@hominis/fireforge 0.47.1 → 0.48.0

package/dist/src/core/rebase-dry-run.js

@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * `rebase --dry-run`: replays the patch queue against the engine's base
+ * commit without touching `engine/`.
+ *
+ * The replay runs on a private index seeded from HEAD (`GIT_INDEX_FILE`
+ * plus `git read-tree HEAD`) and applies each patch there with
+ * `git apply --cached`, in queue order, so a later patch sees what the
+ * earlier ones did, exactly as the real loop's worktree does. Each patch
+ * walks the same context-reduction ladder as {@link applyPatchWithFuzz}.
+ * The worktree and the real index are never written. The private index is
+ * deleted when the replay ends.
+ */
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { GitError } from '../errors/git.js';
+import { exec } from '../utils/process.js';
+import { ensureGit } from './git-base.js';
+import { assertValidMaxFuzz, contextReductionSteps } from './patch-apply-fuzz.js';
+/**
+ * Parses the file names out of `git apply --check` failure output. Git
+ * reports a context mismatch as `error: patch failed: <file>:<line>` and
+ * `error: <file>: patch does not apply`, and a missing or pre-existing
+ * target as `error: <file>: does not exist in index` /
+ * `error: <file>: already exists in index`.
+ */
+export function parseApplyCheckFailures(stderr) {
+    const files = new Set();
+    for (const line of stderr.split('\n')) {
+        const failed = /^error: patch failed: (.+):\d+$/.exec(line);
+        if (failed?.[1]) {
+            files.add(failed[1]);
+            continue;
+        }
+        const named = /^error: (.+?): (?:patch does not apply|does not exist in index|already exists in index)$/.exec(line);
+        if (named?.[1])
+            files.add(named[1]);
+    }
+    return [...files];
+}
+/**
+ * Replays `patches` onto the engine's HEAD tree in a private index.
+ * @param engineDir - Engine repository root
+ * @param patches - Patches in queue order
+ * @param maxFuzz - Maximum context-reduction steps, as for the real rebase
+ * @returns One verdict per patch
+ */
+export async function replayQueueIndexOnly(engineDir, patches, maxFuzz) {
+    assertValidMaxFuzz(maxFuzz);
+    await ensureGit();
+    const scratch = await mkdtemp(join(tmpdir(), 'fireforge-rebase-dry-run-'));
+    const env = { GIT_INDEX_FILE: join(scratch, 'index') };
+    try {
+        const seeded = await exec('git', ['read-tree', 'HEAD'], { cwd: engineDir, env });
+        if (seeded.exitCode !== 0) {
+            throw new GitError(seeded.stderr.trim() || 'Could not seed a private index from HEAD', 'read-tree HEAD');
+        }
+        const ladder = contextReductionSteps(maxFuzz);
+        const verdicts = [];
+        let firstRejectIndex;
+        for (const patch of patches) {
+            let verdict;
+            let exactFailure = '';
+            for (const [step, contextArgs] of ladder.entries()) {
+                const check = await exec('git', ['apply', '--cached', '--check', ...contextArgs, '--', patch.path], { cwd: engineDir, env });
+                if (check.exitCode !== 0) {
+                    if (step === 0)
+                        exactFailure = check.stderr;
+                    continue;
+                }
+                const apply = await exec('git', ['apply', '--cached', ...contextArgs, '--', patch.path], {
+                    cwd: engineDir,
+                    env,
+                });
+                if (apply.exitCode !== 0)
+                    continue;
+                verdict =
+                    step === 0
+                        ? { filename: patch.filename, outcome: 'clean' }
+                        : {
+                            filename: patch.filename,
+                            outcome: 'reduced-context',
+                            step,
+                            contextArg: contextArgs[0] ?? '',
+                        };
+                break;
+            }
+            if (verdict === undefined) {
+                verdict = {
+                    filename: patch.filename,
+                    outcome: 'reject',
+                    files: parseApplyCheckFailures(exactFailure),
+                    detail: exactFailure.trim(),
+                };
+                firstRejectIndex ??= verdicts.length;
+            }
+            verdicts.push(verdict);
+        }
+        return { verdicts, firstRejectIndex };
+    }
+    finally {
+        await rm(scratch, { recursive: true, force: true });
+    }
+}

package/dist/src/core/run-profile.d.ts

@@ -0,0 +1,50 @@
+/** Directory-name prefix of every FireForge-owned temporary run profile. */
+export declare const RUN_PROFILE_PREFIX = "fireforge-run-profile-";
+/** The profile a run launches with, and how to release it afterwards. */
+export interface RunProfile {
+    /** Program parameters to append to `mach run` (empty for mach's default). */
+    args: string[];
+    /** Absolute profile directory, when one was chosen. */
+    dir?: string;
+    /** Whether FireForge created the directory and will delete it. */
+    temporary: boolean;
+    /** Removes a temporary profile. A no-op otherwise. Never throws. */
+    dispose: () => Promise<void>;
+}
+/** Inputs to {@link resolveRunProfile}. */
+export interface RunProfileRequest {
+    /** `--profile <path>`: launch with this directory, left in place. */
+    profile?: string | undefined;
+    /** `--temp-profile`: launch with a fresh directory removed afterwards. */
+    tempProfile?: boolean | undefined;
+    /**
+     * Whether this is a `--smoke-exit` run. A smoke run with neither flag gets
+     * a temporary profile: the step exists to prove what the build does on a
+     * clean start, and the developer's profile-default carries whatever state
+     * the last session left.
+     */
+    smoke: boolean;
+    /** Base directory for temporary profiles (defaults to the OS tmpdir). */
+    tempRoot?: string | undefined;
+}
+/**
+ * Removes every temporary run profile this process still holds. Called by
+ * the CLI entry point's signal handler after child shutdown. Never throws.
+ */
+export declare function removeActiveRunProfiles(): Promise<void>;
+/**
+ * Chooses the profile for a run.
+ * @param request - The run's profile flags
+ * @returns The profile arguments and their release handle
+ */
+export declare function resolveRunProfile(request: RunProfileRequest): Promise<RunProfile>;
+/**
+ * Removes temporary run profiles whose owning FireForge process is gone.
+ * The `finally` that releases a profile covers a clean exit, a failed run
+ * and a forwarded SIGINT/SIGTERM, but not a SIGKILL of FireForge itself;
+ * this sweep is the backstop for that case. A directory whose marker is
+ * missing or unreadable is left alone: nothing proves it is abandoned.
+ * @param tempRoot - Base directory to sweep (defaults to the OS tmpdir)
+ * @returns The number of directories removed
+ */
+export declare function sweepAbandonedRunProfiles(tempRoot?: string): Promise<number>;

package/dist/src/core/run-profile.js

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Profile selection for `fireforge run`.
+ *
+ * `mach run` on desktop has no `--profile` option of its own: its parser's
+ * `--profile/-P` belongs to the Android run parser. On desktop a profile
+ * reaches Firefox as a program parameter (`-profile <dir>`), and mach skips
+ * creating the objdir's `tmp/profile-default` when it sees one among the
+ * params.
+ * Mach's `--temp-profile` does mint a fresh directory, but inside the objdir
+ * and never removes it, so FireForge owns the temporary profile instead:
+ * it creates the directory, seeds the two prefs mach would have written,
+ * passes it as `-profile`, and deletes it when the run ends.
+ */
+import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { InvalidArgumentError } from '../errors/base.js';
+import { isProcessAlive, toError } from '../utils/errors.js';
+import { verbose, warn } from '../utils/logger.js';
+/** Directory-name prefix of every FireForge-owned temporary run profile. */
+export const RUN_PROFILE_PREFIX = 'fireforge-run-profile-';
+/** Marker file naming the pid of the FireForge process that owns the profile. */
+const OWNER_MARKER = '.fireforge-run-owner';
+/**
+ * The prefs `mach run` writes into the profiles it creates itself. A profile
+ * passed with `-profile` gets none of them, and a first-run default-browser
+ * prompt would sit in a headed smoke window.
+ */
+const SEEDED_USER_JS = 'user_pref("browser.shell.checkDefaultBrowser", false);\n' +
+    'user_pref("browser.aboutConfig.showWarning", false);\n';
+/**
+ * Temporary profiles this process created and has not yet removed. The
+ * command's own `finally` loses the race to the entry point's signal
+ * handler, whose `process.exit` never lets it run, so the handler removes
+ * these itself once the browser tree has shut down.
+ */
+const activeTemporaryProfiles = new Set();
+async function removeTemporaryProfile(dir) {
+    try {
+        await rm(dir, { recursive: true, force: true });
+        activeTemporaryProfiles.delete(dir);
+    }
+    catch (error) {
+        warn(`Could not remove temporary run profile ${dir}: ${toError(error).message}`);
+    }
+}
+/**
+ * Removes every temporary run profile this process still holds. Called by
+ * the CLI entry point's signal handler after child shutdown. Never throws.
+ */
+export async function removeActiveRunProfiles() {
+    await Promise.all([...activeTemporaryProfiles].map((dir) => removeTemporaryProfile(dir)));
+}
+const NO_PROFILE = {
+    args: [],
+    temporary: false,
+    dispose: () => Promise.resolve(),
+};
+/**
+ * Chooses the profile for a run.
+ * @param request - The run's profile flags
+ * @returns The profile arguments and their release handle
+ */
+export async function resolveRunProfile(request) {
+    if (request.profile !== undefined && request.tempProfile === true) {
+        throw new InvalidArgumentError('--profile and --temp-profile are mutually exclusive: name a profile or ask for a fresh one.', 'profile');
+    }
+    if (request.profile !== undefined) {
+        const dir = resolve(request.profile);
+        return { args: ['-profile', dir], dir, temporary: false, dispose: NO_PROFILE.dispose };
+    }
+    if (request.tempProfile !== true && !request.smoke) {
+        return NO_PROFILE;
+    }
+    const dir = await mkdtemp(join(request.tempRoot ?? tmpdir(), RUN_PROFILE_PREFIX));
+    activeTemporaryProfiles.add(dir);
+    // The owner marker goes in first, so a FireForge killed past this point
+    // leaves a directory the next run can prove abandoned.
+    await writeFile(join(dir, OWNER_MARKER), `${process.pid}\n`);
+    await writeFile(join(dir, 'user.js'), SEEDED_USER_JS);
+    verbose(`Temporary run profile: ${dir}`);
+    return {
+        args: ['-profile', dir],
+        dir,
+        temporary: true,
+        dispose: () => removeTemporaryProfile(dir),
+    };
+}
+/**
+ * Removes temporary run profiles whose owning FireForge process is gone.
+ * The `finally` that releases a profile covers a clean exit, a failed run
+ * and a forwarded SIGINT/SIGTERM, but not a SIGKILL of FireForge itself;
+ * this sweep is the backstop for that case. A directory whose marker is
+ * missing or unreadable is left alone: nothing proves it is abandoned.
+ * @param tempRoot - Base directory to sweep (defaults to the OS tmpdir)
+ * @returns The number of directories removed
+ */
+export async function sweepAbandonedRunProfiles(tempRoot = tmpdir()) {
+    let entries;
+    try {
+        entries = await readdir(tempRoot);
+    }
+    catch {
+        return 0;
+    }
+    let removed = 0;
+    for (const entry of entries) {
+        if (!entry.startsWith(RUN_PROFILE_PREFIX))
+            continue;
+        const dir = join(tempRoot, entry);
+        let pid;
+        try {
+            pid = Number.parseInt((await readFile(join(dir, OWNER_MARKER), 'utf8')).trim(), 10);
+        }
+        catch {
+            continue;
+        }
+        if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid || isProcessAlive(pid)) {
+            continue;
+        }
+        try {
+            await rm(dir, { recursive: true, force: true });
+            removed += 1;
+        }
+        catch (error) {
+            verbose(`Could not remove abandoned run profile ${dir}: ${toError(error).message}`);
+        }
+    }
+    return removed;
+}

package/dist/src/core/status-binary.d.ts

@@ -26,7 +26,7 @@
  */
 import type { PatchedContentContext } from './patch-apply.js';
 /** Batched patch lookup, injected by callers that classify many files. */
-export type AffectingPatchLookup = Pick<PatchedContentContext, 'getAffectingPatches' | 'readPatchBody'>;
+export type AffectingPatchLookup = Pick<PatchedContentContext, 'getAffectingPatches' | 'readPatchBody'> & Partial<Pick<PatchedContentContext, 'liveBlobHash'>>;
 /**
  * Classification result for a binary comparison. Structurally assignable
  * to `ClassifiedFile` without importing it (which would create a cycle

package/dist/src/core/status-binary.js

@@ -111,7 +111,9 @@ export async function classifyBinaryOwnedFile(args) {
         }
         if (section.hasBinaryDelta && section.indexNewHash !== undefined) {
             const fullPath = join(engineDir, entry.file);
-            const live = (await hashObjectBatch(engineDir, [fullPath])).get(fullPath);
+            const live = args.lookup?.liveBlobHash !== undefined
+                ? await args.lookup.liveBlobHash(fullPath)
+                : (await hashObjectBatch(engineDir, [fullPath])).get(fullPath);
             if (live !== undefined) {
                 // Prefix-compare: recorded hashes may be abbreviated (≥7 chars).
                 const matches = live.startsWith(section.indexNewHash) || section.indexNewHash.startsWith(live);

package/dist/src/core/status-classify.js

@@ -13,6 +13,7 @@ import { readText } from '../utils/fs.js';
 import { verbose } from '../utils/logger.js';
 import { normalizePathSlashes } from '../utils/paths.js';
 import { isBrandingManagedPath } from './branding.js';
+import { isBinaryFile } from './git-file-ops.js';
 import { createPatchedContentContext } from './patch-apply.js';
 import { classifyBinaryOwnedFile } from './status-binary.js';
 /**
@@ -141,6 +142,7 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
     // expected-vs-actual content comparison then routes them into `unmanaged`
     // when the content matches neither owner's expectation.
     const patchClaims = buildPatchClaims(ctx.manifestPatches);
+    await prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx);
     const deps = {
         engineDir,
         patchesDir,
@@ -149,12 +151,37 @@ export async function classifyFiles(files, engineDir, patchesDir, binaryName, fu
         patchClaims,
         ctx,
     };
-    // Bounded pool over per-file classification (each single-owner file
-    // spawns git). Order preserved by the mapper. Per-file failures settle
+    // Bounded pool over per-file classification. Order preserved by the mapper. Per-file failures settle
     // inside classifySingleOwnerFile's catch, so one bad file never rejects
     // the batch.
     return mapWithConcurrency(files, CLASSIFY_CONCURRENCY, (entry) => classifyEntry(entry, deps));
 }
+/**
+ * Fetches, in two git processes, what the per-file comparison would
+ * otherwise spawn git for file by file: the HEAD content of every
+ * single-owner path (one `cat-file --batch`) and the live blob hash of every
+ * one that is binary on disk (one `hash-object` per ARG_MAX chunk). On a
+ * 1,600-file Firefox scan that was ~1,550 `git show` and `hash-object`
+ * spawns. Fetching for a path the classifier ends up routing elsewhere
+ * (a branding path, say) costs a few bytes, never a wrong answer.
+ */
+async function prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx) {
+    const singleOwner = files.filter((entry) => patchClaims.get(entry.file)?.length === 1);
+    if (singleOwner.length === 0)
+        return;
+    await ctx.prefetchBase(singleOwner.map((entry) => entry.file));
+    const present = singleOwner.filter((entry) => getPrimaryStatusCode(entry.status) !== 'D');
+    const binary = await mapWithConcurrency(present, CLASSIFY_CONCURRENCY, async (entry) => {
+        try {
+            return (await isBinaryFile(engineDir, entry.file)) ? join(engineDir, entry.file) : undefined;
+        }
+        catch {
+            // The per-file path probes again and settles the failure itself.
+            return undefined;
+        }
+    });
+    await ctx.prefetchLiveBlobHashes(binary.filter((path) => path !== undefined));
+}
 /** Concurrency bound for per-file classification (matches import's guard). */
 const CLASSIFY_CONCURRENCY = 8;
 /** Classifies one status entry. Extracted so the pool worker stays flat. */

package/dist/src/core/toolchain-preflight.d.ts

@@ -27,6 +27,12 @@
  */
 /** Tools the preflight knows how to probe. */
 export type ToolchainTool = 'cbindgen' | 'rustc';
+/**
+ * Resolves the mach state directory the same way mach itself does:
+ * `$MOZBUILD_STATE_PATH`, else `~/.mozbuild` (same resolution as
+ * `mach-resource-shim.ts`).
+ */
+export declare function mozbuildStateDir(): string;
 /** One probed candidate binary for a tool. */
 export interface ToolchainCandidate {
     /** Binary path (or bare name for the PATH candidate). */

package/dist/src/core/toolchain-preflight.js

@@ -37,7 +37,7 @@ import { verbose } from '../utils/logger.js';
  * `$MOZBUILD_STATE_PATH`, else `~/.mozbuild` (same resolution as
  * `mach-resource-shim.ts`).
  */
-function mozbuildStateDir() {
+export function mozbuildStateDir() {
     return process.env['MOZBUILD_STATE_PATH'] ?? join(homedir(), '.mozbuild');
 }
 /** Where each tool's minimum is declared inside the Firefox tree. */

package/dist/src/core/typecheck.d.ts

@@ -26,6 +26,16 @@ import type { TypecheckProjectResult } from '../types/typecheck.js';
  * in CI logs.
  */
 export declare const CHECK_JS_DISABLED_NOTICE = "Project sets \"checkJs: false\" \u2014 skipping (override the jsconfig to enable typecheck).";
+/** Run-level options for {@link runTypecheck}. */
+export interface RunTypecheckOptions {
+    /**
+     * Directory for the per-project incremental build info. Defaults to
+     * `<projectRoot>/.fireforge/typecheck`.
+     */
+    cacheDir?: string;
+    /** Build every project from scratch and write no build info. */
+    noCache?: boolean;
+}
 /**
  * Runs `fireforge typecheck` against every project listed in `cfg.projects`.
  *
@@ -55,7 +65,7 @@ export declare const CHECK_JS_DISABLED_NOTICE = "Project sets \"checkJs: false\"
  *   in declared order. The CLI is responsible for printing the issues
  *   and computing the exit code.
  */
-export declare function runTypecheck(projectRoot: string, cfg: TypecheckConfig): Promise<TypecheckProjectResult[]>;
+export declare function runTypecheck(projectRoot: string, cfg: TypecheckConfig, runOptions?: RunTypecheckOptions): Promise<TypecheckProjectResult[]>;
 /**
  * Converts an absolute path to a path relative to the project root,
  * for display in CLI output. Falls back to the absolute path when

package/dist/src/core/typecheck.js

@@ -18,10 +18,13 @@
  * without installing it, the function returns a clear error pointing
  * at `npm install typescript`.
  */
-import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { mkdir, readdir, rm } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
+import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
+import { getPackageVersion } from '../utils/package-root.js';
 import { normalizePathSlashes } from '../utils/paths.js';
 import { composeShimSource, SHIM_FILENAME, SUPPRESSED_DIAGNOSTIC_CODES, UNDEFINED_IDENTIFIER_CODES, UNDEFINED_IDENTIFIER_HINT, } from './typecheck-shim.js';
 /**
@@ -60,7 +63,7 @@ export const CHECK_JS_DISABLED_NOTICE = 'Project sets "checkJs: false" — skipp
  *   in declared order. The CLI is responsible for printing the issues
  *   and computing the exit code.
  */
-export async function runTypecheck(projectRoot, cfg) {
+export async function runTypecheck(projectRoot, cfg, runOptions = {}) {
     // Dynamic import, so typescript stays a dev dependency. Same pattern
     // as `patch-lint-checkjs.ts`. The empty-projects-array case is
     // already rejected by config-validate, so we don't gate the import
@@ -133,7 +136,9 @@ export async function runTypecheck(projectRoot, cfg) {
             });
             continue;
         }
-        results.push(await runTypecheckForProject(ts, projectRoot, projectPath, shimSource, cfg.undefinedIdentifiers ?? 'warning'));
+        results.push(await runTypecheckForProject(ts, projectRoot, projectPath, shimSource, cfg.undefinedIdentifiers ?? 'warning', runOptions.noCache === true
+            ? undefined
+            : (runOptions.cacheDir ?? join(projectRoot, '.fireforge', 'typecheck'))));
     }
     return results;
 }
@@ -151,7 +156,7 @@ function resolveProjectExtraShim(cfg, projectPath) {
     return cfg.extraShim;
 }
 /** Runs typecheck for a single jsconfig path, isolating its failures. */
-async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource, undefinedIdentifiers = 'warning') {
+async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource, undefinedIdentifiers = 'warning', cacheDir) {
     const absConfig = resolve(projectRoot, projectPath);
     if (!(await pathExists(absConfig))) {
         return {
@@ -223,12 +228,12 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         noEmit: true,
         allowJs: parsed.options.allowJs ?? true,
         checkJs: parsed.options.checkJs ?? true,
-        // No incremental sidecar, ever. A user jsconfig under `engine/` that sets
-        // `incremental` (or names a `tsBuildInfoFile`) would have this command
-        // drop a `.tsbuildinfo` inside the primary engine checkout: a second
-        // writer that invalidates a concurrent `fireforge test`'s engine
-        // fingerprint. This command emits nothing, so the sidecar buys nothing
-        // either.
+        // Never the jsconfig's own incremental sidecar: a user jsconfig under
+        // `engine/` that sets `incremental` (or names a `tsBuildInfoFile`) would
+        // have this command drop a `.tsbuildinfo` inside the primary engine
+        // checkout, a second writer that invalidates a concurrent
+        // `fireforge test`'s engine fingerprint. FireForge's own build info
+        // lives under `.fireforge/typecheck/` instead (see below).
         incremental: false,
         // skipLibCheck is not forced. The user owns it via their jsconfig.
     };
@@ -267,7 +272,38 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
             return defaultHost.readFile(fileName);
         },
     };
-    const program = ts.createProgram(rootFiles, options, host);
+    // Incremental build info, keyed by everything outside the program's own
+    // files that can change a verdict: the composed shim, the TypeScript
+    // version, the compiler options, the undefined-identifier gate and the
+    // FireForge version. A change to any of them selects a different file,
+    // so a stale verdict is never replayed. Files inside the program are
+    // tracked by TypeScript's own per-file hashes in the build info.
+    const buildInfoFile = cacheDir === undefined
+        ? undefined
+        : await prepareBuildInfoFile(cacheDir, projectPath, {
+            shim: sha256Hex(shimSource),
+            typescript: ts.version,
+            fireforge: getPackageVersion(),
+            undefinedIdentifiers,
+            options,
+        });
+    let program;
+    let writeBuildInfo = () => undefined;
+    if (buildInfoFile === undefined) {
+        program = ts.createProgram(rootFiles, options, host);
+    }
+    else {
+        const builder = ts.createIncrementalProgram({
+            rootNames: rootFiles,
+            options: { ...options, incremental: true, tsBuildInfoFile: buildInfoFile },
+            host: withSourceFileVersions(host),
+        });
+        program = builder;
+        // Under noEmit, emit() writes the build info and nothing else.
+        writeBuildInfo = () => {
+            builder.emit();
+        };
+    }
     // Collect the full diagnostic set. patchLint reads only semantic +
     // syntactic, which is fine for hygiene but wrong for CI: a misconfigured
     // `lib: ["es2015"]` or a missing `paths` target should fail
@@ -298,6 +334,7 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         }
         issues.push(diagnosticToIssue(ts, diag, absConfig, projectPath));
     }
+    writeBuildInfo();
     verbose(`typecheck: ${projectPath} — analyzed ${parsed.fileNames.length} file(s), found ${issues.length} issue(s)`);
     return {
         project: projectPath,
@@ -305,6 +342,43 @@ async function runTypecheckForProject(ts, projectRoot, projectPath, shimSource,
         filesChecked: parsed.fileNames.length,
     };
 }
+/**
+ * Stamps every source file with a content-hash version, which the
+ * incremental builder requires and a plain compiler host never sets.
+ * `ts.createIncrementalCompilerHost` does the same internally, but the
+ * shim here is served by a custom host rather than read from disk.
+ */
+function withSourceFileVersions(host) {
+    const getSourceFile = host.getSourceFile.bind(host);
+    return {
+        ...host,
+        getSourceFile(...args) {
+            const file = getSourceFile(...args);
+            if (file !== undefined) {
+                file.version = sha256Hex(file.text);
+            }
+            return file;
+        },
+    };
+}
+/**
+ * Resolves the build-info path for one project and key, creating the cache
+ * directory and removing the project's build info for any other key: a
+ * shim or TypeScript change leaves the old file unreachable anyway.
+ * @returns Absolute build-info path
+ */
+async function prepareBuildInfoFile(cacheDir, projectPath, keyInputs) {
+    const slug = projectPath.replace(/[^A-Za-z0-9._-]+/g, '_');
+    const key = sha256Hex(JSON.stringify(keyInputs)).slice(0, 16);
+    const fileName = `${slug}-${key}.tsbuildinfo`;
+    await mkdir(cacheDir, { recursive: true });
+    for (const entry of await readdir(cacheDir)) {
+        if (entry !== fileName && entry.startsWith(`${slug}-`) && entry.endsWith('.tsbuildinfo')) {
+            await rm(join(cacheDir, entry), { force: true });
+        }
+    }
+    return join(cacheDir, fileName);
+}
 /**
  * Converts a TS Diagnostic to a TypecheckIssue. The `fallbackFile`
  * is used when the diagnostic carries no source file (typical for

package/dist/src/errors/rebase.d.ts

@@ -31,3 +31,12 @@ export declare class NoRebaseSessionError extends RebaseError {
 export declare class CorruptRebaseSessionError extends RebaseError {
     constructor(sessionPath: string, reason: string);
 }
+/**
+ * Thrown by `rebase --dry-run` when the replay rejects at least one patch.
+ * A dry run that exited 0 regardless used to read as "the rebase is ready".
+ */
+export declare class RebaseDryRunRejectError extends RebaseError {
+    readonly rejected: readonly string[];
+    constructor(rejected: readonly string[]);
+    get userMessage(): string;
+}

package/dist/src/errors/rebase.js

@@ -49,3 +49,23 @@ export class CorruptRebaseSessionError extends RebaseError {
             'or delete the file to start over.');
     }
 }
+/**
+ * Thrown by `rebase --dry-run` when the replay rejects at least one patch.
+ * A dry run that exited 0 regardless used to read as "the rebase is ready".
+ */
+export class RebaseDryRunRejectError extends RebaseError {
+    rejected;
+    constructor(rejected) {
+        super(`Dry run: ${rejected.length} patch(es) would not apply: ${rejected.join(', ')}. ` +
+            'engine/ was not modified.');
+        this.rejected = rejected;
+    }
+    get userMessage() {
+        return (`Rebase Error: ${this.message}` +
+            remedies([
+                'The per-patch lines above name the files that did not apply',
+                'Run "fireforge rebase" to start the real rebase; it stops at the first reject for manual resolution',
+                'Later rejects may cascade from an earlier one; resolve in queue order',
+            ]));
+    }
+}

package/dist/src/index.d.ts

@@ -16,12 +16,14 @@
  * @packageDocumentation
  */
 export { loadConfig, validateConfig } from './core/config.js';
+export type { FindForwardRegistrationsOptions, ForwardRegistration, ForwardRegistrationKind, ForwardRegistrationScope, } from './core/forward-registrations.js';
+export { findForwardRegistrations } from './core/forward-registrations.js';
 export type { ApplyAllComponentsResult } from './core/furnace-apply.js';
 export { applyAllComponents } from './core/furnace-apply.js';
 export { ensureFurnaceConfig, loadFurnaceConfig, loadFurnaceState, saveFurnaceState, validateFurnaceConfig, } from './core/furnace-config.js';
 export { validateAllComponents, validateComponent } from './core/furnace-validate.js';
 export type { PatchSizeTierDecision } from './core/patch-lint.js';
-export { countNonBinaryDiffLines, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
+export { countNonBinaryDiffLines, filesMeasuredByFileTooLarge, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
 export type { AddTokenOptions, AddTokenResult, TokenMode } from './core/token-manager.js';
 export { addToken, getTokensCssPath, validateTokenAdd } from './core/token-manager.js';
 export { CancellationError, CommandError, FireForgeError, GeneralError, InvalidArgumentError, ResolutionError, } from './errors/base.js';

package/dist/src/index.js

@@ -17,10 +17,11 @@
  * @packageDocumentation
  */
 export { loadConfig, validateConfig } from './core/config.js';
+export { findForwardRegistrations } from './core/forward-registrations.js';
 export { applyAllComponents } from './core/furnace-apply.js';
 export { ensureFurnaceConfig, loadFurnaceConfig, loadFurnaceState, saveFurnaceState, validateFurnaceConfig, } from './core/furnace-config.js';
 export { validateAllComponents, validateComponent } from './core/furnace-validate.js';
-export { countNonBinaryDiffLines, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
+export { countNonBinaryDiffLines, filesMeasuredByFileTooLarge, getPatchSizeThresholds, resolvePatchSizeTier, } from './core/patch-lint.js';
 export { addToken, getTokensCssPath, validateTokenAdd } from './core/token-manager.js';
 export { CancellationError, CommandError, FireForgeError, GeneralError, InvalidArgumentError, ResolutionError, } from './errors/base.js';
 export { ExitCode } from './errors/codes.js';