@hominis/fireforge 0.47.1 → 0.49.0

package/dist/src/commands/typecheck.js

@@ -88,7 +88,9 @@ async function runTypecheckCommandBody(projectRoot, options) {
     // use so typecheck checks against the current workspace.
     await regenerateStaleGeneratedJsconfig(projectRoot);
     info(`Running typecheck across ${cfg.projects.length} project(s): ${cfg.projects.join(', ')}`);
-    const results = await runTypecheck(projectRoot, cfg);
+    const results = await runTypecheck(projectRoot, cfg, {
+        ...(options.noCache === true ? { noCache: true } : {}),
+    });
     // Fold the EXPORT-TIME authority into this pass. Per-patch lint runs
     // checkJs over the queue's patch-owned modules in relative isolation and
     // resolves imported typedefs differently from the whole-project pass, so
@@ -193,11 +195,15 @@ export function registerTypecheck(program, { getProjectRoot, withErrorHandling }
         .command('typecheck')
         .description('Run TypeScript type checking against project-owned jsconfig.json files (CI-grade, whole-project)')
         .option('--project <path>', 'Override typecheck.projects with a single jsconfig.json path (one-off run)')
+        .option('--no-cache', 'Check every project from scratch; neither read nor write the incremental build info in .fireforge/typecheck/')
         .action(withErrorHandling(async (options) => {
         const opts = {};
         if (options.project !== undefined) {
             opts.project = options.project;
         }
+        if (options.cache === false) {
+            opts.noCache = true;
+        }
         await typecheckCommand(getProjectRoot(), opts);
     }));
 }

package/dist/src/core/build-baseline-types.d.ts

@@ -35,6 +35,12 @@ export interface BuildBaseline {
      * a tracked deletion.
      */
     packageableFingerprints?: Record<string, string>;
+    /**
+     * All dirty staging inputs, including plain test scripts and support fixtures.
+     * Omitted when any input could not be fingerprinted; a partial map cannot
+     * anchor retained coverage.
+     */
+    testInputFingerprints?: Record<string, string>;
     /**
      * Content hash per build-input manifest (`jar.mn`, `moz.build`,
      * `moz.configure`, `Makefile.in`, `mozbuild.in`) that was dirty
@@ -83,20 +89,12 @@ export interface BuildBaseline {
      * checkouts are refused up-front (`AmbiguousBuildArtifactsError`), so at
      * most one obj dir exists per project.
      *
-     * Union/"shared coverage" across successive scoped builds is unsound in
-     * general: every baseline write refreshes `packageableFingerprints` for
-     * all dirty packageable paths, so a blind union would whitewash an
-     * earlier scope's edited fixtures while `obj-*`/`_tests/` still holds its
-     * stale staging. Coverage therefore replaces by default.
-     *
-     * The one exception is `test --build --extend-coverage`, which unions only
-     * after proving the previous record's anchor still holds: same engine
-     * HEAD, same {@link BuildBaseline.mozconfigHash}, and every previously
-     * fingerprinted path byte-identical, i.e. the wholesale fingerprint
-     * refresh is a no-op for everything the earlier scope's staging depended
-     * on. Any divergence refuses fail-closed. See `src/core/coverage-extend.ts`
-     * for the one boundary that guard does not cover (dirty non-packageable
-     * fixtures).
+     * Successive scoped builds retain the previous claim only when HEAD,
+     * mozconfig and complete testInputFingerprints outside the rebuilt scope
+     * remain anchored. Explicitly rebuilt paths may change. A failed anchor
+     * replaces coverage with a dropped-path notice, or refuses when the caller
+     * required --extend-coverage. Legacy packageable-only anchors cannot retain
+     * coverage because they cannot prove test scripts and fixtures unchanged.
      */
     testPackagingCoverage?: TestPackagingCoverage;
     /**

package/dist/src/core/build-baseline-validate.d.ts

@@ -0,0 +1,3 @@
+import { type BuildBaseline } from './build-baseline-types.js';
+/** Validates persisted fields without converting malformed coverage into a full claim. */
+export declare function isBuildBaseline(value: unknown): value is BuildBaseline;

package/dist/src/core/build-baseline-validate.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { isObject } from '../utils/validation.js';
+import { DELETED_FILE_FINGERPRINT } from './build-baseline-types.js';
+/** Baseline paths are engine-relative POSIX identifiers, never filesystem escapes. */
+function isBaselinePath(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        !value.includes('\0') &&
+        !value.includes('\\') &&
+        !value.includes(':') &&
+        value.split('/').every((part) => part.length > 0 && part !== '.' && part !== '..'));
+}
+function isFingerprint(value) {
+    return (typeof value === 'string' &&
+        (/^[a-f0-9]{64}$/i.test(value) || value === DELETED_FILE_FINGERPRINT));
+}
+function isFingerprintMap(value) {
+    return (isObject(value) &&
+        Object.entries(value).every(([path, fingerprint]) => isBaselinePath(path) && isFingerprint(fingerprint)));
+}
+/** Validates persisted fields without converting malformed coverage into a full claim. */
+export function isBuildBaseline(value) {
+    if (!isObject(value))
+        return false;
+    if (typeof value['engineHeadSha'] !== 'string' ||
+        typeof value['builtAt'] !== 'string' ||
+        !Number.isFinite(Date.parse(value['builtAt'])) ||
+        typeof value['binaryName'] !== 'string' ||
+        !/^[a-z][a-z0-9-]*$/.test(value['binaryName']))
+        return false;
+    for (const field of [
+        'packageableFingerprints',
+        'testInputFingerprints',
+        'buildInputFingerprints',
+    ]) {
+        if (value[field] !== undefined && !isFingerprintMap(value[field]))
+            return false;
+    }
+    const coverage = value['testPackagingCoverage'];
+    if (coverage !== undefined &&
+        coverage !== 'full' &&
+        !(Array.isArray(coverage) && coverage.every(isBaselinePath)))
+        return false;
+    if (value['mozconfigHash'] !== undefined && !isFingerprint(value['mozconfigHash']))
+        return false;
+    if (value['recordedBy'] !== undefined && typeof value['recordedBy'] !== 'string')
+        return false;
+    const components = value['staticComponentsBaseline'];
+    return (components === undefined ||
+        (isObject(components) &&
+            typeof components['engineHeadSha'] === 'string' &&
+            isFingerprintMap(components['fingerprints'])));
+}

package/dist/src/core/build-baseline.d.ts

@@ -33,11 +33,12 @@ export type BaselineBuildKind = 'full' | 'faster';
 export declare function getBuildBaselinePath(projectRoot: string): string;
 /**
  * Reads the last-build baseline if present. Returns undefined when no
- * previous successful build has been recorded. Callers must tolerate that
- * path (first build, cleaned workspace).
+ * previous successful build has been recorded. Builds can replace invalid
+ * markers; dispatch preflights pass `refuse` so invalid coverage never
+ * becomes the legacy implicit full claim.
  * @param projectRoot - Root directory of the project
  */
-export declare function readBuildBaseline(projectRoot: string): Promise<BuildBaseline | undefined>;
+export declare function readBuildBaseline(projectRoot: string, invalid?: 'ignore' | 'refuse'): Promise<BuildBaseline | undefined>;
 export interface WriteBuildBaselineOptions {
     /** Root directory of the project. */
     projectRoot: string;

package/dist/src/core/build-baseline.js

@@ -18,13 +18,15 @@
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { PreflightRefusalError } from '../errors/base.js';
 import { mapWithConcurrency } from '../utils/concurrency.js';
 import { getNodeErrorCode, toError } from '../utils/errors.js';
-import { pathExists, readJson, writeJson } from '../utils/fs.js';
+import { readJson, writeJson } from '../utils/fs.js';
 import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
 import { isBuildInputPath, isJarManifestPath, isPackageablePath, isXpcomManifestPath, } from './build-audit.js';
 import { DELETED_FILE_FINGERPRINT, } from './build-baseline-types.js';
+import { isBuildBaseline } from './build-baseline-validate.js';
 import { FIREFORGE_DIR } from './config-paths.js';
 import { hashEngineFile } from './coverage-extend.js';
 import { getHead, hasChanges, isMissingHeadError } from './git.js';
@@ -47,21 +49,26 @@ export function getBuildBaselinePath(projectRoot) {
 }
 /**
  * Reads the last-build baseline if present. Returns undefined when no
- * previous successful build has been recorded. Callers must tolerate that
- * path (first build, cleaned workspace).
+ * previous successful build has been recorded. Builds can replace invalid
+ * markers; dispatch preflights pass `refuse` so invalid coverage never
+ * becomes the legacy implicit full claim.
  * @param projectRoot - Root directory of the project
  */
-export async function readBuildBaseline(projectRoot) {
+export async function readBuildBaseline(projectRoot, invalid = 'ignore') {
     const path = getBuildBaselinePath(projectRoot);
-    if (!(await pathExists(path))) {
-        return undefined;
-    }
     try {
-        return await readJson(path);
+        const value = await readJson(path);
+        if (!isBuildBaseline(value))
+            throw new Error('invalid baseline fields');
+        return value;
     }
-    catch {
-        // A corrupt marker is equivalent to no marker: the audit/auto-configure
-        // will treat it as "first build" rather than block on the inconsistency.
+    catch (error) {
+        if (getNodeErrorCode(error) === 'ENOENT')
+            return undefined;
+        if (invalid === 'refuse') {
+            throw new PreflightRefusalError(`Build baseline ${path} is invalid: ${toError(error).message}. Run "fireforge build" to record a fresh baseline before dispatching tests.`, 'invalid-build-baseline');
+        }
+        verbose(`Ignoring invalid build baseline ${path}: ${toError(error).message}`);
         return undefined;
     }
 }
@@ -89,6 +96,7 @@ export async function writeBuildBaseline(options) {
         }
     }
     const packageableFingerprints = await collectPackageableFingerprints(engineDir);
+    const testInputFingerprints = await collectDirtyFingerprints(engineDir, () => true, 'test staging fingerprint');
     const buildInputFingerprints = await collectBuildInputFingerprints(engineDir, previousBaseline, buildKind);
     // A full-coverage write (and the legacy no-claim `fireforge build` shape)
     // just recompiled the StaticComponents table, so it anchors the table to
@@ -105,6 +113,7 @@ export async function writeBuildBaseline(options) {
         builtAt: new Date().toISOString(),
         binaryName,
         ...(packageableFingerprints !== undefined ? { packageableFingerprints } : {}),
+        ...(testInputFingerprints !== undefined ? { testInputFingerprints } : {}),
         ...(buildInputFingerprints !== undefined ? { buildInputFingerprints } : {}),
         ...(testPackagingCoverage !== undefined ? { testPackagingCoverage } : {}),
         ...(mozconfigHash !== undefined ? { mozconfigHash } : {}),
@@ -218,6 +227,9 @@ async function collectDirtyFingerprints(engineDir, includePath, contextLabel) {
             }
         });
         const fingerprints = {};
+        // Incomplete maps cannot prove retained test inputs unchanged.
+        if (entries.some((entry) => entry === undefined))
+            return undefined;
         for (const entry of entries) {
             if (entry !== undefined)
                 fingerprints[entry[0]] = entry[1];

package/dist/src/core/build-prepare.d.ts

@@ -58,6 +58,8 @@ export declare function isBackendInvalidatingFile(path: string): boolean;
  * 3. Sets up branding directory if not already done
  * 4. Applies Furnace components if furnace.json exists
  * 5. Generates mozconfig
+ * 6. Runs `mach configure` when a backend-invalidating input, including
+ * the mozconfig just generated, changed since the previous baseline
  *
  * @param projectRoot - Root directory of the project
  * @param paths - Resolved project paths

package/dist/src/core/build-prepare.js

@@ -14,6 +14,7 @@ import { isBrandingSetup, setupBranding } from './branding.js';
 import { isBuildInputPath, isJarManifestPath } from './build-audit.js';
 import { evaluateJarManifestEscalation, formatJarEscalationNotice, } from './build-jar-escalation.js';
 import { findUnexportedDriftAtRisk, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
+import { hashEngineFile } from './coverage-extend.js';
 import { collectChangedEnginePaths, dropPathsMatchingFingerprints } from './engine-changes.js';
 import { applyAllComponents } from './furnace-apply.js';
 import { logApplyWarnings } from './furnace-apply-output.js';
@@ -231,6 +232,40 @@ async function applyFurnaceBeforeBuild(projectRoot) {
     }
     return furnaceApplied;
 }
+/**
+ * Runs the auto-configure step (`mach configure`) against the freshly
+ * generated mozconfig, surfacing the underlying mozbuild error on failure.
+ * @param engineDir - Path to the engine directory
+ * @param triggers - Why the backend is being regenerated, for the notice
+ */
+async function runAutoConfigure(engineDir, triggers) {
+    // Warning severity: this is the "why is this run slow" explanation,
+    // and an info-level line does not survive an agent output filter that
+    // keeps only warnings and errors.
+    notice(`Backend config changed; running backend regeneration first (${triggers}). Backend command: mach configure.`);
+    const configureSpinner = spinner('Running mach configure...');
+    try {
+        const captured = await runMachCapture(['configure'], engineDir);
+        const exitCode = captured.exitCode;
+        if (exitCode !== 0) {
+            configureSpinner.error(`mach configure failed with exit code ${exitCode}`);
+            // Surface the underlying mozbuild error (e.g. UnsortedError)
+            // instead of a bare exit code, since the generic message hid the
+            // actual cause, plus any matched mach-error hints (see the helper).
+            throw buildConfigureFailureError(captured);
+        }
+        configureSpinner.stop('Backend regenerated successfully (mach configure exit code 0)');
+        info('Backend regeneration succeeded; continuing with build.');
+    }
+    catch (error) {
+        if (error instanceof BuildError) {
+            throw error;
+        }
+        configureSpinner.error('mach configure failed');
+        verbose(`Auto-configure error: ${toError(error).message}`);
+        throw new BuildError(`Backend regeneration failed while running mach configure: ${toError(error).message}. Build stopped because continuing would hide the real configure failure.`, 'mach configure', error instanceof Error ? error : undefined);
+    }
+}
 /**
  * Runs the shared pre-flight steps for build and package commands:
  * 1. Warns (or refuses) about unexported engine drift the writes below
@@ -239,6 +274,8 @@ async function applyFurnaceBeforeBuild(projectRoot) {
  * 3. Sets up branding directory if not already done
  * 4. Applies Furnace components if furnace.json exists
  * 5. Generates mozconfig
+ * 6. Runs `mach configure` when a backend-invalidating input, including
+ * the mozconfig just generated, changed since the previous baseline
  *
  * @param projectRoot - Root directory of the project
  * @param paths - Resolved project paths
@@ -259,11 +296,16 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         }
     }
     await reportUnexportedDriftBeforeOverwrite(projectRoot, config, options);
-    // Auto-configure: if any backend-invalidating file (moz.build, moz.configure,
-    // Makefile.in) changed since the last successful build, run `mach configure`
-    // before the build step. Prevents incremental builds from silently skipping
-    // work against a stale recursive-make backend.
-    let reconfigured = false;
+    // Auto-configure census: if any backend-invalidating file (moz.build,
+    // moz.configure, Makefile.in) changed since the last successful build,
+    // `mach configure` runs before the build step. Prevents incremental builds
+    // from silently skipping work against a stale recursive-make backend. The
+    // configure itself waits until the mozconfig below has been regenerated:
+    // run earlier, it configured against the previous engine/mozconfig, and a
+    // configs/ fix for a failing configure (a pinned --with-macos-sdk) could
+    // never take effect because the failure stopped the build before the
+    // regeneration.
+    const configureTriggers = [];
     let fullBuildRequired = false;
     let fullBuildReason;
     if (options.previousBaseline) {
@@ -273,35 +315,7 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         fullBuildRequired = jarEscalation !== undefined;
         fullBuildReason = jarEscalation;
         if (invalidating.length > 0) {
-            // Warning severity: this is the "why is this run slow" explanation,
-            // and an info-level line does not survive an agent output filter that
-            // keeps only warnings and errors.
-            notice(`Backend config changed; running backend regeneration first (${invalidating.length} file${invalidating.length === 1 ? '' : 's'} touched). Backend command: mach configure.`);
-            const configureSpinner = spinner('Running mach configure...');
-            try {
-                const captured = await runMachCapture(['configure'], paths.engine);
-                const exitCode = captured.exitCode;
-                if (exitCode !== 0) {
-                    configureSpinner.error(`mach configure failed with exit code ${exitCode}`);
-                    // Surface the underlying mozbuild error (e.g. UnsortedError)
-                    // instead of a bare exit code, since the generic message hid the
-                    // actual cause, plus any matched mach-error hints (see the helper).
-                    throw buildConfigureFailureError(captured);
-                }
-                else {
-                    configureSpinner.stop('Backend regenerated successfully (mach configure exit code 0)');
-                    info('Backend regeneration succeeded; continuing with build.');
-                    reconfigured = true;
-                }
-            }
-            catch (error) {
-                if (error instanceof BuildError) {
-                    throw error;
-                }
-                configureSpinner.error('mach configure failed');
-                verbose(`Auto-configure error: ${toError(error).message}`);
-                throw new BuildError(`Backend regeneration failed while running mach configure: ${toError(error).message}. Build stopped because continuing would hide the real configure failure.`, 'mach configure', error instanceof Error ? error : undefined);
-            }
+            configureTriggers.push(`${invalidating.length} file${invalidating.length === 1 ? '' : 's'} touched`);
         }
     }
     // Clean stories before build to ensure they don't leak into production binary
@@ -333,14 +347,32 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
     const furnaceApplied = await applyFurnaceBeforeBuild(projectRoot);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
+    let mozconfigWritten;
     try {
-        await generateMozconfig(paths.configs, paths.engine, config);
+        mozconfigWritten = await generateMozconfig(paths.configs, paths.engine, config);
         mozconfigSpinner.stop('mozconfig generated');
     }
     catch (error) {
         mozconfigSpinner.error('Failed to generate mozconfig');
         throw error;
     }
+    // A changed mozconfig is itself backend-invalidating. Compare against the
+    // hash the last successful build recorded; a baseline from before that
+    // field existed falls back to whether this run rewrote the file.
+    if (options.previousBaseline) {
+        const recorded = options.previousBaseline.mozconfigHash;
+        const mozconfigChanged = recorded !== undefined
+            ? (await hashEngineFile(paths.engine, 'mozconfig')) !== recorded
+            : mozconfigWritten;
+        if (mozconfigChanged) {
+            configureTriggers.push('engine/mozconfig changed since the last build');
+        }
+    }
+    let reconfigured = false;
+    if (configureTriggers.length > 0) {
+        await runAutoConfigure(paths.engine, configureTriggers.join('; '));
+        reconfigured = true;
+    }
     return {
         furnaceApplied,
         reconfigured,

package/dist/src/core/component-source-guard.d.ts

@@ -0,0 +1,20 @@
+import type { FurnaceConfig } from '../types/furnace.js';
+import type { FurnacePaths } from './furnace-config.js';
+/** Records authored bytes without following directory aliases or writing to source directories. */
+export declare function snapshotComponentSources(roots: readonly string[]): Promise<Map<string, string>>;
+/** Detects reverted, removed or added source files before deployment can be committed. */
+export declare function changedComponentSources(roots: readonly string[], before: ReadonlyMap<string, string>): Promise<string[]>;
+interface ComponentSourceSnapshot {
+    roots: string[];
+    files: Map<string, string>;
+}
+/** Captures only configured inputs for a real deploy, plus shared CSS fragments. */
+export declare function captureComponentSources(paths: FurnacePaths, config: FurnaceConfig, dryRun: boolean, options?: {
+    componentName?: string;
+}): Promise<ComponentSourceSnapshot | undefined>;
+/** Produces a blocking apply error before the journal or ownership state is committed. */
+export declare function componentSourceErrors(snapshot: ComponentSourceSnapshot | undefined): Promise<Array<{
+    name: string;
+    error: string;
+}>>;
+export {};

package/dist/src/core/component-source-guard.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { getNodeErrorCode } from '../utils/errors.js';
+import { sha256Hex } from '../utils/hash.js';
+/** Records authored bytes without following directory aliases or writing to source directories. */
+export async function snapshotComponentSources(roots) {
+    const files = new Map();
+    async function visit(directory) {
+        let entries;
+        try {
+            entries = await readdir(directory, { withFileTypes: true });
+        }
+        catch (error) {
+            if (getNodeErrorCode(error) === 'ENOENT')
+                return;
+            throw error;
+        }
+        for (const entry of entries) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory())
+                await visit(path);
+            else if (entry.isFile())
+                files.set(path, sha256Hex(await readFile(path)));
+        }
+    }
+    for (const root of roots)
+        await visit(root);
+    return files;
+}
+/** Detects reverted, removed or added source files before deployment can be committed. */
+export async function changedComponentSources(roots, before) {
+    const after = await snapshotComponentSources(roots);
+    return [...new Set([...before.keys(), ...after.keys()])]
+        .filter((path) => before.get(path) !== after.get(path))
+        .sort();
+}
+/** Captures only configured inputs for a real deploy, plus shared CSS fragments. */
+export async function captureComponentSources(paths, config, dryRun, options) {
+    if (dryRun)
+        return undefined;
+    const componentName = options?.componentName;
+    const selected = (name) => componentName === undefined || name === componentName;
+    const roots = [
+        ...Object.keys(config.custom)
+            .filter(selected)
+            .map((name) => join(paths.customDir, name)),
+        ...Object.keys(config.overrides)
+            .filter(selected)
+            .map((name) => join(paths.overridesDir, name)),
+        paths.sharedDir,
+    ];
+    return { roots, files: await snapshotComponentSources(roots) };
+}
+/** Produces a blocking apply error before the journal or ownership state is committed. */
+export async function componentSourceErrors(snapshot) {
+    if (!snapshot)
+        return [];
+    const changed = await changedComponentSources(snapshot.roots, snapshot.files);
+    return changed.length === 0
+        ? []
+        : [
+            {
+                name: 'component-sources',
+                error: `Component sources changed during deployment: ${changed.join(', ')}. Refusing this build/proof; inspect the source edits before retrying.`,
+            },
+        ];
+}

package/dist/src/core/config-paths.d.ts

@@ -7,7 +7,7 @@ export declare const FIREFORGE_DIR = ".fireforge";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -68,6 +68,7 @@ export const SUPPORTED_CONFIG_PATHS = [
     'patchLint.jsdocClassMethods',
     'patchLint.testAssertionFloor',
     'patchLint.chromeScriptJsDoc',
+    'patchLint.forwardRegistration',
     'patchPolicy',
     'typecheck',
     'typecheck.projects',

package/dist/src/core/config-validate.js

@@ -376,6 +376,13 @@ function parsePatchLintBlock(rec) {
     if (fileSizeThresholds !== undefined) {
         out.fileSizeThresholds = parsePatchLintFileSizeThresholds(fileSizeThresholds);
     }
+    const forwardRegistration = rec.raw('forwardRegistration');
+    if (forwardRegistration !== undefined) {
+        if (forwardRegistration !== 'support-files' && forwardRegistration !== 'extended') {
+            throw new ConfigError('Config field "patchLint.forwardRegistration" must be one of: support-files, extended');
+        }
+        out.forwardRegistration = forwardRegistration;
+    }
     for (const key of PATCH_LINT_SEVERITY_GATE_KEYS) {
         const gate = parseSeverityGate(rec.raw(key), `patchLint.${key}`);
         if (gate !== undefined)

package/dist/src/core/coverage-extend.d.ts

@@ -1,37 +1,8 @@
 /**
- * `test --build/--build-only --extend-coverage`: unions the requested paths
- * into the recorded `testPackagingCoverage` instead of replacing it, under
- * an anchor guard.
- *
- * Coverage replaces by default for a reason documented in
- * `build-baseline-types.ts`: every baseline write refreshes
- * `packageableFingerprints` for all dirty packageable paths, so a blind
- * union would whitewash an earlier scope's edited fixtures while
- * `obj-*`/`_tests/` still holds that scope's stale staging. Extending is
- * honest only while everything the previous record vouched for is still
- * true, which is what {@link checkExtendCoverageAnchor} and
- * {@link checkExtendMozconfigAnchor} verify:
- *
- *   1. engine HEAD is unchanged, so every committed edit is excluded.
- *   2. every path the previous baseline fingerprinted still hashes to the
- *      recorded digest, so the earlier scope's staging inputs are
- *      byte-identical. Files that became dirty since that build are fine:
- *      the current whole-tree `mach build faster` repackages `dist/` and
- *      vouches for them.
- *   3. the generated `engine/mozconfig` is unchanged. Engine HEAD does not
- *      cover this: the mozconfig is regenerated from project-side
- *      `configs/*.mozconfig` templates plus `fireforge.json` on every build,
- *      so two builds at the same engine SHA can configure differently.
- *
- * Every failure refuses fail-closed. The operator's remedy is always a plain
- * scoped build, which resets the claim to the paths it actually vouches for.
- *
- * Known boundary, documented rather than closed: dirty non-packageable
- * fixtures under previously covered paths (plain test files, manifests
- * `isPackageablePath` rejects) are invisible to check 2. Editing one
- * uncommitted between two builds leaves the earlier scope's `_tests/`
- * staging stale while extend still vouches for it. Plain replacement has no such
- * window, because the earlier scope simply stops being covered.
+ * Retains prior test staging only when HEAD, mozconfig and every recorded
+ * dirty input outside the newly rebuilt scope are unchanged. Complete
+ * input fingerprints are required: packageable-only legacy records cannot
+ * prove that a test fixture or manifest still matches its staged copy.
  */
 import { type BuildBaseline, type TestPackagingCoverage } from './build-baseline-types.js';
 /** Why `--extend-coverage` could not union onto the recorded claim. */
@@ -51,7 +22,7 @@ export type ExtendAnchorResult = {
  * @param engineDir - Path to the engine directory
  * @param previousBaseline - Baseline recorded by the previous build
  */
-export declare function checkExtendCoverageAnchor(engineDir: string, previousBaseline: BuildBaseline | undefined): Promise<ExtendAnchorResult>;
+export declare function checkExtendCoverageAnchor(engineDir: string, previousBaseline: BuildBaseline | undefined, rebuiltPaths?: readonly string[]): Promise<ExtendAnchorResult>;
 /**
  * Verifies the mozconfig half of the anchor. Split from
  * {@link checkExtendCoverageAnchor} because it can only run after