@hominis/fireforge 0.45.0 → 0.46.0

package/dist/src/core/patch-lint-cache.js

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { pathExists, readJson, writeJson } from '../utils/fs.js';
+import { sha256Hex } from '../utils/hash.js';
 import { getPackageVersion } from '../utils/package-root.js';
 import { getFurnacePaths } from './furnace-config.js';
 import { git } from './git-base.js';
@@ -42,10 +42,6 @@ function stableJson(value) {
         .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`)
         .join(',')}}`;
 }
-/** Computes a SHA-256 hex digest for text or binary content. */
-function sha256Hex(content) {
-    return createHash('sha256').update(content).digest('hex');
-}
 /** Computes a stable SHA-256 digest for JSON-compatible data. */
 function stableHash(value) {
     return sha256Hex(stableJson(value));
@@ -223,7 +219,8 @@ export function getCachedPerPatchLintIssues(cache, patchFilename, key, lintIgnor
     };
 }
 /** Stores the per-patch lint payload after a successful lint calculation. */
-export function setCachedPerPatchLintIssues(cache, patchFilename, key, issues, suppressed, lineCount, lintIgnore) {
+export function setCachedPerPatchLintIssues(input) {
+    const { cache, patchFilename, key, issues, suppressed, lineCount, lintIgnore } = input;
     cache.entries[patchFilename] = {
         key,
         patchFilename,

package/dist/src/core/patch-lint-checkjs.d.ts

@@ -46,6 +46,37 @@ export interface GroupedCheckJsResult {
     byFile: Map<string, PatchLintIssue[]>;
     global: PatchLintIssue[];
 }
+/** Inputs for {@link runCheckJsGrouped}. */
+export interface RunCheckJsGroupedInput {
+    /** Absolute engine (repository) directory. */
+    repoDir: string;
+    /**
+     * Patch-owned `.sys.mjs` paths (relative to `repoDir`) the program should
+     * see and resolve against.
+     */
+    resolutionOwned: Set<string>;
+    /**
+     * Optional project-relative extra `.d.ts` appended to the built-in
+     * Firefox-globals shim (from `patchLint.checkJsExtraShim`).
+     */
+    extraShimPath?: string;
+    /** Absolute project root for resolving `extraShimPath`. */
+    projectRoot?: string;
+    /** Strictness preset plus allowlisted compiler-option overrides. */
+    mode?: CheckJsMode;
+    /** Optional shim text appended AFTER the consumer shim. */
+    builtinShimSuffix?: string;
+    /**
+     * When set, only these repo-relative files become program ROOTS;
+     * resolution (and the host allowlist) still spans all of
+     * `resolutionOwned`, so a subset root's cross-patch imports type-check
+     * against the real owning sources while unrelated owned files are never
+     * parsed. `.mjs` files are module-scoped, so a root's diagnostics are
+     * identical whether other owned files are roots or mere resolution
+     * targets.
+     */
+    rootScope?: ReadonlySet<string>;
+}
 /**
  * Builds the checkJs program **once** over `resolutionOwned` and returns its
  * diagnostics grouped by originating file. Callers slice the result by their
@@ -54,24 +85,10 @@ export interface GroupedCheckJsResult {
  * every file in `resolutionOwned`, so cross-patch `resource:///`/`chrome://`
  * imports resolve to real sources.
  *
- * @param repoDir - Absolute engine (repository) directory
- * @param resolutionOwned - Patch-owned `.sys.mjs` paths (relative to repoDir)
- *   the program should see and resolve against
- * @param extraShimPath - Optional project-relative extra `.d.ts` appended to
- *   the built-in Firefox-globals shim (from `patchLint.checkJsExtraShim`)
- * @param projectRoot - Absolute project root for resolving `extraShimPath`
- * @param mode - Strictness preset plus allowlisted compiler-option overrides
- * @param builtinShimSuffix - Optional shim text appended AFTER the consumer
- *   shim
- * @param rootScope - When set, only these repo-relative files become program
- *   ROOTS; resolution (and the host allowlist) still spans all of
- *   `resolutionOwned`, so a subset root's cross-patch imports type-check
- *   against the real owning sources while unrelated owned files are never
- *   parsed. `.mjs` files are module-scoped, so a root's diagnostics are
- *   identical whether other owned files are roots or mere resolution targets.
+ * @param input - Program inputs; see {@link RunCheckJsGroupedInput}
  * @returns Diagnostics grouped per owning file plus run-level errors
  */
-export declare function runCheckJsGrouped(repoDir: string, resolutionOwned: Set<string>, extraShimPath?: string, projectRoot?: string, mode?: CheckJsMode, builtinShimSuffix?: string, rootScope?: ReadonlySet<string>): Promise<GroupedCheckJsResult>;
+export declare function runCheckJsGrouped(input: RunCheckJsGroupedInput): Promise<GroupedCheckJsResult>;
 /**
  * Flattens a {@link runCheckJsGrouped} run into a single issue list. When
  * `reportScope` is supplied, only diagnostics from files in that set are

package/dist/src/core/patch-lint-checkjs.js

@@ -162,24 +162,11 @@ function createPathsResolver(ts, paths, baseDir, fileExists, onResolved) {
  * every file in `resolutionOwned`, so cross-patch `resource:///`/`chrome://`
  * imports resolve to real sources.
  *
- * @param repoDir - Absolute engine (repository) directory
- * @param resolutionOwned - Patch-owned `.sys.mjs` paths (relative to repoDir)
- *   the program should see and resolve against
- * @param extraShimPath - Optional project-relative extra `.d.ts` appended to
- *   the built-in Firefox-globals shim (from `patchLint.checkJsExtraShim`)
- * @param projectRoot - Absolute project root for resolving `extraShimPath`
- * @param mode - Strictness preset plus allowlisted compiler-option overrides
- * @param builtinShimSuffix - Optional shim text appended AFTER the consumer
- *   shim
- * @param rootScope - When set, only these repo-relative files become program
- *   ROOTS; resolution (and the host allowlist) still spans all of
- *   `resolutionOwned`, so a subset root's cross-patch imports type-check
- *   against the real owning sources while unrelated owned files are never
- *   parsed. `.mjs` files are module-scoped, so a root's diagnostics are
- *   identical whether other owned files are roots or mere resolution targets.
+ * @param input - Program inputs; see {@link RunCheckJsGroupedInput}
  * @returns Diagnostics grouped per owning file plus run-level errors
  */
-export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath, projectRoot, mode, builtinShimSuffix, rootScope) {
+export async function runCheckJsGrouped(input) {
+    const { repoDir, resolutionOwned, extraShimPath, rootScope } = input;
     const empty = { byFile: new Map(), global: [] };
     if (resolutionOwned.size === 0)
         return empty;
@@ -227,12 +214,14 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
     // also undefined, so the resolution target is irrelevant.
     let shimSource;
     try {
-        const composed = await composeShimSource(projectRoot ?? repoDir, extraShimPath);
+        const composed = await composeShimSource(input.projectRoot ?? repoDir, extraShimPath);
         // The suffix (e.g. the loose test-harness baseline) goes
         // AFTER the consumer's extra shim: TypeScript resolves conflicting
         // `declare var` redeclarations to the FIRST declaration, so a typed
         // consumer declaration must precede the loose fallback to win.
-        shimSource = builtinShimSuffix ? `${composed.source}\n${builtinShimSuffix}` : composed.source;
+        shimSource = input.builtinShimSuffix
+            ? `${composed.source}\n${input.builtinShimSuffix}`
+            : composed.source;
         if (composed.extraShimAppended) {
             verbose(`checkJs: extra shim ${extraShimPath ?? ''} appended to Firefox globals shim`);
         }
@@ -252,7 +241,7 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
     }
     const shimPath = toTsPath(resolve(repoDir, SHIM_FILENAME));
     rootFiles.push(shimPath);
-    const strict = mode?.strict === true;
+    const strict = input.mode?.strict === true;
     const strictness = strict
         ? { strict: true, noImplicitAny: true }
         : {
@@ -266,7 +255,7 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
     // sources without a hand-generated ambient stub shim.
     const overrides = {};
     let pathsMapping;
-    const co = mode?.compilerOptions;
+    const co = input.mode?.compilerOptions;
     if (co) {
         for (const key of Object.keys(co)) {
             const v = co[key];
@@ -351,7 +340,7 @@ export async function runCheckJsGrouped(repoDir, resolutionOwned, extraShimPath,
         },
     };
     const program = ts.createProgram(rootFiles, options, host);
-    const byFile = groupOwnedDiagnostics(ts, [...program.getSemanticDiagnostics(), ...program.getSyntacticDiagnostics()], relByAbsolute, mode?.undefinedIdentifiers ?? 'warning');
+    const byFile = groupOwnedDiagnostics(ts, [...program.getSemanticDiagnostics(), ...program.getSyntacticDiagnostics()], relByAbsolute, input.mode?.undefinedIdentifiers ?? 'warning');
     verbose(`checkJs: analyzed ${rootFiles.length - 1} file(s) across ${byFile.size} owning file(s)`);
     return { byFile, global: [] };
 }
@@ -417,7 +406,13 @@ function groupOwnedDiagnostics(ts, diagnostics, relByAbsolute, undefinedIdentifi
  * @returns Array of lint issues from TS diagnostics
  */
 export async function runCheckJs(repoDir, patchOwnedFiles, extraShimPath, projectRoot, mode, reportScope) {
-    const { byFile, global } = await runCheckJsGrouped(repoDir, patchOwnedFiles, extraShimPath, projectRoot, mode);
+    const { byFile, global } = await runCheckJsGrouped({
+        repoDir,
+        resolutionOwned: patchOwnedFiles,
+        ...(extraShimPath !== undefined ? { extraShimPath } : {}),
+        ...(projectRoot !== undefined ? { projectRoot } : {}),
+        ...(mode !== undefined ? { mode } : {}),
+    });
     const issues = [...global];
     for (const [rel, list] of byFile) {
         if (reportScope && !reportScope.has(rel))
@@ -482,7 +477,16 @@ export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint,
                 roots.add(candidate);
             }
         }
-        const result = await runCheckJsGrouped(repoDir, roots, patchLint.checkJsTestShim, projectRoot, mode, TEST_HARNESS_SHIM);
+        const result = await runCheckJsGrouped({
+            repoDir,
+            resolutionOwned: roots,
+            ...(patchLint.checkJsTestShim !== undefined
+                ? { extraShimPath: patchLint.checkJsTestShim }
+                : {}),
+            projectRoot,
+            mode,
+            builtinShimSuffix: TEST_HARNESS_SHIM,
+        });
         const own = result.byFile.get(file);
         if (own && own.length > 0) {
             merged.byFile.set(file, [
@@ -527,7 +531,16 @@ function modeFromPatchLintConfig(patchLint) {
  * (`--patches`); resolution still spans the whole queue
  */
 export async function invokePatchLintCheckJsGrouped(repoDir, patchOwnedFiles, patchLint, projectRoot, rootScope) {
-    return runCheckJsGrouped(repoDir, patchOwnedFiles, patchLint.checkJsExtraShim, projectRoot, modeFromPatchLintConfig(patchLint), undefined, rootScope);
+    return runCheckJsGrouped({
+        repoDir,
+        resolutionOwned: patchOwnedFiles,
+        ...(patchLint.checkJsExtraShim !== undefined
+            ? { extraShimPath: patchLint.checkJsExtraShim }
+            : {}),
+        projectRoot,
+        mode: modeFromPatchLintConfig(patchLint),
+        ...(rootScope !== undefined ? { rootScope } : {}),
+    });
 }
 /**
  * Cheap probe reproducing the only run-level ("global") checkJs findings the

package/dist/src/core/patch-lint-creators.d.ts

@@ -10,13 +10,9 @@
  * so a discarded context frees its map; a caller that mutates a context
  * entry in place must call {@link invalidateNewFileCreatorsCache}.
  */
+import type { PatchQueueBodyEntry, PatchQueueView } from './patch-lint-queue-types.js';
 /** The slice of a queue context the creators map is derived from. */
-interface CreatorsContext {
-    entries: {
-        filename: string;
-        diff: string;
-    }[];
-}
+type CreatorsContext = PatchQueueView<PatchQueueBodyEntry>;
 /** Drops the memoised creators map after an in-place context entry update. */
 export declare function invalidateNewFileCreatorsCache(ctx: CreatorsContext): void;
 /**

package/dist/src/core/patch-lint-cross.d.ts

@@ -34,6 +34,17 @@ export interface PatchQueueEntry {
      * are not indexed here.
      */
     newFiles: Map<string, string>;
+    /**
+     * Every path this patch CREATES, whatever the body kind — text, a
+     * reconstructable `GIT binary patch`, or a payload-less
+     * `Binary files … differ` stub. `newFiles` is text-only by design (a
+     * binary authors no imports, so the import rules gain nothing from it and
+     * `extractNewFileContent` correctly refuses to decode one), but "does a
+     * later patch create this path" is a question about existence after apply,
+     * not about content — and answering it from `newFiles` made every binary
+     * creation invisible to the staged-registration rules.
+     */
+    createdFiles: Set<string>;
     /**
      * Map from existing-file path → concatenated added lines from the patch's
      * hunks against that file (joined with `\n`). Populated for files the
@@ -109,13 +120,10 @@ export declare function isForwardImportableFile(path: string): boolean;
  * Returns the raw specifier strings — callers should take the leaf basename
  * to match against the newFileIndex, because we do not resolve `resource://`
  * URLs to engine file paths.
- */
-export declare function extractImportSpecifiers(source: string): string[];
-/**
- * Internal form of {@link extractImportSpecifiers} that also returns the
- * (0-indexed) line number where each specifier was found. Used by the
- * forward-import rule so it can correlate specifiers against the
- * ignore-marker line set and skip suppressed matches.
+ *
+ * Also returns the (0-indexed) line number where each specifier was found, so
+ * the forward-import rule can correlate specifiers against the ignore-marker
+ * line set and skip suppressed matches.
  */
 export interface ExtractedSpecifier {
     specifier: string;
@@ -123,7 +131,7 @@ export interface ExtractedSpecifier {
 }
 /**
  * Returns import specifiers plus 0-indexed line numbers, preserving the
- * same matching behavior as {@link extractImportSpecifiers}.
+ * same matching behavior as {@link extractImportSpecifiersWithLines}.
  */
 export declare function extractImportSpecifiersWithLines(source: string): ExtractedSpecifier[];
 /**

package/dist/src/core/patch-lint-cross.js

@@ -19,7 +19,9 @@ import { discoverPatches } from './patch-files.js';
 import { lintPatchQueueBinaryBodies } from './patch-lint-binary.js';
 import { collectNewFileCreatorsByPath } from './patch-lint-creators.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
+import { lintPatchQueueForwardRegistrations } from './patch-lint-forward-registration.js';
 import { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';
+import { describeRegistrationFailure, findStagedRegistrationFailure, isLaterOwner, quoteRegistrationLine, } from './patch-lint-staged-registration.js';
 import { loadPatchesManifest } from './patch-manifest-io.js';
 import { categoryRangeForOrder, categoryRangeLabel } from './patch-policy.js';
 import { extractNewFileContent } from './patch-transform.js';
@@ -77,6 +79,9 @@ export async function buildPatchQueueContext(patchesDir, config) {
             metadata: metadataByFilename.get(patch.filename) ?? null,
             diff,
             newFiles,
+            // Straight from the detector, before the text-extraction filter above
+            // drops the bodies it cannot decode.
+            createdFiles: newFilePaths,
             modifiedFileAdditions,
         });
     }
@@ -125,24 +130,6 @@ const FORWARD_IMPORTABLE_EXTENSIONS = ['.mjs', '.sys.mjs', '.js', '.jsm'];
 export function isForwardImportableFile(path) {
     return FORWARD_IMPORTABLE_EXTENSIONS.some((ext) => path.endsWith(ext));
 }
-/**
- * Regex-level extractor for module specifiers in ES module / subscript files.
- *
- * Intentionally conservative. Catches:
- * - `import ... from "specifier"`   (ES module static imports)
- * - `import "specifier"`            (side-effect imports — the `from`
- *                                   clause is optional in the regex)
- * - `import("specifier")`           (dynamic imports)
- * - ChromeUtils.importESModule("specifier")
- * - ChromeUtils.defineESModuleGetters(obj, { Name: "specifier", ... })
- *
- * Returns the raw specifier strings — callers should take the leaf basename
- * to match against the newFileIndex, because we do not resolve `resource://`
- * URLs to engine file paths.
- */
-export function extractImportSpecifiers(source) {
-    return extractImportSpecifiersWithLines(source).map((item) => item.specifier);
-}
 function buildLineOffsets(source) {
     const offsets = [0];
     for (let i = 0; i < source.length; i++) {
@@ -236,7 +223,7 @@ function collectGetterSpecifiers(stripped, results, offsetToLine) {
 }
 /**
  * Returns import specifiers plus 0-indexed line numbers, preserving the
- * same matching behavior as {@link extractImportSpecifiers}.
+ * same matching behavior as {@link extractImportSpecifiersWithLines}.
  */
 export function extractImportSpecifiersWithLines(source) {
     // stripJsComments replaces comment bodies with space runs of equal
@@ -290,8 +277,8 @@ function extractBareGetterSpecifiers(source) {
     const stripped = stripJsComments(source);
     const results = [];
     const lines = stripped.split('\n');
-    for (let i = 0; i < lines.length; i++) {
-        const match = BARE_GETTER_PROPERTY_LINE.exec(lines[i] ?? '');
+    for (const [i, line] of lines.entries()) {
+        const match = BARE_GETTER_PROPERTY_LINE.exec(line);
         if (match?.[1])
             results.push({ specifier: match[1], line: i });
     }
@@ -323,9 +310,8 @@ export const FORWARD_IMPORT_IGNORE_MARKER = 'fireforge-ignore: forward-import';
 export function findForwardImportIgnoreLines(source) {
     const lines = source.split('\n');
     const ignored = new Set();
-    for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        if (line && line.includes(FORWARD_IMPORT_IGNORE_MARKER)) {
+    for (const [i, line] of lines.entries()) {
+        if (line.includes(FORWARD_IMPORT_IGNORE_MARKER)) {
             ignored.add(i);
             ignored.add(i + 1);
         }
@@ -348,29 +334,44 @@ function findMatchingStagedDependency(entry, sitePath, specifier, laterOwners) {
         laterOwners.some((owner) => owner.fullPath === dependency.creates &&
             (dependency.owner === undefined || dependency.owner === owner.filename)));
 }
-/**
- * Later-in-apply-order predicate shared by the forward-import scan and the
- * registration validation: strictly higher ordinal, or same ordinal with a
- * lexicographically later filename (the apply loop's tiebreak).
- */
-function isLaterOwner(owner, entry) {
-    return (owner.order > entry.order || (owner.order === entry.order && owner.filename > entry.filename));
-}
-/** Builds the basename → later-creators index used by the forward-import scan. */
-function buildNewFileIndex(ctx) {
-    const newFileIndex = new Map();
+/** Builds a basename → creators index from one path set per entry. */
+function buildCreatorIndex(ctx, pathsOf) {
+    const index = new Map();
     for (const entry of ctx.entries) {
-        for (const fullPath of entry.newFiles.keys()) {
+        for (const fullPath of pathsOf(entry)) {
             const leaf = basename(fullPath);
-            let owners = newFileIndex.get(leaf);
+            let owners = index.get(leaf);
             if (!owners) {
                 owners = [];
-                newFileIndex.set(leaf, owners);
+                index.set(leaf, owners);
             }
             owners.push({ filename: entry.filename, order: entry.order, fullPath });
         }
     }
-    return newFileIndex;
+    return index;
+}
+/**
+ * Basename → later-creators index for the forward-IMPORT scan.
+ *
+ * Keyed on `newFiles` deliberately: this index answers "which patch creates
+ * the module this specifier resolves to", and a binary is not a module.
+ */
+function buildNewFileIndex(ctx) {
+    return buildCreatorIndex(ctx, (entry) => entry.newFiles.keys());
+}
+/**
+ * Basename → creators index for the staged-REGISTRATION rules.
+ *
+ * Keyed on `createdFiles`, which includes binary creations. A registration
+ * (`support-files`, a jar.mn line, an actor entry) points at a file that
+ * must EXIST after apply; whether its body was text or a `GIT binary patch`
+ * has nothing to do with it. Resolving this from `newFiles` made a declared
+ * dependency on a binary fixture report `creates-unresolved`, so the
+ * declaration read as stale on every lint run and removing it changed
+ * nothing either — the failure was symmetric and therefore invisible.
+ */
+function buildCreatedFileIndex(ctx) {
+    return buildCreatorIndex(ctx, (entry) => entry.createdFiles);
 }
 /**
  * Visits every forward-import site (an import whose leaf is created by a
@@ -389,9 +390,9 @@ function eachForwardImportSite(ctx, newFileIndex, visit) {
             // Dedupe by (specifier, line): a patch that adds the whole getter
             // call carries both the opener (found by the balanced walk) and the
             // property line (found here) — report each site once.
-            const seen = new Set(sites.map((site) => `${site.specifier}|${String(site.line)}`));
+            const seen = new Set(sites.map((site) => `${site.specifier}|${site.line}`));
             for (const extra of extractBareGetterSpecifiers(content)) {
-                if (!seen.has(`${extra.specifier}|${String(extra.line)}`))
+                if (!seen.has(`${extra.specifier}|${extra.line}`))
                     sites.push(extra);
             }
         }
@@ -453,6 +454,7 @@ export function collectForwardImportEdges(ctx) {
  */
 export function lintPatchQueueForwardImports(ctx) {
     const newFileIndex = buildNewFileIndex(ctx);
+    const createdFileIndex = buildCreatedFileIndex(ctx);
     const issues = [];
     const usedStagedDeclarations = new Set();
     eachForwardImportSite(ctx, newFileIndex, (entry, sitePath, specifier, cleaned, laterOwners) => {
@@ -531,7 +533,7 @@ export function lintPatchQueueForwardImports(ctx) {
         // (with `owner`, when set, naming that patch) — mirroring
         // findMatchingStagedDependency for the import kind.
         for (const registration of entry.metadata?.stagedDependencies?.registrations ?? []) {
-            const failure = findStagedRegistrationFailure(entry, registration, newFileIndex);
+            const failure = findStagedRegistrationFailure(entry, registration, createdFileIndex);
             if (failure === undefined)
                 continue;
             issues.push({
@@ -541,62 +543,16 @@ export function lintPatchQueueForwardImports(ctx) {
                 fingerprint: `staged-dependency-unused|${entry.filename}|${registration.file}|reg:${registration.line}|${registration.creates}|${registration.owner ?? ''}`,
                 message: `${entry.filename} declares a staged registration in ${registration.file} ` +
                     `("${registration.line}") for ${registration.creates}, but ${describeRegistrationFailure(failure)} ` +
-                    'Remove the stale declaration with "fireforge patch staged-dependency --remove --kind registration" or update it to match the patch and queue.',
+                    'Remove the stale declaration with: ' +
+                    `fireforge patch staged-dependency ${entry.filename} --remove --kind registration ` +
+                    `--file ${registration.file} --line "${quoteRegistrationLine(registration.line)}" ` +
+                    `--creates ${registration.creates}; or update it to match the patch and queue.`,
                 severity: 'warning',
             });
         }
     }
     return issues;
 }
-/**
- * Validates one registration-kind declaration against the patch content
- * and the queue, mirroring {@link findMatchingStagedDependency}: the
- * declared line must be added by this patch, `creates` must exactly match
- * a file a LATER-ordered patch creates (an earlier-only creator means the
- * dependency is already satisfied and the declaration is stale), and
- * `owner`, when set, must name one of those creating patches. Returns
- * undefined when valid.
- */
-function findStagedRegistrationFailure(entry, registration, newFileIndex) {
-    if (!isRegistrationLinePresent(entry, registration))
-        return { kind: 'line-absent' };
-    const creators = (newFileIndex.get(basename(registration.creates)) ?? []).filter((owner) => owner.fullPath === registration.creates && isLaterOwner(owner, entry));
-    if (creators.length === 0)
-        return { kind: 'creates-unresolved' };
-    if (registration.owner !== undefined &&
-        !creators.some((owner) => owner.filename === registration.owner)) {
-        return { kind: 'owner-mismatch', creators };
-    }
-    return undefined;
-}
-/** Message tail for each {@link StagedRegistrationFailure} shape. */
-function describeRegistrationFailure(failure) {
-    switch (failure.kind) {
-        case 'line-absent':
-            return 'the patch does not add that line.';
-        case 'creates-unresolved':
-            return ('no later-ordered patch creates that file — the declaration is stale, ' +
-                'or the queue order no longer stages it.');
-        case 'owner-mismatch':
-            return `that file is created by ${failure.creators.map((o) => o.filename).join(', ')}, not the declared owner.`;
-    }
-}
-/**
- * True when the declared registration/packaging line appears (trimmed)
- * among the lines the patch introduces in the declaring file — either as a
- * newly-created file's content or as added lines to an existing file
- * (where jar.mn / customElements.js / actor-registration edits land).
- */
-function isRegistrationLinePresent(entry, registration) {
-    const declared = registration.line.trim();
-    if (declared.length === 0)
-        return false;
-    const introduced = [
-        entry.newFiles.get(registration.file),
-        entry.modifiedFileAdditions.get(registration.file),
-    ];
-    return introduced.some((content) => content !== undefined && content.split('\n').some((line) => line.trim() === declared));
-}
 /**
  * Cross-patch lint orchestrator. Runs every cross-patch rule against the
  * provided context and returns combined issues.
@@ -614,6 +570,7 @@ export function lintPatchQueue(ctx) {
         ...lintPatchQueueDuplicateCreations(ctx),
         ...lintPatchQueueForwardImports(ctx),
         ...lintPatchQueueModuleRegistrations(ctx),
+        ...lintPatchQueueForwardRegistrations(ctx),
         ...lintPatchQueueBinaryBodies(ctx),
     ];
 }

package/dist/src/core/patch-lint-css.js

@@ -73,11 +73,8 @@ function buildAddedLinesScanSource(rawCss, addedNumbers) {
         .map((n) => maskedLines[n - 1] ?? '')
         .join('\n');
 }
-/**
- * Raw-color check for one patched CSS file, scoped to introduced lines
- * when diff context is available. Pushes onto `issues`.
- */
-function checkRawColorValues(file, rawCss, addedLinesByFile, addedLineNumbersByFile, config, issues) {
+function checkRawColorValues(input) {
+    const { file, rawCss, addedLinesByFile, addedLineNumbersByFile, config, issues } = input;
     // Check only introduced raw color values when diff context is available.
     // Skip files on the raw-color allowlist (exact path or basename match) and
     // auto-exempt files under `browser/branding/` — those are the fork's
@@ -207,7 +204,14 @@ export async function lintPatchedCss(repoDir, affectedFiles, diffContent, config
         const rawCss = await readText(filePath);
         // Strip block comments before scanning
         const cssContent = rawCss.replace(/\/\*[\s\S]*?\*\//g, '');
-        checkRawColorValues(file, rawCss, addedLinesByFile, addedLineNumbersByFile, config, issues);
+        checkRawColorValues({
+            file,
+            rawCss,
+            addedLinesByFile,
+            addedLineNumbersByFile,
+            config,
+            issues,
+        });
         checkTokenPrefixViolations(file, cssContent, addedLinesByFile, tokenContext, issues);
     }
     return issues;

package/dist/src/core/patch-lint-file-size.js

@@ -44,10 +44,10 @@ export function resolveFileSizeThresholds(overrides, isTest) {
 export function formatFileTooLargeMessage(args) {
     const { label, lineCount, thresholds, band, verb } = args;
     if (band === 'error') {
-        return `${label} has ${String(lineCount)} lines (error threshold: ${String(thresholds.error)}). Consider ${verb}.`;
+        return `${label} has ${lineCount} lines (error threshold: ${thresholds.error}). Consider ${verb}.`;
     }
-    return (`${label} has ${String(lineCount)} lines (warning threshold: ${String(thresholds.warning)}, ` +
-        `error threshold: ${String(thresholds.error)}). Consider ${verb}. ` +
+    return (`${label} has ${lineCount} lines (warning threshold: ${thresholds.warning}, ` +
+        `error threshold: ${thresholds.error}). Consider ${verb}. ` +
         `Reported as a ${band}, which a gate running --max-warnings 0 treats as a failure; ` +
         `tune "patchLint.fileSizeThresholds" if these limits are wrong for this project.`);
 }

package/dist/src/core/patch-lint-forward-registration.d.ts

@@ -0,0 +1,58 @@
+import type { PatchLintIssue } from '../types/commands/index.js';
+import type { PatchQueueForwardRegistrationEntry, PatchQueueView } from './patch-lint-queue-types.js';
+/**
+ * One `support-files` entry, with the line the patch actually adds it on.
+ *
+ * The entry alone is not enough for the discharge command the rule prints:
+ * `--line` is compared, whitespace-trimmed, against the lines the patch
+ * ADDS, and a synthesised `support-files = ["<entry>"]` only ever matches a
+ * manifest whose array is single-line and single-entry. Carrying the source
+ * line keeps the remedy and the validation talking about the same text.
+ */
+export interface SupportFileEntry {
+    /** The entry as written inside the manifest (e.g. `fixtures/*.sqlite`). */
+    entry: string;
+    /** The first added line, whitespace-trimmed, that spells the entry out. */
+    line: string;
+    /**
+     * How many distinct added lines spell it out. Above one, the printed
+     * command quotes the first and says so: one declaration covers the file
+     * either way, because the declared check keys on file + creates.
+     */
+    occurrences: number;
+}
+/**
+ * Extracts the `support-files` entries declared in `content`, each paired
+ * with the manifest line it is written on.
+ *
+ * Handles the TOML array on one line and spread over several, and the
+ * whitespace-separated `.ini` spelling. Anything else — a computed value, a
+ * shape this does not recognise — yields nothing, because a rule that
+ * guesses at a manifest it cannot parse refuses correct queues.
+ *
+ * Quoted tokens are matched per physical line rather than over the whole
+ * accumulated array body, so a multi-line array attributes each element to
+ * its own line. Entries are deduplicated: a manifest that lists the same
+ * file under two per-test sections needs one declaration, not two.
+ */
+export declare function extractSupportFileEntries(content: string): SupportFileEntry[];
+/**
+ * Resolves one `support-files` entry, relative to its manifest's directory,
+ * into a matcher over engine-relative paths.
+ *
+ * Only a `*` inside a single path segment is expanded — the shape the
+ * downstream report uses (`fixtures/*.sqlite`). `**`, `!` exclusions and
+ * absolute `/`-rooted entries return undefined: they either cross directory
+ * boundaries or subtract, and a matcher that guessed at them would attribute
+ * a creation to the wrong manifest.
+ */
+export declare function buildSupportFileMatcher(manifestPath: string, entry: string): ((candidate: string) => boolean) | undefined;
+/**
+ * Flags every `support-files` registration a patch introduces that names a
+ * file only a later-ordered patch creates, unless the staged dependency is
+ * declared.
+ *
+ * @param ctx - Projected queue in application order
+ * @returns One issue per undeclared forward registration
+ */
+export declare function lintPatchQueueForwardRegistrations(ctx: PatchQueueView<PatchQueueForwardRegistrationEntry>): PatchLintIssue[];