@hominis/fireforge 0.47.1 → 0.48.0

package/dist/src/core/git-file-ops.d.ts

@@ -77,6 +77,27 @@ export declare function hashObjectBatch(repoDir: string, fullPaths: string[]): P
  * @returns File content or null if file doesn't exist at that ref
  */
 export declare function getFileContentAtRef(repoDir: string, filePath: string, ref?: string): Promise<string | null>;
+/**
+ * Batched equivalent of {@link getFileContentAtRef}: reads every path at
+ * `ref` through one `git cat-file --batch` process instead of one
+ * `git show` per file. A Firefox-sized ownership scan paid 1,493 of those,
+ * about 18 ms each and almost all of it spawn overhead.
+ *
+ * The first request line is `ref` itself, so an unresolvable ref throws a
+ * {@link GitError} exactly as the per-file helper does, rather than being
+ * read as "every path missing". A path reported `missing` maps to `null`,
+ * as the per-file helper returns for a path absent at that ref. Anything
+ * the batch cannot answer as a plain blob (a path containing a newline,
+ * which the line protocol cannot carry, or an object that is not a blob)
+ * is fetched through {@link getFileContentAtRef}, so the result for every
+ * path is what that helper returns.
+ *
+ * @param repoDir - Repository directory
+ * @param filePaths - Paths relative to the repository root
+ * @param ref - Git ref to read from. Defaults to HEAD.
+ * @returns Content (or `null` when absent at `ref`) for every input path
+ */
+export declare function getFilesContentAtRef(repoDir: string, filePaths: readonly string[], ref?: string): Promise<Map<string, string | null>>;
 /**
  * Checks if a file is binary by looking for NUL bytes in the first 8KB.
  * Uses the same heuristic as git.

package/dist/src/core/git-file-ops.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { GitError } from '../errors/git.js';
 import { removeFile } from '../utils/fs.js';
 import { exec } from '../utils/process.js';
+import { execWithInput } from '../utils/process-input.js';
 import { chunkPathspecs, ensureGit, git } from './git-base.js';
 /**
  * Restores a tracked path from HEAD, including staged changes.
@@ -175,6 +176,80 @@ export async function getFileContentAtRef(repoDir, filePath, ref = 'HEAD') {
     }
     return result.stdout;
 }
+/**
+ * Batched equivalent of {@link getFileContentAtRef}: reads every path at
+ * `ref` through one `git cat-file --batch` process instead of one
+ * `git show` per file. A Firefox-sized ownership scan paid 1,493 of those,
+ * about 18 ms each and almost all of it spawn overhead.
+ *
+ * The first request line is `ref` itself, so an unresolvable ref throws a
+ * {@link GitError} exactly as the per-file helper does, rather than being
+ * read as "every path missing". A path reported `missing` maps to `null`,
+ * as the per-file helper returns for a path absent at that ref. Anything
+ * the batch cannot answer as a plain blob (a path containing a newline,
+ * which the line protocol cannot carry, or an object that is not a blob)
+ * is fetched through {@link getFileContentAtRef}, so the result for every
+ * path is what that helper returns.
+ *
+ * @param repoDir - Repository directory
+ * @param filePaths - Paths relative to the repository root
+ * @param ref - Git ref to read from. Defaults to HEAD.
+ * @returns Content (or `null` when absent at `ref`) for every input path
+ */
+export async function getFilesContentAtRef(repoDir, filePaths, ref = 'HEAD') {
+    const contents = new Map();
+    const unique = [...new Set(filePaths)];
+    const batchable = unique.filter((path) => !path.includes('\n'));
+    const fallback = unique.filter((path) => path.includes('\n'));
+    if (batchable.length > 0) {
+        await ensureGit();
+        const requests = [ref, ...batchable.map((path) => `${ref}:${path}`)];
+        const result = await execWithInput('git', ['cat-file', '--batch'], requests.join('\n') + '\n', {
+            cwd: repoDir,
+        });
+        if (result.exitCode !== 0) {
+            throw new GitError(result.stderr.trim() || 'git cat-file --batch failed', 'cat-file --batch');
+        }
+        const out = result.stdout;
+        let offset = 0;
+        for (const [index, request] of requests.entries()) {
+            const newline = out.indexOf(0x0a, offset);
+            if (newline === -1) {
+                throw new GitError(`Truncated cat-file --batch output at ${request}`, 'cat-file --batch');
+            }
+            const header = out.toString('utf8', offset, newline);
+            offset = newline + 1;
+            const path = index === 0 ? undefined : batchable[index - 1];
+            if (header.endsWith(' missing') || header.endsWith(' ambiguous')) {
+                if (path === undefined) {
+                    throw new GitError(`Cannot resolve ${ref}: ${header}`, `cat-file --batch ${ref}`);
+                }
+                if (header.endsWith(' missing'))
+                    contents.set(path, null);
+                else
+                    fallback.push(path);
+                continue;
+            }
+            const match = /^[0-9a-f]+ (\S+) (\d+)$/.exec(header);
+            if (!match) {
+                throw new GitError(`Unexpected cat-file --batch header: ${header}`, 'cat-file --batch');
+            }
+            const size = Number(match[2]);
+            const body = out.subarray(offset, offset + size);
+            offset += size + 1;
+            if (path === undefined)
+                continue;
+            if (match[1] === 'blob')
+                contents.set(path, body.toString('utf8'));
+            else
+                fallback.push(path);
+        }
+    }
+    for (const path of fallback) {
+        contents.set(path, await getFileContentAtRef(repoDir, path, ref));
+    }
+    return contents;
+}
 /**
  * Checks if a file is binary by looking for NUL bytes in the first 8KB.
  * Uses the same heuristic as git.

package/dist/src/core/git-status.d.ts

@@ -39,6 +39,20 @@ export declare function resolveMaxUntrackedFilesPerDir(): number;
  *   files
  */
 export declare function expandUntrackedDirectoryEntries(repoDir: string, entries: GitStatusEntry[]): Promise<GitStatusEntry[]>;
+/**
+ * Lists the untracked files under each collapsed `dir/` status entry with
+ * one `git ls-files` per ARG_MAX chunk, instead of one spawn per directory
+ * (a Firefox-sized worktree scan paid 73 of them). The result maps every
+ * requested directory to its files in git's order, which is exactly what
+ * {@link getUntrackedFilesInDir} returns for that directory alone. `-z`
+ * keeps non-ASCII names literal: the newline form C-quotes them under
+ * git's default `core.quotePath`, and a quoted path names no file.
+ *
+ * @param repoDir - Repository directory
+ * @param dirs - Collapsed untracked directories, each ending in `/`
+ * @returns Files per directory (every input key present, possibly empty)
+ */
+export declare function listUntrackedFilesInDirs(repoDir: string, dirs: readonly string[]): Promise<Map<string, string[]>>;
 /**
  * Gets all untracked files (including files inside untracked directories).
  * @param repoDir - Repository directory

package/dist/src/core/git-status.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { warn } from '../utils/logger.js';
-import { git } from './git-base.js';
+import { chunkPathspecs, git } from './git-base.js';
 /**
  * True when a porcelain status column carries a rename or copy, i.e. the
  * record is followed by a second NUL-terminated field holding the original
@@ -95,12 +95,16 @@ export function resolveMaxUntrackedFilesPerDir() {
 export async function expandUntrackedDirectoryEntries(repoDir, entries) {
     const expanded = [];
     const maxPerDir = resolveMaxUntrackedFilesPerDir();
+    const collapsed = entries
+        .filter((entry) => entry.isUntracked && entry.file.endsWith('/'))
+        .map((entry) => entry.file);
+    const untrackedByDir = await listUntrackedFilesInDirs(repoDir, collapsed);
     for (const entry of entries) {
         if (!entry.isUntracked || !entry.file.endsWith('/')) {
             expanded.push(entry);
             continue;
         }
-        const individualFiles = await getUntrackedFilesInDir(repoDir, entry.file);
+        const individualFiles = untrackedByDir.get(entry.file) ?? [];
         if (individualFiles.length > maxPerDir) {
             warn(`Untracked directory ${entry.file} contains ${individualFiles.length} files — only the first ${maxPerDir} are listed. Add a .gitignore entry or clean the directory.`);
         }
@@ -118,6 +122,41 @@ export async function expandUntrackedDirectoryEntries(repoDir, entries) {
     }
     return expanded;
 }
+/**
+ * Lists the untracked files under each collapsed `dir/` status entry with
+ * one `git ls-files` per ARG_MAX chunk, instead of one spawn per directory
+ * (a Firefox-sized worktree scan paid 73 of them). The result maps every
+ * requested directory to its files in git's order, which is exactly what
+ * {@link getUntrackedFilesInDir} returns for that directory alone. `-z`
+ * keeps non-ASCII names literal: the newline form C-quotes them under
+ * git's default `core.quotePath`, and a quoted path names no file.
+ *
+ * @param repoDir - Repository directory
+ * @param dirs - Collapsed untracked directories, each ending in `/`
+ * @returns Files per directory (every input key present, possibly empty)
+ */
+export async function listUntrackedFilesInDirs(repoDir, dirs) {
+    const byDir = new Map(dirs.map((dir) => [dir, []]));
+    if (byDir.size === 0)
+        return byDir;
+    for (const chunk of chunkPathspecs([...byDir.keys()])) {
+        const output = await git(['ls-files', '--others', '--exclude-standard', '-z', '--', ...chunk], repoDir);
+        for (const file of output.split('\0')) {
+            if (file.length === 0)
+                continue;
+            // Collapsed status directories never nest, so the first matching
+            // ancestor is the only one.
+            for (let slash = file.indexOf('/'); slash !== -1; slash = file.indexOf('/', slash + 1)) {
+                const bucket = byDir.get(file.slice(0, slash + 1));
+                if (bucket !== undefined) {
+                    bucket.push(file);
+                    break;
+                }
+            }
+        }
+    }
+    return byDir;
+}
 /**
  * Gets all untracked files (including files inside untracked directories).
  * @param repoDir - Repository directory

package/dist/src/core/mach-mozconfig.d.ts

@@ -52,5 +52,6 @@ export declare function assertBrandingMozconfigAgreement(engineDir: string, mozc
  * @param configsDir - Path to the configs directory
  * @param engineDir - Path to the engine directory
  * @param config - FireForge configuration
+ * @returns Whether engine/mozconfig was rewritten (its content changed)
  */
-export declare function generateMozconfig(configsDir: string, engineDir: string, config: FireForgeConfig): Promise<void>;
+export declare function generateMozconfig(configsDir: string, engineDir: string, config: FireForgeConfig): Promise<boolean>;

package/dist/src/core/mach-mozconfig.js

@@ -114,6 +114,7 @@ export async function assertBrandingMozconfigAgreement(engineDir, mozconfigPath,
  * @param configsDir - Path to the configs directory
  * @param engineDir - Path to the engine directory
  * @param config - FireForge configuration
+ * @returns Whether engine/mozconfig was rewritten (its content changed)
  */
 export async function generateMozconfig(configsDir, engineDir, config) {
     const platform = getPlatform();
@@ -161,4 +162,5 @@ export async function generateMozconfig(configsDir, engineDir, config) {
     // write, before anything consumes mozconfig) keeps `generateMozconfig`
     // the single source of truth for both the render and the sanity-check.
     await assertBrandingMozconfigAgreement(engineDir, outputPath, config);
+    return wrote;
 }

package/dist/src/core/patch-apply-fuzz.d.ts

@@ -26,6 +26,18 @@ export interface FuzzyApplyResult {
     /** List of `.rej` files created (when falling through to --reject). */
     rejectFiles?: string[];
 }
+/**
+ * The context-reduction ladder shared by the real apply and the dry-run
+ * replay: step 0 is an exact apply, step k passes `-C(3-k)`.
+ * @param maxFuzz - Maximum context-reduction steps (validated by callers)
+ * @returns One `git apply` argument list per step, in order
+ */
+export declare function contextReductionSteps(maxFuzz: number): string[][];
+/**
+ * Validates a `maxFuzz` value.
+ * @throws InvalidArgumentError when `maxFuzz` is not a non-negative integer
+ */
+export declare function assertValidMaxFuzz(maxFuzz: number): void;
 /**
  * Attempts to apply a patch with escalating context reduction.
  *

package/dist/src/core/patch-apply-fuzz.js

@@ -23,6 +23,29 @@ import { exec } from '../utils/process.js';
 import { ensureGit } from './git-base.js';
 /** Git's default diff context width, the ceiling for reduction steps. */
 const GIT_DEFAULT_CONTEXT = 3;
+/**
+ * The context-reduction ladder shared by the real apply and the dry-run
+ * replay: step 0 is an exact apply, step k passes `-C(3-k)`.
+ * @param maxFuzz - Maximum context-reduction steps (validated by callers)
+ * @returns One `git apply` argument list per step, in order
+ */
+export function contextReductionSteps(maxFuzz) {
+    const maxSteps = Math.min(maxFuzz, GIT_DEFAULT_CONTEXT);
+    const steps = [];
+    for (let step = 0; step <= maxSteps; step++) {
+        steps.push(step > 0 ? [`-C${GIT_DEFAULT_CONTEXT - step}`] : []);
+    }
+    return steps;
+}
+/**
+ * Validates a `maxFuzz` value.
+ * @throws InvalidArgumentError when `maxFuzz` is not a non-negative integer
+ */
+export function assertValidMaxFuzz(maxFuzz) {
+    if (!Number.isInteger(maxFuzz) || maxFuzz < 0) {
+        throw new InvalidArgumentError(`maxFuzz must be a non-negative integer, got ${maxFuzz}.`, 'maxFuzz');
+    }
+}
 // ── Implementation ──
 /**
  * Attempts to apply a patch with escalating context reduction.
@@ -41,14 +64,12 @@ const GIT_DEFAULT_CONTEXT = 3;
  *   (including the exact-match one) and fall straight through to `--reject`
  */
 export async function applyPatchWithFuzz(patchPath, engineDir, maxFuzz = 3) {
-    if (!Number.isInteger(maxFuzz) || maxFuzz < 0) {
-        throw new InvalidArgumentError(`maxFuzz must be a non-negative integer, got ${maxFuzz}.`, 'maxFuzz');
-    }
+    assertValidMaxFuzz(maxFuzz);
     await ensureGit();
     // Try exact match first, then escalate context reduction.
-    const maxSteps = Math.min(maxFuzz, GIT_DEFAULT_CONTEXT);
-    for (let step = 0; step <= maxSteps; step++) {
-        const contextArgs = step > 0 ? [`-C${GIT_DEFAULT_CONTEXT - step}`] : [];
+    const ladder = contextReductionSteps(maxFuzz);
+    const maxSteps = ladder.length - 1;
+    for (const [step, contextArgs] of ladder.entries()) {
         const check = await exec('git', ['apply', '--check', ...contextArgs, '--', patchPath], {
             cwd: engineDir,
         });

package/dist/src/core/patch-apply.d.ts

@@ -63,6 +63,19 @@ export interface PatchedContentContext {
     getAffectingPatches: (filePath: string) => readonly PatchInfo[];
     /** Patch body text, memoized per patch path across the whole batch. */
     readPatchBody: (patch: PatchInfo) => Promise<string>;
+    /**
+     * Reads the HEAD content of every path in one `git cat-file --batch`
+     * and holds it for the next {@link computePatched} of each path, which
+     * otherwise spawns one `git show` per file. Call it before a loop.
+     */
+    prefetchBase: (filePaths: readonly string[]) => Promise<void>;
+    /**
+     * Hashes every live file in one `git hash-object` per ARG_MAX chunk and
+     * holds the hashes for {@link liveBlobHash}.
+     */
+    prefetchLiveBlobHashes: (fullPaths: readonly string[]) => Promise<void>;
+    /** The live blob hash of a file, from the prefetch or a single hash-object. */
+    liveBlobHash: (fullPath: string) => Promise<string | undefined>;
 }
 /**
  * Builds a batched patched-content context that loads the manifest and

package/dist/src/core/patch-apply.js

@@ -11,7 +11,7 @@ import { pathExists, readText, writeFileAtomic, writeText } from '../utils/fs.js
 import { verbose } from '../utils/logger.js';
 import { isContainedRelativePath } from '../utils/paths.js';
 import { applyPatchIdempotent, reversePatch } from './git.js';
-import { getFileContentAtRef } from './git-file-ops.js';
+import { getFileContentAtRef, getFilesContentAtRef, hashObjectBatch } from './git-file-ops.js';
 import { discoverPatches } from './patch-files.js';
 import { loadPatchesManifest } from './patch-manifest.js';
 import { extractAffectedFiles, extractConflictingFiles, isNewFileInPatch, parseDiffSections, } from './patch-parse.js';
@@ -395,12 +395,37 @@ export async function createPatchedContentContext(patchesDir, engineDir) {
         return body;
     };
     const getAffectingPatches = (filePath) => affectingByFile.get(filePath) ?? [];
+    // Prefetched HEAD content, consumed on first use so a large scan does not
+    // hold every base file for the life of the context.
+    const baseContent = new Map();
+    const takeBase = async (filePath) => {
+        if (baseContent.has(filePath)) {
+            const content = baseContent.get(filePath) ?? null;
+            baseContent.delete(filePath);
+            return content;
+        }
+        return getFileContentAtRef(engineDir, filePath);
+    };
+    const liveHashes = new Map();
     return {
         manifestPatches: manifest?.patches ?? [],
         getAffectingPatches,
         readPatchBody,
+        prefetchBase: async (filePaths) => {
+            const wanted = filePaths.filter((file) => !baseContent.has(file));
+            for (const [file, content] of await getFilesContentAtRef(engineDir, wanted)) {
+                baseContent.set(file, content);
+            }
+        },
+        prefetchLiveBlobHashes: async (fullPaths) => {
+            const wanted = fullPaths.filter((path) => !liveHashes.has(path));
+            for (const [path, hash] of await hashObjectBatch(engineDir, wanted)) {
+                liveHashes.set(path, hash);
+            }
+        },
+        liveBlobHash: async (fullPath) => liveHashes.get(fullPath) ?? (await hashObjectBatch(engineDir, [fullPath])).get(fullPath),
         computePatched: async (filePath) => {
-            let content = await getFileContentAtRef(engineDir, filePath);
+            let content = await takeBase(filePath);
             for (const patch of getAffectingPatches(filePath)) {
                 content = applyPatchTextToContent(content, await readPatchBody(patch), filePath);
             }

package/dist/src/core/patch-lint-checkjs-cache.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Parsed `SourceFile`s reused across programs, keyed by file name and the
+ * parse options TypeScript asked for. The language service shares files
+ * across programs the same way (its document registry): a `SourceFile` is
+ * parsed and bound once, and every program that includes it reuses both.
+ * Only valid while the files cannot change and every program uses the same
+ * compiler options, which holds within one lint run.
+ */
+export type CheckJsSourceFileCache = Map<string, import('typescript').SourceFile>;
+/**
+ * Returns `host` with a shared-parse `getSourceFile` when a cache is given,
+ * or `host` itself when not.
+ * @param host - The program's compiler host
+ * @param cache - Shared parse cache, or undefined for an unshared program
+ * @param shimPath - Path the host serves the composed shim at
+ * @param shimSource - The composed shim text
+ */
+export declare function withSharedSourceFiles(host: import('typescript').CompilerHost, cache: CheckJsSourceFileCache | undefined, shimPath: string, shimSource: string): import('typescript').CompilerHost;

package/dist/src/core/patch-lint-checkjs-cache.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Parsed-source sharing across checkJs programs.
+ *
+ * Its own module rather than part of `patch-lint-checkjs.ts` only because
+ * that file sits on a 500-line budget.
+ */
+import { sha256Hex } from '../utils/hash.js';
+/**
+ * Wraps a host's `getSourceFile` so each file is parsed at most once per
+ * cache. The shim is keyed by its content as well, since the shim text is
+ * composed per call rather than read from disk.
+ */
+function cachingGetSourceFile(cache, shimPath, shimSource, getSourceFile) {
+    const shimDigest = sha256Hex(shimSource);
+    return (fileName, languageVersionOrOptions, onError, shouldCreate) => {
+        const parse = typeof languageVersionOrOptions === 'object'
+            ? `${languageVersionOrOptions.languageVersion}|${String(languageVersionOrOptions.impliedNodeFormat)}`
+            : String(languageVersionOrOptions);
+        const key = fileName === shimPath ? `${fileName}\0${parse}\0${shimDigest}` : `${fileName}\0${parse}`;
+        const cached = cache.get(key);
+        if (cached !== undefined)
+            return cached;
+        const created = getSourceFile(fileName, languageVersionOrOptions, onError, shouldCreate);
+        if (created !== undefined)
+            cache.set(key, created);
+        return created;
+    };
+}
+/**
+ * Returns `host` with a shared-parse `getSourceFile` when a cache is given,
+ * or `host` itself when not.
+ * @param host - The program's compiler host
+ * @param cache - Shared parse cache, or undefined for an unshared program
+ * @param shimPath - Path the host serves the composed shim at
+ * @param shimSource - The composed shim text
+ */
+export function withSharedSourceFiles(host, cache, shimPath, shimSource) {
+    if (cache === undefined)
+        return host;
+    return {
+        ...host,
+        getSourceFile: cachingGetSourceFile(cache, shimPath, shimSource, host.getSourceFile.bind(host)),
+    };
+}

package/dist/src/core/patch-lint-checkjs.d.ts

@@ -26,6 +26,7 @@
  */
 import type { PatchLintIssue } from '../types/commands/index.js';
 import type { PatchLintCheckJsCompilerOptions, PatchLintConfig, PatchLintSeverityGate } from '../types/config.js';
+import { type CheckJsSourceFileCache } from './patch-lint-checkjs-cache.js';
 /** How a checkJs run controls reporting and resolution. See module docs. */
 export interface CheckJsMode {
     strict: boolean;
@@ -76,6 +77,11 @@ export interface RunCheckJsGroupedInput {
      * targets.
      */
     rootScope?: ReadonlySet<string>;
+    /**
+     * Parsed source files shared across several programs built with the same
+     * compiler options and shim in one run. See {@link runCheckJsTestFilesGrouped}.
+     */
+    sourceFileCache?: CheckJsSourceFileCache;
 }
 /**
  * Builds the checkJs program once over `resolutionOwned` and returns its

package/dist/src/core/patch-lint-checkjs.js

@@ -30,6 +30,7 @@ import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { normalizePathSlashes } from '../utils/paths.js';
+import { withSharedSourceFiles } from './patch-lint-checkjs-cache.js';
 import { collectUnmanagedCompanions, retargetUnmanagedCompanionHints, } from './patch-lint-unmanaged-companion.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, TEST_HARNESS_SHIM, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 // ---------------------------------------------------------------------------
@@ -340,7 +341,7 @@ export async function runCheckJsGrouped(input) {
             });
         },
     };
-    const program = ts.createProgram(rootFiles, options, host);
+    const program = ts.createProgram(rootFiles, options, withSharedSourceFiles(host, input.sourceFileCache, shimPath, shimSource));
     const byFile = groupOwnedDiagnostics(ts, [...program.getSemanticDiagnostics(), ...program.getSyntacticDiagnostics()], relByAbsolute, input.mode?.undefinedIdentifiers ?? 'warning');
     verbose(`checkJs: analyzed ${rootFiles.length - 1} file(s) across ${byFile.size} owning file(s)`);
     return { byFile, global: [] };
@@ -461,6 +462,11 @@ export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint,
     const mode = modeFromPatchLintConfig(patchLint);
     const seenGlobal = new Set();
     const files = [...testFiles].sort((a, b) => a.localeCompare(b));
+    // Every test program below shares options and shim, and mostly the same
+    // files: TypeScript's lib declarations, the shim, and the directory's
+    // head.js helpers. Parsing them once instead of once per test file took
+    // a 467-test queue's pass from 66 s to a fraction of that.
+    const sourceFileCache = new Map();
     const companions = await collectUnmanagedCompanions(repoDir, files, testFiles);
     for (const file of files) {
         // Under a rootScope only the scoped files get their own program, but
@@ -487,6 +493,7 @@ export async function runCheckJsTestFilesGrouped(repoDir, testFiles, patchLint,
             projectRoot,
             mode,
             builtinShimSuffix: TEST_HARNESS_SHIM,
+            sourceFileCache,
         });
         const own = result.byFile.get(file);
         if (own && own.length > 0) {

package/dist/src/core/patch-lint-cross.d.ts

@@ -11,6 +11,7 @@
  */
 import type { PatchLintIssue, PatchMetadata } from '../types/commands/index.js';
 import type { FireForgeConfig, PatchPolicyConfig } from '../types/config.js';
+import type { ForwardRegistrationScope } from './patch-lint-forward-registration-extended.js';
 /**
  * One patch's contribution to {@link PatchQueueContext}.
  *
@@ -39,7 +40,7 @@ export interface PatchQueueEntry {
      * reconstructable `GIT binary patch`, or a payload-less
      * `Binary files … differ` stub. `newFiles` is text-only by design (a
      * binary authors no imports, so the import rules gain nothing from it and
-     * `extractNewFileContent` correctly refuses to decode one), but "does a
+     * `extractNewFileContentFromDiff` correctly refuses to decode one), but "does a
      * later patch create this path" is a question about existence after apply,
      * not about content, and answering it from `newFiles` made every binary
      * creation invisible to the staged-registration rules.
@@ -76,6 +77,11 @@ export interface PatchQueueContext {
      * Absent = current behavior (hint always printed).
      */
     patchPolicy?: PatchPolicyConfig;
+    /**
+     * Which carriers the forward-registration rule checks, from
+     * `patchLint.forwardRegistration`. Absent = `support-files` only.
+     */
+    forwardRegistration?: ForwardRegistrationScope;
 }
 /**
  * Builds a {@link PatchQueueContext} by reading every .patch file in the

package/dist/src/core/patch-lint-cross.js

@@ -11,7 +11,6 @@
  * module.
  */
 import { basename } from 'node:path';
-import { toError } from '../utils/errors.js';
 import { readText } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { stripJsComments } from '../utils/regex.js';
@@ -24,7 +23,7 @@ import { lintPatchQueueModuleRegistrations } from './patch-lint-module-registrat
 import { describeRegistrationFailure, findStagedRegistrationFailure, isLaterOwner, quoteRegistrationLine, } from './patch-lint-staged-registration.js';
 import { loadPatchesManifest } from './patch-manifest-io.js';
 import { categoryRangeForOrder, categoryRangeLabel } from './patch-policy.js';
-import { extractNewFileContent } from './patch-transform.js';
+import { extractNewFileContentsFromDiff } from './patch-transform.js';
 /**
  * Builds a {@link PatchQueueContext} by reading every .patch file in the
  * directory and extracting new-file content for each creation.
@@ -50,15 +49,11 @@ export async function buildPatchQueueContext(patchesDir, config) {
     for (const patch of patches) {
         const diff = await readText(patch.path);
         const newFilePaths = detectNewFilesInDiff(diff);
-        const newFiles = new Map();
-        for (const newFile of newFilePaths) {
-            try {
-                const content = await extractNewFileContent(patch.path, newFile);
-                newFiles.set(newFile, content);
-            }
-            catch (error) {
-                verbose(`Skipping forward-import scan for ${newFile} in ${patch.filename}: ${toError(error).message}`);
-            }
+        // One parse of the body already in hand. Extracting per file re-read
+        // the whole patch from disk for every file it creates.
+        const { contents: newFiles, refused } = extractNewFileContentsFromDiff(diff, newFilePaths);
+        for (const newFile of refused) {
+            verbose(`Skipping forward-import scan for ${newFile} in ${patch.filename}: binary section cannot be extracted as text`);
         }
         // Added-line content for every file the patch modifies but does not
         // create. Fed to the forward-import rule so imports introduced into
@@ -87,7 +82,13 @@ export async function buildPatchQueueContext(patchesDir, config) {
     }
     // Sort by order so rules can rely on entries being in apply order.
     entries.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
-    return { entries, ...(config?.patchPolicy ? { patchPolicy: config.patchPolicy } : {}) };
+    return {
+        entries,
+        ...(config?.patchPolicy ? { patchPolicy: config.patchPolicy } : {}),
+        ...(config?.patchLint?.forwardRegistration !== undefined
+            ? { forwardRegistration: config.patchLint.forwardRegistration }
+            : {}),
+    };
 }
 // The creators map (split out of `lintPatchQueueDuplicateCreations` so
 // `status --ownership` can consume the structured data) lives in

package/dist/src/core/patch-lint-forward-registration-extended.d.ts

@@ -0,0 +1,38 @@
+import type { PatchQueueForwardRegistrationEntry, PatchQueueView } from './patch-lint-queue-types.js';
+/** Which carriers `forward-registration` checks. */
+export type ForwardRegistrationScope = 'support-files' | 'extended';
+/** The carrier kind a forward registration was found in. */
+export type ForwardRegistrationKind = 'support-files' | 'jar-mn' | 'moz-build' | 'test-manifest' | 'custom-elements';
+/** One undeclared forward registration: a line naming a file a later patch creates. */
+export interface ForwardRegistration {
+    /** The patch that adds the registration line. */
+    patch: string;
+    /** Carrier kind. */
+    kind: ForwardRegistrationKind;
+    /** Engine-relative path of the carrier file (the manifest, jar.mn, …). */
+    file: string;
+    /** The added line, whitespace-trimmed, that names the target. */
+    line: string;
+    /** The token on that line that names the target, as written. */
+    token: string;
+    /** Engine-relative path of the file the later patch creates. */
+    creates: string;
+    /** The later patch that creates it. */
+    owner: string;
+    /** How many distinct added lines in the carrier name the same target. */
+    occurrences: number;
+    /** Paste-and-run declaration that records the stage as intentional. */
+    command: string;
+}
+/** The discharge command, in the exact shape the support-files arm prints. */
+export declare function formatRegistrationDeclaration(patch: string, file: string, line: string, creates: string, owner: string): string;
+/**
+ * Finds every undeclared forward registration in the extended carriers:
+ * a registration line a patch adds that names a file only a later-ordered
+ * patch creates. Creators come from `createdFiles` (the `new file mode`
+ * sections), never `filesAffected`.
+ *
+ * @param ctx - Queue in application order
+ * @returns One record per (patch, carrier, created file), first line quoted
+ */
+export declare function findExtendedForwardRegistrations(ctx: PatchQueueView<PatchQueueForwardRegistrationEntry>): ForwardRegistration[];