@hominis/fireforge 0.54.0 → 0.60.0

package/dist/bin/fireforge.js

@@ -1,143 +1,48 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * FireForge CLI entry point, and the only file that may call process.exit().
- * Library code propagates errors via CommandError or FireForgeError instead.
- *
- * The signal pipeline below composes several lifecycle modules. See
- * docs/lifecycle-invariants.md for who owns what.
+ * The process entry, and the only file that ends the process. Everything
+ * else returns an exit code or throws.
  */
-import { installBrokenPipeHandler, main } from '../src/cli.js';
-import { removeActivePgidFile } from '../src/commands/test-harness-teardown.js';
-import { emitKilledVerdict } from '../src/commands/test-verdict.js';
-import { forceReleaseHeldLocksForSignal } from '../src/core/file-lock.js';
-import { forceReleaseFurnaceLocksForActiveOperations, isSignalRollbackInFlight, rollbackActiveOperationsForSignal, } from '../src/core/furnace-operation.js';
-import { restoreActiveNegativeControlsForSignal } from '../src/core/negative-control.js';
-import { closeActiveRunLog } from '../src/core/run-log.js';
-import { removeActiveRunProfiles } from '../src/core/run-profile.js';
-import { waitForActiveCriticalSections } from '../src/core/signal-critical.js';
-import { CommandError } from '../src/errors/base.js';
-import { waitForActiveChildShutdown } from '../src/utils/process.js';
-import { waitForStdioDrain } from '../src/utils/stdio-drain.js';
+import { runProgram } from '../src/cli/program.js';
+import { drainStdio, handleBrokenPipe } from '../src/cli/stdio.js';
+import { program } from '../src/commands/index.js';
+import { installSignalHandlers, isShuttingDown } from '../src/kernel/signals.js';
+import { isInteractive } from '../src/kernel/tty.js';
 /**
- * Upper bound (ms) the signal handler will wait for any in-flight critical
- * section (e.g. rebase apply + session persist) to finish before calling
- * process.exit. Keep short so a stuck I/O operation cannot indefinitely
- * postpone the exit a user requested with Ctrl+C.
- */
-const SIGNAL_CRITICAL_SECTION_TIMEOUT_MS = 5_000;
-/**
- * Upper bound (ms) the signal handler waits for spawned children (Firefox
- * under `run`/`test`, mach under `build`) to shut down after the signal was
- * forwarded to them. Must exceed the largest child grace window
- * (execSmokeRun's killGraceMs default of 10 s) so the SIGTERM → grace →
- * SIGKILL escalation can complete. Exiting earlier orphans hung Firefox
- * trees. A second Ctrl+C escalates to SIGKILL immediately.
- */
-const CHILD_SHUTDOWN_TIMEOUT_MS = 12_000;
-/**
- * Upper bound (ms) a delayed exit waits for stdout/stderr to drain. A pipe
- * is async, so `process.exit()` discards anything queued past the 64 KiB
- * kernel buffer, which is enough to truncate a JSON payload mid-object.
- * Bounded so a stalled reader cannot wedge a failing process. An
- * EPIPE'd/closed pipe releases the wait immediately.
+ * Upper bound on the wait for stdout and stderr before a delayed exit.
+ * `process.exit` discards what a pipe still has queued, so every exit but the
+ * forced one drains first; the bound keeps a stalled reader from wedging it.
  */
 const STDIO_FLUSH_TIMEOUT_MS = 5_000;
-/**
- * Drains stdio, then exits. Every delayed exit routes through here. Only
- * the second-Ctrl+C force-exit (an explicit request to quit at once) and
- * this helper's own call terminate directly.
- */
-function exitAfterStdioFlush(code) {
-    void waitForStdioDrain(STDIO_FLUSH_TIMEOUT_MS).finally(() => {
+function exitAfterFlush(code) {
+    void drainStdio(STDIO_FLUSH_TIMEOUT_MS).finally(() => {
         process.exit(code);
     });
 }
-installBrokenPipeHandler();
+handleBrokenPipe();
 process.on('unhandledRejection', (reason) => {
-    console.error('Fatal error (unhandled rejection):', reason instanceof Error ? reason.message : reason);
-    if (reason instanceof Error && reason.stack) {
-        console.error(reason.stack);
-    }
-    exitAfterStdioFlush(1);
+    console.error('Fatal error (unhandled rejection):', reason);
+    exitAfterFlush(1);
 });
-// SIGINT / SIGTERM run any in-flight furnace rollback before terminating.
-// The library may not call process.exit itself, so the entry point owns both
-// the rollback dispatch and the exit. A no-op when no furnace mutation is
-// registered with the lifecycle wrapper.
-function installFurnaceSignalHandler(signal, exitCode) {
-    process.on(signal, () => {
-        // First, before anything that can stall: a killed test run must leave a
-        // terminal line, or a log tail cannot tell "killed" from "still
-        // running" from "never started". The drain below is bounded but not
-        // instant, and the verdict must survive a drain that times out.
-        // No-op unless a test run was actually in flight.
-        try {
-            emitKilledVerdict(signal);
-        }
-        catch {
-            // A diagnostic must never keep the process from exiting.
-        }
-        if (isSignalRollbackInFlight()) {
-            // A second Ctrl+C while we're already rolling back means the user
-            // wants out now, so let it terminate the process forcefully rather
-            // than queueing another rollback that will race the first.
-            process.exit(exitCode);
-        }
-        // Rollback, critical-section drain, and child shutdown run in parallel.
-        // Draining critical sections (rebase's apply + session persist, registered
-        // via `runInSignalCriticalSection`) keeps the CLI from exiting with a patch
-        // applied to the engine but a stale session file that mis-tracks progress
-        // on `--continue`. Waiting on child shutdown keeps the parent alive through
-        // the SIGTERM → grace → SIGKILL escalation execInherit/execSmokeRun forward
-        // to Firefox/mach. Exiting first orphans those trees.
-        void Promise.allSettled([
-            rollbackActiveOperationsForSignal(signal).catch((error) => {
-                console.error(`Furnace rollback after ${signal} failed:`, error instanceof Error ? error.message : error);
-            }),
-            waitForActiveCriticalSections(SIGNAL_CRITICAL_SECTION_TIMEOUT_MS),
-            waitForActiveChildShutdown(CHILD_SHUTDOWN_TIMEOUT_MS),
-        ])
-            // A `test --negative-control` mutation must be undone while this
-            // process still holds the engine lock, or the next lock holder builds
-            // and tests the neuter. Runs after child shutdown, so the dying
-            // harness no longer reads the files. Never throws.
-            .then(() => restoreActiveNegativeControlsForSignal())
-            // `withFileLock`'s `finally { rm }` never runs across `process.exit`,
-            // so both sweeps exist for the same reason. The generic one covers
-            // every lock this process holds (engine session, patch directory,
-            // build). The furnace one stays because it carries rollback
-            // bookkeeping the generic sweep does not, and runs after it so the
-            // ownership checks see a settled tree.
-            .then(() => forceReleaseHeldLocksForSignal())
-            .then(() => forceReleaseFurnaceLocksForActiveOperations())
-            // The run log's held partial line and queued writes do not survive
-            // `process.exit`. The command's own `finally` that would close it is
-            // racing this handler and usually loses. Best-effort like the log
-            // itself: a diagnostic must never keep the process from exiting.
-            .then(() => closeActiveRunLog().catch(() => undefined))
-            // `--pgid-file` names a group this handler has just signalled; after a
-            // normal exit `testCommand`'s finally removes it, but that finally
-            // loses the race to the exit below. Only a kill FireForge never saw
-            // may leave the file behind.
-            .then(() => removeActivePgidFile().catch(() => undefined))
-            // A `run --temp-profile` (the `--smoke-exit` default) owes the removal
-            // of its profile directory; the command's finally loses this race too.
-            // Runs after child shutdown, so the browser no longer holds the files.
-            .then(() => removeActiveRunProfiles())
-            .finally(() => {
-            exitAfterStdioFlush(exitCode);
-        });
-    });
-}
-installFurnaceSignalHandler('SIGINT', 130);
-installFurnaceSignalHandler('SIGTERM', 143);
-main().catch((error) => {
-    if (error instanceof CommandError) {
-        exitAfterStdioFlush(error.exitCode);
-        return;
-    }
-    // Unexpected: withErrorHandling should have thrown a CommandError.
+// The first SIGINT, SIGTERM or SIGHUP runs the interrupt pipeline (stop children, roll
+// back, release locks) and then exits. A second one exits immediately.
+installSignalHandlers({
+    exit: exitAfterFlush,
+    forceExit: (code) => process.exit(code),
+});
+runProgram(program, {
+    argv: process.argv.slice(2),
+    cwd: process.cwd(),
+    env: process.env,
+    stdout: (text) => process.stdout.write(text),
+    interactive: isInteractive(),
+}).then((code) => {
+    // An interrupted command also ends, usually with an error. The interrupt
+    // pipeline is still undoing and releasing, and the exit is its to make.
+    if (!isShuttingDown())
+        exitAfterFlush(code);
+}, (error) => {
     console.error('Fatal error:', error);
-    exitAfterStdioFlush(1);
+    exitAfterFlush(1);
 });

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "version": "0.54.0",
-  "commit": "2bf7356bab0d77849cb1ab136f0160995dabf41e",
-  "shortCommit": "2bf7356bab0d",
+  "version": "0.60.0",
+  "commit": "c7c36e5d76b12fbae283a4ac975f2ff4b5ffae74",
+  "shortCommit": "c7c36e5d76b1",
   "dirty": false,
   "dirtyHash": null,
-  "buildTime": "2026-10-24T18:17:09.937Z"
+  "buildTime": "2026-11-12T00:37:35.293Z"
 }

package/dist/src/check/check.js

@@ -0,0 +1,394 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * `check`: the composed static check. It runs the built-in steps (status,
+ * verify, lint, typecheck, component validation, design tokens) and the
+ * project's own `check.extraSteps` as one judgement, each step in this
+ * process through the same feature function its own command calls.
+ *
+ * Steps that work in an engine (typecheck, component validation, an extra
+ * step declaring `engine`) share one workspace for the whole check, taken
+ * when the first of them starts. Steps run side by side unless one is
+ * ordered after another.
+ */
+import { join } from 'node:path';
+import { usageError } from '../cli/command.js';
+import { CHECK_STEPS } from '../config/index.js';
+import { loadFurnaceConfig, validateComponents, validationPasses } from '../furnace/index.js';
+import { FireForgeError, toError } from '../kernel/errors.js';
+import { ensureDir, exists, writeFile } from '../kernel/fs.js';
+import { writeJson } from '../kernel/json.js';
+import { run } from '../kernel/process/index.js';
+import { tailLines } from '../kernel/text.js';
+import { formatDuration, mapLimit } from '../kernel/time.js';
+import { lintReportJson, lintVerdict, renderLintReport, runLint } from '../lint/index.js';
+import { deployComponents, lintSubject, ownedChanges, ownedFiles, requireCurrentTyping, status, trackedFiles, typeCacheDir, verify, withOwnedRead, withWorkspaceOnDemand, } from '../mode/index.js';
+import { lintTokens, measureCoverage, tokenSettings } from '../tokens/index.js';
+import { renderTypecheckReport, runTypecheck, typecheckVerdict } from '../typecheck/index.js';
+/** Steps in flight at once. Most are bound by one thread or one disk, so more buys nothing. */
+const CONCURRENCY = 4;
+/** Lines of a failed extra step's output kept in the report. */
+const OUTPUT_TAIL = 30;
+function once(compute) {
+    let value;
+    return () => (value ??= compute());
+}
+const plural = (count, noun) => `${count} ${noun}${count === 1 ? '' : 's'}`;
+async function statusStep({ project, read }) {
+    const report = await read(() => status(project));
+    const { failOn, allow = [] } = project.config.check.status ?? {};
+    const failing = report.pending.filter((problem) => (failOn?.includes(problem.code) ?? true) && !allow.includes(problem.code));
+    if (failing.length === 0) {
+        return { pass: true, detail: `${plural(report.owned.length, 'owned path')}, nothing failing` };
+    }
+    const counts = new Map();
+    for (const problem of failing)
+        counts.set(problem.code, (counts.get(problem.code) ?? 0) + 1);
+    return {
+        pass: false,
+        detail: [...counts].map(([code, count]) => `${count} ${code}`).join(', '),
+        output: failing.map((problem) => `${problem.code}  ${problem.subject === undefined ? '' : `${problem.subject}: `}${problem.message}`),
+    };
+}
+async function verifyStep({ project, read }) {
+    const { problems } = await read(() => verify(project));
+    return {
+        pass: problems.length === 0,
+        detail: problems.length === 0 ? 'sound' : plural(problems.length, 'problem'),
+        output: problems.map((problem) => `${problem.code}  ${problem.subject === undefined ? '' : `${problem.subject}: `}${problem.message}`),
+    };
+}
+async function lintStep({ project, read }) {
+    const subject = await read(() => lintSubject(project, { scope: 'queue' }));
+    const report = await runLint(subject.changes, subject.engine, project.config, {
+        projectRoot: project.root,
+        sequential: subject.sequential,
+        components: subject.components,
+        cacheDir: typeCacheDir(project),
+        ...(subject.tokens === undefined ? {} : { tokens: subject.tokens }),
+    });
+    const verdict = lintVerdict(report, project.config.check.maxWarnings?.lint);
+    const { lintReport } = project.config.check;
+    if (lintReport !== undefined) {
+        await writeJson(join(project.root, lintReport), lintReportJson(report, verdict));
+    }
+    return {
+        pass: verdict.pass,
+        detail: `${plural(verdict.errors, 'error')}, ${plural(verdict.warnings, 'warning')}`,
+        output: verdict.pass ? [] : renderLintReport(report, verdict, false),
+    };
+}
+async function typecheckStep({ project, engine }) {
+    if (project.config.typecheck === undefined) {
+        return { unavailable: 'no "typecheck" block in fireforge.json' };
+    }
+    await requireCurrentTyping(project);
+    const workspace = await engine();
+    const subject = await lintSubject(project, { workspace });
+    const report = await runTypecheck({
+        config: project.config,
+        projectRoot: project.root,
+        engineDir: workspace.engineDir,
+        changes: subject.changes,
+        engine: subject.engine,
+        cacheDir: typeCacheDir(project),
+    });
+    const verdict = typecheckVerdict(report);
+    return {
+        pass: verdict.pass,
+        detail: `${plural(verdict.errors, 'error')}, ${plural(verdict.warnings, 'warning')}`,
+        output: verdict.pass ? [] : renderTypecheckReport(report),
+    };
+}
+async function furnaceStep({ project, engine }) {
+    if (!(await exists(project.paths.furnace)))
+        return { unavailable: 'no furnace.json' };
+    const report = await validateComponents(project, await trackedFiles(project), {
+        workspace: await engine(),
+    });
+    return {
+        pass: validationPasses(report, project.config.check.maxWarnings?.furnace),
+        detail: `${plural(report.judged, 'component')}: ${plural(report.errors, 'error')}, ${plural(report.warnings, 'warning')}`,
+        output: report.findings.map((finding) => `${finding.severity} ${finding.component} [${finding.check}] ${finding.message}`),
+    };
+}
+/** Judges the token file with the project's conventions over the owned stylesheets, held still. */
+async function judgeTokens({ project, read }, judge) {
+    const furnace = (await exists(project.paths.furnace))
+        ? await loadFurnaceConfig(project)
+        : undefined;
+    const settings = tokenSettings(furnace, project.config.binaryName);
+    return read(async () => {
+        const owned = await ownedFiles(project);
+        return (await owned.read(settings.file)) === undefined
+            ? { unavailable: `the project has no token file (${settings.file})` }
+            : judge(owned, settings);
+    });
+}
+function tokenCoverageStep(shared) {
+    return judgeTokens(shared, async (owned, settings) => {
+        const report = await measureCoverage(settings.file, owned, settings);
+        const floor = shared.project.config.check.minTokenCoverage;
+        const pass = floor === undefined || report.percent >= floor;
+        return {
+            pass,
+            detail: `coverage ${report.percent}%${pass ? '' : `, below ${String(floor)}%`}`,
+            output: pass
+                ? []
+                : report.files
+                    .filter((file) => file.rawColors + file.unknownVars > 0)
+                    .map((file) => `${file.file}  raw colors ${file.rawColors} | unknown variables ${file.unknownVars}`),
+        };
+    });
+}
+function tokenLintStep(shared) {
+    return judgeTokens(shared, async (owned, settings) => {
+        const { filesScanned, findings } = await lintTokens(settings.file, owned, settings);
+        return {
+            pass: findings.length === 0,
+            detail: `${plural(findings.length, 'finding')} in ${plural(filesScanned, 'stylesheet')}`,
+            output: findings.map((finding) => `${finding.file}:${finding.line} [${finding.check}] ${finding.message}`),
+        };
+    });
+}
+const BUILTIN = {
+    status: { run: statusStep },
+    verify: { run: verifyStep },
+    lint: { run: lintStep },
+    // Both type passes write one result cache.
+    typecheck: { after: ['lint'], run: typecheckStep },
+    'furnace-validate': { run: furnaceStep },
+    'token-coverage': { run: tokenCoverageStep },
+    'token-lint': { run: tokenLintStep },
+};
+/**
+ * Runs a project command as a step. Its environment names the project root
+ * (`FIREFORGE_PROJECT_ROOT`), a file listing the owned engine paths one per
+ * line (`FIREFORGE_OWNED_PATHS`), the lint step's report when
+ * `check.lintReport` is set (`FIREFORGE_CHECK_LINT_REPORT`), and, for a step
+ * declaring `engine`, the engine directory (`FIREFORGE_ENGINE`).
+ */
+async function extraStep(shared, step) {
+    const { project } = shared;
+    const listing = join(project.paths.stateDir, 'check', 'owned-paths.txt');
+    await ensureDir(join(project.paths.stateDir, 'check'));
+    await writeFile(listing, (await shared.ownedPaths()).map((path) => `${path}\n`).join(''));
+    const { lintReport } = project.config.check;
+    const [program = '', ...args] = step.command;
+    const result = await run(program, args, {
+        cwd: project.root,
+        env: {
+            FIREFORGE_PROJECT_ROOT: project.root,
+            FIREFORGE_OWNED_PATHS: listing,
+            ...(lintReport === undefined
+                ? {}
+                : { FIREFORGE_CHECK_LINT_REPORT: join(project.root, lintReport) }),
+            ...(step.engine ? { FIREFORGE_ENGINE: (await shared.engine()).engineDir } : {}),
+        },
+        timeoutMs: step.timeout * 1000,
+        timeoutIsResult: true,
+        processGroup: true,
+    });
+    const lines = tailLines(`${result.stdout}\n${result.stderr}`.trim(), OUTPUT_TAIL);
+    if (result.timedOut) {
+        return { pass: false, detail: `timed out after ${step.timeout}s`, output: lines };
+    }
+    return result.exitCode === 0
+        ? { pass: true, detail: '' }
+        : { pass: false, detail: `exit ${result.exitCode}`, output: lines };
+}
+/** The steps the invocation selected, and the rows of those it left out by name. */
+function selectSteps(project, shared, options) {
+    const extras = project.config.check.extraSteps ?? [];
+    const all = [
+        ...CHECK_STEPS.map((name) => ({
+            name,
+            kind: 'builtin',
+            after: BUILTIN[name].after ?? [],
+            run: () => BUILTIN[name].run(shared),
+        })),
+        ...extras.map((step) => ({
+            name: step.name,
+            kind: 'extra',
+            after: step.after ?? [],
+            run: () => extraStep(shared, step),
+        })),
+    ];
+    const known = new Set(all.map((step) => step.name));
+    for (const name of [...(options.only ?? []), ...(options.skip ?? [])]) {
+        if (!known.has(name)) {
+            throw usageError(`"${name}" is not a check step`, `Steps: ${[...known].join(', ')}.`);
+        }
+    }
+    const only = options.only ?? [];
+    const candidates = only.length === 0 ? all : all.filter((step) => only.includes(step.name));
+    const configured = project.config.check.skip ?? [];
+    const why = (name) => options.skip?.includes(name) === true
+        ? 'skipped by --skip'
+        : configured.includes(name)
+            ? 'skipped by check.skip in fireforge.json'
+            : undefined;
+    return {
+        steps: candidates.filter((step) => why(step.name) === undefined),
+        excluded: candidates.flatMap((step) => {
+            const detail = why(step.name);
+            return detail === undefined
+                ? []
+                : [
+                    {
+                        name: step.name,
+                        kind: step.kind,
+                        status: 'skipped',
+                        detail,
+                        durationMs: 0,
+                        skipped: 'config',
+                        output: [],
+                    },
+                ];
+        }),
+    };
+}
+async function runStep(step) {
+    const startedAt = Date.now();
+    const base = { name: step.name, kind: step.kind };
+    try {
+        const outcome = await step.run();
+        const durationMs = Date.now() - startedAt;
+        if ('unavailable' in outcome) {
+            return {
+                ...base,
+                status: 'skipped',
+                detail: outcome.unavailable,
+                durationMs,
+                skipped: 'unavailable',
+                output: [],
+            };
+        }
+        return {
+            ...base,
+            status: outcome.pass ? 'pass' : 'fail',
+            detail: outcome.detail,
+            durationMs,
+            output: outcome.pass ? [] : (outcome.output ?? []),
+        };
+    }
+    catch (error) {
+        // A lock that never came says nothing about the project: the check did not run.
+        if (error instanceof FireForgeError && error.code === 'lock-timeout')
+            throw error;
+        const failure = toError(error);
+        const hint = error instanceof FireForgeError ? error.hint : undefined;
+        return {
+            ...base,
+            status: 'fail',
+            detail: failure.message.split('\n')[0] ?? '',
+            durationMs: Date.now() - startedAt,
+            output: [failure.message, ...(hint === undefined ? [] : [hint])],
+        };
+    }
+}
+/** Runs the steps in waves: each wave is every step whose `after` steps have finished. */
+async function runSteps(steps) {
+    const selected = new Set(steps.map((step) => step.name));
+    const finished = new Map();
+    let waiting = [...steps];
+    while (waiting.length > 0) {
+        const ready = waiting.filter((step) => step.after.every((name) => !selected.has(name) || finished.has(name)));
+        const results = await mapLimit(ready, CONCURRENCY, runStep);
+        for (const result of results)
+            finished.set(result.name, result);
+        waiting = waiting.filter((step) => !finished.has(step.name));
+    }
+    return steps.flatMap((step) => finished.get(step.name) ?? []);
+}
+/**
+ * Runs the composed static check.
+ *
+ * @param project - The project
+ * @param options - See {@link CheckOptions}
+ * @returns The report; a red step is a result, not an exception
+ * @throws `invalid-argument` for an unknown step name, `lock-timeout` (exit
+ *   code 15) when the workspace never came free, and in patch mode
+ *   `engine-missing` before `download`
+ */
+export async function runCheck(project, options = {}) {
+    const startedAt = Date.now();
+    const body = async (workspace) => {
+        // A caller holding the workspace (the gate) already keeps the owned changes still.
+        const read = (run) => options.held === undefined
+            ? withOwnedRead(project, { command: 'check', waitMs: options.waitMs }, run)
+            : run();
+        const shared = {
+            project,
+            read,
+            engine: once(async () => {
+                const leased = await workspace();
+                await deployComponents(leased, { waitMs: options.waitMs });
+                return leased;
+            }),
+            ownedPaths: once(async () => (await read(() => ownedChanges(project)))
+                .net()
+                .filter((change) => change.kind !== 'delete')
+                .map((change) => change.path)),
+        };
+        const { steps, excluded } = selectSteps(project, shared, options);
+        const results = [...(await runSteps(steps)), ...excluded];
+        const order = new Map([...CHECK_STEPS, ...(project.config.check.extraSteps ?? []).map((step) => step.name)].map((name, index) => [name, index]));
+        results.sort((a, b) => (order.get(a.name) ?? 0) - (order.get(b.name) ?? 0));
+        const { failOnSkipped } = project.config.check;
+        const failed = results
+            .filter((step) => step.status === 'fail' || (failOnSkipped && step.skipped === 'unavailable'))
+            .map((step) => step.name);
+        return {
+            pass: failed.length === 0,
+            failed,
+            steps: results,
+            durationMs: Date.now() - startedAt,
+        };
+    };
+    const { held } = options;
+    if (held !== undefined)
+        return body(() => Promise.resolve(held));
+    // Every step only reads the engine; one that needs it takes it shared when it starts.
+    return withWorkspaceOnDemand(project, { command: 'check', waitMs: options.waitMs, workspace: options.workspace, write: false }, body);
+}
+/**
+ * The report for a person: one row per step, the output of each failed
+ * step under its row, and a summary line.
+ *
+ * @param report - The report
+ */
+export function renderCheck(report) {
+    const width = Math.max(...report.steps.map((step) => step.name.length), 4);
+    const lines = [];
+    for (const step of report.steps) {
+        const time = step.status === 'skipped' ? '' : formatDuration(step.durationMs);
+        lines.push(`${step.name.padEnd(width)}  ${step.status.padEnd(7)}  ${time.padStart(6)}  ${step.detail}`.trimEnd());
+        for (const line of step.output)
+            lines.push(`    ${line}`);
+    }
+    const count = (state) => report.steps.filter((step) => step.status === state).length;
+    lines.push(`Check ${report.pass ? 'passed' : `failed (${report.failed.join(', ')})`}: ` +
+        `${count('pass')} passed, ${count('fail')} failed, ${count('skipped')} skipped in ${formatDuration(report.durationMs)}.`);
+    return lines;
+}
+/**
+ * The report as the `--json` document of `check`.
+ *
+ * @param report - The report
+ */
+export function checkJson(report) {
+    return {
+        pass: report.pass,
+        failed: report.failed,
+        durationMs: report.durationMs,
+        steps: report.steps.map((step) => ({
+            name: step.name,
+            kind: step.kind,
+            status: step.status,
+            detail: step.detail,
+            durationMs: step.durationMs,
+            skipped: step.skipped ?? null,
+            output: step.output,
+        })),
+    };
+}