {
+    if (!isObject(raw)) {
+        throw new ConfigError(`Config field "${field}" must be a plain object with "path" and "reason"`);
+    }
+    for (const key of Object.keys(raw)) {
+        if (key !== 'path' && key !== 'reason') {
+            throw new ConfigError(`Config field "${field}" has unknown key "${key}"`);
+        }
+    }
+    const path = raw['path'];
+    if (typeof path !== 'string' || path.trim().length === 0) {
+        throw new ConfigError(`Config field "${field}.path" must be a non-empty string`);
+    }
+    if (!isContainedRelativePath(path)) {
+        throw new ConfigError(`Config field "${field}.path" must be an engine-relative path`);
+    }
+    if (path.includes('**')) {
+        // A `**` carve-out admits an entire subtree, which is how a reviewed
+        // exception quietly becomes a blanket one. `*` inside a single segment
+        // is enough for the shapes this exists for.
+        throw new ConfigError(`Config field "${field}.path" must not use "**" — a carve-out may glob within one path segment only`);
+    }
+    const reason = raw['reason'];
+    if (typeof reason !== 'string' || reason.trim().length === 0) {
+        // Required on purpose: this is the one audit class FireForge cannot
+        // derive from the tree, so the declaration IS the evidence.
+        throw new ConfigError(`Config field "${field}.reason" must be a non-empty string explaining why the file is never packaged`);
+    }
+    return { path, reason };
+}
+/**
+ * Parses the `buildAudit` block.
+ *
+ * @param raw - The raw `buildAudit` value from fireforge.json
+ * @returns The validated block
+ */
+export function parseBuildAuditConfig(raw) {
+    if (!isObject(raw)) {
+        throw new ConfigError('Config field "buildAudit" must be a plain object');
+    }
+    for (const key of Object.keys(raw)) {
+        if (key !== 'unpackaged') {
+            throw new ConfigError(`Config field "buildAudit" has unknown key "${key}"`);
+        }
+    }
+    const unpackaged = raw['unpackaged'];
+    if (unpackaged === undefined)
+        return {};
+    if (!Array.isArray(unpackaged)) {
+        throw new ConfigError('Config field "buildAudit.unpackaged" must be an array');
+    }
+    const entries = unpackaged.map((entry, index) => parseUnpackagedEntry(entry, `buildAudit.unpackaged[${String(index)}]`));
+    const seen = new Set();
+    for (const entry of entries) {
+        if (seen.has(entry.path)) {
+            // Two rows for one path means one of the two reasons is not the
+            // operative one, and nothing says which.
+            throw new ConfigError(`Config field "buildAudit.unpackaged" declares "${entry.path}" more than once`);
+        }
+        seen.add(entry.path);
+    }
+    return { unpackaged: entries };
+}

package/dist/src/core/config-validate-file-size.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Validation for `patchLint.fileSizeThresholds`.
+ *
+ * Split out of `config-validate.ts`, which is at its per-file line budget.
+ */
+import type { PatchLintFileSizeThresholds } from '../types/config.js';
+/**
+ * Parses the `patchLint.fileSizeThresholds` block. Ordering is validated
+ * against the MERGED triple (overrides on top of the defaults), so setting
+ * only `warning` cannot land below the default `notice`.
+ */
+export declare function parsePatchLintFileSizeThresholds(raw: unknown): PatchLintFileSizeThresholds;

package/dist/src/core/config-validate-file-size.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Validation for `patchLint.fileSizeThresholds`.
+ *
+ * Split out of `config-validate.ts`, which is at its per-file line budget.
+ */
+import { ConfigError } from '../errors/config.js';
+import { isObject } from '../utils/validation.js';
+import { DEFAULT_FILE_SIZE_THRESHOLDS } from './patch-lint-file-size.js';
+/**
+ * Parses one `patchLint.fileSizeThresholds.<tier>` triple. Every field is
+ * optional and merges over the built-in default; values must be positive
+ * integers and stay ordered `notice <= warning <= error`, because an
+ * out-of-order triple would silently disable a band instead of failing.
+ */
+function parseFileSizeTier(raw, field) {
+    if (!isObject(raw)) {
+        throw new ConfigError(`Config field "${field}" must be a plain object`);
+    }
+    const out = {};
+    for (const key of ['notice', 'warning', 'error']) {
+        const value = raw[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+            throw new ConfigError(`Config field "${field}.${key}" must be a positive integer`);
+        }
+        out[key] = value;
+    }
+    for (const key of Object.keys(raw)) {
+        if (!['notice', 'warning', 'error'].includes(key)) {
+            throw new ConfigError(`Config field "${field}" has unknown key "${key}"`);
+        }
+    }
+    return out;
+}
+/**
+ * Parses the `patchLint.fileSizeThresholds` block. Ordering is validated
+ * against the MERGED triple (overrides on top of the defaults), so setting
+ * only `warning` cannot land below the default `notice`.
+ */
+export function parsePatchLintFileSizeThresholds(raw) {
+    if (!isObject(raw)) {
+        throw new ConfigError('Config field "patchLint.fileSizeThresholds" must be a plain object');
+    }
+    const out = {};
+    for (const tier of ['general', 'test']) {
+        const value = raw[tier];
+        if (value === undefined)
+            continue;
+        const parsed = parseFileSizeTier(value, `patchLint.fileSizeThresholds.${tier}`);
+        const merged = { ...DEFAULT_FILE_SIZE_THRESHOLDS[tier], ...parsed };
+        if (merged.notice > merged.warning || merged.warning > merged.error) {
+            throw new ConfigError(`Config field "patchLint.fileSizeThresholds.${tier}" must satisfy notice <= warning <= error ` +
+                `(resolved: ${merged.notice}/${merged.warning}/${merged.error})`);
+        }
+        out[tier] = parsed;
+    }
+    for (const key of Object.keys(raw)) {
+        if (key !== 'general' && key !== 'test') {
+            throw new ConfigError(`Config field "patchLint.fileSizeThresholds" has unknown key "${key}"`);
+        }
+    }
+    return out;
+}

package/dist/src/core/config-validate-patch-policy.d.ts

@@ -2,6 +2,6 @@
  * Validation helpers for `fireforge.json#patchPolicy`.
  */
 import type { PatchPolicyConfig } from '../types/config.js';
-import { parseObject } from '../utils/parse.js';
+import { type ParsedRecord } from '../utils/parse.js';
 /** Parses and validates the optional patch policy config block. */
-export declare function parsePatchPolicyBlock(rec: ReturnType<typeof parseObject>): PatchPolicyConfig;
+export declare function parsePatchPolicyBlock(rec: ParsedRecord): PatchPolicyConfig;

package/dist/src/core/config-validate-patch-policy.js

@@ -108,7 +108,7 @@ function parsePatchPolicyReservedRange(raw, label) {
     return {
         from,
         to,
-        allowed: allowedRaw.map((entry, index) => parseReservedAllowedPatch(entry, `${label}.allowed[${String(index)}]`)),
+        allowed: allowedRaw.map((entry, index) => parseReservedAllowedPatch(entry, `${label}.allowed[${index}]`)),
     };
 }
 function assertPolicyRangesDoNotOverlap(ranges, label) {
@@ -160,14 +160,14 @@ export function parsePatchPolicyBlock(rec) {
     if (!Array.isArray(rangesRaw) || rangesRaw.length === 0) {
         throw new ConfigError('Config field "patchPolicy.ranges" must be a non-empty array');
     }
-    out.ranges = rangesRaw.map((entry, index) => parsePatchPolicyRange(entry, `patchPolicy.ranges[${String(index)}]`));
+    out.ranges = rangesRaw.map((entry, index) => parsePatchPolicyRange(entry, `patchPolicy.ranges[${index}]`));
     assertPolicyRangesDoNotOverlap(out.ranges, 'patchPolicy.ranges');
     const reservedRangesRaw = rec.raw('reservedRanges');
     if (reservedRangesRaw !== undefined) {
         if (!Array.isArray(reservedRangesRaw)) {
             throw new ConfigError('Config field "patchPolicy.reservedRanges" must be an array');
         }
-        out.reservedRanges = reservedRangesRaw.map((entry, index) => parsePatchPolicyReservedRange(entry, `patchPolicy.reservedRanges[${String(index)}]`));
+        out.reservedRanges = reservedRangesRaw.map((entry, index) => parsePatchPolicyReservedRange(entry, `patchPolicy.reservedRanges[${index}]`));
         assertPolicyRangesDoNotOverlap(out.reservedRanges, 'patchPolicy.reservedRanges');
     }
     return out;

package/dist/src/core/config-validate-test-toolchains.d.ts

@@ -1,6 +1,6 @@
 import type { FireForgeConfig } from '../types/config.js';
-import { parseObject } from '../utils/parse.js';
-type ConfigRecord = ReturnType<typeof parseObject>;
+import type { ParsedRecord } from '../utils/parse.js';
+type ConfigRecord = ParsedRecord;
 /** Parses the optional `test` block. */
 export declare function parseTestBlock(rec: ConfigRecord, config: FireForgeConfig): void;
 /** Parses optional project-specific external toolchain doctor probes. */

package/dist/src/core/config-validate-test-toolchains.js

@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { ConfigError } from '../errors/config.js';
-import { parseObject } from '../utils/parse.js';
 import { isContainedRelativePath } from '../utils/paths.js';
 import { isObject } from '../utils/validation.js';
 function optionalConfigString(rec, key, label) {
@@ -58,16 +57,16 @@ export function parseExternalToolchainsBlock(rec, config) {
     }
     config.externalToolchains = raw.map((entry, index) => {
         if (!isObject(entry)) {
-            throw new ConfigError(`Config field "externalToolchains[${String(index)}]" must be an object`);
+            throw new ConfigError(`Config field "externalToolchains[${index}]" must be an object`);
         }
         const item = entry;
         const name = item['name'];
         if (typeof name !== 'string' || name.trim() === '') {
-            throw new ConfigError(`Config field "externalToolchains[${String(index)}].name" must be a non-empty string`);
+            throw new ConfigError(`Config field "externalToolchains[${index}].name" must be a non-empty string`);
         }
         const tools = item['tools'];
         if (!Array.isArray(tools) || tools.length === 0) {
-            throw new ConfigError(`Config field "externalToolchains[${String(index)}].tools" must be a non-empty array`);
+            throw new ConfigError(`Config field "externalToolchains[${index}].tools" must be a non-empty array`);
         }
         return {
             name,
@@ -76,7 +75,7 @@ export function parseExternalToolchainsBlock(rec, config) {
     });
 }
 function parseExternalToolRequirement(tool, index, toolIndex) {
-    const label = `externalToolchains[${String(index)}].tools[${String(toolIndex)}]`;
+    const label = `externalToolchains[${index}].tools[${toolIndex}]`;
     if (!isObject(tool)) {
         throw new ConfigError(`Config field "${label}" must be an object`);
     }