@hominis/fireforge 0.49.1 → 0.50.0

package/dist/src/core/patch-lint-forward-registration.js

@@ -243,6 +243,16 @@ export function lintPatchQueueForwardRegistrations(ctx) {
             check: 'forward-registration',
             patches: [found.patch],
             fingerprint: `forward-registration|${found.patch}|${found.file}|${found.token}|${found.creates}|${found.owner}`,
+            stagedDeclarations: [
+                {
+                    patch: found.patch,
+                    kind: 'registration',
+                    file: found.file,
+                    line: found.line,
+                    creates: found.creates,
+                    owner: found.owner,
+                },
+            ],
             message: `${found.file} in ${found.patch} registers "${found.token}" ${KIND_PHRASES[found.kind]}, ` +
                 `but ${found.creates} is created by the later patch ${found.owner}. ` +
                 'Applying the queue up to this patch leaves the registration dangling. ' +

package/dist/src/core/patch-lint-ignore.d.ts

@@ -0,0 +1,152 @@
+/**
+ * `PatchMetadata.lintIgnore` entries and the waiver filter they drive.
+ *
+ * An entry is either a bare check ID, which suppresses that rule at any
+ * size, or a ceiling `{ rule, max, reason }`, which suppresses a size rule
+ * only while its measurement is at or below `max`. The bare form let a
+ * waived file grow without bound: nothing re-examined the waiver once it
+ * was written, so a 950-line file waived at review time was still waived at
+ * 2,000 lines. The ceiling makes growth past the reviewed size fire again,
+ * and lets a gate say when the waiver is no longer needed at all.
+ *
+ * Its own module so every caller that turns a manifest list into a filter
+ * (export, re-export, per-patch and aggregate lint, split, move-files)
+ * shares one reading of an entry, and so `patch-lint.ts` only calls into it.
+ */
+import type { LintIgnoreCeiling, LintIgnoreEntry, PatchLintIssue } from '../types/commands/index.js';
+/**
+ * The size rules whose findings carry a `measurement`, and therefore the
+ * only rules a ceiling can bound. A ceiling on any other rule could never
+ * suppress anything, so the manifest validator refuses it.
+ */
+export declare const LINT_IGNORE_CEILING_RULES: readonly string[];
+/**
+ * A waiver filter: the bare check IDs as a set (so a plain `Set<string>`
+ * still satisfies the type), plus the ceilings keyed by rule.
+ *
+ * Bare IDs and ceilings are kept apart on purpose. A caller that only knows
+ * `has()` treats a ceiling-waived rule as not waived, which fails closed.
+ */
+export type LintIgnoreChecks = ReadonlySet<string> & {
+    readonly ceilings?: ReadonlyMap<string, LintIgnoreCeiling>;
+};
+/** Narrows an entry to the ceiling form. */
+export declare function isLintIgnoreCeiling(entry: LintIgnoreEntry): entry is LintIgnoreCeiling;
+/** The check ID an entry names, whatever its form. */
+export declare function lintIgnoreRule(entry: LintIgnoreEntry): string;
+/** One-word rendering for summaries and dry runs: `file-too-large<=1200`. */
+export declare function formatLintIgnoreEntry(entry: LintIgnoreEntry): string;
+/** Renders a list for messages, `(empty)` when there is nothing to show. */
+export declare function formatLintIgnoreList(entries: readonly LintIgnoreEntry[]): string;
+/**
+ * Validates a raw `lintIgnore` value from `patches.json`.
+ *
+ * Bare strings keep their historical leniency (any ID, duplicates collapse
+ * later). A ceiling must name a measured size rule, carry a positive
+ * integer `max` and a non-empty `reason`, and must be the only entry for
+ * its rule: a bare ID beside a ceiling for the same rule would make the
+ * ceiling dead, and two ceilings would leave the effective one ambiguous.
+ *
+ * @param raw - The value under `lintIgnore`
+ * @param label - Field label for error messages, e.g. `patches[3].lintIgnore`
+ * @returns The validated entries
+ * @throws Error naming the offending element
+ */
+export declare function parseLintIgnoreEntries(raw: unknown, label: string): LintIgnoreEntry[];
+/**
+ * Builds the waiver filter for a patch's entries.
+ *
+ * @param entries - `PatchMetadata.lintIgnore`, possibly merged with CLI flags
+ * @returns The filter, or undefined when there is nothing to waive
+ */
+export declare function buildLintIgnoreChecks(entries: readonly LintIgnoreEntry[] | undefined): LintIgnoreChecks | undefined;
+/**
+ * Canonical string form of a filter for the per-patch lint cache's waiver
+ * comparison: bare IDs as themselves, ceilings as `rule<=max`.
+ */
+export declare function lintIgnoreCacheTokens(checks: LintIgnoreChecks | undefined): string[];
+/**
+ * Unions CLI-flag check IDs into an existing list, the append-only
+ * semantics `export` / `re-export --lint-ignore` have always had. A bare ID
+ * whose rule already has an entry (bare or ceiling) is a no-op: widening a
+ * reviewed ceiling to an unbounded waiver is `patch lint-ignore`'s job, where
+ * it is confirmed explicitly.
+ *
+ * @returns The merged list, or undefined when it is empty
+ */
+export declare function mergeLintIgnoreIds(existing: readonly LintIgnoreEntry[] | undefined, ids: readonly string[] | undefined): LintIgnoreEntry[] | undefined;
+/**
+ * Adds or replaces entries by rule, the `patch lint-ignore --add` semantics:
+ * an explicit `--add <rule>` turns a ceiling into a bare waiver, and
+ * `--add <rule> --max <n>` sets or moves the ceiling.
+ *
+ * @returns The new list, or undefined when it is empty
+ */
+export declare function upsertLintIgnoreEntries(existing: readonly LintIgnoreEntry[], additions: readonly LintIgnoreEntry[]): LintIgnoreEntry[] | undefined;
+/** Removes every entry naming one of `rules`. Undefined when nothing is left. */
+export declare function removeLintIgnoreRules(existing: readonly LintIgnoreEntry[], rules: readonly string[]): LintIgnoreEntry[] | undefined;
+/** Entries present in `after` but not (identically) in `before`. */
+export declare function addedLintIgnoreEntries(before: readonly LintIgnoreEntry[], after: readonly LintIgnoreEntry[]): LintIgnoreEntry[];
+/**
+ * Splits issues into the ones that still surface and the ones a waiver
+ * drops.
+ *
+ * A bare ID drops every finding of its rule. A ceiling drops a finding only
+ * when it carries a measurement at or below `max`. Past the ceiling the
+ * finding surfaces at its own severity with the ceiling named, and a
+ * finding with no measurement surfaces too (fail closed).
+ */
+export declare function partitionLintIgnoredIssues(issues: readonly PatchLintIssue[], checks: LintIgnoreChecks | undefined): {
+    kept: PatchLintIssue[];
+    suppressed: PatchLintIssue[];
+};
+/** True when `checks` waives `issue` (see {@link partitionLintIgnoredIssues}). */
+export declare function isLintIgnored(issue: PatchLintIssue, checks: LintIgnoreChecks | undefined): boolean;
+/**
+ * Drops issues that a patch owning `issue.file` (via `filesAffected`)
+ * waives. Used where findings carry no patch scope of their own (aggregate
+ * `lint`). Each owner keeps its own filter, so a ceiling stays bounded by
+ * the patch that declared it instead of merging into a file-wide union; an
+ * issue is dropped when any owner waives it.
+ */
+export declare function filterLintIgnoredByOwners(issues: PatchLintIssue[], owners: ReadonlyArray<{
+    lintIgnore?: LintIgnoreEntry[];
+    filesAffected: readonly string[];
+} | null | undefined>): PatchLintIssue[];
+/** Where a ceiling stands against the patch's current measurements. */
+export type LintIgnoreCeilingState = 'within' | 'exceeded' | 'removable';
+/** One ceiling's standing, as `lint --per-patch --report` records it. */
+export interface LintIgnoreCeilingStatus {
+    rule: string;
+    max: number;
+    reason: string;
+    /** Largest current measurement for the rule, null when none was taken. */
+    measurement: number | null;
+    /**
+     * `exceeded`: a finding measured past `max` and surfaced.
+     * `removable`: the rule no longer reaches its own warning band, so the
+     * waiver changes no gate and can be dropped.
+     * `within`: the waiver is doing its job.
+     */
+    state: LintIgnoreCeilingState;
+}
+/**
+ * Evaluates each ceiling on a patch against the findings its lint produced
+ * (both surfaced and suppressed).
+ *
+ * @param entries - The patch's `lintIgnore`
+ * @param issues - Every finding of the patch's lint, surfaced and suppressed
+ * @param patchMeasurements - Patch-level measurements used when a
+ *   patch-size rule did not fire at all, so the report still shows the
+ *   current number
+ */
+export declare function evaluateLintIgnoreCeilings(entries: readonly LintIgnoreEntry[] | undefined, issues: readonly PatchLintIssue[], patchMeasurements: {
+    lines: number;
+    files: number;
+}): LintIgnoreCeilingStatus[];
+/**
+ * Notice-severity findings for ceilings that are no longer needed, so the
+ * waiver's removal is prompted by the tool that enforces it rather than
+ * discovered by hand.
+ */
+export declare function removableCeilingIssues(patchFilename: string, statuses: readonly LintIgnoreCeilingStatus[]): PatchLintIssue[];

package/dist/src/core/patch-lint-ignore.js

@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * `PatchMetadata.lintIgnore` entries and the waiver filter they drive.
+ *
+ * An entry is either a bare check ID, which suppresses that rule at any
+ * size, or a ceiling `{ rule, max, reason }`, which suppresses a size rule
+ * only while its measurement is at or below `max`. The bare form let a
+ * waived file grow without bound: nothing re-examined the waiver once it
+ * was written, so a 950-line file waived at review time was still waived at
+ * 2,000 lines. The ceiling makes growth past the reviewed size fire again,
+ * and lets a gate say when the waiver is no longer needed at all.
+ *
+ * Its own module so every caller that turns a manifest list into a filter
+ * (export, re-export, per-patch and aggregate lint, split, move-files)
+ * shares one reading of an entry, and so `patch-lint.ts` only calls into it.
+ */
+/**
+ * The size rules whose findings carry a `measurement`, and therefore the
+ * only rules a ceiling can bound. A ceiling on any other rule could never
+ * suppress anything, so the manifest validator refuses it.
+ */
+export const LINT_IGNORE_CEILING_RULES = [
+    'file-too-large',
+    'large-patch-lines',
+    'large-patch-files',
+];
+/** Narrows an entry to the ceiling form. */
+export function isLintIgnoreCeiling(entry) {
+    return typeof entry !== 'string';
+}
+/** The check ID an entry names, whatever its form. */
+export function lintIgnoreRule(entry) {
+    return isLintIgnoreCeiling(entry) ? entry.rule : entry;
+}
+/** One-word rendering for summaries and dry runs: `file-too-large<=1200`. */
+export function formatLintIgnoreEntry(entry) {
+    return isLintIgnoreCeiling(entry) ? `${entry.rule}<=${String(entry.max)}` : entry;
+}
+/** Renders a list for messages, `(empty)` when there is nothing to show. */
+export function formatLintIgnoreList(entries) {
+    return entries.length > 0 ? entries.map(formatLintIgnoreEntry).join(', ') : '(empty)';
+}
+function sameEntry(a, b) {
+    if (!isLintIgnoreCeiling(a) || !isLintIgnoreCeiling(b))
+        return a === b;
+    return a.rule === b.rule && a.max === b.max && a.reason === b.reason;
+}
+/**
+ * Validates a raw `lintIgnore` value from `patches.json`.
+ *
+ * Bare strings keep their historical leniency (any ID, duplicates collapse
+ * later). A ceiling must name a measured size rule, carry a positive
+ * integer `max` and a non-empty `reason`, and must be the only entry for
+ * its rule: a bare ID beside a ceiling for the same rule would make the
+ * ceiling dead, and two ceilings would leave the effective one ambiguous.
+ *
+ * @param raw - The value under `lintIgnore`
+ * @param label - Field label for error messages, e.g. `patches[3].lintIgnore`
+ * @returns The validated entries
+ * @throws Error naming the offending element
+ */
+export function parseLintIgnoreEntries(raw, label) {
+    if (!Array.isArray(raw)) {
+        throw new Error(`${label} must be an array`);
+    }
+    const entries = [];
+    const ceilingRules = new Set();
+    for (const [index, item] of raw.entries()) {
+        const itemLabel = `${label}[${String(index)}]`;
+        if (typeof item === 'string') {
+            entries.push(item);
+            continue;
+        }
+        entries.push(parseCeiling(item, itemLabel));
+    }
+    for (const entry of entries) {
+        if (!isLintIgnoreCeiling(entry))
+            continue;
+        if (ceilingRules.has(entry.rule) || entries.includes(entry.rule)) {
+            throw new Error(`${label} names "${entry.rule}" more than once; keep a single entry (bare or ceiling) per rule`);
+        }
+        ceilingRules.add(entry.rule);
+    }
+    return entries;
+}
+function parseCeiling(item, label) {
+    if (item === null || typeof item !== 'object' || Array.isArray(item)) {
+        throw new Error(`${label} must be a check ID string or a { rule, max, reason } object`);
+    }
+    const record = item;
+    const unknownKeys = Object.keys(record).filter((key) => key !== 'rule' && key !== 'max' && key !== 'reason');
+    if (unknownKeys.length > 0) {
+        throw new Error(`${label} has unknown field(s): ${unknownKeys.join(', ')}`);
+    }
+    const { rule, max, reason } = record;
+    if (typeof rule !== 'string' || !LINT_IGNORE_CEILING_RULES.includes(rule)) {
+        throw new Error(`${label}.rule must be one of the measured size rules: ${LINT_IGNORE_CEILING_RULES.join(', ')}`);
+    }
+    if (typeof max !== 'number' || !Number.isInteger(max) || max <= 0) {
+        throw new Error(`${label}.max must be a positive integer`);
+    }
+    if (typeof reason !== 'string' || reason.trim() === '') {
+        throw new Error(`${label}.reason must be a non-empty string`);
+    }
+    return { rule, max, reason };
+}
+/**
+ * Builds the waiver filter for a patch's entries.
+ *
+ * @param entries - `PatchMetadata.lintIgnore`, possibly merged with CLI flags
+ * @returns The filter, or undefined when there is nothing to waive
+ */
+export function buildLintIgnoreChecks(entries) {
+    if (entries === undefined || entries.length === 0)
+        return undefined;
+    const plain = new Set();
+    const ceilings = new Map();
+    for (const entry of entries) {
+        if (isLintIgnoreCeiling(entry))
+            ceilings.set(entry.rule, entry);
+        else
+            plain.add(entry);
+    }
+    return ceilings.size > 0 ? Object.assign(plain, { ceilings }) : plain;
+}
+/**
+ * Canonical string form of a filter for the per-patch lint cache's waiver
+ * comparison: bare IDs as themselves, ceilings as `rule<=max`.
+ */
+export function lintIgnoreCacheTokens(checks) {
+    if (checks === undefined)
+        return [];
+    const ceilings = [...(checks.ceilings?.values() ?? [])].map(formatLintIgnoreEntry);
+    return [...checks, ...ceilings];
+}
+/**
+ * Unions CLI-flag check IDs into an existing list, the append-only
+ * semantics `export` / `re-export --lint-ignore` have always had. A bare ID
+ * whose rule already has an entry (bare or ceiling) is a no-op: widening a
+ * reviewed ceiling to an unbounded waiver is `patch lint-ignore`'s job, where
+ * it is confirmed explicitly.
+ *
+ * @returns The merged list, or undefined when it is empty
+ */
+export function mergeLintIgnoreIds(existing, ids) {
+    const merged = [];
+    const rules = new Set();
+    for (const entry of [...(existing ?? []), ...(ids ?? [])]) {
+        const rule = lintIgnoreRule(entry);
+        if (rules.has(rule))
+            continue;
+        rules.add(rule);
+        merged.push(entry);
+    }
+    return merged.length > 0 ? merged : undefined;
+}
+/**
+ * Adds or replaces entries by rule, the `patch lint-ignore --add` semantics:
+ * an explicit `--add <rule>` turns a ceiling into a bare waiver, and
+ * `--add <rule> --max <n>` sets or moves the ceiling.
+ *
+ * @returns The new list, or undefined when it is empty
+ */
+export function upsertLintIgnoreEntries(existing, additions) {
+    const next = [...existing];
+    for (const addition of additions) {
+        const rule = lintIgnoreRule(addition);
+        const index = next.findIndex((entry) => lintIgnoreRule(entry) === rule);
+        if (index === -1)
+            next.push(addition);
+        else
+            next[index] = addition;
+    }
+    return mergeLintIgnoreIds(next, undefined);
+}
+/** Removes every entry naming one of `rules`. Undefined when nothing is left. */
+export function removeLintIgnoreRules(existing, rules) {
+    const drop = new Set(rules);
+    const remaining = existing.filter((entry) => !drop.has(lintIgnoreRule(entry)));
+    return remaining.length > 0 ? remaining : undefined;
+}
+/** Entries present in `after` but not (identically) in `before`. */
+export function addedLintIgnoreEntries(before, after) {
+    return after.filter((entry) => !before.some((prior) => sameEntry(prior, entry)));
+}
+/**
+ * Splits issues into the ones that still surface and the ones a waiver
+ * drops.
+ *
+ * A bare ID drops every finding of its rule. A ceiling drops a finding only
+ * when it carries a measurement at or below `max`. Past the ceiling the
+ * finding surfaces at its own severity with the ceiling named, and a
+ * finding with no measurement surfaces too (fail closed).
+ */
+export function partitionLintIgnoredIssues(issues, checks) {
+    const kept = [];
+    const suppressed = [];
+    for (const issue of issues) {
+        if (checks?.has(issue.check) === true) {
+            suppressed.push(issue);
+            continue;
+        }
+        const ceiling = checks?.ceilings?.get(issue.check);
+        if (ceiling === undefined) {
+            kept.push(issue);
+            continue;
+        }
+        if (issue.measurement !== undefined && issue.measurement <= ceiling.max) {
+            suppressed.push(issue);
+            continue;
+        }
+        kept.push({ ...issue, message: `${issue.message} ${describeExceededCeiling(ceiling)}` });
+    }
+    return { kept, suppressed };
+}
+function describeExceededCeiling(ceiling) {
+    return (`This exceeds the patch's lintIgnore ceiling for ${ceiling.rule} ` +
+        `(max ${String(ceiling.max)}: ${ceiling.reason}).`);
+}
+/** True when `checks` waives `issue` (see {@link partitionLintIgnoredIssues}). */
+export function isLintIgnored(issue, checks) {
+    return partitionLintIgnoredIssues([issue], checks).suppressed.length === 1;
+}
+/**
+ * Drops issues that a patch owning `issue.file` (via `filesAffected`)
+ * waives. Used where findings carry no patch scope of their own (aggregate
+ * `lint`). Each owner keeps its own filter, so a ceiling stays bounded by
+ * the patch that declared it instead of merging into a file-wide union; an
+ * issue is dropped when any owner waives it.
+ */
+export function filterLintIgnoredByOwners(issues, owners) {
+    const byFile = new Map();
+    for (const owner of owners) {
+        const checks = buildLintIgnoreChecks(owner?.lintIgnore);
+        if (!checks)
+            continue;
+        for (const file of owner?.filesAffected ?? []) {
+            byFile.set(file, [...(byFile.get(file) ?? []), checks]);
+        }
+    }
+    if (byFile.size === 0)
+        return issues;
+    return issues.filter((issue) => !(byFile.get(issue.file) ?? []).some((checks) => isLintIgnored(issue, checks)));
+}
+/**
+ * Evaluates each ceiling on a patch against the findings its lint produced
+ * (both surfaced and suppressed).
+ *
+ * @param entries - The patch's `lintIgnore`
+ * @param issues - Every finding of the patch's lint, surfaced and suppressed
+ * @param patchMeasurements - Patch-level measurements used when a
+ *   patch-size rule did not fire at all, so the report still shows the
+ *   current number
+ */
+export function evaluateLintIgnoreCeilings(entries, issues, patchMeasurements) {
+    const statuses = [];
+    for (const entry of entries ?? []) {
+        if (!isLintIgnoreCeiling(entry))
+            continue;
+        const findings = issues.filter((issue) => issue.check === entry.rule);
+        const measured = findings
+            .map((issue) => issue.measurement)
+            .filter((value) => value !== undefined);
+        const fallback = entry.rule === 'large-patch-lines'
+            ? patchMeasurements.lines
+            : entry.rule === 'large-patch-files'
+                ? patchMeasurements.files
+                : null;
+        const measurement = measured.length > 0 ? Math.max(...measured) : fallback;
+        const gating = findings.some((issue) => issue.severity !== 'notice');
+        const state = measured.some((value) => value > entry.max)
+            ? 'exceeded'
+            : gating
+                ? 'within'
+                : 'removable';
+        statuses.push({ rule: entry.rule, max: entry.max, reason: entry.reason, measurement, state });
+    }
+    return statuses;
+}
+/**
+ * Notice-severity findings for ceilings that are no longer needed, so the
+ * waiver's removal is prompted by the tool that enforces it rather than
+ * discovered by hand.
+ */
+export function removableCeilingIssues(patchFilename, statuses) {
+    return statuses
+        .filter((status) => status.state === 'removable')
+        .map((status) => {
+        const now = status.measurement === null ? 'below its notice band' : `at ${String(status.measurement)}`;
+        return {
+            file: patchFilename,
+            check: 'lint-ignore-removable',
+            message: `lintIgnore ceiling for ${status.rule} (max ${String(status.max)}) is no longer needed: ` +
+                `the measurement is ${now}, under the rule's own warning threshold. ` +
+                `Remove it with "fireforge patch lint-ignore ${patchFilename} --remove ${status.rule}".`,
+            severity: 'notice',
+        };
+    });
+}

package/dist/src/core/patch-lint-size-thresholds.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The patch-size thresholds (`large-patch-lines`, `large-patch-files`) and
+ * their merge with `patchLint.patchSizeThresholds`.
+ *
+ * Its own dependency-free module for the same reason as
+ * `patch-lint-file-size.ts`: the config validator checks an override
+ * against the merged result, and importing the rule bodies from config
+ * parsing would draw an import cycle.
+ */
+import type { PatchLintPatchSizeThresholds } from '../types/config.js';
+import type { ResolvedFileSizeTier } from './patch-lint-file-size.js';
+/** The tiers a patch is measured against. */
+export type PatchSizeTierName = 'general' | 'test' | 'branding';
+/**
+ * A resolved `large-patch-files` triple. `error` is `null` when no error
+ * band is configured. `notice` equal to `warning` means no notice band.
+ */
+export interface ResolvedPatchFilesTier {
+    notice: number;
+    warning: number;
+    error: number | null;
+}
+/** Line and file-count thresholds governing one patch-size tier. */
+export interface PatchSizeThresholds {
+    /** Line counts at which `large-patch-lines` notice/warning/error issues fire. */
+    lines: ResolvedFileSizeTier;
+    /** File counts at which `large-patch-files` notice/warning/error issues fire. */
+    files: ResolvedPatchFilesTier;
+    /**
+     * The `files.warning` threshold, kept for consumers written before the
+     * files triple existed.
+     */
+    maxFiles: number;
+}
+/**
+ * Merges the configured overrides over the defaults for one tier.
+ *
+ * @param tier - The tier to resolve
+ * @param overrides - The `patchLint.patchSizeThresholds` block, if any
+ * @returns The effective thresholds
+ */
+export declare function resolvePatchSizeThresholds(tier: PatchSizeTierName, overrides: PatchLintPatchSizeThresholds | undefined): PatchSizeThresholds;
+/**
+ * True when `file` matches one of the `patchLint.patchSizeRegistrationFiles`
+ * globs. A glob without `/` matches the basename, one with `/` the whole
+ * engine-relative path. `*` and `?` stay within a segment, `**` crosses
+ * segments.
+ *
+ * @param file - Engine-relative POSIX path
+ * @param globs - The configured globs
+ */
+export declare function isPatchSizeRegistrationFile(file: string, globs: readonly string[]): boolean;

package/dist/src/core/patch-lint-size-thresholds.js

@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * The patch-size thresholds (`large-patch-lines`, `large-patch-files`) and
+ * their merge with `patchLint.patchSizeThresholds`.
+ *
+ * Its own dependency-free module for the same reason as
+ * `patch-lint-file-size.ts`: the config validator checks an override
+ * against the merged result, and importing the rule bodies from config
+ * parsing would draw an import cycle.
+ */
+import { escapeRegex } from '../utils/regex.js';
+/**
+ * Built-in line-count bands per tier.
+ *
+ * Branding patches have a legitimate reason to be large: they include
+ * every locale's `brand.ftl`, copied upstream CSS/PNG assets, and the
+ * fork-specific `configure.sh` / `brand.properties` under a single
+ * `browser/branding/<name>/` subtree. The tier is calibrated against a
+ * fresh-fork branding export, which lands around 15-16k lines (localized
+ * brand.ftl across many locales + SVG path data + copied upstream CSS).
+ * That is the minimum branding diff, so it must surface as a `notice`
+ * rather than a `warning`: the warning band sits above it with ~13%
+ * headroom, and the error band at roughly 2× the baseline, where
+ * non-branding work is probably bundled in.
+ *
+ * Permissive thresholds are safe because the *gate* into this tier is
+ * narrow: auto-detect requires every file under `browser/branding/` plus a
+ * tight registration allowlist, or an explicit `PatchMetadata.tier:
+ * "branding"` opt-in. A non-branding patch cannot accidentally land here.
+ */
+const DEFAULT_PATCH_LINE_THRESHOLDS = {
+    general: { notice: 800, warning: 1500, error: 3000 },
+    test: { notice: 1500, warning: 3000, error: 6000 },
+    branding: { notice: 8000, warning: 18000, error: 30000 },
+};
+/**
+ * Built-in `large-patch-files` warning band per tier. There is no notice or
+ * error band by default: file count expresses scope, not blast radius.
+ *
+ * The branding tier sits well above the typical floor because branding
+ * patches inherently span many files: PNG/ICO icon assets in 7+ sizes, MSIX
+ * manifests, channel-specific configs, locale `.ftl` files, Windows/macOS
+ * launcher resources. A fresh-fork branding bundle is around 56 files, so 60
+ * leaves headroom for additional channels/locales while still firing on a
+ * genuinely bloated patch. The test tier matches general because a
+ * test-only patch rarely touches many files.
+ */
+const DEFAULT_PATCH_FILES_WARNING = {
+    general: 5,
+    test: 5,
+    branding: 60,
+};
+/**
+ * Merges the configured overrides over the defaults for one tier.
+ *
+ * @param tier - The tier to resolve
+ * @param overrides - The `patchLint.patchSizeThresholds` block, if any
+ * @returns The effective thresholds
+ */
+export function resolvePatchSizeThresholds(tier, overrides) {
+    const configured = overrides?.[tier];
+    const lines = { ...DEFAULT_PATCH_LINE_THRESHOLDS[tier], ...configured?.lines };
+    const files = resolveFilesTier(DEFAULT_PATCH_FILES_WARNING[tier], configured?.files);
+    return { lines, files, maxFiles: files.warning };
+}
+function resolveFilesTier(defaultWarning, configured) {
+    const warning = configured?.warning ?? defaultWarning;
+    return {
+        notice: configured?.notice ?? warning,
+        warning,
+        error: configured?.error ?? null,
+    };
+}
+/**
+ * True when `file` matches one of the `patchLint.patchSizeRegistrationFiles`
+ * globs. A glob without `/` matches the basename, one with `/` the whole
+ * engine-relative path. `*` and `?` stay within a segment, `**` crosses
+ * segments.
+ *
+ * @param file - Engine-relative POSIX path
+ * @param globs - The configured globs
+ */
+export function isPatchSizeRegistrationFile(file, globs) {
+    if (globs.length === 0)
+        return false;
+    const basename = file.slice(file.lastIndexOf('/') + 1);
+    return globs.some((glob) => globToRegExp(glob).test(glob.includes('/') ? file : basename));
+}
+function globToRegExp(glob) {
+    let source = '';
+    for (let i = 0; i < glob.length; i++) {
+        const char = glob.charAt(i);
+        if (char === '*' && glob.charAt(i + 1) === '*') {
+            // `**/` matches zero or more whole segments, a bare `**` anything.
+            const slash = glob.charAt(i + 2) === '/';
+            source += slash ? '(?:.*/)?' : '.*';
+            i += slash ? 2 : 1;
+        }
+        else if (char === '*') {
+            source += '[^/]*';
+        }
+        else if (char === '?') {
+            source += '[^/]';
+        }
+        else {
+            source += escapeRegex(char);
+        }
+    }
+    return new RegExp(`^${source}$`);
+}