@hominis/fireforge 0.55.0 → 0.60.0

package/dist/src/core/run-profile.d.ts

@@ -1,57 +0,0 @@
-/** Directory-name prefix of every FireForge-owned temporary run profile. */
-export declare const RUN_PROFILE_PREFIX = "fireforge-run-profile-";
-/** The profile a run launches with, and how to release it afterwards. */
-export interface RunProfile {
-    /** Program parameters to append to `mach run` (empty for mach's default). */
-    args: string[];
-    /** Absolute profile directory, when one was chosen. */
-    dir?: string;
-    /** Whether FireForge created the directory and will delete it. */
-    temporary: boolean;
-    /** Removes a temporary profile. A no-op otherwise. Never throws. */
-    dispose: () => Promise<void>;
-}
-/** Inputs to {@link resolveRunProfile}. */
-export interface RunProfileRequest {
-    /** `--profile <path>`: launch with this directory, left in place. */
-    profile?: string | undefined;
-    /** `--temp-profile`: launch with a fresh directory removed afterwards. */
-    tempProfile?: boolean | undefined;
-    /**
-     * Whether a named `profile` launches with `-purgecaches` (default `true`).
-     * A UI build does not change the build id the profile's startup cache is
-     * keyed on, so without it a kept profile runs the chrome scripts an
-     * earlier build cached. Temporary profiles start without a cache.
-     */
-    purgeCaches?: boolean | undefined;
-    /**
-     * Whether this is a `--smoke-exit` run. A smoke run with neither flag gets
-     * a temporary profile: the step exists to prove what the build does on a
-     * clean start, and the developer's profile-default carries whatever state
-     * the last session left.
-     */
-    smoke: boolean;
-    /** Base directory for temporary profiles (defaults to the OS tmpdir). */
-    tempRoot?: string | undefined;
-}
-/**
- * Removes every temporary run profile this process still holds. Called by
- * the CLI entry point's signal handler after child shutdown. Never throws.
- */
-export declare function removeActiveRunProfiles(): Promise<void>;
-/**
- * Chooses the profile for a run.
- * @param request - The run's profile flags
- * @returns The profile arguments and their release handle
- */
-export declare function resolveRunProfile(request: RunProfileRequest): Promise<RunProfile>;
-/**
- * Removes temporary run profiles whose owning FireForge process is gone.
- * The `finally` that releases a profile covers a clean exit, a failed run
- * and a forwarded SIGINT/SIGTERM, but not a SIGKILL of FireForge itself;
- * this sweep is the backstop for that case. A directory whose marker is
- * missing or unreadable is left alone: nothing proves it is abandoned.
- * @param tempRoot - Base directory to sweep (defaults to the OS tmpdir)
- * @returns The number of directories removed
- */
-export declare function sweepAbandonedRunProfiles(tempRoot?: string): Promise<number>;

package/dist/src/core/run-profile.js

@@ -1,137 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Profile selection for `fireforge run`.
- *
- * `mach run` on desktop has no `--profile` option of its own: its parser's
- * `--profile/-P` belongs to the Android run parser. On desktop a profile
- * reaches Firefox as a program parameter (`-profile <dir>`), and mach skips
- * creating the objdir's `tmp/profile-default` when it sees one among the
- * params.
- * Mach's `--temp-profile` does mint a fresh directory, but inside the objdir
- * and never removes it, so FireForge owns the temporary profile instead:
- * it creates the directory, seeds the two prefs mach would have written,
- * passes it as `-profile`, and deletes it when the run ends.
- */
-import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import { InvalidArgumentError } from '../errors/base.js';
-import { isProcessAlive, toError } from '../utils/errors.js';
-import { verbose, warn } from '../utils/logger.js';
-/** Directory-name prefix of every FireForge-owned temporary run profile. */
-export const RUN_PROFILE_PREFIX = 'fireforge-run-profile-';
-/** Marker file naming the pid of the FireForge process that owns the profile. */
-const OWNER_MARKER = '.fireforge-run-owner';
-/**
- * The prefs `mach run` writes into the profiles it creates itself. A profile
- * passed with `-profile` gets none of them, and a first-run default-browser
- * prompt would sit in a headed smoke window.
- */
-const SEEDED_USER_JS = 'user_pref("browser.shell.checkDefaultBrowser", false);\n' +
-    'user_pref("browser.aboutConfig.showWarning", false);\n';
-/**
- * Temporary profiles this process created and has not yet removed. The
- * command's own `finally` loses the race to the entry point's signal
- * handler, whose `process.exit` never lets it run, so the handler removes
- * these itself once the browser tree has shut down.
- */
-const activeTemporaryProfiles = new Set();
-async function removeTemporaryProfile(dir) {
-    try {
-        await rm(dir, { recursive: true, force: true });
-        activeTemporaryProfiles.delete(dir);
-    }
-    catch (error) {
-        warn(`Could not remove temporary run profile ${dir}: ${toError(error).message}`);
-    }
-}
-/**
- * Removes every temporary run profile this process still holds. Called by
- * the CLI entry point's signal handler after child shutdown. Never throws.
- */
-export async function removeActiveRunProfiles() {
-    await Promise.all([...activeTemporaryProfiles].map((dir) => removeTemporaryProfile(dir)));
-}
-const NO_PROFILE = {
-    args: [],
-    temporary: false,
-    dispose: () => Promise.resolve(),
-};
-/**
- * Chooses the profile for a run.
- * @param request - The run's profile flags
- * @returns The profile arguments and their release handle
- */
-export async function resolveRunProfile(request) {
-    if (request.profile !== undefined && request.tempProfile === true) {
-        throw new InvalidArgumentError('--profile and --temp-profile are mutually exclusive: name a profile or ask for a fresh one.', 'profile');
-    }
-    if (request.profile !== undefined) {
-        const dir = resolve(request.profile);
-        const purge = request.purgeCaches === false ? [] : ['-purgecaches'];
-        return {
-            args: ['-profile', dir, ...purge],
-            dir,
-            temporary: false,
-            dispose: NO_PROFILE.dispose,
-        };
-    }
-    if (request.tempProfile !== true && !request.smoke) {
-        return NO_PROFILE;
-    }
-    const dir = await mkdtemp(join(request.tempRoot ?? tmpdir(), RUN_PROFILE_PREFIX));
-    activeTemporaryProfiles.add(dir);
-    // The owner marker goes in first, so a FireForge killed past this point
-    // leaves a directory the next run can prove abandoned.
-    await writeFile(join(dir, OWNER_MARKER), `${process.pid}\n`);
-    await writeFile(join(dir, 'user.js'), SEEDED_USER_JS);
-    verbose(`Temporary run profile: ${dir}`);
-    return {
-        args: ['-profile', dir],
-        dir,
-        temporary: true,
-        dispose: () => removeTemporaryProfile(dir),
-    };
-}
-/**
- * Removes temporary run profiles whose owning FireForge process is gone.
- * The `finally` that releases a profile covers a clean exit, a failed run
- * and a forwarded SIGINT/SIGTERM, but not a SIGKILL of FireForge itself;
- * this sweep is the backstop for that case. A directory whose marker is
- * missing or unreadable is left alone: nothing proves it is abandoned.
- * @param tempRoot - Base directory to sweep (defaults to the OS tmpdir)
- * @returns The number of directories removed
- */
-export async function sweepAbandonedRunProfiles(tempRoot = tmpdir()) {
-    let entries;
-    try {
-        entries = await readdir(tempRoot);
-    }
-    catch {
-        return 0;
-    }
-    let removed = 0;
-    for (const entry of entries) {
-        if (!entry.startsWith(RUN_PROFILE_PREFIX))
-            continue;
-        const dir = join(tempRoot, entry);
-        let pid;
-        try {
-            pid = Number.parseInt((await readFile(join(dir, OWNER_MARKER), 'utf8')).trim(), 10);
-        }
-        catch {
-            continue;
-        }
-        if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid || isProcessAlive(pid)) {
-            continue;
-        }
-        try {
-            await rm(dir, { recursive: true, force: true });
-            removed += 1;
-        }
-        catch (error) {
-            verbose(`Could not remove abandoned run profile ${dir}: ${toError(error).message}`);
-        }
-    }
-    return removed;
-}

package/dist/src/core/shared-ftl.d.ts

@@ -1,28 +0,0 @@
-/**
- * Structural rules for the `sharedFtl` field on a custom component.
- *
- * Both the `--shared-ftl` CLI flag path (`furnace create`) and the
- * furnace.json parser apply the same rules. Extracting them here
- * avoids drift between the two entry points and lets the `.mjs`
- * template generator assume the value is safe to interpolate verbatim.
- */
-/**
- * Outcome of {@link validateSharedFtl}. `ok: true` carries the trimmed
- * (operator-safe) value. `ok: false` carries a human-readable message
- * suitable for throwing as a `FurnaceError` or `InvalidArgumentError`.
- */
-export type SharedFtlValidation = {
-    ok: true;
-    value: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/**
- * Validates a candidate `sharedFtl` value. Returns the trimmed value
- * when well-formed, or a structured reason when not. Callers throw the
- * error type appropriate to their context (CLI vs config parser).
- */
-export declare function validateSharedFtl(raw: unknown, context: {
-    localized: boolean;
-}): SharedFtlValidation;

package/dist/src/core/shared-ftl.js

@@ -1,49 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Structural rules for the `sharedFtl` field on a custom component.
- *
- * Both the `--shared-ftl` CLI flag path (`furnace create`) and the
- * furnace.json parser apply the same rules. Extracting them here
- * avoids drift between the two entry points and lets the `.mjs`
- * template generator assume the value is safe to interpolate verbatim.
- */
-/**
- * Characters that must not appear in `sharedFtl`.
- *
- * This is a policy rule about what a sensible FTL path looks like, not the
- * safety boundary for the generated `.mjs`. The scaffold escapes the value at
- * its sink with `JSON.stringify` (`commands/furnace/create-templates.ts`),
- * which is what actually makes interpolation safe, and what covers the two
- * inputs this rule never catches: a `"` and a raw newline.
- *
- * Kept because each remains a real sign of a malformed path:
- *  - `\` is a path-escape we do not want to interpret.
- *  - Backticks and `${` are inert in the current double-quoted sink, but a
- *    template-literal sink is one refactor away and they are not valid in a
- *    chrome:// FTL path regardless.
- */
-const UNSAFE_CHARS = /[`\\]|\$\{/;
-/**
- * Validates a candidate `sharedFtl` value. Returns the trimmed value
- * when well-formed, or a structured reason when not. Callers throw the
- * error type appropriate to their context (CLI vs config parser).
- */
-export function validateSharedFtl(raw, context) {
-    if (typeof raw !== 'string') {
-        return { ok: false, reason: 'must be a string when set' };
-    }
-    const value = raw.trim();
-    if (value.length === 0) {
-        return { ok: false, reason: 'must not be empty' };
-    }
-    if (UNSAFE_CHARS.test(value)) {
-        return {
-            ok: false,
-            reason: 'must not contain backticks, backslashes, or ${ (would break the generated .mjs)',
-        };
-    }
-    if (!context.localized) {
-        return { ok: false, reason: 'requires localized to be true' };
-    }
-    return { ok: true, value };
-}

package/dist/src/core/signal-critical.d.ts

@@ -1,38 +0,0 @@
-/**
- * Signal-deferred critical sections.
- *
- * Commands that perform a compound mutation (e.g. "apply a patch to the
- * engine, then persist progress to a session file on disk") need to finish
- * the pair atomically with respect to SIGINT / SIGTERM. The furnace rollback
- * mechanism is not the right tool here: rebase-style operations intentionally
- * leave the engine mutated and only need the on-disk bookkeeping write to
- * complete before the process exits.
- *
- * `runInSignalCriticalSection(fn)` wraps a short body in a registry slot.
- * While the body runs, the CLI entry point's SIGINT / SIGTERM handlers wait
- * for the slot to clear before calling `process.exit`, so a signal that
- * lands mid-body is held until the body's state write finishes.
- *
- * This module is a pure runtime registry. It installs no signal handlers
- * itself. The bin entry point is responsible for awaiting
- * `waitForActiveCriticalSections` before terminating.
- */
-/**
- * Runs `fn` inside a signal-deferred critical section. The CLI entry point's
- * signal handlers `await` every active section before exiting, so a SIGINT or
- * SIGTERM that arrives during `fn` will hold exit until `fn` returns (or
- * rejects).
- *
- * `fn` should be short. Anything that takes longer than the bounded wait in
- * the bin handler (`SIGNAL_CRITICAL_SECTION_TIMEOUT_MS`) will time out and
- * the handler will exit anyway. The intent is "guard the apply + state
- * persist pair," not "postpone exit indefinitely."
- */
-export declare function runInSignalCriticalSection<T>(label: string, fn: () => Promise<T>): Promise<T>;
-/**
- * Waits for every active critical section to complete or for `timeoutMs` to
- * elapse, whichever comes first. Never rejects: a section that throws still
- * resolves from the registry's perspective because `runInSignalCriticalSection`
- * cleans up in `finally`.
- */
-export declare function waitForActiveCriticalSections(timeoutMs: number): Promise<void>;

package/dist/src/core/signal-critical.js

@@ -1,62 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Signal-deferred critical sections.
- *
- * Commands that perform a compound mutation (e.g. "apply a patch to the
- * engine, then persist progress to a session file on disk") need to finish
- * the pair atomically with respect to SIGINT / SIGTERM. The furnace rollback
- * mechanism is not the right tool here: rebase-style operations intentionally
- * leave the engine mutated and only need the on-disk bookkeeping write to
- * complete before the process exits.
- *
- * `runInSignalCriticalSection(fn)` wraps a short body in a registry slot.
- * While the body runs, the CLI entry point's SIGINT / SIGTERM handlers wait
- * for the slot to clear before calling `process.exit`, so a signal that
- * lands mid-body is held until the body's state write finishes.
- *
- * This module is a pure runtime registry. It installs no signal handlers
- * itself. The bin entry point is responsible for awaiting
- * `waitForActiveCriticalSections` before terminating.
- */
-import { sleep } from '../utils/sleep.js';
-const activeSections = new Set();
-/**
- * Runs `fn` inside a signal-deferred critical section. The CLI entry point's
- * signal handlers `await` every active section before exiting, so a SIGINT or
- * SIGTERM that arrives during `fn` will hold exit until `fn` returns (or
- * rejects).
- *
- * `fn` should be short. Anything that takes longer than the bounded wait in
- * the bin handler (`SIGNAL_CRITICAL_SECTION_TIMEOUT_MS`) will time out and
- * the handler will exit anyway. The intent is "guard the apply + state
- * persist pair," not "postpone exit indefinitely."
- */
-export async function runInSignalCriticalSection(label, fn) {
-    let resolver = () => undefined;
-    const section = {
-        label,
-        promise: new Promise((resolve) => {
-            resolver = resolve;
-        }),
-    };
-    activeSections.add(section);
-    try {
-        return await fn();
-    }
-    finally {
-        activeSections.delete(section);
-        resolver();
-    }
-}
-/**
- * Waits for every active critical section to complete or for `timeoutMs` to
- * elapse, whichever comes first. Never rejects: a section that throws still
- * resolves from the registry's perspective because `runInSignalCriticalSection`
- * cleans up in `finally`.
- */
-export async function waitForActiveCriticalSections(timeoutMs) {
-    if (activeSections.size === 0)
-        return;
-    const snapshot = [...activeSections].map((s) => s.promise);
-    await Promise.race([Promise.allSettled(snapshot).then(() => undefined), sleep(timeoutMs)]);
-}

package/dist/src/core/smoke-patterns.d.ts

@@ -1,81 +0,0 @@
-/**
- * Shared regex library for `fireforge run --smoke-exit`. Used by the smoke
- * runner to decide whether a console line from the real chrome counts as a
- * runtime error. Kept separate from the runner so the patterns can be
- * exercised in isolation and amended without touching process-group logic.
- *
- * Matching is anchored at the start of the line (`^`) on purpose: a runtime
- * error leaves a canonical prefix that Firefox's logging layer prints at
- * column zero. Embedded mentions of the same string inside an unrelated
- * warning (e.g. `"pending JavaScript error cleanup"`) do not start with
- * the prefix and should not trip the scanner.
- */
-/**
- * Returns `true` when `line` matches any pattern in
- * {@link SMOKE_ERROR_PATTERNS}. Does not consult the allowlist. That step
- * lives in {@link matchAllowlist}, so the smoke runner can count
- * allowlisted hits separately from raw error matches for its summary.
- */
-export declare function matchesSmokeError(line: string): boolean;
-/**
- * Returns `true` when `line` is console output from the browser rather than
- * mach's own timestamped log. A blank line is neither.
- */
-export declare function isBrowserConsoleLine(line: string): boolean;
-/**
- * One compiled allowlist entry with its provenance retained so the smoke
- * summary can attribute hits per entry. An entry that silently
- * stops matching (its suppressed shape changed upstream) is only
- * detectable when zero-hit entries are visible.
- */
-export interface CompiledAllowlistEntry {
-    pattern: RegExp;
-    /** Verbatim source text of the entry. */
-    source: string;
-    /** Human-readable origin: `allow.txt:12` or `--console-allow #2`. */
-    origin: string;
-    /**
-     * Ceiling from a `# max-hits: N` directive above the entry: how often the
-     * suppressed cause can physically fire in one boot. More hits than this
-     * is a flood wearing an allowlisted shape, and fails the run.
-     */
-    maxHits?: number;
-}
-/**
- * Returns the index of the FIRST entry in `allow` matching `line`, or -1.
- * First-match attribution is deterministic and cheap. A line matching
- * several entries credits the earliest one. Safe to call with an empty
- * allowlist (always returns -1).
- */
-export declare function matchAllowlist(line: string, allow: readonly CompiledAllowlistEntry[]): number;
-/**
- * Parses a newline-delimited allowlist file body. Lines are trimmed. Blank
- * lines and `#`-prefixed comments are skipped. Each remaining line is
- * compiled as a RegExp with its `<file>:<line>` origin retained. A bad
- * pattern throws immediately: better to fail fast at CLI parse time than
- * to silently let a typo match nothing.
- *
- * A `# max-hits: N` comment sets the ceiling of the entry that follows it
- * (other comment lines may sit between). A blank line or end of file with
- * no entry after the directive is an error rather than a silently dropped
- * cap, since a cap the operator wrote and the run ignored is the exact
- * shape of failure this directive exists to prevent.
- */
-export declare function compileAllowlistFromFile(body: string, sourcePath: string): CompiledAllowlistEntry[];
-/** An allowlist entry that matched more lines than its `# max-hits` ceiling. */
-export interface OverCapAllowlistEntry {
-    entry: CompiledAllowlistEntry;
-    hits: number;
-    maxHits: number;
-}
-/**
- * Entries whose per-entry hit count (every matched line, error-class or
- * not: the `N×` number the attribution block prints and the operator tunes
- * against) exceeds their ceiling. Entries without a ceiling never appear.
- */
-export declare function findOverCapAllowlistEntries(allow: readonly CompiledAllowlistEntry[], hits: readonly number[]): OverCapAllowlistEntry[];
-/**
- * Compiles an array of regex-string inputs (e.g. repeated `--console-allow`
- * flag values). Same fail-fast semantics as {@link compileAllowlistFromFile}.
- */
-export declare function compileAllowlistFromStrings(sources: readonly string[]): CompiledAllowlistEntry[];

package/dist/src/core/smoke-patterns.js

@@ -1,176 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Shared regex library for `fireforge run --smoke-exit`. Used by the smoke
- * runner to decide whether a console line from the real chrome counts as a
- * runtime error. Kept separate from the runner so the patterns can be
- * exercised in isolation and amended without touching process-group logic.
- *
- * Matching is anchored at the start of the line (`^`) on purpose: a runtime
- * error leaves a canonical prefix that Firefox's logging layer prints at
- * column zero. Embedded mentions of the same string inside an unrelated
- * warning (e.g. `"pending JavaScript error cleanup"`) do not start with
- * the prefix and should not trip the scanner.
- */
-/**
- * Line prefixes that signal an actual runtime error in a Firefox chrome
- * process. A hit on any of these patterns is a smoke failure unless the
- * line also matches the caller-supplied allowlist.
- *
- * Additions here should be conservative. False positives turn every
- * smoke run into noise for operators and every CI run into flake.
- */
-import { toError } from '../utils/errors.js';
-const SMOKE_ERROR_PATTERNS = [
-    // Firefox chrome error lines: `JavaScript error: chrome://…, line N: TypeError: …`.
-    /^\s*JavaScript error:/i,
-    // Some log paths prefix browser-console `console.error(...)` with the literal label below.
-    /^\s*console\.error:/i,
-    // Older bracketed-prefix variant still seen in some chrome logs / test runs.
-    /^\s*\[JavaScript (Error|Warning)\]/i,
-    // IPC-layer fatal assertions. Firefox prints `###!!! [Parent] Error: …` on content-process crashes.
-    /^\s*###!!! \[Parent\]/,
-    // A chrome:// or resource:// URL that resolves to nothing. Outside
-    // automation Gecko only PRINTS this (printf_stderr in
-    // `CheckForBrokenChromeURL`, netwerk/base/nsNetUtil.cpp). Under
-    // `xpc::IsInAutomation()` the same condition is a
-    // `MOZ_CRASH_UNSAFE_PRINTF` in whichever process opened the channel. So
-    // the smoke probe, which runs outside automation, sees the printed
-    // line for the same defect that hard-crashes every harness run, and a
-    // probe that exits 0 on it reports "startup is healthy" for a build that
-    // hangs at "Waiting for browser…". Both spellings are matched: the
-    // non-automation singular `URL:` and the automation plural `URLs:`.
-    // Allowlistable through `--console-allow` like any other pattern.
-    /^\s*Missing chrome or resource URLs?:/,
-];
-/**
- * Returns `true` when `line` matches any pattern in
- * {@link SMOKE_ERROR_PATTERNS}. Does not consult the allowlist. That step
- * lives in {@link matchAllowlist}, so the smoke runner can count
- * allowlisted hits separately from raw error matches for its summary.
- */
-export function matchesSmokeError(line) {
-    for (const pattern of SMOKE_ERROR_PATTERNS) {
-        if (pattern.test(line)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Mach's own log lines carry an elapsed-time prefix (` 0:00.42 <message>`),
- * the first of which echoes the browser command line. They prove mach ran,
- * not that the browser printed anything.
- */
-const MACH_LOG_LINE = /^\s*\d+:\d{2}\.\d{2} /;
-/**
- * Returns `true` when `line` is console output from the browser rather than
- * mach's own timestamped log. A blank line is neither.
- */
-export function isBrowserConsoleLine(line) {
-    return line.trim() !== '' && !MACH_LOG_LINE.test(line);
-}
-/** `# max-hits: N` on its own comment line, case-insensitive. */
-const MAX_HITS_DIRECTIVE = /^#\s*max-hits:\s*(\S+)\s*$/i;
-function parseMaxHitsDirective(raw, at) {
-    if (!/^[1-9]\d*$/.test(raw)) {
-        throw new Error(`Invalid allowlist max-hits directive at ${at}: expected a positive integer (got "${raw}")`);
-    }
-    return Number.parseInt(raw, 10);
-}
-/**
- * Returns the index of the FIRST entry in `allow` matching `line`, or -1.
- * First-match attribution is deterministic and cheap. A line matching
- * several entries credits the earliest one. Safe to call with an empty
- * allowlist (always returns -1).
- */
-export function matchAllowlist(line, allow) {
-    return allow.findIndex((entry) => entry.pattern.test(line));
-}
-/**
- * Parses a newline-delimited allowlist file body. Lines are trimmed. Blank
- * lines and `#`-prefixed comments are skipped. Each remaining line is
- * compiled as a RegExp with its `<file>:<line>` origin retained. A bad
- * pattern throws immediately: better to fail fast at CLI parse time than
- * to silently let a typo match nothing.
- *
- * A `# max-hits: N` comment sets the ceiling of the entry that follows it
- * (other comment lines may sit between). A blank line or end of file with
- * no entry after the directive is an error rather than a silently dropped
- * cap, since a cap the operator wrote and the run ignored is the exact
- * shape of failure this directive exists to prevent.
- */
-export function compileAllowlistFromFile(body, sourcePath) {
-    const lines = body.split(/\r?\n/);
-    const compiled = [];
-    let pending;
-    const assertNoOrphanDirective = () => {
-        if (pending) {
-            throw new Error(`Invalid allowlist max-hits directive at ${pending.at}: no entry follows it (the ceiling applies to the next non-comment line)`);
-        }
-    };
-    lines.forEach((raw, index) => {
-        const line = raw.trim();
-        const at = `${sourcePath}:${index + 1}`;
-        if (!line) {
-            assertNoOrphanDirective();
-            return;
-        }
-        if (line.startsWith('#')) {
-            const directive = MAX_HITS_DIRECTIVE.exec(line);
-            if (directive)
-                pending = { maxHits: parseMaxHitsDirective(directive[1] ?? '', at), at };
-            return;
-        }
-        try {
-            compiled.push({
-                pattern: new RegExp(line),
-                source: line,
-                origin: at,
-                ...(pending ? { maxHits: pending.maxHits } : {}),
-            });
-        }
-        catch (error) {
-            const message = toError(error).message;
-            throw new Error(`Invalid allowlist regex at ${at}: ${message}`, { cause: error });
-        }
-        pending = undefined;
-    });
-    assertNoOrphanDirective();
-    return compiled;
-}
-/**
- * Entries whose per-entry hit count (every matched line, error-class or
- * not: the `N×` number the attribution block prints and the operator tunes
- * against) exceeds their ceiling. Entries without a ceiling never appear.
- */
-export function findOverCapAllowlistEntries(allow, hits) {
-    const over = [];
-    allow.forEach((entry, index) => {
-        const count = hits[index] ?? 0;
-        if (entry.maxHits !== undefined && count > entry.maxHits) {
-            over.push({ entry, hits: count, maxHits: entry.maxHits });
-        }
-    });
-    return over;
-}
-/**
- * Compiles an array of regex-string inputs (e.g. repeated `--console-allow`
- * flag values). Same fail-fast semantics as {@link compileAllowlistFromFile}.
- */
-export function compileAllowlistFromStrings(sources) {
-    const compiled = [];
-    sources.forEach((source, index) => {
-        try {
-            compiled.push({
-                pattern: new RegExp(source),
-                source,
-                origin: `--console-allow #${index + 1}`,
-            });
-        }
-        catch (error) {
-            const message = toError(error).message;
-            throw new Error(`Invalid --console-allow regex at position ${index + 1} ("${source}"): ${message}`, { cause: error });
-        }
-    });
-    return compiled;
-}