@hominis/fireforge 0.54.0 → 0.60.0

package/dist/src/core/checkjs-support-heads.js

@@ -1,104 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Unowned support heads for the named-file checkJs pass of `test --build`.
- *
- * Each named test is checked as its own program: the test plus the
- * patch-owned `head*.js` beside it. A suite moved onto a NEW support head
- * (`head_world_page.js`, loaded with `loadSubScript`) cannot be proven
- * before that head is exported, because the head is in no patch: every kit
- * name reads as "Cannot find name" and the run is refused at preflight,
- * with the generic hint, which offers the shim as a remedy.
- *
- * So an unowned same-directory `head*.js` joins the pass when a named test
- * loads it with `loadSubScript` or a manifest beside it lists it in
- * `support-files`, which are the two ways the harness itself would bring
- * it into the test's scope. The operator is told it is unowned and how to
- * adopt it, as for the `head.js` companions in
- * `patch-lint-unmanaged-companion.ts`.
- */
-import { readdir, readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { buildSupportFileMatcher, extractSupportFileEntries, } from './patch-lint-forward-registration.js';
-import { findLoadSubScriptTargets } from './patch-lint-unmanaged-companion.js';
-const HEAD_BASENAME_PATTERN = /^head(?:_.*)?\.js$/;
-const TEST_MANIFEST_PATTERN = /^(?:xpcshell|mochitest|browser|chrome|a11y)\.(?:toml|ini)$/;
-async function readOrUndefined(path) {
-    try {
-        return await readFile(path, 'utf8');
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Why `head` is in scope for the named tests of its directory, if it is. */
-async function findInclusionReason(engineDir, dir, head, context) {
-    const headName = head.slice(dir.length);
-    for (const test of context.tests) {
-        const source = await readOrUndefined(join(engineDir, test));
-        if (source === undefined)
-            continue;
-        const loads = findLoadSubScriptTargets(source).some((target) => target.slice(target.lastIndexOf('/') + 1) === headName);
-        if (loads)
-            return `${test} loads it with loadSubScript`;
-    }
-    for (const manifest of context.manifests) {
-        const source = await readOrUndefined(join(engineDir, manifest));
-        if (source === undefined)
-            continue;
-        const listed = extractSupportFileEntries(source).some(({ entry }) => buildSupportFileMatcher(manifest, entry)?.(head) === true);
-        if (listed)
-            return `${manifest} lists it in support-files`;
-    }
-    return undefined;
-}
-/**
- * Finds the unowned same-directory `head*.js` files the named tests bring
- * into scope.
- *
- * @param engineDir - Absolute engine directory
- * @param selected - Engine-relative named test files
- * @param owned - Every file the pass already includes
- */
-export async function findUnownedSupportHeads(engineDir, selected, owned) {
-    const testsByDir = new Map();
-    for (const test of selected) {
-        const dir = test.slice(0, test.lastIndexOf('/') + 1);
-        testsByDir.set(dir, [...(testsByDir.get(dir) ?? []), test]);
-    }
-    const heads = [];
-    for (const [dir, tests] of testsByDir) {
-        let names;
-        try {
-            names = (await readdir(join(engineDir, dir))).sort();
-        }
-        catch {
-            continue;
-        }
-        const manifests = names
-            .filter((name) => TEST_MANIFEST_PATTERN.test(name))
-            .map((name) => `${dir}${name}`);
-        const candidates = names
-            .filter((name) => HEAD_BASENAME_PATTERN.test(name))
-            .map((name) => `${dir}${name}`)
-            .filter((file) => !owned.has(file));
-        for (const file of candidates) {
-            const reason = await findInclusionReason(engineDir, dir, file, { tests, manifests });
-            if (reason !== undefined)
-                heads.push({ file, reason });
-        }
-    }
-    return heads;
-}
-/**
- * The notice for an included unowned head: the ownership fact, the
- * adoption command, and an explicit "not the shim", for the same reason
- * `formatUnmanagedCompanionHint` gives.
- *
- * @param head - From {@link findUnownedSupportHeads}
- */
-export function formatUnownedSupportHeadNotice(head) {
-    return (`${head.file} is in no patch yet; the pass includes it because ${head.reason}. ` +
-        `Adopt it with "fireforge re-export <patch> --scan --scan-file ${head.file}" before ` +
-        'export. Do NOT add its globals to the test shim: that would hide a genuinely missing ' +
-        'helper once the head is exported.');
-}

package/dist/src/core/component-source-guard.d.ts

@@ -1,20 +0,0 @@
-import type { FurnaceConfig } from '../types/furnace.js';
-import type { FurnacePaths } from './furnace-config.js';
-/** Records authored bytes without following directory aliases or writing to source directories. */
-export declare function snapshotComponentSources(roots: readonly string[]): Promise<Map<string, string>>;
-/** Detects reverted, removed or added source files before deployment can be committed. */
-export declare function changedComponentSources(roots: readonly string[], before: ReadonlyMap<string, string>): Promise<string[]>;
-interface ComponentSourceSnapshot {
-    roots: string[];
-    files: Map<string, string>;
-}
-/** Captures only configured inputs for a real deploy, plus shared CSS fragments. */
-export declare function captureComponentSources(paths: FurnacePaths, config: FurnaceConfig, dryRun: boolean, options?: {
-    componentName?: string;
-}): Promise<ComponentSourceSnapshot | undefined>;
-/** Produces a blocking apply error before the journal or ownership state is committed. */
-export declare function componentSourceErrors(snapshot: ComponentSourceSnapshot | undefined): Promise<Array<{
-    name: string;
-    error: string;
-}>>;
-export {};

package/dist/src/core/component-source-guard.js

@@ -1,68 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-import { readdir, readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { getNodeErrorCode } from '../utils/errors.js';
-import { sha256Hex } from '../utils/hash.js';
-/** Records authored bytes without following directory aliases or writing to source directories. */
-export async function snapshotComponentSources(roots) {
-    const files = new Map();
-    async function visit(directory) {
-        let entries;
-        try {
-            entries = await readdir(directory, { withFileTypes: true });
-        }
-        catch (error) {
-            if (getNodeErrorCode(error) === 'ENOENT')
-                return;
-            throw error;
-        }
-        for (const entry of entries) {
-            const path = join(directory, entry.name);
-            if (entry.isDirectory())
-                await visit(path);
-            else if (entry.isFile())
-                files.set(path, sha256Hex(await readFile(path)));
-        }
-    }
-    for (const root of roots)
-        await visit(root);
-    return files;
-}
-/** Detects reverted, removed or added source files before deployment can be committed. */
-export async function changedComponentSources(roots, before) {
-    const after = await snapshotComponentSources(roots);
-    return [...new Set([...before.keys(), ...after.keys()])]
-        .filter((path) => before.get(path) !== after.get(path))
-        .sort();
-}
-/** Captures only configured inputs for a real deploy, plus shared CSS fragments. */
-export async function captureComponentSources(paths, config, dryRun, options) {
-    if (dryRun)
-        return undefined;
-    const componentName = options?.componentName;
-    const selected = (name) => componentName === undefined || name === componentName;
-    const roots = [
-        ...Object.keys(config.custom)
-            .filter(selected)
-            .map((name) => join(paths.customDir, name)),
-        ...Object.keys(config.overrides)
-            .filter(selected)
-            .map((name) => join(paths.overridesDir, name)),
-        paths.sharedDir,
-    ];
-    return { roots, files: await snapshotComponentSources(roots) };
-}
-/** Produces a blocking apply error before the journal or ownership state is committed. */
-export async function componentSourceErrors(snapshot) {
-    if (!snapshot)
-        return [];
-    const changed = await changedComponentSources(snapshot.roots, snapshot.files);
-    return changed.length === 0
-        ? []
-        : [
-            {
-                name: 'component-sources',
-                error: `Component sources changed during deployment: ${changed.join(', ')}. Refusing this build/proof; inspect the source edits before retrying.`,
-            },
-        ];
-}

package/dist/src/core/config-mutate.d.ts

@@ -1,16 +0,0 @@
-/**
- * Immutable config mutation with dot-path keys.
- */
-import type { FireForgeConfig } from '../types/config.js';
-import type { JsonObject, JsonValue } from '../types/json.js';
-/**
- * Creates a mutated copy of a config with a nested key set to a new value,
- * optionally re-validated.
- * @param config - Original config
- * @param key - Dot-separated config path
- * @param value - New value
- * @param skipValidation - If true, skip re-validation (for --force)
- * @returns The mutated config
- */
-export declare function mutateConfig(config: FireForgeConfig, key: string, value: JsonValue, skipValidation?: false): FireForgeConfig;
-export declare function mutateConfig(config: FireForgeConfig | JsonObject, key: string, value: JsonValue, skipValidation: true): JsonObject;

package/dist/src/core/config-mutate.js

@@ -1,76 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Immutable config mutation with dot-path keys.
- */
-import { ConfigError } from '../errors/config.js';
-import { toError } from '../utils/errors.js';
-import { verbose } from '../utils/logger.js';
-import { isJsonObject, isObject } from '../utils/validation.js';
-import { validateConfig } from './config-validate.js';
-function cloneConfigDocument(config) {
-    const cloned = structuredClone(config);
-    if (!isObject(cloned)) {
-        throw new ConfigError('Config clone unexpectedly produced a non-object value');
-    }
-    // Both input shapes hold only JSON data (`FireForgeConfig` is plain
-    // parsed-config data), and `structuredClone` preserves that, so the
-    // object check above is the only invariant left to establish.
-    return cloned;
-}
-/**
- * The error every sentinel-segment refusal raises. Only the message lives
- * here: the comparison itself is spelled inline at each write site, because
- * that is what both a reader and CodeQL's `js/prototype-pollution-utility`
- * barrier detection need. That detection is not interprocedural, so a check
- * hidden behind a helper leaves the descent below looking unguarded.
- */
-function sentinelSegmentError(key, part) {
-    return new ConfigError(`Config key "${key}" contains a reserved segment "${part}". ` +
-        'Segments "__proto__", "constructor", and "prototype" are not permitted ' +
-        'because they would mutate the object prototype chain.');
-}
-function getOrCreateChildRecord(parent, key) {
-    const existing = parent[key];
-    if (isJsonObject(existing)) {
-        return existing;
-    }
-    const child = {};
-    parent[key] = child;
-    return child;
-}
-export function mutateConfig(config, key, value, skipValidation = false) {
-    const parts = key.split('.');
-    const raw = cloneConfigDocument(config);
-    // Every segment is checked at the point it is used as a property name
-    // (the descent below and the leaf assignment) rather than once up front,
-    // so `--force` cannot be used to mutate Object.prototype and neither write
-    // can drift out from behind the guard. `raw` is a private clone, so a
-    // refusal here has mutated nothing the caller can observe.
-    let current = raw;
-    for (let i = 0; i < parts.length - 1; i++) {
-        const part = parts[i];
-        if (part === undefined)
-            continue;
-        if (part === '__proto__' || part === 'constructor' || part === 'prototype') {
-            throw sentinelSegmentError(key, part);
-        }
-        current = getOrCreateChildRecord(current, part);
-    }
-    const lastPart = parts[parts.length - 1];
-    if (lastPart !== undefined) {
-        if (lastPart === '__proto__' || lastPart === 'constructor' || lastPart === 'prototype') {
-            throw sentinelSegmentError(key, lastPart);
-        }
-        current[lastPart] = value;
-    }
-    if (!skipValidation) {
-        return validateConfig(raw);
-    }
-    try {
-        validateConfig(raw);
-    }
-    catch (error) {
-        verbose(`Skipping config revalidation for forced mutation on "${key}": ${toError(error).message}`);
-    }
-    return raw;
-}

package/dist/src/core/config-paths.d.ts

@@ -1,16 +0,0 @@
-/**
- * Project path derivation from a root directory.
- */
-import type { ProjectPaths } from '../types/config.js';
-/** Name of the fireforge data directory */
-export declare const FIREFORGE_DIR = ".fireforge";
-/** Supported top-level fireforge.json keys backed by the current schema. */
-export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "history", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment", "check"];
-/** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "test.mochitestPorts", "test.lockMode", "test.furnaceApply", "history", "history.path", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchLint.forwardRegistration", "patchLint.fileSizeMetric", "patchLint.patchSizeMetric", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment", "check"];
-/**
- * Gets all project paths based on a root directory.
- * @param root - Root directory of the project
- * @returns All project paths
- */
-export declare function getProjectPaths(root: string): ProjectPaths;

package/dist/src/core/config-paths.js

@@ -1,106 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Project path derivation from a root directory.
- */
-import { join } from 'node:path';
-/** Name of the configuration file */
-const CONFIG_FILENAME = 'fireforge.json';
-/** Name of the fireforge data directory */
-export const FIREFORGE_DIR = '.fireforge';
-/** Name of the state file */
-const STATE_FILENAME = 'state.json';
-/** Name of the engine directory */
-const ENGINE_DIR = 'engine';
-/** Name of the patches directory */
-const PATCHES_DIR = 'patches';
-/** Name of the configs directory */
-const CONFIGS_DIR = 'configs';
-/** Name of the source directory */
-const SRC_DIR = 'src';
-/** Supported top-level fireforge.json keys backed by the current schema. */
-export const SUPPORTED_CONFIG_ROOT_KEYS = [
-    'name',
-    'vendor',
-    'appId',
-    'binaryName',
-    'firefox',
-    'build',
-    'buildAudit',
-    'test',
-    'history',
-    'externalToolchains',
-    'license',
-    'wire',
-    'patchLint',
-    'patchPolicy',
-    'typecheck',
-    'markerComment',
-    'check',
-];
-/** Supported config paths that can be read or set without --force. */
-export const SUPPORTED_CONFIG_PATHS = [
-    'name',
-    'vendor',
-    'appId',
-    'binaryName',
-    'license',
-    'firefox',
-    'firefox.version',
-    'firefox.product',
-    'firefox.sha256',
-    'firefox.candidate',
-    'firefox.allowUnverifiedDownload',
-    'build',
-    'build.jobs',
-    'test',
-    'test.canaryPath',
-    'test.canaryTimeoutSeconds',
-    'test.reapOrphans',
-    'test.mochitestPorts',
-    'test.lockMode',
-    'test.furnaceApply',
-    'history',
-    'history.path',
-    'externalToolchains',
-    'wire',
-    'wire.subscriptDir',
-    'patchLint',
-    'patchLint.checkJs',
-    'patchLint.checkJsStrict',
-    'patchLint.checkJsCompilerOptions',
-    'patchLint.checkJsExtraShim',
-    'patchLint.checkJsTestFiles',
-    'patchLint.checkJsTestShim',
-    'patchLint.rawColorAllowlist',
-    'patchLint.jsdocClassMethods',
-    'patchLint.testAssertionFloor',
-    'patchLint.chromeScriptJsDoc',
-    'patchLint.forwardRegistration',
-    'patchLint.fileSizeMetric',
-    'patchLint.patchSizeMetric',
-    'patchPolicy',
-    'typecheck',
-    'typecheck.projects',
-    'typecheck.extraShim',
-    'markerComment',
-    'check',
-];
-/**
- * Gets all project paths based on a root directory.
- * @param root - Root directory of the project
- * @returns All project paths
- */
-export function getProjectPaths(root) {
-    const fireforgeDir = join(root, FIREFORGE_DIR);
-    return {
-        root,
-        config: join(root, CONFIG_FILENAME),
-        fireforgeDir,
-        state: join(fireforgeDir, STATE_FILENAME),
-        engine: join(root, ENGINE_DIR),
-        patches: join(root, PATCHES_DIR),
-        configs: join(root, CONFIGS_DIR),
-        src: join(root, SRC_DIR),
-        componentsDir: join(root, 'components'),
-    };
-}

package/dist/src/core/config-state.d.ts

@@ -1,16 +0,0 @@
-/**
- * Project state file management (.fireforge/state.json).
- */
-import type { FireForgeState } from '../types/config.js';
-/**
- * Loads the fireforge state, or returns defaults if it doesn't exist.
- * @param root - Root directory of the project
- * @returns FireForge state
- */
-export declare function loadState(root: string): Promise<FireForgeState>;
-/**
- * Updates specific fields in the fireforge state.
- * @param root - Root directory of the project
- * @param updates - Fields to update, or a transactional updater function
- */
-export declare function updateState(root: string, updates: Partial<FireForgeState> | ((current: FireForgeState) => FireForgeState)): Promise<void>;

package/dist/src/core/config-state.js

@@ -1,141 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Project state file management (.fireforge/state.json).
- */
-import { ConfigError } from '../errors/config.js';
-import { BUILD_MODES } from '../types/config.js';
-import { toError } from '../utils/errors.js';
-import { pathExists, readJson, writeJson } from '../utils/fs.js';
-import { warn } from '../utils/logger.js';
-import { isObject, isString } from '../utils/validation.js';
-import { makeEnumGuard } from '../utils/validation.js';
-/** Narrows an arbitrary string to a {@link BuildMode}. */
-const isBuildMode = makeEnumGuard(BUILD_MODES);
-import { getProjectPaths } from './config-paths.js';
-import { quarantineStateFile, withStateFileLock } from './state-file.js';
-function sanitizeProjectState(data) {
-    if (!isObject(data)) {
-        return {
-            state: {},
-            issues: ['the root value must be a JSON object'],
-            recoveredFields: [],
-        };
-    }
-    const state = {};
-    const issues = [];
-    const recoveredFields = [];
-    const stringFields = ['brand', 'buildMode', 'downloadedVersion', 'baseCommit'];
-    for (const key of stringFields) {
-        const value = data[key];
-        if (value === undefined) {
-            continue;
-        }
-        if (!isString(value)) {
-            issues.push(`field "${key}" must be a string`);
-            continue;
-        }
-        if (key === 'buildMode') {
-            // Validate and assign in one block so the predicate's narrowing reaches
-            // the assignment. Split across two `key === 'buildMode'` guards,
-            // TypeScript cannot correlate them and the assignment needed a cast,
-            // which is what let the untyped allowlist drift from the union.
-            if (!isBuildMode(value)) {
-                issues.push(`field "buildMode" must be one of: ${BUILD_MODES.join(', ')}`);
-                continue;
-            }
-            state.buildMode = value;
-        }
-        else {
-            state[key] = value;
-        }
-        recoveredFields.push(key);
-    }
-    const pendingResolution = data['pendingResolution'];
-    if (pendingResolution !== undefined) {
-        if (isObject(pendingResolution) &&
-            isString(pendingResolution['patchFilename']) &&
-            isString(pendingResolution['originalError'])) {
-            state.pendingResolution = {
-                patchFilename: pendingResolution['patchFilename'],
-                originalError: pendingResolution['originalError'],
-            };
-            recoveredFields.push('pendingResolution');
-        }
-        else {
-            issues.push('field "pendingResolution" must be an object with string fields "patchFilename" and "originalError"');
-        }
-    }
-    return { state, issues, recoveredFields };
-}
-/**
- * Validates a parsed project state object and returns a typed FireForgeState.
- * @param data - Parsed JSON state data
- * @returns Validated FireForgeState
- */
-function validateFireForgeState(data) {
-    const result = sanitizeProjectState(data);
-    if (result.issues.length > 0) {
-        throw new ConfigError(`Invalid FireForge state: ${result.issues.join('; ')}`);
-    }
-    return result.state;
-}
-async function recoverInvalidProjectState(statePath, result, alreadyLocked = false) {
-    const recover = async () => {
-        const quarantinedFile = await quarantineStateFile(statePath);
-        if (result.recoveredFields.length > 0) {
-            await writeJson(statePath, result.state);
-        }
-        const quarantineMessage = quarantinedFile
-            ? ` Quarantined the original file as ${quarantinedFile}.`
-            : '';
-        const recoveryMessage = result.recoveredFields.length > 0
-            ? ` Recovered valid field${result.recoveredFields.length === 1 ? '' : 's'}: ${result.recoveredFields.join(', ')}.`
-            : ' No valid state fields could be recovered; using defaults.';
-        warn(`State file (.fireforge/state.json) was invalid: ${result.issues.join('; ')}.${recoveryMessage}${quarantineMessage} ` +
-            'Run "fireforge doctor" to check project health.');
-        return result.state;
-    };
-    return alreadyLocked ? recover() : withStateFileLock(statePath, recover);
-}
-async function loadStateFromPath(statePath, alreadyLocked = false) {
-    if (!(await pathExists(statePath))) {
-        return {};
-    }
-    try {
-        const data = await readJson(statePath);
-        const result = sanitizeProjectState(data);
-        if (result.issues.length === 0) {
-            return result.state;
-        }
-        return await recoverInvalidProjectState(statePath, result, alreadyLocked);
-    }
-    catch (error) {
-        return await recoverInvalidProjectState(statePath, {
-            state: {},
-            issues: [`the file could not be parsed: ${toError(error).message}`],
-            recoveredFields: [],
-        }, alreadyLocked);
-    }
-}
-/**
- * Loads the fireforge state, or returns defaults if it doesn't exist.
- * @param root - Root directory of the project
- * @returns FireForge state
- */
-export async function loadState(root) {
-    const paths = getProjectPaths(root);
-    return loadStateFromPath(paths.state);
-}
-/**
- * Updates specific fields in the fireforge state.
- * @param root - Root directory of the project
- * @param updates - Fields to update, or a transactional updater function
- */
-export async function updateState(root, updates) {
-    const paths = getProjectPaths(root);
-    await withStateFileLock(paths.state, async () => {
-        const current = await loadStateFromPath(paths.state, true);
-        const nextState = typeof updates === 'function' ? updates(current) : { ...current, ...updates };
-        await writeJson(paths.state, validateFireForgeState(nextState));
-    });
-}

package/dist/src/core/config-validate-build-audit.d.ts

@@ -1,8 +0,0 @@
-import type { BuildAuditConfig } from '../types/config.js';
-/**
- * Parses the `buildAudit` block.
- *
- * @param raw - The raw `buildAudit` value from fireforge.json
- * @returns The validated block
- */
-export declare function parseBuildAuditConfig(raw: unknown): BuildAuditConfig;

package/dist/src/core/config-validate-build-audit.js

@@ -1,80 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Validation for the `buildAudit` block.
- *
- * Split out of `config-validate.ts`, which is at its per-file line budget,
- * following the `config-validate-file-size.ts` precedent.
- *
- * The rules here are stricter than the schema strictly needs, on purpose:
- * every entry is a standing suppression of a warning the
- * audit would otherwise raise. A malformed one must fail loudly at config
- * load rather than quietly admit nothing (leaving the operator believing a
- * path is carved out) or quietly admit everything.
- */
-import { ConfigError } from '../errors/config.js';
-import { isContainedRelativePath } from '../utils/paths.js';
-import { isObject } from '../utils/validation.js';
-/** Parses one `buildAudit.unpackaged[]` entry. */
-function parseUnpackagedEntry(raw, field) {
-    if (!isObject(raw)) {
-        throw new ConfigError(`Config field "${field}" must be a plain object with "path" and "reason"`);
-    }
-    for (const key of Object.keys(raw)) {
-        if (key !== 'path' && key !== 'reason') {
-            throw new ConfigError(`Config field "${field}" has unknown key "${key}"`);
-        }
-    }
-    const path = raw['path'];
-    if (typeof path !== 'string' || path.trim().length === 0) {
-        throw new ConfigError(`Config field "${field}.path" must be a non-empty string`);
-    }
-    if (!isContainedRelativePath(path)) {
-        throw new ConfigError(`Config field "${field}.path" must be an engine-relative path`);
-    }
-    if (path.includes('**')) {
-        // A `**` carve-out admits an entire subtree, which is how a reviewed
-        // exception quietly becomes a blanket one. `*` inside a single segment
-        // is enough for the shapes this exists for.
-        throw new ConfigError(`Config field "${field}.path" must not use "**" — a carve-out may glob within one path segment only`);
-    }
-    const reason = raw['reason'];
-    if (typeof reason !== 'string' || reason.trim().length === 0) {
-        // Required on purpose: this is the one audit class FireForge cannot
-        // derive from the tree, so the declaration is the evidence.
-        throw new ConfigError(`Config field "${field}.reason" must be a non-empty string explaining why the file is never packaged`);
-    }
-    return { path, reason };
-}
-/**
- * Parses the `buildAudit` block.
- *
- * @param raw - The raw `buildAudit` value from fireforge.json
- * @returns The validated block
- */
-export function parseBuildAuditConfig(raw) {
-    if (!isObject(raw)) {
-        throw new ConfigError('Config field "buildAudit" must be a plain object');
-    }
-    for (const key of Object.keys(raw)) {
-        if (key !== 'unpackaged') {
-            throw new ConfigError(`Config field "buildAudit" has unknown key "${key}"`);
-        }
-    }
-    const unpackaged = raw['unpackaged'];
-    if (unpackaged === undefined)
-        return {};
-    if (!Array.isArray(unpackaged)) {
-        throw new ConfigError('Config field "buildAudit.unpackaged" must be an array');
-    }
-    const entries = unpackaged.map((entry, index) => parseUnpackagedEntry(entry, `buildAudit.unpackaged[${String(index)}]`));
-    const seen = new Set();
-    for (const entry of entries) {
-        if (seen.has(entry.path)) {
-            // Two rows for one path means one of the two reasons is not the
-            // operative one, and nothing says which.
-            throw new ConfigError(`Config field "buildAudit.unpackaged" declares "${entry.path}" more than once`);
-        }
-        seen.add(entry.path);
-    }
-    return { unpackaged: entries };
-}

package/dist/src/core/config-validate-check.d.ts

@@ -1,8 +0,0 @@
-import { type CheckConfig } from '../types/config.js';
-/**
- * Parses the `check` block.
- *
- * @param raw - The raw `check` value from fireforge.json
- * @returns The validated block
- */
-export declare function parseCheckConfig(raw: unknown): CheckConfig;