@hominis/fireforge 0.47.1 → 0.49.0

package/dist/src/core/coverage-extend.js

@@ -1,38 +1,9 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * `test --build/--build-only --extend-coverage`: unions the requested paths
- * into the recorded `testPackagingCoverage` instead of replacing it, under
- * an anchor guard.
- *
- * Coverage replaces by default for a reason documented in
- * `build-baseline-types.ts`: every baseline write refreshes
- * `packageableFingerprints` for all dirty packageable paths, so a blind
- * union would whitewash an earlier scope's edited fixtures while
- * `obj-*`/`_tests/` still holds that scope's stale staging. Extending is
- * honest only while everything the previous record vouched for is still
- * true, which is what {@link checkExtendCoverageAnchor} and
- * {@link checkExtendMozconfigAnchor} verify:
- *
- *   1. engine HEAD is unchanged, so every committed edit is excluded.
- *   2. every path the previous baseline fingerprinted still hashes to the
- *      recorded digest, so the earlier scope's staging inputs are
- *      byte-identical. Files that became dirty since that build are fine:
- *      the current whole-tree `mach build faster` repackages `dist/` and
- *      vouches for them.
- *   3. the generated `engine/mozconfig` is unchanged. Engine HEAD does not
- *      cover this: the mozconfig is regenerated from project-side
- *      `configs/*.mozconfig` templates plus `fireforge.json` on every build,
- *      so two builds at the same engine SHA can configure differently.
- *
- * Every failure refuses fail-closed. The operator's remedy is always a plain
- * scoped build, which resets the claim to the paths it actually vouches for.
- *
- * Known boundary, documented rather than closed: dirty non-packageable
- * fixtures under previously covered paths (plain test files, manifests
- * `isPackageablePath` rejects) are invisible to check 2. Editing one
- * uncommitted between two builds leaves the earlier scope's `_tests/`
- * staging stale while extend still vouches for it. Plain replacement has no such
- * window, because the earlier scope simply stops being covered.
+ * Retains prior test staging only when HEAD, mozconfig and every recorded
+ * dirty input outside the newly rebuilt scope are unchanged. Complete
+ * input fingerprints are required: packageable-only legacy records cannot
+ * prove that a test fixture or manifest still matches its staged copy.
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
@@ -41,6 +12,8 @@ import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
 import { DELETED_FILE_FINGERPRINT, } from './build-baseline-types.js';
 import { getHead, isMissingHeadError } from './git.js';
+import { git } from './git-base.js';
+import { getUntrackedFiles } from './git-status.js';
 /** Filename of the generated mozconfig, relative to the engine directory. */
 const MOZCONFIG_FILENAME = 'mozconfig';
 /** How many diverged paths a refusal names before truncating. */
@@ -52,14 +25,15 @@ const MAX_DIVERGED_REPORTED = 5;
  * @param engineDir - Path to the engine directory
  * @param previousBaseline - Baseline recorded by the previous build
  */
-export async function checkExtendCoverageAnchor(engineDir, previousBaseline) {
+export async function checkExtendCoverageAnchor(engineDir, previousBaseline, rebuiltPaths = []) {
     if (previousBaseline === undefined) {
         return { ok: false, reason: 'no-baseline', detail: [] };
     }
     if (previousBaseline.mozconfigHash === undefined) {
         return { ok: false, reason: 'no-mozconfig-hash', detail: [] };
     }
-    const recordedFingerprints = previousBaseline.packageableFingerprints;
+    const recordedFingerprints = previousBaseline.testInputFingerprints;
+    const rebuilt = (file) => rebuiltPaths.some((path) => file === path || file.startsWith(path.replace(/\/$/, '') + '/'));
     if (recordedFingerprints === undefined) {
         return { ok: false, reason: 'no-fingerprints', detail: [] };
     }
@@ -77,10 +51,25 @@ export async function checkExtendCoverageAnchor(engineDir, previousBaseline) {
     }
     const diverged = [];
     for (const [relPath, recordedHash] of Object.entries(recordedFingerprints)) {
+        if (rebuilt(relPath))
+            continue;
         const liveHash = await hashEngineFile(engineDir, relPath);
         if (liveHash !== recordedHash)
             diverged.push(relPath);
     }
+    // New dirty test inputs are absent from the previous fingerprint map.
+    // They invalidate retained staging too; explicitly rebuilt inputs are safe.
+    if (previousBaseline.testInputFingerprints !== undefined) {
+        const changed = (await git(['diff', '--name-only', 'HEAD'], engineDir)).split('\n');
+        changed.push(...(await getUntrackedFiles(engineDir)));
+        for (const file of changed.filter(Boolean)) {
+            if (file === MOZCONFIG_FILENAME || rebuilt(file) || Object.hasOwn(recordedFingerprints, file))
+                continue;
+            // A retained manifest may stage a shared fixture outside test-named
+            // directories. Without its full dependency graph, refuse conservatively.
+            diverged.push(file);
+        }
+    }
     if (diverged.length > 0) {
         return { ok: false, reason: 'fingerprint-diverged', detail: diverged.sort() };
     }
@@ -136,7 +125,7 @@ export function formatExtendCoverageRefusal(result) {
             return ('--extend-coverage refused: the recorded baseline predates the mozconfig anchor, so it ' +
                 `cannot be proven that this build configures identically. ${remedy}`);
         case 'no-fingerprints':
-            return ('--extend-coverage refused: the recorded baseline carries no packageable fingerprints, so ' +
+            return ('--extend-coverage refused: the recorded baseline carries no complete test-input fingerprints, so ' +
                 `the earlier scope's staging inputs cannot be verified unchanged. ${remedy}`);
         case 'head-moved':
             return ('--extend-coverage refused: engine HEAD moved since the recorded build ' +
@@ -144,7 +133,7 @@ export function formatExtendCoverageRefusal(result) {
                 `longer anchored. ${remedy}`);
         case 'fingerprint-diverged':
             return ('--extend-coverage refused: ' +
-                `${result.detail.length} packageable file(s) the recorded build staged have changed ` +
+                `${result.detail.length} staging input(s) the recorded build staged have changed ` +
                 `since (${formatDivergedPaths(result.detail)}). Extending would vouch for the earlier scope ` +
                 `while obj-*/_tests/ still holds its stale staging. ${remedy}`);
         case 'mozconfig-changed':

package/dist/src/core/discard-baseline.js

@@ -53,11 +53,12 @@ export async function planDiscardBaselines(patchesDir, engineDir, entries) {
     if (claimedEntries.length === 0) {
         return planUpstreamDiscards(entries);
     }
-    const { computePatched } = await createPatchedContentContext(patchesDir, engineDir);
+    const { computePatched, prefetchBase } = await createPatchedContentContext(patchesDir, engineDir);
     const claimedFiles = [
         ...new Set(claimedEntries.flatMap((entry) => entry.originalPath !== undefined ? [entry.file, entry.originalPath] : [entry.file])),
     ];
     const trackedInHead = await listTrackedInHead(engineDir, claimedFiles);
+    await prefetchBase(claimedFiles);
     const computeExpected = async (path) => {
         try {
             return await computePatched(path);

package/dist/src/core/engine-write-boundary.d.ts

@@ -0,0 +1,5 @@
+import type { FurnaceConfig } from '../types/furnace.js';
+/** Checks all component destinations before an apply starts writing. */
+export declare function assertComponentWriteBoundaries(engineDir: string, config: FurnaceConfig, ftlDir: string): Promise<void>;
+/** Resolves the nearest existing parent before any mkdir/copy can write through an alias. */
+export declare function assertEngineWriteBoundary(engineDir: string, directory: string): Promise<void>;

package/dist/src/core/engine-write-boundary.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { realpath } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
+import { FurnaceError } from '../errors/furnace.js';
+import { getNodeErrorCode } from '../utils/errors.js';
+import { CUSTOM_ELEMENTS_JS, JAR_MN } from './furnace-constants.js';
+/** Checks all component destinations before an apply starts writing. */
+export async function assertComponentWriteBoundaries(engineDir, config, ftlDir) {
+    const destinations = new Set([
+        ftlDir,
+        dirname(JAR_MN),
+        dirname(CUSTOM_ELEMENTS_JS),
+        ...Object.values(config.custom).map((entry) => entry.targetPath),
+        ...Object.values(config.overrides).map((entry) => entry.basePath),
+    ]);
+    for (const destination of destinations) {
+        await assertEngineWriteBoundary(engineDir, join(engineDir, destination));
+    }
+}
+/** Resolves the nearest existing parent before any mkdir/copy can write through an alias. */
+export async function assertEngineWriteBoundary(engineDir, directory) {
+    const root = await realpath(engineDir);
+    let parent = resolve(directory);
+    for (;;) {
+        try {
+            const canonical = await realpath(parent);
+            if (canonical !== root && !canonical.startsWith(root + sep)) {
+                throw new FurnaceError(`Engine destination ${directory} resolves outside engine/ (${canonical}). Refusing to write through into component sources or another checkout.`);
+            }
+            return;
+        }
+        catch (error) {
+            if (getNodeErrorCode(error) !== 'ENOENT')
+                throw error;
+            const next = dirname(parent);
+            if (next === parent)
+                throw error;
+            parent = next;
+        }
+    }
+}

package/dist/src/core/forward-registrations.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Public, queue-level entry point to the `forward-registration` census.
+ *
+ * A consumer that keeps its own audit (a ratchet baseline over forward
+ * edges, say) runs the rule's own predicate here instead of mirroring it.
+ * Lives apart from the rule module because it builds the queue context,
+ * which imports the rule back.
+ */
+import type { FireForgeConfig } from '../types/config.js';
+import type { ForwardRegistration, ForwardRegistrationScope } from './patch-lint-forward-registration-extended.js';
+/** Options for {@link findForwardRegistrations}. */
+export interface FindForwardRegistrationsOptions {
+    /**
+     * Which carriers to check. Defaults to `'extended'` (every carrier the
+     * rule can resolve), since a census wants the whole picture whatever the
+     * lint gate is configured to enforce.
+     */
+    scope?: ForwardRegistrationScope;
+    /** Project config, for the queue's patchPolicy ordering context. Optional. */
+    config?: FireForgeConfig;
+}
+/**
+ * Lists every undeclared forward registration in a patch queue: a line a
+ * patch adds (to a test manifest, jar.mn, moz.build or customElements.js)
+ * that names a file only a later-ordered patch creates. Each record carries
+ * the paste-and-run `patch staged-dependency` command that declares it.
+ *
+ * @param patchesDir - The project's `patches/` directory
+ * @param options - Scope and optional config
+ * @returns One record per (patch, carrier file, created file)
+ */
+export declare function findForwardRegistrations(patchesDir: string, options?: FindForwardRegistrationsOptions): Promise<ForwardRegistration[]>;
+export type { ForwardRegistration, ForwardRegistrationKind, ForwardRegistrationScope, } from './patch-lint-forward-registration-extended.js';

package/dist/src/core/forward-registrations.js

@@ -0,0 +1,16 @@
+import { buildPatchQueueContext } from './patch-lint-cross.js';
+import { collectForwardRegistrations } from './patch-lint-forward-registration.js';
+/**
+ * Lists every undeclared forward registration in a patch queue: a line a
+ * patch adds (to a test manifest, jar.mn, moz.build or customElements.js)
+ * that names a file only a later-ordered patch creates. Each record carries
+ * the paste-and-run `patch staged-dependency` command that declares it.
+ *
+ * @param patchesDir - The project's `patches/` directory
+ * @param options - Scope and optional config
+ * @returns One record per (patch, carrier file, created file)
+ */
+export async function findForwardRegistrations(patchesDir, options = {}) {
+    const ctx = await buildPatchQueueContext(patchesDir, options.config);
+    return collectForwardRegistrations(ctx, options.scope ?? 'extended');
+}

package/dist/src/core/furnace-apply-helpers.js

@@ -323,13 +323,16 @@ export async function applyCustomComponent(ctx, config, dryRun = false, rollback
     // fragment-expanded form. The workspace source keeps only the directive,
     // so shared CSS stays single-sourced.
     const sharedDir = join(componentDir, '..', '..', SHARED_FRAGMENTS_DIR);
-    await Promise.all(filesToCopy.map(async (entry) => {
+    const copies = await Promise.allSettled(filesToCopy.map(async (entry) => {
         const src = join(componentDir, entry.name);
         const dest = join(targetDir, entry.name);
         await deployFileWithFragments(src, dest, sharedDir);
         affectedPaths.push(normalizePathSlashes(relative(engineDir, dest)));
         copiedFileNames.push(entry.name);
     }));
+    const failedCopy = copies.find((copy) => copy.status === 'rejected');
+    if (failedCopy?.status === 'rejected')
+        throw failedCopy.reason;
     // See buildCustomDryRunActions for the rationale: when `sharedFtl` is set
     // the shared bundle is owned elsewhere and FireForge must not copy or
     // register a per-component `.ftl` on its behalf.
@@ -416,12 +419,15 @@ export async function applyOverrideComponent(ctx, config, dryRun = false, rollba
         }
     }
     // Copy phase (parallel)
-    await Promise.all(candidateEntries.map(async (entry) => {
+    const copies = await Promise.allSettled(candidateEntries.map(async (entry) => {
         const src = join(componentDir, entry.name);
         const dest = getOverrideEngineTargetPath(engineDir, config, entry.name, ftlDir);
         await copyFile(src, dest);
         affectedPaths.push(normalizePathSlashes(relative(engineDir, dest)));
     }));
+    const failedCopy = copies.find((copy) => copy.status === 'rejected');
+    if (failedCopy?.status === 'rejected')
+        throw failedCopy.reason;
     if (affectedPaths.length === 0) {
         throw new FurnaceError(`No matching files found in override directory for "${name}"`, name);
     }

package/dist/src/core/furnace-apply.js

@@ -5,7 +5,9 @@ import { assert } from '../utils/assert.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { info } from '../utils/logger.js';
+import { captureComponentSources, componentSourceErrors } from './component-source-guard.js';
 import { getProjectPaths, loadConfig } from './config.js';
+import { assertComponentWriteBoundaries } from './engine-write-boundary.js';
 import { applyCustomComponent, applyOverrideComponent, computeComponentChecksums, diffDeletedFiles, extractComponentChecksums, hasComponentChanged, hasCustomEngineDrift, hasOverrideEngineDrift, prefixChecksums, undeployCustomFiles, undeployOverrideFiles, } from './furnace-apply-helpers.js';
 import { findPatchOwnedOverwrites, loadPatchClaimsForApply, recordOverwriteWarnings, } from './furnace-apply-overwrite-warn.js';
 import { buildCustomUndeployActions, buildOverrideUndeployActions, } from './furnace-apply-undeploy-actions.js';
@@ -334,6 +336,10 @@ export async function applyAllComponents(root, dryRun = false, options) {
     const forgeConfig = await loadConfig(root).catch(() => undefined);
     const markerComment = resolveFurnaceMarkerComment(forgeConfig);
     await assertFurnaceEngineDirReady(engineDir);
+    if (!dryRun) {
+        await assertComponentWriteBoundaries(engineDir, config, ftlDir);
+    }
+    const sourceSnapshot = await captureComponentSources(furnacePaths, config, dryRun, options);
     const rollbackJournal = dryRun ? undefined : createRollbackJournal();
     if (rollbackJournal && operationContext) {
         operationContext.registerJournal(rollbackJournal);
@@ -381,6 +387,7 @@ export async function applyAllComponents(root, dryRun = false, options) {
     };
     await applyOverrideBatch(batchContext);
     await applyCustomBatch(batchContext, root, markerComment);
+    result.errors.push(...(await componentSourceErrors(sourceSnapshot)));
     // Check for any partial failures (blocking step errors on applied
     // components). Advisory step errors (e.g. FTL degradation) are warnings
     // and never gate rollback.

package/dist/src/core/furnace-validate-accessibility.js

@@ -2,6 +2,7 @@
 import { join } from 'node:path';
 import { pathExists, readText } from '../utils/fs.js';
 import { createIssue } from './furnace-validate-helpers.js';
+import { collectLitTemplateRegions, parseTemplateAttributes } from './lit-template-regions.js';
 /**
  * Validates accessibility patterns in a component's .mjs file.
  * Checks for ARIA roles, keyboard handlers, l10n, and focus delegation.
@@ -103,15 +104,16 @@ function hasUnlabelledFormInput(content) {
     // (id implies an external <label for="..."> could exist). A control wrapped
     // in a <label> that carries actual text is implicitly associated and is
     // exempt as well.
+    content = collectLitTemplateRegions(content).join('\n');
     const labelledSpans = collectLabelledSpans(content);
-    const inputPattern = /<(input|select|textarea)\b([^>]*)>/gi;
+    const inputPattern = /<(input|select|textarea)\b((?:"[^"]*"|'[^']*'|[^'">])*)>/gi;
     let inputMatch;
     while ((inputMatch = inputPattern.exec(content)) !== null) {
-        const attrs = inputMatch[2] ?? '';
-        if (/aria-label\s*=/.test(attrs) ||
-            /aria-labelledby\s*=/.test(attrs) ||
-            /\bid\s*=/.test(attrs) ||
-            /type\s*=\s*["']hidden["']/i.test(attrs)) {
+        const attrs = parseTemplateAttributes(inputMatch[2] ?? '');
+        if (attrs.has('aria-label') ||
+            attrs.has('aria-labelledby') ||
+            attrs.has('id') ||
+            attrs.get('type')?.toLowerCase() === 'hidden') {
             continue;
         }
         const index = inputMatch.index;
@@ -315,12 +317,7 @@ function isFlaggableText(text) {
     return true;
 }
 function hasFlaggedTextInLitTemplates(content) {
-    // Match `html\`…\`` regions, anchored on a non-identifier char before `html`
-    // so substrings like `otherhtml` do not spuriously open a template.
-    const htmlPattern = /(?:^|[^a-zA-Z0-9_$])html`([\s\S]*?)`/g;
-    let litMatch;
-    while ((litMatch = htmlPattern.exec(content)) !== null) {
-        const region = litMatch[1] ?? '';
+    for (const region of collectLitTemplateRegions(content)) {
         const textPattern = />([^<$\s][^<$]*)</g;
         let textMatch;
         while ((textMatch = textPattern.exec(region)) !== null) {

package/dist/src/core/furnace-validate.js

@@ -1,14 +1,12 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { getProjectPaths, loadConfig } from './config.js';
 import { extractComponentChecksums } from './furnace-checksum-utils.js';
 import { getFurnacePaths, loadFurnaceConfig, loadFurnaceState } from './furnace-config.js';
 import { resolveFtlDir, xpcshellTestParentDir } from './furnace-constants.js';
 import { validateCssFragments } from './furnace-css-fragments.js';
-import { detectComposesCycles, validateComposesReferences } from './furnace-graph-utils.js';
 import { findJsconfigPathsDrift } from './furnace-jsconfig.js';
 import { validateAccessibility, validateCompatibility, validateJarMnEntries, validateRegistrationPatterns, validateStructure, validateTokenLink, } from './furnace-validate-checks.js';
 import { createIssue } from './furnace-validate-helpers.js';
@@ -110,47 +108,6 @@ export async function validateAllComponents(root) {
         const config = await loadFurnaceConfig(root);
         const furnacePaths = getFurnacePaths(root);
         const results = new Map();
-        // Validate composition graph integrity (dangling references and cycles)
-        try {
-            validateComposesReferences(config.stock, config.overrides, config.custom);
-        }
-        catch (err) {
-            const message = toError(err).message;
-            // Attribute the issue to the first custom component with a bad composes reference
-            for (const [name, cfg] of Object.entries(config.custom)) {
-                if (cfg.composes) {
-                    const existing = results.get(name) ?? [];
-                    existing.push({
-                        component: name,
-                        severity: 'error',
-                        check: 'composes-dangling-reference',
-                        message,
-                    });
-                    results.set(name, existing);
-                    break;
-                }
-            }
-        }
-        try {
-            detectComposesCycles(config.custom);
-        }
-        catch (err) {
-            const message = toError(err).message;
-            // Attribute the cycle issue to the first custom component in the cycle
-            for (const name of Object.keys(config.custom)) {
-                if (config.custom[name]?.composes) {
-                    const existing = results.get(name) ?? [];
-                    existing.push({
-                        component: name,
-                        severity: 'error',
-                        check: 'composes-cycle',
-                        message,
-                    });
-                    results.set(name, existing);
-                    break;
-                }
-            }
-        }
         // Override components
         for (const name of Object.keys(config.overrides)) {
             const componentDir = join(furnacePaths.overridesDir, name);

package/dist/src/core/gecko-dom-types.d.ts

@@ -0,0 +1,2 @@
+/** Adds Gecko's cross-compartment DOM predicates to virtual lib.dom constructor types. */
+export declare function withGeckoDomTypes(ts: typeof import('typescript'), host: import('typescript').CompilerHost): import('typescript').CompilerHost;

package/dist/src/core/gecko-dom-types.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: EUPL-1.2
+/** Adds Gecko's cross-compartment DOM predicates to virtual lib.dom constructor types. */
+export function withGeckoDomTypes(ts, host) {
+    const original = host.getSourceFile.bind(host);
+    return {
+        ...host,
+        getSourceFile(...args) {
+            const file = original(...args);
+            if (!file || !args[0].endsWith('/lib.dom.d.ts'))
+                return file;
+            const source = file.text.replace(/declare var (\w+): \{\s*prototype: (\w+);/g, (declaration, name, instance) => declaration +
+                `\n    isInstance(value: unknown): value is ${instance};` +
+                (name === 'MouseEvent' ? '\n    readonly MOZ_SOURCE_PEN: number;' : ''));
+            return ts.createSourceFile(args[0], source, args[1], true);
+        },
+    };
+}

package/dist/src/core/git-file-ops.d.ts

@@ -77,6 +77,27 @@ export declare function hashObjectBatch(repoDir: string, fullPaths: string[]): P
  * @returns File content or null if file doesn't exist at that ref
  */
 export declare function getFileContentAtRef(repoDir: string, filePath: string, ref?: string): Promise<string | null>;
+/**
+ * Batched equivalent of {@link getFileContentAtRef}: reads every path at
+ * `ref` through one `git cat-file --batch` process instead of one
+ * `git show` per file. A Firefox-sized ownership scan paid 1,493 of those,
+ * about 18 ms each and almost all of it spawn overhead.
+ *
+ * The first request line is `ref` itself, so an unresolvable ref throws a
+ * {@link GitError} exactly as the per-file helper does, rather than being
+ * read as "every path missing". A path reported `missing` maps to `null`,
+ * as the per-file helper returns for a path absent at that ref. Anything
+ * the batch cannot answer as a plain blob (a path containing a newline,
+ * which the line protocol cannot carry, or an object that is not a blob)
+ * is fetched through {@link getFileContentAtRef}, so the result for every
+ * path is what that helper returns.
+ *
+ * @param repoDir - Repository directory
+ * @param filePaths - Paths relative to the repository root
+ * @param ref - Git ref to read from. Defaults to HEAD.
+ * @returns Content (or `null` when absent at `ref`) for every input path
+ */
+export declare function getFilesContentAtRef(repoDir: string, filePaths: readonly string[], ref?: string): Promise<Map<string, string | null>>;
 /**
  * Checks if a file is binary by looking for NUL bytes in the first 8KB.
  * Uses the same heuristic as git.

package/dist/src/core/git-file-ops.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { GitError } from '../errors/git.js';
 import { removeFile } from '../utils/fs.js';
 import { exec } from '../utils/process.js';
+import { execWithInput } from '../utils/process-input.js';
 import { chunkPathspecs, ensureGit, git } from './git-base.js';
 /**
  * Restores a tracked path from HEAD, including staged changes.
@@ -175,6 +176,80 @@ export async function getFileContentAtRef(repoDir, filePath, ref = 'HEAD') {
     }
     return result.stdout;
 }
+/**
+ * Batched equivalent of {@link getFileContentAtRef}: reads every path at
+ * `ref` through one `git cat-file --batch` process instead of one
+ * `git show` per file. A Firefox-sized ownership scan paid 1,493 of those,
+ * about 18 ms each and almost all of it spawn overhead.
+ *
+ * The first request line is `ref` itself, so an unresolvable ref throws a
+ * {@link GitError} exactly as the per-file helper does, rather than being
+ * read as "every path missing". A path reported `missing` maps to `null`,
+ * as the per-file helper returns for a path absent at that ref. Anything
+ * the batch cannot answer as a plain blob (a path containing a newline,
+ * which the line protocol cannot carry, or an object that is not a blob)
+ * is fetched through {@link getFileContentAtRef}, so the result for every
+ * path is what that helper returns.
+ *
+ * @param repoDir - Repository directory
+ * @param filePaths - Paths relative to the repository root
+ * @param ref - Git ref to read from. Defaults to HEAD.
+ * @returns Content (or `null` when absent at `ref`) for every input path
+ */
+export async function getFilesContentAtRef(repoDir, filePaths, ref = 'HEAD') {
+    const contents = new Map();
+    const unique = [...new Set(filePaths)];
+    const batchable = unique.filter((path) => !path.includes('\n'));
+    const fallback = unique.filter((path) => path.includes('\n'));
+    if (batchable.length > 0) {
+        await ensureGit();
+        const requests = [ref, ...batchable.map((path) => `${ref}:${path}`)];
+        const result = await execWithInput('git', ['cat-file', '--batch'], requests.join('\n') + '\n', {
+            cwd: repoDir,
+        });
+        if (result.exitCode !== 0) {
+            throw new GitError(result.stderr.trim() || 'git cat-file --batch failed', 'cat-file --batch');
+        }
+        const out = result.stdout;
+        let offset = 0;
+        for (const [index, request] of requests.entries()) {
+            const newline = out.indexOf(0x0a, offset);
+            if (newline === -1) {
+                throw new GitError(`Truncated cat-file --batch output at ${request}`, 'cat-file --batch');
+            }
+            const header = out.toString('utf8', offset, newline);
+            offset = newline + 1;
+            const path = index === 0 ? undefined : batchable[index - 1];
+            if (header.endsWith(' missing') || header.endsWith(' ambiguous')) {
+                if (path === undefined) {
+                    throw new GitError(`Cannot resolve ${ref}: ${header}`, `cat-file --batch ${ref}`);
+                }
+                if (header.endsWith(' missing'))
+                    contents.set(path, null);
+                else
+                    fallback.push(path);
+                continue;
+            }
+            const match = /^[0-9a-f]+ (\S+) (\d+)$/.exec(header);
+            if (!match) {
+                throw new GitError(`Unexpected cat-file --batch header: ${header}`, 'cat-file --batch');
+            }
+            const size = Number(match[2]);
+            const body = out.subarray(offset, offset + size);
+            offset += size + 1;
+            if (path === undefined)
+                continue;
+            if (match[1] === 'blob')
+                contents.set(path, body.toString('utf8'));
+            else
+                fallback.push(path);
+        }
+    }
+    for (const path of fallback) {
+        contents.set(path, await getFileContentAtRef(repoDir, path, ref));
+    }
+    return contents;
+}
 /**
  * Checks if a file is binary by looking for NUL bytes in the first 8KB.
  * Uses the same heuristic as git.

package/dist/src/core/git-status.d.ts

@@ -39,6 +39,20 @@ export declare function resolveMaxUntrackedFilesPerDir(): number;
  *   files
  */
 export declare function expandUntrackedDirectoryEntries(repoDir: string, entries: GitStatusEntry[]): Promise<GitStatusEntry[]>;
+/**
+ * Lists the untracked files under each collapsed `dir/` status entry with
+ * one `git ls-files` per ARG_MAX chunk, instead of one spawn per directory
+ * (a Firefox-sized worktree scan paid 73 of them). The result maps every
+ * requested directory to its files in git's order, which is exactly what
+ * {@link getUntrackedFilesInDir} returns for that directory alone. `-z`
+ * keeps non-ASCII names literal: the newline form C-quotes them under
+ * git's default `core.quotePath`, and a quoted path names no file.
+ *
+ * @param repoDir - Repository directory
+ * @param dirs - Collapsed untracked directories, each ending in `/`
+ * @returns Files per directory (every input key present, possibly empty)
+ */
+export declare function listUntrackedFilesInDirs(repoDir: string, dirs: readonly string[]): Promise<Map<string, string[]>>;
 /**
  * Gets all untracked files (including files inside untracked directories).
  * @param repoDir - Repository directory

package/dist/src/core/git-status.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { warn } from '../utils/logger.js';
-import { git } from './git-base.js';
+import { chunkPathspecs, git } from './git-base.js';
 /**
  * True when a porcelain status column carries a rename or copy, i.e. the
  * record is followed by a second NUL-terminated field holding the original
@@ -95,12 +95,16 @@ export function resolveMaxUntrackedFilesPerDir() {
 export async function expandUntrackedDirectoryEntries(repoDir, entries) {
     const expanded = [];
     const maxPerDir = resolveMaxUntrackedFilesPerDir();
+    const collapsed = entries
+        .filter((entry) => entry.isUntracked && entry.file.endsWith('/'))
+        .map((entry) => entry.file);
+    const untrackedByDir = await listUntrackedFilesInDirs(repoDir, collapsed);
     for (const entry of entries) {
         if (!entry.isUntracked || !entry.file.endsWith('/')) {
             expanded.push(entry);
             continue;
         }
-        const individualFiles = await getUntrackedFilesInDir(repoDir, entry.file);
+        const individualFiles = untrackedByDir.get(entry.file) ?? [];
         if (individualFiles.length > maxPerDir) {
             warn(`Untracked directory ${entry.file} contains ${individualFiles.length} files — only the first ${maxPerDir} are listed. Add a .gitignore entry or clean the directory.`);
         }
@@ -118,6 +122,41 @@ export async function expandUntrackedDirectoryEntries(repoDir, entries) {
     }
     return expanded;
 }
+/**
+ * Lists the untracked files under each collapsed `dir/` status entry with
+ * one `git ls-files` per ARG_MAX chunk, instead of one spawn per directory
+ * (a Firefox-sized worktree scan paid 73 of them). The result maps every
+ * requested directory to its files in git's order, which is exactly what
+ * {@link getUntrackedFilesInDir} returns for that directory alone. `-z`
+ * keeps non-ASCII names literal: the newline form C-quotes them under
+ * git's default `core.quotePath`, and a quoted path names no file.
+ *
+ * @param repoDir - Repository directory
+ * @param dirs - Collapsed untracked directories, each ending in `/`
+ * @returns Files per directory (every input key present, possibly empty)
+ */
+export async function listUntrackedFilesInDirs(repoDir, dirs) {
+    const byDir = new Map(dirs.map((dir) => [dir, []]));
+    if (byDir.size === 0)
+        return byDir;
+    for (const chunk of chunkPathspecs([...byDir.keys()])) {
+        const output = await git(['ls-files', '--others', '--exclude-standard', '-z', '--', ...chunk], repoDir);
+        for (const file of output.split('\0')) {
+            if (file.length === 0)
+                continue;
+            // Collapsed status directories never nest, so the first matching
+            // ancestor is the only one.
+            for (let slash = file.indexOf('/'); slash !== -1; slash = file.indexOf('/', slash + 1)) {
+                const bucket = byDir.get(file.slice(0, slash + 1));
+                if (bucket !== undefined) {
+                    bucket.push(file);
+                    break;
+                }
+            }
+        }
+    }
+    return byDir;
+}
 /**
  * Gets all untracked files (including files inside untracked directories).
  * @param repoDir - Repository directory

package/dist/src/core/lit-template-regions.d.ts

@@ -0,0 +1,4 @@
+/** Collects Lit html quasis, masking expressions while preserving nested templates. */
+export declare function collectLitTemplateRegions(content: string): string[];
+/** Reads actual attribute names and values, skipping quoted values as indivisible tokens. */
+export declare function parseTemplateAttributes(source: string): Map<string, string | undefined>;