@hominis/fireforge 0.44.4 → 0.46.0

package/dist/src/commands/doctor-check-core.d.ts

@@ -96,12 +96,6 @@ export interface DoctorCheckDefinition {
      */
     fix?: string;
 }
-/**
- * Resolves a {@link DoctorCheck} to its effective severity. `severity` is the
- * single source of truth; this exists so every consumer of a
- * `DoctorCheck[]` reads it the same way.
- */
-export declare function resolveDoctorSeverity(check: DoctorCheck): 'ok' | 'warning' | 'error';
 /**
  * Builds a DoctorCheck object representing a successful "OK" check.
  */

package/dist/src/commands/doctor-check-core.js

@@ -4,14 +4,6 @@
  * `doctor.ts` and sibling check modules. Kept separate so registries can import
  * these symbols without creating cycles through `doctor.ts`.
  */
-/**
- * Resolves a {@link DoctorCheck} to its effective severity. `severity` is the
- * single source of truth; this exists so every consumer of a
- * `DoctorCheck[]` reads it the same way.
- */
-export function resolveDoctorSeverity(check) {
-    return check.severity;
-}
 /**
  * Builds a DoctorCheck object representing a successful "OK" check.
  */

package/dist/src/commands/doctor-orphaned-harness.d.ts

@@ -27,12 +27,6 @@ export interface OrphanedHarnessWorker {
     cpuSeconds: number;
     command: string;
 }
-/**
- * Parses a `ps` TIME (accumulated CPU) value. Implemented in terms of
- * {@link parsePsDuration} — `time=` and `etime=` share one grammar, and a
- * second copy is how the two would drift.
- */
-export declare function parseCpuTime(time: string): number;
 /**
  * Scans `ps -axo pid=,ppid=,time=,command=` output for orphaned harness
  * workers: PPID 1 (reparented to init/launchd), a multiprocessing

package/dist/src/commands/doctor-orphaned-harness.js

@@ -29,14 +29,6 @@ import { ok, warning } from './doctor-check-core.js';
 const HARNESS_WORKER_COMMAND_PATTERN = /multiprocessing\.(?:spawn|forkserver)\b|multiprocessing\.resource_tracker|from multiprocessing\.\w+ import/;
 /** Minimum accumulated CPU time before a match is reported (10 minutes). */
 const DEFAULT_MIN_CPU_SECONDS = 600;
-/**
- * Parses a `ps` TIME (accumulated CPU) value. Implemented in terms of
- * {@link parsePsDuration} — `time=` and `etime=` share one grammar, and a
- * second copy is how the two would drift.
- */
-export function parseCpuTime(time) {
-    return parsePsDuration(time);
-}
 /**
  * Scans `ps -axo pid=,ppid=,time=,command=` output for orphaned harness
  * workers: PPID 1 (reparented to init/launchd), a multiprocessing
@@ -57,7 +49,7 @@ export function findOrphanedHarnessWorkers(psOutput, minCpuSeconds = DEFAULT_MIN
             continue;
         if (!HARNESS_WORKER_COMMAND_PATTERN.test(command))
             continue;
-        const cpuSeconds = parseCpuTime(cpuTime);
+        const cpuSeconds = parsePsDuration(cpuTime);
         if (Number.isNaN(cpuSeconds) || cpuSeconds < minCpuSeconds)
             continue;
         workers.push({ pid, ppid, cpuTime, cpuSeconds, command });
@@ -68,7 +60,7 @@ export function findOrphanedHarnessWorkers(psOutput, minCpuSeconds = DEFAULT_MIN
 async function listSystemProcesses() {
     const result = await exec('ps', ['-axo', 'pid=,ppid=,time=,command='], { timeout: 10000 });
     if (result.exitCode !== 0) {
-        throw new Error(`ps exited ${String(result.exitCode)}`);
+        throw new Error(`ps exited ${result.exitCode}`);
     }
     return result.stdout;
 }
@@ -86,10 +78,10 @@ async function runOrphanedHarnessCheck() {
         return ok(CHECK_NAME);
     }
     const rows = orphans
-        .map((w) => `PID ${String(w.pid)} (CPU time ${w.cpuTime}): ${w.command.slice(0, 160)}`)
+        .map((w) => `PID ${w.pid} (CPU time ${w.cpuTime}): ${w.command.slice(0, 160)}`)
         .join('; ');
     const pids = orphans.map((w) => String(w.pid)).join(' ');
-    return warning(CHECK_NAME, `Found ${String(orphans.length)} orphaned Python multiprocessing worker(s) — PPID 1 with ` +
+    return warning(CHECK_NAME, `Found ${orphans.length} orphaned Python multiprocessing worker(s) — PPID 1 with ` +
         `high accumulated CPU time, the shape a test harness that died at startup leaves behind ` +
         `(field incident: one such worker busy-spun for ~26 days). ${rows}`, `These look like workers orphaned by a crashed test harness. Verify each command line, ` +
         `then terminate with: kill ${pids} (or kill -9 if a process survives). ` +

package/dist/src/commands/doctor-post-rebase-audit.js

@@ -88,7 +88,7 @@ async function runPostRebaseAudit(ctx) {
     }
     const browserTomls = await collectBrowserTomlFiles(engineDir);
     if (browserTomls.unreadable.length > 0) {
-        issues.push(`could not read ${String(browserTomls.unreadable.length)} ` +
+        issues.push(`could not read ${browserTomls.unreadable.length} ` +
             `${browserTomls.unreadable.length === 1 ? 'directory' : 'directories'} under ` +
             `browser/base/content/test: ${browserTomls.unreadable.join(', ')}`);
     }

package/dist/src/commands/doctor-source-pin.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Doctor check comparing the CONFIGURED Firefox source pin against what the
+ * engine checkout actually is.
+ *
+ * `fireforge source set` lands `firefox.version` inside `fireforge.json`,
+ * beside hand-maintained policy sections. That is convenient and it is also
+ * the whole problem: a routine `git checkout -- fireforge.json` — undoing an
+ * accidental reformat, say — silently reverts an uncommitted pin along with
+ * it, and nothing afterwards reports that the pin and the checkout have
+ * diverged. The tell in the field was a gate flipping green with no change
+ * that should have made it green.
+ *
+ * This is deliberately not a lock and not a refusal: a tree may legitimately
+ * be mid-migration between two versions. It only makes a mismatched tree
+ * VISIBLE, which is all that was missing.
+ *
+ * Scope is limited by what is actually recorded. `firefox.product`,
+ * `firefox.sha256` and `firefox.candidate` have NO counterpart anywhere on
+ * disk — `.fireforge/state.json` records only `downloadedVersion` and
+ * `baseCommit` — so there is nothing to compare them against and the check
+ * says nothing about them rather than implying it verified them.
+ */
+import type { DoctorCheckDefinition } from './doctor-check-core.js';
+/**
+ * Pin-vs-checkout reporting. Needs the loaded config, so it declares the
+ * dependency on the config check that populates `ctx.config`; skipped
+ * entirely without an engine, where there is nothing to compare.
+ */
+export declare const SOURCE_PIN_DOCTOR_CHECK: DoctorCheckDefinition;

package/dist/src/commands/doctor-source-pin.js

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Doctor check comparing the CONFIGURED Firefox source pin against what the
+ * engine checkout actually is.
+ *
+ * `fireforge source set` lands `firefox.version` inside `fireforge.json`,
+ * beside hand-maintained policy sections. That is convenient and it is also
+ * the whole problem: a routine `git checkout -- fireforge.json` — undoing an
+ * accidental reformat, say — silently reverts an uncommitted pin along with
+ * it, and nothing afterwards reports that the pin and the checkout have
+ * diverged. The tell in the field was a gate flipping green with no change
+ * that should have made it green.
+ *
+ * This is deliberately not a lock and not a refusal: a tree may legitimately
+ * be mid-migration between two versions. It only makes a mismatched tree
+ * VISIBLE, which is all that was missing.
+ *
+ * Scope is limited by what is actually recorded. `firefox.product`,
+ * `firefox.sha256` and `firefox.candidate` have NO counterpart anywhere on
+ * disk — `.fireforge/state.json` records only `downloadedVersion` and
+ * `baseCommit` — so there is nothing to compare them against and the check
+ * says nothing about them rather than implying it verified them.
+ */
+import { getFirefoxVersion } from '../core/firefox.js';
+import { toError } from '../utils/errors.js';
+import { ok, warning } from './doctor-check-core.js';
+const CHECK_NAME = 'Source pin matches engine';
+/**
+ * Reports the configured pin beside the two facts that can contradict it:
+ * the engine's own `browser/config/version.txt`, and the version the last
+ * download recorded into state.
+ */
+async function runSourcePinCheck(ctx) {
+    const pinned = ctx.config?.firefox.version;
+    if (pinned === undefined) {
+        // The config failed to load (its own check already reported that), so
+        // there is no pin to compare. Silence beats a second complaint.
+        return ok(CHECK_NAME, 'Skipped: no configured source version');
+    }
+    let actual;
+    try {
+        // A blank or whitespace-only version.txt (a truncated write, a partial
+        // extraction) carries no version to compare — treat it as absent rather
+        // than reporting the engine as being at version "".
+        actual = (await getFirefoxVersion(ctx.paths.engine))?.trim() || undefined;
+    }
+    catch (error) {
+        // Best-effort: an unreadable version.txt is not a pin mismatch, and a
+        // diagnostic must never turn into a failure of its own.
+        return ok(CHECK_NAME, `Configured ${pinned}; engine version could not be read (${toError(error).message})`);
+    }
+    const downloaded = ctx.state.downloadedVersion;
+    const mismatches = [];
+    if (actual !== undefined && actual !== pinned) {
+        mismatches.push(`engine/browser/config/version.txt reads ${actual}`);
+    }
+    if (downloaded !== undefined && downloaded !== pinned) {
+        mismatches.push(`the last download recorded ${downloaded}`);
+    }
+    if (mismatches.length === 0) {
+        const observed = actual ?? downloaded;
+        return ok(CHECK_NAME, observed === undefined
+            ? `Configured ${pinned}; no engine version to compare against yet`
+            : `Configured ${pinned}, engine ${observed}`);
+    }
+    return warning(CHECK_NAME, `fireforge.json pins Firefox ${pinned}, but ${mismatches.join(' and ')}.`, 'If the pin is right, run "fireforge download" to bring the checkout to it. If the ' +
+        'CHECKOUT is right, run "fireforge source set --version <version>" to record it — a ' +
+        'pin set but not committed is lost by any revert of fireforge.json, which is the most ' +
+        'common way these diverge.');
+}
+/**
+ * Pin-vs-checkout reporting. Needs the loaded config, so it declares the
+ * dependency on the config check that populates `ctx.config`; skipped
+ * entirely without an engine, where there is nothing to compare.
+ */
+export const SOURCE_PIN_DOCTOR_CHECK = {
+    name: CHECK_NAME,
+    skipIf: (ctx) => !ctx.engineExists,
+    dependsOn: ['fireforge.json is valid'],
+    run: runSourcePinCheck,
+};

package/dist/src/commands/doctor.d.ts

@@ -21,6 +21,8 @@ export declare function validateCheckDependencies(checks: readonly DoctorCheckDe
  * context-population dependency chain (see {@link DOCTOR_CHECKS}) must
  * also update this list, which gives us a single place to notice and
  * think through the consequences.
+ *
+ * @internal Exported only so tests can reach it; not part of the public surface.
  */
 export declare const DOCTOR_CHECK_ORDER: readonly string[];
 /**

package/dist/src/commands/doctor.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { Command } from 'commander';
-import { configExists, getProjectPaths, loadConfig, loadState, updateState, } from '../core/config.js';
+import { configExists, getProjectPaths, loadConfig, loadState } from '../core/config.js';
 import { furnaceConfigExists as checkFurnaceConfigExists } from '../core/furnace-config.js';
 import { getCurrentBranch, getHead, isGitRepository, isMissingHeadError } from '../core/git.js';
 import { ensureGit } from '../core/git-base.js';
@@ -14,13 +14,15 @@ import { pathExists } from '../utils/fs.js';
 import { error, info, intro, outro, success, warn } from '../utils/logger.js';
 import { addWaitLockOption } from '../utils/options.js';
 import { findExecutable } from '../utils/process.js';
-import { failure, ok, resolveDoctorSeverity, warning } from './doctor-check-core.js';
+import { failure, ok, warning } from './doctor-check-core.js';
 import { EXTERNAL_TOOLCHAIN_DOCTOR_CHECK } from './doctor-external-toolchains.js';
 import { FURNACE_DOCTOR_CHECKS } from './doctor-furnace.js';
 import { ORPHANED_HARNESS_DOCTOR_CHECK } from './doctor-orphaned-harness.js';
 import { PATCH_MANIFEST_CONSISTENCY_CHECK } from './doctor-patch-manifest.js';
 import { POST_REBASE_AUDIT_CHECK } from './doctor-post-rebase-audit.js';
+import { SOURCE_PIN_DOCTOR_CHECK } from './doctor-source-pin.js';
 import { inspectEngineWorkingTree } from './doctor-working-tree.js';
+import { clearPendingResolution } from './pending-resolution.js';
 import { collectPatchQueueHealth } from './verify.js';
 /**
  * Runs a single check definition, converting thrown errors into
@@ -201,16 +203,13 @@ const DOCTOR_CHECKS = [
                 if (health.errorCount > 0) {
                     return failure('Pending Resolution', `Refusing to clear pending resolution for ${patchFilename}: patch queue health check found ${health.errorCount} error(s).`, 'Run "fireforge verify" for details, fix the queue, then retry "fireforge doctor --clear-resolution".');
                 }
-                await updateState(ctx.projectRoot, (current) => {
-                    const next = { ...current };
-                    delete next.pendingResolution;
-                    return next;
-                });
+                await clearPendingResolution(ctx.projectRoot);
                 return ok('Pending Resolution');
             }
             return failure('Pending Resolution', `You are currently resolving a conflict for patch ${patchFilename}.`, 'Build and Export commands may behave unexpectedly until "fireforge resolve" is completed. If the queue now verifies cleanly, run "fireforge doctor --clear-resolution" to discard the stale marker.');
         },
     },
+    SOURCE_PIN_DOCTOR_CHECK,
     {
         name: 'Engine is git repository',
         skipIf: (ctx) => !ctx.engineExists,
@@ -320,6 +319,8 @@ validateCheckDependencies(DOCTOR_CHECKS);
  * context-population dependency chain (see {@link DOCTOR_CHECKS}) must
  * also update this list, which gives us a single place to notice and
  * think through the consequences.
+ *
+ * @internal Exported only so tests can reach it; not part of the public surface.
  */
 export const DOCTOR_CHECK_ORDER = DOCTOR_CHECKS.map((check) => check.name);
 /**
@@ -334,7 +335,7 @@ export function reportDoctorResults(checks, mutations = []) {
     let warningCount = 0;
     let failedCount = 0;
     for (const check of checks) {
-        const severity = resolveDoctorSeverity(check);
+        const severity = check.severity;
         if (severity === 'warning') {
             warn(`! ${check.name}: ${check.message}`);
             if (check.fix) {

package/dist/src/commands/download.js

@@ -110,11 +110,6 @@ function closeRestoreSpinner(restoreSpinner, result) {
     }
     restoreSpinner.stop('Patch-touched files restored');
 }
-async function clearStaleFurnaceApplyState(projectRoot) {
-    // --force installs a new baseCommit, which invalidates every applied
-    // checksum in furnace-state.json.
-    await clearAppliedFurnaceState(projectRoot);
-}
 async function activateReplacementEngine(args) {
     const { engineDir, replacementDir, backupDir } = args;
     await rename(engineDir, backupDir);
@@ -155,28 +150,39 @@ async function restorePreviousEngine(args) {
     }
 }
 async function downloadAndExtractFirefox(args) {
-    const { version, product, engineDir, cacheDir, sha256, candidate } = args;
+    const { version, product, engineDir, cacheDir, sha256, candidate, allowUnverifiedDownload } = args;
     let s = spinner(`Downloading Firefox ${version}...`);
     let lastPercent = 0;
     const phaseState = { value: 'download' };
     try {
-        await downloadFirefoxSource(version, product, engineDir, cacheDir, (downloaded, total) => {
-            if (total <= 0)
-                return;
-            const percent = Math.floor((downloaded / total) * 100);
-            if (percent !== lastPercent && percent % 5 === 0) {
-                s.message(`Downloading Firefox ${version}... ${percent}% (${formatBytes(downloaded)} / ${formatBytes(total)})`);
-                lastPercent = percent;
-            }
-        }, (phase) => {
-            if (phase === 'extract' && phaseState.value === 'download') {
-                s.stop(`Firefox ${version} downloaded`);
-                phaseState.value = 'extract';
-                s = spinner(`Extracting Firefox ${version}... (decompressing ~600 MB of source; typically 30–90s)`);
-            }
-        }, sha256, (message) => {
-            s.message(message);
-        }, candidate);
+        await downloadFirefoxSource({
+            version: version,
+            product: product,
+            destDir: engineDir,
+            cacheDir: cacheDir,
+            onProgress: (downloaded, total) => {
+                if (total <= 0)
+                    return;
+                const percent = Math.floor((downloaded / total) * 100);
+                if (percent !== lastPercent && percent % 5 === 0) {
+                    s.message(`Downloading Firefox ${version}... ${percent}% (${formatBytes(downloaded)} / ${formatBytes(total)})`);
+                    lastPercent = percent;
+                }
+            },
+            onPhase: (phase) => {
+                if (phase === 'extract' && phaseState.value === 'download') {
+                    s.stop(`Firefox ${version} downloaded`);
+                    phaseState.value = 'extract';
+                    s = spinner(`Extracting Firefox ${version}... (decompressing ~600 MB of source; typically 30–90s)`);
+                }
+            },
+            expectedSha256: sha256,
+            onPhaseProgress: (message) => {
+                s.message(message);
+            },
+            candidate: candidate,
+            integrity: allowUnverifiedDownload === undefined ? undefined : { allowUnverifiedDownload },
+        });
         s.stop(phaseState.value === 'extract'
             ? `Firefox ${version} extracted`
             : `Firefox ${version} downloaded`);
@@ -235,7 +241,9 @@ async function initializeDownloadedEngine(args) {
             throw error;
         }
         if (replacementActivated) {
-            await clearStaleFurnaceApplyState(projectRoot);
+            // --force installs a new baseCommit, which invalidates every applied
+            // checksum in furnace-state.json.
+            await clearAppliedFurnaceState(projectRoot);
         }
         await updateState(projectRoot, {
             downloadedVersion: version,
@@ -389,6 +397,9 @@ export async function downloadCommand(projectRoot, options) {
                 ...(config.firefox.candidate !== undefined
                     ? { candidate: config.firefox.candidate }
                     : {}),
+                ...(config.firefox.allowUnverifiedDownload !== undefined
+                    ? { allowUnverifiedDownload: config.firefox.allowUnverifiedDownload }
+                    : {}),
             });
             if (replacementEngineDir && backupEngineDir) {
                 warn('Activating replacement engine directory...');

package/dist/src/commands/export-all.js

@@ -19,10 +19,20 @@ import { info, intro, outro, spinner } from '../utils/logger.js';
 import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../utils/options.js';
 import { renderDryRunPreview } from './export-flow.js';
 import { autoFixLicenseHeaders, promptExportPatchMetadata, runPatchLint, runSupersedeAndOverlapGates, } from './export-shared.js';
+/**
+ * The engine paths an export-all entry owns: its current file plus, for a
+ * rename, the path it came from. Spelled once because three call sites had
+ * copied the same `filter((value): value is string => !!value)` narrowing.
+ * @param entry - Export entry carrying `file` and an optional `originalPath`.
+ * @returns Both paths when the entry was renamed, otherwise just `file`.
+ */
+function ownedPaths(entry) {
+    return [entry.file, entry.originalPath].filter((value) => !!value);
+}
 async function checkBrandingManagedFiles(paths, config) {
     const changedFiles = await getWorkingTreeStatus(paths.engine);
     const brandingManagedFiles = changedFiles
-        .flatMap((entry) => [entry.file, entry.originalPath].filter((value) => !!value))
+        .flatMap((entry) => ownedPaths(entry))
         .filter((file) => isBrandingManagedPath(file, config.binaryName));
     if (brandingManagedFiles.length > 0) {
         throw new GeneralError('Export-all refuses to capture tool-managed branding changes by default.\n\n' +
@@ -52,7 +62,7 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
     const rawStatus = await getWorkingTreeStatus(paths.engine);
     const changedFiles = await expandUntrackedDirectoryEntries(paths.engine, rawStatus);
     const furnaceManagedFiles = changedFiles
-        .flatMap((entry) => [entry.file, entry.originalPath].filter((value) => !!value))
+        .flatMap((entry) => ownedPaths(entry))
         .filter((file) => [...prefixes].some((prefix) => file.startsWith(prefix)));
     if (furnaceManagedFiles.length === 0)
         return new Set();
@@ -196,7 +206,7 @@ export async function exportAllCommand(projectRoot, options = {}) {
         const allChanged = await expandUntrackedDirectoryEntries(paths.engine, rawChanged);
         const nonFurnacePaths = [
             ...new Set(allChanged
-                .flatMap((entry) => [entry.file, entry.originalPath].filter((value) => !!value))
+                .flatMap((entry) => ownedPaths(entry))
                 .filter((file) => !furnaceExcluded.has(file))),
         ].sort();
         scopedExportPaths = nonFurnacePaths;
@@ -254,7 +264,14 @@ export async function exportAllCommand(projectRoot, options = {}) {
         const patchQueueCtx = (await pathExists(paths.patches))
             ? await buildPatchQueueContext(paths.patches)
             : undefined;
-        await runPatchLint(paths.engine, filesAffected, diff, config, options.skipLint, patchQueueCtx);
+        await runPatchLint({
+            engineDir: paths.engine,
+            filesAffected,
+            diffContent: diff,
+            config,
+            skipLint: options.skipLint,
+            patchQueueCtx,
+        });
         // Dry-run: enumerate filename, metadata, and supersede coverage without
         // writing. Mirrors `fireforge export --dry-run` so the same preview
         // surface is available for both targeted and aggregate exports. Runs

package/dist/src/commands/export-flow.js

@@ -10,14 +10,12 @@
 import { join } from 'node:path';
 import {} from '../core/destructive.js';
 import { detectMovedCodeOverlaps, formatAdoptThenSplitRemedy, } from '../core/export-moved-code-shape.js';
-import { normalizePatchArtifact } from '../core/patch-artifact-normalize.js';
-import { findAllPatchesForFilesWithDetails, patchNameSlug, planExport, } from '../core/patch-export.js';
-import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, detectNewFilesInDiff, lintPatchQueue, } from '../core/patch-lint.js';
+import { buildPlanExportInput, findAllPatchesForFilesWithDetails, patchNameSlug, planExport, } from '../core/patch-export.js';
+import { buildPatchQueueContext, lintPatchQueue } from '../core/patch-lint.js';
 import { withPatchDirectoryLock } from '../core/patch-lock.js';
 import { addPatchToManifest, loadPatchesManifest, loadPatchesManifestForWrite, renumberPatchesInManifest, resolvePatchIdentifier, savePatchesManifest, } from '../core/patch-manifest.js';
-import { requirePatchOrder } from '../core/patch-parse.js';
+import { formatPatchOrder, requirePatchOrder } from '../core/patch-parse.js';
 import { applyRenameMapToManifest, buildProjectedManifest, enforcePatchPolicy, } from '../core/patch-policy.js';
-import { extractNewFileContentFromDiff } from '../core/patch-transform.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText, removeFile, writeText } from '../utils/fs.js';
@@ -25,6 +23,8 @@ import { info, warn } from '../utils/logger.js';
 import { groupProjectedPlacementErrors } from './export-placement-conflicts.js';
 import { assertPlacementAvoidsReservedRanges } from './export-placement-policy.js';
 import { findPartialOwnershipOverlap } from './export-shared.js';
+import { projectEntryBody } from './patch/entry-projection.js';
+import { getSortedRenameEntries, renameMapsEqual } from './patch-rename-map.js';
 function buildFilenameForPlacement(category, name, order, width) {
     const padded = String(order).padStart(Math.max(3, width), '0');
     return `${padded}-${category}-${patchNameSlug(name, category)}.patch`;
@@ -35,9 +35,6 @@ function prefixWidthForPatches(manifestPatches, requestedOrder) {
         return Math.max(width, match?.[1]?.length ?? 3, String(requestedOrder).length);
     }, 3);
 }
-function getSortedRenameEntries(renameMap) {
-    return Array.from(renameMap.entries()).sort((a, b) => a[1].newOrder - b[1].newOrder);
-}
 /**
  * Structural equality for placement plans — used by placement-mode export
  * and `patch split` to verify the queue did not change between the
@@ -47,20 +44,7 @@ export function placementPlansEqual(left, right) {
     if (left.insertionOrder !== right.insertionOrder || left.newFilename !== right.newFilename) {
         return false;
     }
-    const leftEntries = getSortedRenameEntries(left.renameMap);
-    const rightEntries = getSortedRenameEntries(right.renameMap);
-    if (leftEntries.length !== rightEntries.length) {
-        return false;
-    }
-    return leftEntries.every(([leftFilename, leftEntry], index) => {
-        const rightTuple = rightEntries[index];
-        if (!rightTuple)
-            return false;
-        const [rightFilename, rightEntry] = rightTuple;
-        return (leftFilename === rightFilename &&
-            leftEntry.newFilename === rightEntry.newFilename &&
-            leftEntry.newOrder === rightEntry.newOrder);
-    });
+    return renameMapsEqual(left.renameMap, right.renameMap);
 }
 /**
  * Computes the shift map that moves existing patches out of the requested
@@ -72,7 +56,7 @@ export function computePlacementPlan(manifestPatches, newPatchCategory, newPatch
     // Failing fast here prevents a NaN requestedOrder from producing a
     // filename like "NaN-ui-foo.patch".
     if (!Number.isInteger(requestedOrder) || requestedOrder <= 0) {
-        throw new InvalidArgumentError(`computePlacementPlan requires a positive integer order, got ${String(requestedOrder)}.`, 'requestedOrder');
+        throw new InvalidArgumentError(`computePlacementPlan requires a positive integer order, got ${requestedOrder}.`, 'requestedOrder');
     }
     const sorted = [...manifestPatches].sort((a, b) => a.order - b.order);
     const renameMap = new Map();
@@ -90,7 +74,7 @@ export function computePlacementPlan(manifestPatches, newPatchCategory, newPatch
         }
         const newOrder = cursor + 1;
         const currentRest = patch.filename.replace(/^\d+-/, '');
-        const newFilename = `${String(newOrder).padStart(prefixWidth, '0')}-${currentRest}`;
+        const newFilename = `${formatPatchOrder(newOrder, prefixWidth)}-${currentRest}`;
         renameMap.set(patch.filename, { newOrder, newFilename });
         cursor = newOrder;
     }
@@ -109,11 +93,11 @@ export function computePlacementPlan(manifestPatches, newPatchCategory, newPatch
  */
 export function computeExactPlacementPlan(manifestPatches, newPatchCategory, newPatchName, requestedOrder) {
     if (!Number.isInteger(requestedOrder) || requestedOrder <= 0) {
-        throw new InvalidArgumentError(`--order must be a positive integer, got ${String(requestedOrder)}.`, '--order');
+        throw new InvalidArgumentError(`--order must be a positive integer, got ${requestedOrder}.`, '--order');
     }
     const occupied = manifestPatches.find((patch) => patch.order === requestedOrder);
     if (occupied) {
-        throw new InvalidArgumentError(`--order ${String(requestedOrder)} is already occupied by ${occupied.filename}. ` +
+        throw new InvalidArgumentError(`--order ${requestedOrder} is already occupied by ${occupied.filename}. ` +
             'Choose an unused order or use --before/--after for positional insertion.', '--order');
     }
     return {
@@ -140,7 +124,7 @@ export async function resolvePlacementPlan(patchesDir, options, category, name,
         // function is called directly from the command body which could
         // reach here with a NaN/0/negative value passed in via test harness.
         if (!Number.isInteger(options.order) || options.order <= 0) {
-            throw new InvalidArgumentError(`--order must be a positive integer, got ${String(options.order)}.`, '--order');
+            throw new InvalidArgumentError(`--order must be a positive integer, got ${options.order}.`, '--order');
         }
         return computeExactPlacementPlan(existingPatches, category, name, options.order);
     }
@@ -166,21 +150,6 @@ export async function resolvePlacementPlan(patchesDir, options, category, name,
     assertPlacementAvoidsReservedRanges(plan, existingPatches, config);
     return plan;
 }
-/**
- * Extracts the newly-created files a diff would produce and builds the
- * `newFiles` map in the shape expected by {@link PatchQueueEntry}. Used
- * to build a faithful synthetic entry for the pending patch when
- * projecting through cross-patch lint — without this the forward-import
- * rule cannot see imports authored by the new patch itself.
- */
-function buildNewFilesFromDiff(diff) {
-    const newFiles = new Map();
-    const newFilePaths = detectNewFilesInDiff(diff);
-    for (const path of newFilePaths) {
-        newFiles.set(path, extractNewFileContentFromDiff(diff, path));
-    }
-    return newFiles;
-}
 /**
  * Projects the placement through cross-patch lint to detect forward-imports
  * the renumber would introduce *or* that the new patch itself would
@@ -205,9 +174,7 @@ export async function projectPlacementForLint(patchesDir, plan, diff, config) {
         filename: plan.newFilename,
         order: plan.insertionOrder,
         metadata: null,
-        diff,
-        newFiles: buildNewFilesFromDiff(diff),
-        modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff),
+        ...projectEntryBody(diff),
     });
     projectedEntries.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
     const policyRest = baseCtx.patchPolicy ? { patchPolicy: baseCtx.patchPolicy } : {};
@@ -309,7 +276,7 @@ export async function commitPlacementExport(input) {
             }
             // Normalize identically to commitExportedPatch — the two export
             // paths must produce one artifact contract for the same diff.
-            await writeText(patchPath, normalizePatchArtifact(input.diff));
+            await writeText(patchPath, input.diff);
             await addPatchToManifest(input.patchesDir, {
                 ...input.metadata,
                 filename: currentPlan.newFilename,
@@ -395,19 +362,7 @@ export async function renderDryRunPreview(input) {
     const overlap = manifest !== null
         ? findPartialOwnershipOverlap(manifest, input.filesAffected, supersedingFilenames)
         : new Map();
-    const plan = await planExport({
-        patchesDir: input.patchesDir,
-        category: input.category,
-        name: input.name,
-        description: input.description,
-        filesAffected: input.filesAffected,
-        sourceEsrVersion: input.sourceEsrVersion,
-        ...(input.sourceProduct !== undefined ? { sourceProduct: input.sourceProduct } : {}),
-        ...(input.sourceVersion !== undefined ? { sourceVersion: input.sourceVersion } : {}),
-        ...(input.tier !== undefined ? { tier: input.tier } : {}),
-        ...(input.lintIgnore !== undefined ? { lintIgnore: input.lintIgnore } : {}),
-        ...(input.config !== undefined ? { config: input.config } : {}),
-    });
+    const plan = await planExport(buildPlanExportInput(input));
     if (input.config !== undefined) {
         enforcePatchPolicy({
             config: input.config,
@@ -441,7 +396,7 @@ export async function renderDryRunPreview(input) {
     }
     if (overlap.size > 0) {
         const entries = [...overlap.entries()].sort(([a], [b]) => a.localeCompare(b));
-        warn(`\n[dry-run] Would create cross-patch ownership overlap on ${String(entries.length)} file${entries.length === 1 ? '' : 's'}:`);
+        warn(`\n[dry-run] Would create cross-patch ownership overlap on ${entries.length} file${entries.length === 1 ? '' : 's'}:`);
         for (const [file, owners] of entries) {
             warn(`  - ${file} already claimed by: ${owners.join(', ')}`);
         }

package/dist/src/commands/export-placement-conflicts.js

@@ -66,10 +66,10 @@ export function groupProjectedPlacementErrors(projectedErrors, baselineErrors, p
             details.push(`  ${formatPatchLintIssue(issue)}`);
         }
     };
-    pushGroup(`errors in the exported patch content (${String(exported.length)}):`, exported);
+    pushGroup(`errors in the exported patch content (${exported.length}):`, exported);
     pushGroup(`consequences of renumbering existing patches to make room at ordinal ` +
-        `${String(plan.insertionOrder)} (${String(renumbering.length)}) — these come from ` +
+        `${plan.insertionOrder} (${renumbering.length}) — these come from ` +
         'renumbering, NOT from the exported content:', renumbering);
-    pushGroup(`errors already present in the queue before this export (${String(preExisting.length)}):`, preExisting);
+    pushGroup(`errors already present in the queue before this export (${preExisting.length}):`, preExisting);
     return details;
 }

package/dist/src/commands/export-placement-gate.js

@@ -10,7 +10,7 @@ import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { applyRenameMapToManifest, buildProjectedManifest, enforcePatchPolicy, } from '../core/patch-policy.js';
 import { buildPatchSourceMetadata } from '../core/patch-source-metadata.js';
 import { InvalidArgumentError } from '../errors/base.js';
-import { outro } from '../utils/logger.js';
+import { proceedAfterDecision } from './destructive-decision.js';
 import { placementSummary, projectPlacementForLint, resolvePlacementPlan, } from './export-flow.js';
 /**
  * Spreadable optional metadata (`tier`, `lintIgnore`) derived from the
@@ -85,14 +85,8 @@ export async function gatePlacementPlan(args) {
             unsafeOverride: options.forceUnsafe === true,
             conflicts,
         });
-        if (decision === 'dry-run') {
-            outro('Dry run complete — no changes made');
+        if (!proceedAfterDecision(decision, 'Export cancelled'))
             return 'stop';
-        }
-        if (decision === 'declined') {
-            outro('Export cancelled');
-            return 'stop';
-        }
     }
     else if (conflicts && options.forceUnsafe !== true) {
         s.stop();