@hominis/fireforge 0.54.0 → 0.60.0

package/dist/src/lint/shim.js

@@ -0,0 +1,323 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * The declarations both type passes add to every program: Firefox's
+ * privileged globals, Lit, and the test harness.
+ *
+ * Firefox JavaScript runs in scopes TypeScript does not know, so the shim
+ * declares the common globals, mostly as `any`. Structured globals
+ * (`ChromeUtils`, `Cu`, `Localization`) are declared through named
+ * interfaces (`ChromeUtilsShim`, `CuShim`, ...) so a project shim adds
+ * members by interface merging; `Cu` has a closed member list
+ * (`nsIXPCComponents_Utils`), so calling a member it lacks is an error.
+ * `resource:` and `chrome:` imports no file resolves fall to ambient
+ * wildcard modules and type as `any`.
+ */
+/** Firefox's privileged globals. */
+export const FIREFOX_GLOBALS_SHIM = `
+declare var Services: any;
+// Extensible via interface merging from a project shim.
+interface ChromeUtilsShim {
+  defineESModuleGetters(target: any, modules: Record<string, string>): void;
+  importESModule(specifier: string): any;
+  import(specifier: string): any;
+  registerWindowActor(name: string, options: Record<string, any>): void;
+  defineModuleGetter(target: any, name: string, specifier: string): void;
+  defineLazyGetter(target: any, name: string, getter: () => any): void;
+  generateQI(interfaces: any[]): Function;
+  getClassName(obj: any, unwrap?: boolean): string;
+  isClassInfo(obj: any): boolean;
+  // Two WebIDL overloads (URI string or nsIURI) collapsed into one loose signature.
+  predictRemoteTypeForURI(uri: string | object | null, options?: object): string | null;
+}
+declare var ChromeUtils: ChromeUtilsShim;
+// Components.utils (js/xpconnect/idl/xpccomponents.idl, nsIXPCComponents_Utils).
+// Every member is listed with loose (any) jsval parameters and
+// results, so Xray-waived and cloned objects keep their expandos, but the
+// member set is closed: a call to a member Cu does not have (Cu.now() is
+// ChromeUtils.now()) is a typecheck error instead of a runtime TypeError.
+// Extensible via interface merging, same as ChromeUtilsShim.
+interface CuShim {
+  QueryInterface(iid: any): any;
+  printStderr(message: string): void;
+  reportError(error: any, stack?: any): void;
+  readonly Sandbox: { new (principal: any, options?: any): any; (principal: any, options?: any): any };
+  evalInSandbox(
+    source: string,
+    sandbox: any,
+    version?: any,
+    filename?: string,
+    lineNo?: number,
+    enforceFilenameRestrictions?: boolean
+  ): any;
+  getUAWidgetScope(principal: any): any;
+  getSandboxMetadata(sandbox: any): any;
+  setSandboxMetadata(sandbox: any, metadata: any): void;
+  setSandboxLocaleOverride(sandbox: any, locale: string): void;
+  setSandboxTimezoneOverride(sandbox: any, timezone: string): void;
+  isESModuleLoaded(resourceURI: string): boolean;
+  importGlobalProperties(propertyList: any): void;
+  getWeakReference(obj: any): { get(): any };
+  forceGC(): void;
+  forceCC(listener?: any): void;
+  createCCLogger(): any;
+  finishCC(): void;
+  ccSlice(budget: number): void;
+  getMaxCCSliceTimeSinceClear(): number;
+  clearMaxCCTime(): void;
+  forceShrinkingGC(): void;
+  schedulePreciseGC(callback: any): void;
+  schedulePreciseShrinkingGC(callback: any): void;
+  unlinkGhostWindows(): void;
+  intentionallyLeak(): void;
+  getJSTestingFunctions(): any;
+  getFunctionSourceLocation(func: any): any;
+  callFunctionWithAsyncStack(func: any, stack: any, asyncCause: string): any;
+  getGlobalForObject(obj: any): any;
+  isProxy(obj: any): boolean;
+  exportFunction(func: any, scope: any, options?: any): any;
+  createObjectIn(scope: any, options?: any): any;
+  makeObjectPropsNormal(obj: any): void;
+  isDeadWrapper(obj: any): boolean;
+  isRemoteProxy(val: any): boolean;
+  recomputeWrappers(obj?: any): void;
+  setWantXrays(scope: any): void;
+  dispatch(runnable: any, scope?: any): void;
+  readonly isInAutomation: boolean;
+  exitIfInAutomation(): void;
+  crashIfNotInAutomation(): void;
+  setGCZeal(zeal: number): void;
+  nukeSandbox(obj: any): void;
+  blockScriptForGlobal(global: any): void;
+  unblockScriptForGlobal(global: any): void;
+  isOpaqueWrapper(obj: any): boolean;
+  isXrayWrapper(obj: any): boolean;
+  waiveXrays(val: any): any;
+  unwaiveXrays(val: any): any;
+  getClassName(obj: any, unwrap: boolean): string;
+  getIncumbentGlobal(callback?: any): any;
+  getDebugName(obj: any): string;
+  getWatchdogTimestamp(category: string): number;
+  getJSEngineTelemetryValue(): any;
+  cloneInto(value: any, scope: any, options?: any): any;
+  getWebIDLCallerPrincipal(): any;
+  getObjectPrincipal(obj: any): any;
+  getRealmLocation(obj: any): string;
+  readUTF8File(file: any): string;
+  readUTF8URI(url: any): string;
+  createSpellChecker(): any;
+  createCommandLine(args: string[], workingDir: any, state: number): any;
+  createCommandParams(): any;
+  createLoadContext(): any;
+  createPrivateLoadContext(): any;
+  createPersistentProperties(): any;
+  createDocumentEncoder(contentType: string): any;
+  createHTMLCopyEncoder(): any;
+  readonly loadedESModules: string[];
+  getModuleImportStack(location: string): string;
+}
+declare var Cu: CuShim;
+declare var Ci: any;
+declare var Cc: any;
+declare var Cr: any;
+declare var Components: any;
+declare var XPCOMUtils: any;
+declare var lazy: Record<string, any>;
+declare var PathUtils: any;
+declare var IOUtils: any;
+declare var FileUtils: any;
+declare var gBrowser: any;
+declare var gURLBar: any;
+declare var gNavigatorBundle: any;
+declare var AppConstants: any;
+declare class JSWindowActorChild {
+  readonly browsingContext: any;
+  readonly contentWindow: any;
+  readonly document: any;
+  sendAsyncMessage(name: string, data?: any, transfers?: any[]): void;
+  sendQuery(name: string, data?: any, transfers?: any[]): Promise<any>;
+}
+declare class JSWindowActorParent {
+  readonly browsingContext: any;
+  sendAsyncMessage(name: string, data?: any, transfers?: any[]): void;
+  sendQuery(name: string, data?: any, transfers?: any[]): Promise<any>;
+}
+// Fluent localization, a stable chrome global. Members stay loose (any),
+// but the constructor shape is declared so "new Localization([...])" and
+// "new Localization([...], true)" typecheck without a local cast. Both
+// interfaces are extensible via interface merging from a project extra
+// shim, same as ChromeUtilsShim.
+interface LocalizationInstanceShim {
+  formatValue(id: string, args?: Record<string, unknown>): any;
+  formatValues(keys: any[]): any;
+  formatMessages(keys: any[]): any;
+  formatValueSync(id: string, args?: Record<string, unknown>): any;
+  formatValuesSync(keys: any[]): any;
+  formatMessagesSync(keys: any[]): any;
+  addResourceIds(ids: Array<string | { path: string; optional?: boolean }>): void;
+  removeResourceIds(ids: string[]): number;
+  setAsync(): void;
+}
+interface LocalizationShim {
+  new (
+    resourceIds: Array<string | { path: string; optional?: boolean }>,
+    sync?: boolean
+  ): LocalizationInstanceShim;
+}
+declare var Localization: LocalizationShim;
+
+// Shorthand ambient modules: imports of URLs no file resolves are typed any.
+declare module 'resource:*';
+declare module 'chrome:*';
+
+`;
+/**
+ * Loose test-harness globals (mochitest browser-chrome, xpcshell), appended
+ * after the project's test shim, whose typed declarations come first and win.
+ */
+export const TEST_HARNESS_SHIM = `
+// ── FireForge test-harness shim (loose baseline) ──
+declare var TestUtils: any;
+declare var BrowserTestUtils: any;
+declare var SpecialPowers: any;
+declare var EventUtils: any;
+declare var SimpleTest: any;
+declare var Assert: any;
+declare var gTestPath: string;
+declare var content: any;
+declare function add_task(task: (...args: any[]) => any): any;
+declare function add_setup(task: (...args: any[]) => any): any;
+declare function ok(condition: any, message?: string): void;
+declare function is(actual: any, expected: any, message?: string): void;
+declare function isnot(actual: any, expected: any, message?: string): void;
+declare function todo(condition: any, message?: string): void;
+declare function todo_is(actual: any, expected: any, message?: string): void;
+declare function todo_isnot(actual: any, expected: any, message?: string): void;
+declare function info(message: string): void;
+declare function registerCleanupFunction(callback: (...args: any[]) => any): void;
+declare function waitForExplicitFinish(): void;
+declare function finish(): void;
+declare function do_get_profile(): any;
+declare function run_test(): any;
+
+`;
+/**
+ * Typed Lit: `LitElement` (with `ReactiveElement`'s lifecycle) and
+ * `MozLitElement` with closed member lists, so a misspelt member of a widget
+ * is an error; template helpers stay loose. A widget casts its base to the
+ * global `MozLitElementWith<Extra>` to declare the getters `static queries`
+ * installs. A project shim can merge members into `LitElementShimMembers`.
+ */
+export const LIT_TYPES_SHIM = `
+// ── FireForge typed Lit (litTypes) ──
+interface LitPropertyDeclarationShim {
+  type?: unknown;
+  attribute?: boolean | string;
+  reflect?: boolean;
+  state?: boolean;
+  noAccessor?: boolean;
+  converter?: unknown;
+  hasChanged?(value: unknown, oldValue: unknown): boolean;
+  fluent?: boolean;
+}
+interface LitElementShimMembers {
+  readonly renderRoot: HTMLElement | DocumentFragment;
+  readonly isUpdatePending: boolean;
+  readonly hasUpdated: boolean;
+  readonly updateComplete: Promise<boolean>;
+  renderOptions: any;
+  requestUpdate(name?: PropertyKey, oldValue?: unknown, options?: LitPropertyDeclarationShim): void;
+  addController(controller: any): void;
+  removeController(controller: any): void;
+  connectedCallback(): void;
+  disconnectedCallback(): void;
+  attributeChangedCallback(name: string, oldValue: string | null, value: string | null): void;
+  createRenderRoot(): HTMLElement | DocumentFragment;
+  enableUpdating(requestedUpdate: boolean): void;
+  scheduleUpdate(): void | Promise<unknown>;
+  performUpdate(): void;
+  getUpdateComplete(): Promise<boolean>;
+  shouldUpdate(changedProperties: Map<PropertyKey, unknown>): boolean;
+  willUpdate(changedProperties: Map<PropertyKey, unknown>): void;
+  update(changedProperties: Map<PropertyKey, unknown>): void;
+  render(): unknown;
+  firstUpdated(changedProperties: Map<PropertyKey, unknown>): void;
+  updated(changedProperties: Map<PropertyKey, unknown>): void;
+}
+declare module 'chrome://global/content/vendor/lit.all.mjs' {
+  export class ReactiveElement extends HTMLElement {
+    static properties: Record<string, LitPropertyDeclarationShim>;
+    static styles: any;
+    static shadowRootOptions: ShadowRootInit;
+    static get observedAttributes(): string[];
+    static createProperty(name: PropertyKey, options?: LitPropertyDeclarationShim): void;
+    static addInitializer(initializer: (element: ReactiveElement) => void): void;
+  }
+  export interface ReactiveElement extends LitElementShimMembers {}
+  export class LitElement extends ReactiveElement {}
+  export const html: (strings: TemplateStringsArray, ...values: unknown[]) => any;
+  export const svg: (strings: TemplateStringsArray, ...values: unknown[]) => any;
+  export const css: (strings: TemplateStringsArray, ...values: unknown[]) => any;
+  export const nothing: any;
+  export const noChange: any;
+  export const render: any;
+  export const unsafeCSS: any;
+  export const classMap: any;
+  export const styleMap: any;
+  export const ifDefined: any;
+  export const repeat: any;
+  export const when: any;
+  export const map: any;
+  export const live: any;
+  export const ref: any;
+  export const createRef: any;
+  export const until: any;
+  export const guard: any;
+  export const choose: any;
+  export const keyed: any;
+  export const cache: any;
+  export const join: any;
+  export const range: any;
+  export const unsafeHTML: any;
+  export const unsafeSVG: any;
+  export const literal: any;
+  export const unsafeStatic: any;
+  export const staticHtml: any;
+  export const staticSvg: any;
+  export const directive: any;
+  export const Directive: any;
+  export const AsyncDirective: any;
+  export const PartType: any;
+  export const defaultConverter: any;
+  export const notEqual: any;
+  export const adoptStyles: any;
+  export const supportsAdoptingStyleSheets: boolean;
+  export const CSSResult: any;
+  export const isServer: boolean;
+}
+declare module 'chrome://global/content/lit-utils.mjs' {
+  import { LitElement } from 'chrome://global/content/vendor/lit.all.mjs';
+  export class MozLitElement extends LitElement {
+    static queries: Record<string, string | Record<string, unknown>>;
+    static fragment: unknown;
+    dispatchOnUpdateComplete(event: Event): Promise<void>;
+  }
+  export const MozBaseInputElement: any;
+  export const MozBoolInputElement: any;
+  export const SelectControlBaseElement: any;
+  export const SelectControlItemMixin: any;
+}
+// MozLitElement with instance members Extra: what a widget casts its base
+// to for the getters static queries installs (and properties it declares
+// only in static properties). A class field would redefine a query getter
+// and throw, and a constructor declaration reads it before renderRoot.
+type MozLitElementWith<Extra> = Pick<
+  typeof import('chrome://global/content/lit-utils.mjs').MozLitElement,
+  keyof typeof import('chrome://global/content/lit-utils.mjs').MozLitElement
+> &
+  (new () => import('chrome://global/content/lit-utils.mjs').MozLitElement & Extra);
+`;
+/** Without typed Lit, `MozLitElementWith<Extra>` is `any`, as the base it casts is. */
+export const LOOSE_LIT_SHIM = `
+// FireForge loose Lit (litTypes off).
+type MozLitElementWith<Extra> = any;
+`;

package/dist/src/lint/typescript.js

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * The TypeScript compiler API as both type passes use it: loading it, the
+ * Firefox-globals shim, and which diagnostics count. Owned-file checkJs and
+ * the whole-project typecheck share all of it, so a file cannot pass one and
+ * fail the other for a reason the operator could not see.
+ */
+import { dirname, resolve } from 'node:path';
+import { ExitCode, FireForgeError } from '../kernel/errors.js';
+import { readTextIfExists } from '../kernel/fs.js';
+import { hash } from '../kernel/hash.js';
+import { FIREFOX_GLOBALS_SHIM, LIT_TYPES_SHIM, LOOSE_LIT_SHIM, TEST_HARNESS_SHIM } from './shim.js';
+/**
+ * Packages tried for the compiler API, in order. TypeScript 7's `typescript`
+ * ships no compiler API; a project on it installs `@typescript/typescript6`
+ * beside it, or aliases `typescript` to that package.
+ */
+const API_PACKAGES = ['typescript', '@typescript/typescript6'];
+const load = (name) => import(name);
+function isApi(candidate) {
+    return (typeof candidate === 'object' &&
+        candidate !== null &&
+        'createProgram' in candidate &&
+        typeof candidate.createProgram === 'function');
+}
+/**
+ * Loads the compiler API: `typescript` when it carries it, else
+ * `@typescript/typescript6`, resolved from where FireForge is installed (the
+ * project's own dependencies).
+ *
+ * @throws FireForgeError `typescript-missing` when neither package carries it
+ */
+export async function loadTypeScript() {
+    for (const name of API_PACKAGES) {
+        let loaded;
+        try {
+            loaded = await load(name);
+        }
+        catch {
+            continue;
+        }
+        const candidate = isApi(loaded)
+            ? loaded
+            : typeof loaded === 'object' && loaded !== null && 'default' in loaded
+                ? loaded.default
+                : undefined;
+        if (isApi(candidate))
+            return candidate;
+    }
+    throw new FireForgeError('typescript-missing', 'No installed package carries the TypeScript compiler API.', {
+        exitCode: ExitCode.MISSING_DEPENDENCY,
+        hint: 'Install "typescript" 6 or older in the project, or with TypeScript 7 also "@typescript/typescript6".',
+    });
+}
+const REFERENCE = /^\s*\/\/\/\s*<reference\s+path\s*=\s*["']([^"']+)["']\s*\/?>\s*$/;
+/**
+ * Inlines `/// <reference path>` directives, recursively and once each: the
+ * shim is served at a synthetic path, against which a relative reference
+ * would resolve to nothing.
+ */
+async function inlineReferences(source, directory, seen) {
+    const out = [];
+    for (const line of source.split('\n')) {
+        const target = REFERENCE.exec(line)?.[1];
+        if (target === undefined) {
+            out.push(line);
+            continue;
+        }
+        const absolute = resolve(directory, target);
+        if (seen.has(absolute))
+            continue;
+        seen.add(absolute);
+        const text = await readTextIfExists(absolute);
+        out.push(text === undefined
+            ? `// (fireforge: unresolved /// <reference path="${target}">)`
+            : await inlineReferences(text, dirname(absolute), seen));
+    }
+    return out.join('\n');
+}
+/**
+ * Composes the shim: the built-in Firefox globals, typed or loose Lit, the
+ * project's `.d.ts` (which can merge members into the shim's interfaces),
+ * then for tests the loose harness globals, which a typed declaration in the
+ * project shim precedes and so wins over.
+ *
+ * @param projectRoot - Absolute project root
+ * @param projectShim - Project-relative `.d.ts`, if configured
+ * @param options - See {@link ShimOptions}
+ * @throws FireForgeError `typescript-shim-missing` when the project shim does not exist
+ */
+export async function composeShim(projectRoot, projectShim, options) {
+    const parts = [FIREFOX_GLOBALS_SHIM, options.litTypes ? LIT_TYPES_SHIM : LOOSE_LIT_SHIM];
+    if (projectShim !== undefined) {
+        const absolute = resolve(projectRoot, projectShim);
+        const text = await readTextIfExists(absolute);
+        if (text === undefined) {
+            throw new FireForgeError('typescript-shim-missing', `The TypeScript shim ${projectShim} does not exist.`, {
+                exitCode: ExitCode.CONFIG_ERROR,
+                hint: 'Create the file or correct its path in fireforge.json.',
+            });
+        }
+        parts.push(`// project shim: ${projectShim}`, await inlineReferences(text, dirname(absolute), new Set([absolute])));
+    }
+    if (options.testHarness === true)
+        parts.push(TEST_HARNESS_SHIM);
+    const source = parts.join('\n');
+    return { fileName: `__fireforge_globals_${hash(source).slice(0, 12)}.d.ts`, source };
+}
+/**
+ * Codes that are noise when Firefox JavaScript is checked outside its build:
+ * `resource://` and `chrome://` URLs do not resolve, and the shim is narrow.
+ * TS2305 and TS2306 still count on a specifier that resolved to a real file.
+ */
+const SUPPRESSED_CODES = new Set([2307, 2306, 2305, 2792, 2580, 7016]);
+/** Undefined free identifiers, reported at the configured severity. */
+const UNDEFINED_IDENTIFIER_CODES = new Set([2304, 2552]);
+/** Codes that count when their import's specifier resolved to a real file. */
+const RESOLVED_MEMBER_CODES = new Set([2305, 2306]);
+const UNDEFINED_IDENTIFIER_HINT = '(undefined identifier: import or declare it, add the global to the project shim, or tune ' +
+    '"undefinedIdentifiers")';
+function importSpecifierAt(ts, file, position) {
+    const statement = file.statements.find((candidate) => position >= candidate.getStart(file) && position < candidate.end);
+    if (statement === undefined)
+        return undefined;
+    if (!ts.isImportDeclaration(statement) && !ts.isExportDeclaration(statement))
+        return undefined;
+    const specifier = statement.moduleSpecifier;
+    return specifier !== undefined && ts.isStringLiteralLike(specifier) ? specifier.text : undefined;
+}
+/**
+ * Judges one diagnostic: dropped when it is resolution or shim noise (a
+ * missing export of a module that did resolve still counts) or an undefined
+ * identifier under `off`; otherwise its severity and flattened message.
+ *
+ * @param ts - The compiler API
+ * @param diagnostic - The diagnostic
+ * @param policy - Undefined-identifier severity, and whether a specifier
+ *   imported from a file resolved to a real file
+ */
+export function judgeDiagnostic(ts, diagnostic, policy) {
+    const { code, file, start } = diagnostic;
+    if (SUPPRESSED_CODES.has(code)) {
+        const specifier = RESOLVED_MEMBER_CODES.has(code) && file !== undefined && start !== undefined
+            ? importSpecifierAt(ts, file, start)
+            : undefined;
+        if (specifier === undefined ||
+            file === undefined ||
+            !policy.isResolved(file.fileName, specifier)) {
+            return undefined;
+        }
+    }
+    const message = ts.flattenDiagnosticMessageText(diagnostic.messageText, '\n');
+    if (UNDEFINED_IDENTIFIER_CODES.has(code)) {
+        if (policy.undefinedIdentifiers === 'off')
+            return undefined;
+        return {
+            severity: policy.undefinedIdentifiers,
+            message: `${message} ${UNDEFINED_IDENTIFIER_HINT}`,
+            code,
+        };
+    }
+    const severity = diagnostic.category === ts.DiagnosticCategory.Error ? 'error' : 'warning';
+    return { severity, message, code };
+}
+/**
+ * Wraps a compiler host so `lib.dom.d.ts` declares Gecko's cross-compartment
+ * `isInstance` predicate on every DOM constructor, and
+ * `MouseEvent.MOZ_SOURCE_PEN`.
+ *
+ * @param ts - The compiler API
+ * @param host - The host to wrap
+ */
+export function withGeckoDomTypes(ts, host) {
+    const original = host.getSourceFile.bind(host);
+    return {
+        ...host,
+        getSourceFile(fileName, languageVersion, ...rest) {
+            const file = original(fileName, languageVersion, ...rest);
+            if (file === undefined || !fileName.endsWith('/lib.dom.d.ts'))
+                return file;
+            const source = file.text.replace(/declare var (\w+): \{\s*prototype: (\w+);/g, (declaration, name, instance) => `${declaration}\n    isInstance(value: unknown): value is ${instance};` +
+                (name === 'MouseEvent' ? '\n    readonly MOZ_SOURCE_PEN: number;' : ''));
+            return ts.createSourceFile(fileName, source, languageVersion, true);
+        },
+    };
+}

package/dist/src/lint/waivers.js

@@ -0,0 +1,93 @@
+function ceilingOf(entries, finding) {
+    const ceilings = entries.filter((entry) => typeof entry !== 'string' && entry.rule === finding.rule);
+    return (ceilings.find((entry) => entry.share !== undefined && entry.share === finding.share) ??
+        ceilings.find((entry) => entry.share === undefined));
+}
+function exceededText(ceiling) {
+    const share = ceiling.share === undefined ? '' : ` (${ceiling.share} share)`;
+    return `This exceeds the lintIgnore ceiling for ${ceiling.rule}${share} (max ${ceiling.max}: ${ceiling.reason}).`;
+}
+/** The groups whose waivers apply to a finding. */
+function governingGroups(changes, finding) {
+    const groups = new Set();
+    if (finding.group !== undefined)
+        groups.add(finding.group);
+    if (finding.path !== undefined) {
+        for (const step of changes.at(finding.path))
+            if (step.group !== undefined)
+                groups.add(step.group);
+    }
+    return [...groups];
+}
+function judge(changes, finding) {
+    let exceeded;
+    for (const id of governingGroups(changes, finding)) {
+        const entries = changes.group(id)?.lintIgnore ?? [];
+        if (entries.includes(finding.rule))
+            return { suppressed: true, finding };
+        const ceiling = ceilingOf(entries, finding);
+        if (ceiling === undefined)
+            continue;
+        if (finding.measurement !== undefined && finding.measurement <= ceiling.max) {
+            return { suppressed: true, finding };
+        }
+        exceeded ??= ceiling;
+    }
+    if (exceeded === undefined || finding.severity === 'notice')
+        return { suppressed: false, finding };
+    return {
+        suppressed: false,
+        finding: { ...finding, message: `${finding.message} ${exceededText(exceeded)}` },
+    };
+}
+function status(group, entry, findings) {
+    const rule = typeof entry === 'string' ? entry : entry.rule;
+    const share = typeof entry === 'string' ? undefined : entry.share;
+    const max = typeof entry === 'string' ? null : entry.max;
+    const relevant = findings.filter((finding) => finding.rule === rule && (share === undefined || finding.share === share));
+    const measured = relevant.flatMap((finding) => finding.measurement === undefined ? [] : [finding.measurement]);
+    const gating = relevant.filter((finding) => finding.severity !== 'notice');
+    const exceeded = max !== null &&
+        gating.some((finding) => finding.measurement !== undefined && finding.measurement > max);
+    return {
+        group,
+        rule,
+        max,
+        reason: typeof entry === 'string' ? null : entry.reason,
+        ...(share === undefined ? {} : { share }),
+        measurement: measured.length > 0 ? Math.max(...measured) : null,
+        state: exceeded ? 'exceeded' : gating.length > 0 ? 'within' : 'removable',
+    };
+}
+/**
+ * Splits findings into those that surface and those a waiver drops, and
+ * judges every waiver of every group against them. A ceiling that no
+ * longer changes an outcome adds a `lint-ignore-removable` notice.
+ *
+ * @param changes - The owned changes, whose groups carry the waivers
+ * @param findings - Every finding of the run
+ */
+export function applyWaivers(changes, findings) {
+    const kept = [];
+    const suppressed = [];
+    for (const finding of findings) {
+        const outcome = judge(changes, finding);
+        (outcome.suppressed ? suppressed : kept).push(outcome.finding);
+    }
+    const waivers = changes.groups.flatMap((group) => {
+        const own = findings.filter((finding) => governingGroups(changes, finding).includes(group.id));
+        return (group.lintIgnore ?? []).map((entry) => status(group.id, entry, own));
+    });
+    for (const waiver of waivers) {
+        if (waiver.max === null || waiver.state !== 'removable')
+            continue;
+        kept.push({
+            rule: 'lint-ignore-removable',
+            severity: 'notice',
+            group: waiver.group,
+            message: `The lintIgnore ceiling for ${waiver.rule} (max ${waiver.max}${waiver.share === undefined ? '' : `, ${waiver.share} share`}) ` +
+                `is no longer needed: the rule reports nothing at warning or error on ${waiver.group}. Remove it.`,
+        });
+    }
+    return { kept, suppressed, waivers };
+}