@hominis/fireforge 0.54.0 → 0.60.0

package/dist/src/commands/tree.js

@@ -1,341 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * `fireforge tree`: copy-on-write verification clones.
- *
- * Trees enable concurrent read-mostly verification (lint, typecheck, status,
- * verify, doctor, export dry-runs) beside a busy primary tree. Exports and
- * every other mutation stay strictly serial in the primary, because a tree's
- * patches/components are snapshots with no merge model, and the tree guard
- * (cli.ts preAction + core/tree-guard.ts) refuses mutating commands inside a
- * tree.
- *
- * `create --with-objdir` additionally clones the primary's built obj-*
- * directory, rewrites its mozinfo.json to the tree, and runs `mach configure`
- * inside the tree so the remaining configure output (config.status,
- * backend.mk, Makefile, config/autoconf.mk) stops naming the primary. That is
- * fail-closed by design (mach objdirs embed absolute source paths, and an
- * unrelocated clone would silently operate against the primary), and it is
- * what admits build-less `fireforge test` inside that tree.
- */
-import { spawn } from 'node:child_process';
-import { mkdir, rm } from 'node:fs/promises';
-import { join } from 'node:path';
-import { Command } from 'commander';
-import { withEngineSessionLock } from '../core/engine-session-lock.js';
-import { hasBuildArtifacts, runMach, withBuildLock } from '../core/mach.js';
-import { assertBuildArtifacts, findObjdirRelocationViolation, } from '../core/mach-build-artifacts.js';
-import { detectCowSupport } from '../core/tree-cow.js';
-import { cloneTree, listTrees, removeTree } from '../core/tree-store.js';
-import { assertValidTreeName, computePrimaryFingerprint, getTreeMarkerPath, getTreesDir, readTreeMarker, withTreeLifecycleLock, } from '../core/tree-store.js';
-import { GeneralError, InvalidArgumentError } from '../errors/base.js';
-import { BuildError } from '../errors/build.js';
-import { toError } from '../utils/errors.js';
-import { pathExists } from '../utils/fs.js';
-import { info, intro, outro, setMachineOutputMode, setStdoutSealed, success, warn, } from '../utils/logger.js';
-import { emitMachineError, MACHINE_OUTPUT_SCHEMA_VERSION } from '../utils/machine-output.js';
-import { addWaitLockOption, resolveWaitLockSeconds } from '../utils/options.js';
-function assertPosix() {
-    if (process.platform === 'win32') {
-        throw new GeneralError('fireforge tree is POSIX-only; copy-on-write cloning relies on clonefile/reflink, which are not available on Windows.');
-    }
-}
-/**
- * Resolves the primary objdir a `--with-objdir` clone will keep,
- * refusing missing, incomplete, ambiguous, or already-mismatched builds
- * before any copying starts.
- */
-async function resolveObjdirForClone(projectRoot) {
-    const engineDir = join(projectRoot, 'engine');
-    const buildCheck = await hasBuildArtifacts(engineDir);
-    assertBuildArtifacts(engineDir, buildCheck, {
-        label: 'tree create --with-objdir',
-        requirement: 'tree create --with-objdir requires a completed primary build.',
-        remediation: 'Run "fireforge build" first, or create the tree without --with-objdir.',
-        requireExisting: true,
-    });
-    if (buildCheck.objDir === undefined) {
-        throw new GeneralError('tree create --with-objdir could not determine the primary obj-* directory.');
-    }
-    return buildCheck.objDir;
-}
-/**
- * Runs `mach configure` inside the tree's engine so the configure-generated
- * root files (config.status, backend.mk, Makefile, config/autoconf.mk) are
- * regenerated against the tree's paths. The mozinfo rewrite alone leaves
- * those naming the primary, and a build-less in-tree `test` must never
- * consult primary state. Exit code 0 is not trusted on its own: configure
- * obeys MOZCONFIG / MOZ_OBJDIR, so the postcondition is verified afterwards
- * via `findObjdirRelocationViolation`: the intended objdir was configured,
- * its mozinfo points into the tree, and none of those root files still
- * names the primary engine (nested Makefiles are products of the verified
- * config.status, and `.deps` build products are out of scope, see the
- * checker's doc). A failure throws before `cloneTree` writes the marker,
- * so the tree is removed and `clonedObjdir` is never recorded (fail-closed).
- */
-async function reconfigureClonedObjdir(treeEngineDir, objDir, primaryEngineDir) {
-    info('  Running mach configure in the tree so no build metadata retains primary paths...');
-    let exitCode;
-    try {
-        exitCode = await runMach(['configure'], treeEngineDir);
-    }
-    catch (error) {
-        throw new BuildError('mach configure failed in the cloned tree; the tree was removed. ' +
-            'Re-run tree create, or create the tree without --with-objdir.', 'mach configure', error instanceof Error ? error : undefined);
-    }
-    if (exitCode !== 0) {
-        throw new BuildError(`mach configure exited non-zero (${exitCode}) in the cloned tree; the tree was removed. ` +
-            'Re-run tree create, or create the tree without --with-objdir.', 'mach configure');
-    }
-    const violation = await findObjdirRelocationViolation({
-        engineDir: treeEngineDir,
-        objDir,
-        forbiddenDir: primaryEngineDir,
-    });
-    if (violation !== undefined) {
-        throw new BuildError(`mach configure exited 0 in the cloned tree but did not relocate the objdir: ${violation}. ` +
-            'The tree was removed. Re-run tree create, or create the tree without --with-objdir.', 'mach configure');
-    }
-}
-/** Creates a verification tree under `.fireforge/trees/<name>`. */
-export async function treeCreateCommand(projectRoot, name, options = {}) {
-    assertPosix();
-    intro('FireForge Tree Create');
-    assertValidTreeName(name);
-    // A marker we cannot parse still means "something claims this is a tree", so
-    // it must block nesting too. Otherwise a corrupt marker is a licence to
-    // clone a snapshot into itself.
-    const markerState = await readTreeMarker(projectRoot);
-    if (markerState.kind !== 'absent') {
-        throw new GeneralError(markerState.kind === 'valid'
-            ? 'Verification trees cannot be nested: run tree create in the primary tree.'
-            : `${getTreeMarkerPath(projectRoot)} claims this directory is a verification tree, but ` +
-                `${markerState.reason}. Repair or delete the marker before creating a tree here.`);
-    }
-    const treesDir = getTreesDir(projectRoot);
-    const treeRoot = join(treesDir, name);
-    await withTreeLifecycleLock(projectRoot, async () => {
-        if (await pathExists(treeRoot)) {
-            throw new GeneralError(`A tree named "${name}" already exists. Remove it first (fireforge tree remove ${name}) — refresh is remove + create.`);
-        }
-        await mkdir(treesDir, { recursive: true });
-        const capability = await detectCowSupport(treesDir);
-        if (capability === 'none' && options.forceCopy !== true) {
-            throw new GeneralError('This filesystem cannot copy-on-write (APFS clonefile or btrfs/XFS reflink required), so a tree ' +
-                'would be a full physical copy of the applied engine tree — potentially tens of gigabytes. ' +
-                'Re-run with --force-copy to accept that explicitly.');
-        }
-        if (capability === 'none') {
-            warn('No copy-on-write support detected — performing a full physical copy (--force-copy).');
-        }
-        // Courtesy fast-fail: refuse obvious no-build cases before waiting on
-        // locks. The result is discarded: a build can still start before the
-        // locks below are held, so only the re-resolution under the build lock
-        // is authoritative for what actually gets cloned.
-        if (options.withObjdir === true) {
-            await resolveObjdirForClone(projectRoot);
-        }
-        // Snapshot under the primary engine-session lock so a mid-mutation
-        // state (half-applied export, furnace deploy) is never captured. An
-        // objdir snapshot additionally holds the primary build lock, under
-        // which the objdir is re-validated immediately before cloning so a
-        // concurrent `fireforge build` can neither tear the obj-* mid-write
-        // nor swap it after preflight. A failed clone (including the
-        // fail-closed mozinfo-rewrite refusal and a failed in-tree
-        // reconfigure) removes the partial tree so the name is immediately
-        // reusable.
-        const marker = await withEngineSessionLock(projectRoot, 'tree create', async () => {
-            const clone = (objDir) => cloneTree({
-                primaryRoot: projectRoot,
-                treeRoot,
-                name,
-                capability,
-                createdAt: new Date().toISOString(),
-                ...(objDir === undefined
-                    ? {}
-                    : {
-                        withObjdir: {
-                            objDir,
-                            reconfigure: (treeEngineDir) => reconfigureClonedObjdir(treeEngineDir, objDir, join(projectRoot, 'engine')),
-                        },
-                    }),
-            });
-            try {
-                return options.withObjdir === true
-                    ? await withBuildLock(projectRoot, async () => clone(await resolveObjdirForClone(projectRoot)))
-                    : await clone();
-            }
-            catch (error) {
-                await rm(treeRoot, { recursive: true, force: true });
-                throw error;
-            }
-        }, { waitLockSeconds: options.waitLockSeconds });
-        success(`Created verification tree "${name}" at ${treeRoot}`);
-        info(`  Engine HEAD: ${marker.engineHead ?? '(no engine)'}`);
-        info('  Read-only: status, lint, typecheck, verify, doctor, and export/re-export --dry-run run inside it; mutation commands are refused.');
-        if (marker.clonedObjdir !== undefined) {
-            info(`  Build cloned: ${marker.clonedObjdir} was kept and rewritten to this tree — build-less "fireforge test" runs inside it.`);
-            info('  Browser tests share Marionette port 2828 with the primary; pass --marionette-port for concurrent runs.');
-        }
-    });
-    outro('Tree created');
-}
-/** Prints the tree list with staleness against the current primary state. */
-export async function treeListCommand(projectRoot, options = {}) {
-    if (options.json === true) {
-        // stdout belongs exclusively to the JSON payload: engage machine mode so
-        // any diagnostic, including a listTrees failure rendered later by
-        // withErrorHandling (which also resets the mode), routes to stderr.
-        setMachineOutputMode(true);
-        try {
-            const trees = await listTrees(projectRoot);
-            process.stdout.write(`${JSON.stringify({ schemaVersion: MACHINE_OUTPUT_SCHEMA_VERSION, trees }, null, 2)}\n`);
-            // Payload written: stdout is now spoken for. See docs/machine-output.md.
-            setStdoutSealed(true);
-        }
-        catch (error) {
-            // Same failure envelope `status --json` emits. Without it a scripted
-            // consumer got a parseable refusal from one command and a bare
-            // non-zero exit from the other. See docs/machine-output.md.
-            emitMachineError('tree-list-failed', toError(error).message);
-        }
-        finally {
-            setMachineOutputMode(false);
-        }
-        return;
-    }
-    const trees = await listTrees(projectRoot);
-    intro('FireForge Trees');
-    if (trees.length === 0) {
-        info('No verification trees. Create one with: fireforge tree create <name>');
-        outro('Done');
-        return;
-    }
-    for (const tree of trees) {
-        info(`${tree.name.padEnd(20)} ${tree.staleness.padEnd(24)} created ${tree.createdAt}`);
-    }
-    outro(`${trees.length} tree(s)`);
-}
-/** Removes one tree (or all of them with `--all`). */
-export async function treeRemoveCommand(projectRoot, name, options = {}) {
-    assertPosix();
-    intro('FireForge Tree Remove');
-    if (options.all !== true && name === undefined) {
-        throw new InvalidArgumentError('Pass a tree name, or --all to remove every tree.', '--all');
-    }
-    await withTreeLifecycleLock(projectRoot, async () => {
-        const targets = options.all === true ? (await listTrees(projectRoot)).map((t) => t.name) : [name ?? ''];
-        if (targets.length === 0) {
-            info('No verification trees to remove.');
-            return;
-        }
-        for (const target of targets) {
-            await removeTree(projectRoot, target, { force: options.force === true });
-            success(`Removed verification tree "${target}"`);
-        }
-    });
-    outro('Tree removal complete');
-}
-/** Spawns `fireforge <args>` with the tree as its working directory. */
-async function treeExecCommand(projectRoot, name, args) {
-    assertPosix();
-    assertValidTreeName(name);
-    const treeRoot = join(getTreesDir(projectRoot), name);
-    const state = await readTreeMarker(treeRoot);
-    if (state.kind === 'corrupt') {
-        // Collapsing corrupt into "no such tree" misdiagnoses: the directory IS
-        // there, claiming to be a tree, and "no tree named X" points the operator
-        // at the wrong remediation.
-        throw new GeneralError(`Tree "${name}" exists but its marker could not be read: ${state.reason}. ` +
-            'Recreate it (fireforge tree remove <name> && fireforge tree create <name>).');
-    }
-    if (state.kind === 'absent') {
-        throw new GeneralError(`No verification tree named "${name}". List trees with: fireforge tree list`);
-    }
-    if (state.kind === 'unsupported') {
-        throw new GeneralError(`Cannot inspect tree "${name}": ${state.reason}`);
-    }
-    const marker = state.marker;
-    const current = await computePrimaryFingerprint(projectRoot);
-    if (marker.engineHead !== current.engineHead) {
-        warn(`Tree "${name}" is stale (primary engine advanced since the snapshot).`);
-    }
-    else if (marker.engineFingerprint !== undefined &&
-        marker.engineFingerprint !== current.engineFingerprint) {
-        warn(`Tree "${name}" is stale (primary engine worktree changed since the snapshot).`);
-    }
-    else if (marker.patchesFingerprint !== current.patchesFingerprint) {
-        warn(`Tree "${name}" is stale (primary patches changed since the snapshot).`);
-    }
-    const cliEntry = process.argv[1];
-    if (cliEntry === undefined) {
-        throw new GeneralError('Cannot resolve the fireforge CLI entry point for tree exec.');
-    }
-    const exitCode = await new Promise((resolvePromise, rejectPromise) => {
-        const child = spawn(process.execPath, [cliEntry, ...args], {
-            cwd: treeRoot,
-            stdio: 'inherit',
-        });
-        child.on('error', rejectPromise);
-        child.on('exit', (code) => {
-            resolvePromise(code ?? 1);
-        });
-    }).finally(() => {
-        // With `stdio: 'inherit'` the child owned stdout, including any
-        // FIREFORGE-VERDICT line it emitted as its last stdout write. From here
-        // on the parent must not write stdout again, or its own refusal text
-        // (the GeneralError below, rendered by withErrorHandling) prints after
-        // the child's verdict and breaks the "verdict is the run's last stdout
-        // line" contract at the tree-exec boundary. Sealing routes the parent's
-        // remaining output to stderr. withErrorHandling's finally clears it.
-        setStdoutSealed(true);
-    });
-    if (exitCode !== 0) {
-        throw new GeneralError(`tree exec: fireforge ${args.join(' ')} exited with code ${exitCode}.`);
-    }
-}
-/** Registers the tree command group on the CLI program. */
-export function registerTree(program, context) {
-    const { getProjectRoot, withErrorHandling } = context;
-    const tree = program
-        .command('tree')
-        .description('Manage copy-on-write verification clones of this project for concurrent read-mostly work (lint, typecheck, status, verify, export/re-export --dry-run; build-less test with create --with-objdir). Mutation commands are refused inside a tree.')
-        // No-subcommand contract shared with `patch`/`token`/`furnace`: help on
-        // stdout, exit 0 (see `handleParseError` for the groups without an action).
-        .action(() => {
-        tree.outputHelp();
-    });
-    addWaitLockOption(tree
-        .command('create <name>')
-        .description('Clone the project (engine included, obj-* excluded) into .fireforge/trees/<name> using filesystem copy-on-write (APFS clonefile / btrfs-XFS reflink). Refuses on filesystems without CoW support unless --force-copy explicitly accepts a full physical copy.')
-        .option('--force-copy', 'Allow a full physical copy when the filesystem cannot copy-on-write. This can copy tens of GB; never implied.')
-        .option('--with-objdir', 'Also clone the primary obj-* build and rewrite its mozinfo.json to the tree (fail-closed), enabling build-less "fireforge test" inside the tree. Requires a completed, unambiguous primary build.')).action(withErrorHandling(async (name, options) => {
-        // The flag is a CLI-layer concern: the command takes the resolved
-        // wait budget, matching how furnace routes its subcommand locks.
-        const { waitLock, ...rest } = options;
-        await treeCreateCommand(getProjectRoot(), name, {
-            ...rest,
-            waitLockSeconds: resolveWaitLockSeconds(waitLock),
-        });
-    }));
-    tree
-        .command('list')
-        .description('List verification trees with creation time and staleness vs the primary tree (engine HEAD and patches.json fingerprint).')
-        .option('--json', 'Output the tree list as JSON')
-        .action(withErrorHandling(async (options) => {
-        await treeListCommand(getProjectRoot(), options);
-    }));
-    tree
-        .command('remove [name]')
-        .description("Delete a verification tree. Refuses while a live process holds the tree's build or engine-session lock, and when a lock exists whose owning process cannot be identified.")
-        .option('--all', 'Remove every verification tree')
-        .option('--force', "Delete even when a lock directory's owner cannot be identified. Only safe once you have confirmed no build or test is running against the tree.")
-        .action(withErrorHandling(async (name, options) => {
-        await treeRemoveCommand(getProjectRoot(), name, options);
-    }));
-    tree
-        .command('exec <name> [args...]')
-        .description('Run a fireforge command inside the named tree (equivalent to cd-ing into it). Example: fireforge tree exec shard-a -- lint --per-patch')
-        .action(withErrorHandling(async (name, args) => {
-        await treeExecCommand(getProjectRoot(), name, args);
-    }));
-}

package/dist/src/commands/typecheck.d.ts

@@ -1,56 +0,0 @@
-/**
- * `fireforge typecheck`: whole-project TypeScript type checking driven by
- * user-supplied jsconfig.json paths.
- *
- * Distinct from `patchLint.checkJs`: that pass is patch-hygiene (scoped to
- * patch-owned `.sys.mjs`, run automatically by `fireforge lint`). This
- * command is CI-grade: it runs whole projects with the user's own compiler
- * options. The two share their Firefox-globals shim and the same
- * suppressed-diagnostic set so a file that lints clean cannot fail typecheck
- * for a reason the operator could not have inferred from the docs.
- *
- * Exits non-zero on any error-severity diagnostic. Warnings print but do not
- * fail.
- */
-import { Command } from 'commander';
-import type { CommandContext } from '../types/cli.js';
-import type { PatchLintIssue } from '../types/commands/index.js';
-import type { TypecheckConfig } from '../types/config.js';
-import type { TypecheckProjectResult } from '../types/typecheck.js';
-/** Command-line options Commander forwards from `fireforge typecheck`. */
-export interface TypecheckCommandOptions {
-    /**
-     * Override `typecheck.projects` with a single jsconfig.json path
-     * for one-off verification. Replaces (does not augment) the config,
-     * which is useful to re-run a single project after fixing one of its
-     * issues without waiting for the full set.
-     */
-    project?: string;
-    /**
-     * Build every project from scratch and write no incremental build info
-     * (`--no-cache`).
-     */
-    noCache?: boolean;
-}
-/**
- * Resolves the project list to type-check. `--project` wins over
- * config. If neither is set, throws a clear error pointing at both
- * paths to a fix (add the config field or pass --project).
- */
-export declare function resolveTypecheckProjects(configTypecheck: TypecheckConfig | undefined, override: string | undefined): TypecheckConfig;
-/**
- * Top-level entry point invoked by the registered Commander action.
- * Loads config, resolves projects, runs typecheck, prints the result,
- * and throws `GeneralError` to set a non-zero exit on errors.
- */
-export declare function typecheckCommand(projectRoot: string, options: TypecheckCommandOptions): Promise<void>;
-/**
- * Prints all issues, computes the per-project + total counts, and
- * throws on errors. Extracted so it can be exercised directly by
- * the CLI test without spawning a child process.
- */
-export declare function reportResults(projectRoot: string, results: ReadonlyArray<TypecheckProjectResult>, patchLintIssues?: ReadonlyArray<PatchLintIssue>): void;
-/**
- * Registers the `typecheck` command on the CLI program.
- */
-export declare function registerTypecheck(program: Command, { getProjectRoot, withErrorHandling }: CommandContext): void;

package/dist/src/commands/verify-scope.d.ts

@@ -1,28 +0,0 @@
-import type { PatchLintIssue, PatchMetadata } from '../types/commands/index.js';
-/** The resolved scope: manifest filenames, and every path they claim. */
-export interface VerifyScope {
-    patches: ReadonlySet<string>;
-    files: ReadonlySet<string>;
-}
-/**
- * Resolves raw `--patches` values against the manifest. Returns undefined
- * when the flag was not given and refuses a name that matches no patch.
- *
- * @param patchesDir - Absolute path to the patches directory
- * @param requested - Raw `--patches` values (each may be a comma list)
- */
-export declare function resolveVerifyScope(patchesDir: string, requested: readonly string[] | undefined): Promise<VerifyScope | undefined>;
-/**
- * True when a filename-keyed finding (manifest consistency, policy) is in
- * scope: it names a scoped patch, or it names no patch at all.
- */
-export declare function isFilenameInScope(scope: VerifyScope | undefined, filename: string): boolean;
-/** True when any of the implicated patches is in scope. */
-export declare function anyPatchInScope(scope: VerifyScope | undefined, filenames: readonly string[]): boolean;
-/**
- * Keeps the lint issues that implicate a scoped patch. An issue without a
- * `patches` list is attributed through its file instead.
- */
-export declare function scopeLintIssues(issues: PatchLintIssue[], scope: VerifyScope | undefined): PatchLintIssue[];
-/** Keeps the manifest rows in scope. No scope keeps all. */
-export declare function scopePatches<T extends Pick<PatchMetadata, 'filename'>>(patches: readonly T[], scope: VerifyScope | undefined): T[];

package/dist/src/commands/verify-scope.js

@@ -1,67 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * `verify --patches <list>`: judges only the named patches' findings. Split
- * out of verify.ts so the per-group attribution rules sit in one place.
- *
- * A finding is in scope when it names a scoped patch: a manifest or policy
- * issue by its filename, a cross-patch claim or lint issue by any patch it
- * implicates, a drifted file by its owning patch, a dangling registration
- * by the patch that registers it. Findings about the queue as a whole (a
- * manifest that does not parse) are kept, because no patch can be judged
- * past them. Unowned worktree changes belong to no patch and drop out.
- */
-import { loadPatchesManifest } from '../core/patch-manifest.js';
-import { selectPatchSubset } from '../core/patch-subset.js';
-import { GeneralError } from '../errors/base.js';
-/**
- * Resolves raw `--patches` values against the manifest. Returns undefined
- * when the flag was not given and refuses a name that matches no patch.
- *
- * @param patchesDir - Absolute path to the patches directory
- * @param requested - Raw `--patches` values (each may be a comma list)
- */
-export async function resolveVerifyScope(patchesDir, requested) {
-    if (requested === undefined || requested.length === 0)
-        return undefined;
-    const manifest = await loadPatchesManifest(patchesDir);
-    if (!manifest || manifest.patches.length === 0) {
-        throw new GeneralError('--patches needs a patch queue, but patches.json lists no patches.');
-    }
-    const subset = selectPatchSubset(manifest, requested, '--patches selects patches (filename, stem, order number, manifest name, or slug).');
-    return {
-        patches: new Set(subset.map((patch) => patch.filename)),
-        files: new Set(subset.flatMap((patch) => patch.filesAffected)),
-    };
-}
-/**
- * True when a filename-keyed finding (manifest consistency, policy) is in
- * scope: it names a scoped patch, or it names no patch at all.
- */
-export function isFilenameInScope(scope, filename) {
-    if (scope === undefined)
-        return true;
-    return scope.patches.has(filename) || !filename.endsWith('.patch');
-}
-/** True when any of the implicated patches is in scope. */
-export function anyPatchInScope(scope, filenames) {
-    if (scope === undefined)
-        return true;
-    return filenames.some((filename) => scope.patches.has(filename));
-}
-/**
- * Keeps the lint issues that implicate a scoped patch. An issue without a
- * `patches` list is attributed through its file instead.
- */
-export function scopeLintIssues(issues, scope) {
-    if (scope === undefined)
-        return issues;
-    return issues.filter((issue) => issue.patches !== undefined && issue.patches.length > 0
-        ? anyPatchInScope(scope, issue.patches)
-        : scope.files.has(issue.file));
-}
-/** Keeps the manifest rows in scope. No scope keeps all. */
-export function scopePatches(patches, scope) {
-    if (scope === undefined)
-        return [...patches];
-    return patches.filter((patch) => scope.patches.has(patch.filename));
-}

package/dist/src/commands/verify.d.ts

@@ -1,58 +0,0 @@
-/**
- * `fireforge verify`: read-only fsck for the patch queue.
- *
- * Combines the manifest consistency check (orphan files, missing entries,
- * files-affected mismatch, duplicate entries) with the cross-patch lint
- * rules (duplicate /dev/null creation, forward imports). Does not run
- * `planExport` per patch. That is out of scope because it
- * would couple verify to engine state and make the command too slow to be
- * useful as a pre-flight gate. Engine-level patch application issues are
- * still covered by the existing `fireforge doctor` and `fireforge import`
- * paths.
- *
- * Exits non-zero when any error-severity finding is reported so CI can
- * treat the output as pass/fail.
- */
-import { Command } from 'commander';
-import type { CommandContext } from '../types/cli.js';
-import { type VerifyScope } from './verify-scope.js';
-interface VerifyIssueGroup {
-    title: string;
-    issues: string[];
-    errorCount: number;
-    warningCount: number;
-}
-export interface PatchQueueHealth {
-    hasPatchesDirectory: boolean;
-    groups: VerifyIssueGroup[];
-    errorCount: number;
-    warningCount: number;
-}
-/**
- * Collects the same queue-health findings reported by `fireforge verify`
- * without printing. Used by doctor recovery paths that need a read-only
- * "is this queue healthy?" decision before clearing stale state.
- *
- * @param projectRoot - Project root directory
- * @param scope - `verify --patches`: keep only the findings that name these
- *   patches (see verify-scope.ts). Omitted, every finding counts.
- */
-export declare function collectPatchQueueHealth(projectRoot: string, scope?: VerifyScope): Promise<PatchQueueHealth>;
-/**
- * Runs the `verify` command: manifest consistency + cross-patch lint.
- * Read-only. Exits non-zero on any error-severity finding.
- *
- * @param projectRoot - Project root directory
- * @param options - `patches`: the raw `--patches` values
- */
-export declare function verifyCommand(projectRoot: string, options?: {
-    patches?: string[];
-}): Promise<void>;
-/**
- * Registers the `verify` command on the CLI program.
- *
- * @param program - Commander root program
- * @param context - Shared CLI registration context
- */
-export declare function registerVerify(program: Command, { getProjectRoot, withErrorHandling }: CommandContext): void;
-export {};

package/dist/src/commands/watch.d.ts

@@ -1,9 +0,0 @@
-import { Command } from 'commander';
-import type { CommandContext } from '../types/cli.js';
-/**
- * Runs the watch command for auto-rebuilding.
- * @param projectRoot - Root directory of the project
- */
-export declare function watchCommand(projectRoot: string): Promise<void>;
-/** Registers the watch command on the CLI program. */
-export declare function registerWatch(program: Command, { getProjectRoot, withErrorHandling }: CommandContext): void;

package/dist/src/commands/wire.d.ts

@@ -1,13 +0,0 @@
-import { Command } from 'commander';
-import type { CommandContext } from '../types/cli.js';
-import type { WireOptions } from '../types/commands/index.js';
-/**
- * Wires a chrome subscript into the browser.
- *
- * @param projectRoot - Root directory of the project
- * @param name - Subscript name (without .js extension)
- * @param options - Command options
- */
-export declare function wireCommand(projectRoot: string, name: string, options?: WireOptions): Promise<void>;
-/** Registers the wire command on the CLI program. */
-export declare function registerWire(program: Command, { getProjectRoot, withErrorHandling }: CommandContext): void;

package/dist/src/core/ast-utils.d.ts

@@ -1,73 +0,0 @@
-import * as acorn from 'acorn';
-import type * as estree from 'estree';
-import { walk } from 'estree-walker';
-/**
- * An ESTree node augmented with acorn's character-offset positions.
- * At runtime `acorn.parse` produces objects that carry both the ESTree
- * shape and `start`/`end` indices, but the type system doesn't know that.
- * This intersection type bridges the gap so we can safely use both APIs.
- */
-export type AcornESTreeNode<T extends estree.Node = estree.Node> = T & {
-    start: number;
-    end: number;
-};
-/**
- * Parse JavaScript source as a script, not an ES module.
- * All Mozilla chrome JS files (`browser-main.js`, `browser-init.js`,
- * `customElements.js`, etc.) are scripts that run in a privileged scope.
- *
- * @param content - Source text to parse
- * @param onComment - Optional array that acorn fills with comment nodes
- * @returns Parsed program AST with character-offset positions
- */
-export declare function parseScript(content: string, onComment?: acorn.Comment[]): AcornESTreeNode<estree.Program>;
-/**
- * Parse JavaScript source as an ES module.
- * Used for `.sys.mjs` files which use static import/export syntax.
- *
- * @param content - Source text to parse
- * @param onComment - Optional array that acorn fills with comment nodes
- * @returns Parsed program AST with character-offset positions
- */
-export declare function parseModule(content: string, onComment?: acorn.Comment[]): AcornESTreeNode<estree.Program>;
-/**
- * Convenience cast from `acorn.Node` (or the generic ESTree union returned
- * by estree-walker callbacks) to a positioned, narrowly-typed node.
- *
- * Caller obligation: you must already have discriminated on `node.type`.
- * This performs no runtime check. It exists to attach acorn's `start`/`end`
- * offsets to a node the caller has already narrowed, typically inside an
- * `if (node.type === 'CallExpression')` branch or an equivalent walker
- * guard. Calling it on an undiscriminated node produces a value whose type
- * is wrong.
- *
- * No runtime `type` assertion: every call site sits in the hot loop of a lint
- * or registration walker and is already post-narrowing, so the check would
- * cost traversal time on every node to re-prove what the enclosing branch
- * established.
- */
-export declare function asEstree<T extends estree.Node>(node: estree.Node): AcornESTreeNode<T>;
-/**
- * Type-safe wrapper around estree-walker's `walk()` that bridges the
- * acorn→estree type gap. Centralises the single `as unknown as` cast so
- * callers don't need it.
- */
-export declare function walkAST(ast: AcornESTreeNode<estree.Program>, visitors: Parameters<typeof walk>[1]): ReturnType<typeof walk>;
-/**
- * Read backward from `position` to the preceding newline (or start of
- * string) and return the leading whitespace.  This is the "visual indent"
- * of whatever token begins at `position`.
- *
- * ```
- * "  try {\n    foo();\n  }"
- *                          ^  detectIndent(…, 26) → "  "
- * ```
- */
-export declare function detectIndent(content: string, position: number): string;
-/**
- * Extract the raw source text for a node's range.
- */
-export declare function getNodeSource(content: string, node: {
-    start: number;
-    end: number;
-}): string;