@hominis/fireforge 0.55.0 → 0.60.0

package/dist/src/core/state-file.d.ts

@@ -1,60 +0,0 @@
-/** Runs an operation while holding the sidecar lock for a FireForge state file. */
-export declare function withStateFileLock<T>(statePath: string, operation: () => Promise<T>): Promise<T>;
-/**
- * A filesystem-safe, sortable timestamp: `2026-08-28T14-32-05-123Z`.
- *
- * Colons are not portable in filenames (Windows rejects them outright), so
- * the ISO form is punctuated with dashes only. Lexical order still equals
- * chronological order, which is what run-log pruning relies on.
- *
- * @param now - Instant to render
- * @returns The ISO-8601 form with `:` and `.` replaced by `-`
- */
-export declare function fileSafeTimestamp(now: Date): string;
-/** Renames a state file out of the way while preserving it for later inspection. */
-export declare function quarantineStateFile(statePath: string, reason?: string): Promise<string | undefined>;
-/**
- * Outcome of a version check on a persisted FireForge document.
- *
- * The distinction that matters is `newer` vs `corrupt`. A document written
- * by a newer FireForge is not damaged. The operator simply needs to upgrade.
- * A check that collapses the two offers destructive remedies. The
- * sharpest case is the tree marker, whose `schemaVersion` check inside a
- * boolean type guard makes a `schemaVersion: 2` marker read as "missing or
- * mistypes a required field". `tree-guard.ts` is default-deny on corrupt, so
- * a newer FireForge would lock the operator out of every mutating command
- * inside that tree.
- *
- * `furnace.json` is the pattern the rest should follow: it refuses a newer
- * version by name and tells the operator to upgrade (`validateConfigVersion`
- * in `furnace-config.ts`).
- */
-export type DocumentVersionCheck = {
-    kind: 'current';
-} | {
-    kind: 'older';
-    found: number;
-} | {
-    kind: 'newer';
-    found: number;
-} | {
-    kind: 'malformed';
-};
-/**
- * Classifies a persisted document's `version`/`schemaVersion` field.
- *
- * @param raw - The parsed document
- * @param field - Version field name, e.g. `schemaVersion`
- * @param supported - Version this build writes and understands
- * @returns Whether the document is current, older, newer, or malformed
- */
-export declare function checkDocumentVersion(raw: unknown, field: string, supported: number): DocumentVersionCheck;
-/**
- * The refusal shown for a document this build is too old to read.
- *
- * @param label - Operator-facing document name, e.g. `tree marker`
- * @param found - Version found on disk
- * @param supported - Version this build understands
- * @returns A message naming both versions and the remedy
- */
-export declare function describeNewerDocument(label: string, found: number, supported: number): string;

package/dist/src/core/state-file.js

@@ -1,71 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-import { rename } from 'node:fs/promises';
-import { basename } from 'node:path';
-import { pathExists } from '../utils/fs.js';
-import { createSiblingLockPath, withFileLock } from './file-lock.js';
-/** Runs an operation while holding the sidecar lock for a FireForge state file. */
-export async function withStateFileLock(statePath, operation) {
-    return withFileLock(createSiblingLockPath(statePath, '.fireforge-state.lock'), operation, {
-        onTimeoutMessage: `Timed out waiting to update FireForge state at ${statePath}. ` +
-            'If no other fireforge process is running, remove the stale lock directory and retry.',
-        onStaleLockMessage: (ageMs) => `Removing stale FireForge state lock for ${basename(statePath)} ` +
-            `(age: ${Math.round(ageMs / 1000)}s). A previous fireforge process may have crashed.`,
-    });
-}
-/**
- * A filesystem-safe, sortable timestamp: `2026-08-28T14-32-05-123Z`.
- *
- * Colons are not portable in filenames (Windows rejects them outright), so
- * the ISO form is punctuated with dashes only. Lexical order still equals
- * chronological order, which is what run-log pruning relies on.
- *
- * @param now - Instant to render
- * @returns The ISO-8601 form with `:` and `.` replaced by `-`
- */
-export function fileSafeTimestamp(now) {
-    return now.toISOString().replace(/[:.]/g, '-');
-}
-/** Renames a state file out of the way while preserving it for later inspection. */
-export async function quarantineStateFile(statePath, reason = 'corrupt') {
-    if (!(await pathExists(statePath))) {
-        return undefined;
-    }
-    const timestamp = fileSafeTimestamp(new Date());
-    const quarantinedPath = `${statePath}.${reason}-${timestamp}`;
-    await rename(statePath, quarantinedPath);
-    return basename(quarantinedPath);
-}
-/**
- * Classifies a persisted document's `version`/`schemaVersion` field.
- *
- * @param raw - The parsed document
- * @param field - Version field name, e.g. `schemaVersion`
- * @param supported - Version this build writes and understands
- * @returns Whether the document is current, older, newer, or malformed
- */
-export function checkDocumentVersion(raw, field, supported) {
-    if (typeof raw !== 'object' || raw === null)
-        return { kind: 'malformed' };
-    const found = raw[field];
-    if (typeof found !== 'number' || !Number.isInteger(found) || found < 1) {
-        return { kind: 'malformed' };
-    }
-    if (found > supported)
-        return { kind: 'newer', found };
-    if (found < supported)
-        return { kind: 'older', found };
-    return { kind: 'current' };
-}
-/**
- * The refusal shown for a document this build is too old to read.
- *
- * @param label - Operator-facing document name, e.g. `tree marker`
- * @param found - Version found on disk
- * @param supported - Version this build understands
- * @returns A message naming both versions and the remedy
- */
-export function describeNewerDocument(label, found, supported) {
-    return (`the ${label} was written by a newer FireForge (schema version ${found}; ` +
-        `this build understands ${supported}). Upgrade FireForge to read it — the file is ` +
-        'not damaged, so do not delete it.');
-}

package/dist/src/core/status-binary.d.ts

@@ -1,62 +0,0 @@
-/**
- * Binary-aware drift classification for patch-owned files.
- *
- * The text classifier compares utf-8 decoded content against
- * `computePatchedContent`, which cannot apply `GIT binary patch` bodies, so
- * a binary file exported into a patch classifies as `patch-owned-drift`
- * forever, keeping the engine-clean gate permanently red with nothing
- * actually un-durable. A `GIT binary patch` section does carry the ground
- * truth: `git diff --binary` always records full blob hashes on the section's
- * `index <old>..<new>` line. Comparing the live file's `git hash-object`
- * against the last owning section's new-side hash settles the classification
- * exactly. Bodies without a usable hash (hand-written diffs) classify as
- * `binary-unsupported`: an honest "cannot compare" instead of a false "not
- * durable".
- *
- * That hash is trusted only when the section carries a replayable payload
- * (`hasBinaryDelta`). A `Binary files … differ` stub carries a correct index
- * line too, so hashing against it reports `patch-backed` for a body that
- * cannot rebuild the file at all, which is the dishonesty this module
- * exists to avoid. Such a body is `binary-unsupported` here, and an error
- * from the `binary-body-not-reconstructable` queue lint.
- *
- * Lives in its own module (not `status-classify.ts`) so the classifier stays
- * within the per-file line budget and this module never has to import it
- * back: the dependency edge points one way, which keeps dpdm clean.
- */
-import type { PatchedContentContext } from './patch-apply.js';
-/** Batched patch lookup, injected by callers that classify many files. */
-export type AffectingPatchLookup = Pick<PatchedContentContext, 'getAffectingPatches' | 'readPatchBody'> & Partial<Pick<PatchedContentContext, 'liveBlobHash'>>;
-/**
- * Classification result for a binary comparison. Structurally assignable
- * to `ClassifiedFile` without importing it (which would create a cycle
- * with `status-classify.ts`).
- */
-export interface BinaryClassifiedFile {
-    status: string;
-    file: string;
-    classification: 'patch-backed' | 'furnace' | 'patch-owned-drift' | 'binary-unsupported';
-    owner: string;
-}
-/**
- * Classifies a single-owner file whose comparison is binary. Returns
- * `null` when the comparison is not binary (the live file is text and,
- * for deletions, the owning section is text), so the caller falls
- * through to the existing utf-8 content comparison unchanged.
- *
- * @param args.fileMissing - True when the porcelain status reports the
- *   file deleted (there are no live bytes to probe or hash).
- */
-export declare function classifyBinaryOwnedFile(args: {
-    entry: {
-        status: string;
-        file: string;
-    };
-    engineDir: string;
-    patchesDir: string;
-    matchClassification: 'patch-backed' | 'furnace';
-    owner: string;
-    fileMissing?: boolean;
-    /** Batched lookup. When absent, falls back to per-file manifest queries. */
-    lookup?: AffectingPatchLookup;
-}): Promise<BinaryClassifiedFile | null>;

package/dist/src/core/status-binary.js

@@ -1,133 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Binary-aware drift classification for patch-owned files.
- *
- * The text classifier compares utf-8 decoded content against
- * `computePatchedContent`, which cannot apply `GIT binary patch` bodies, so
- * a binary file exported into a patch classifies as `patch-owned-drift`
- * forever, keeping the engine-clean gate permanently red with nothing
- * actually un-durable. A `GIT binary patch` section does carry the ground
- * truth: `git diff --binary` always records full blob hashes on the section's
- * `index <old>..<new>` line. Comparing the live file's `git hash-object`
- * against the last owning section's new-side hash settles the classification
- * exactly. Bodies without a usable hash (hand-written diffs) classify as
- * `binary-unsupported`: an honest "cannot compare" instead of a false "not
- * durable".
- *
- * That hash is trusted only when the section carries a replayable payload
- * (`hasBinaryDelta`). A `Binary files … differ` stub carries a correct index
- * line too, so hashing against it reports `patch-backed` for a body that
- * cannot rebuild the file at all, which is the dishonesty this module
- * exists to avoid. Such a body is `binary-unsupported` here, and an error
- * from the `binary-body-not-reconstructable` queue lint.
- *
- * Lives in its own module (not `status-classify.ts`) so the classifier stays
- * within the per-file line budget and this module never has to import it
- * back: the dependency edge points one way, which keeps dpdm clean.
- */
-import { join } from 'node:path';
-import { toError } from '../utils/errors.js';
-import { readText } from '../utils/fs.js';
-import { verbose } from '../utils/logger.js';
-import { hashObjectBatch, isBinaryFile } from './git-file-ops.js';
-import { findPatchesAffectingFile } from './patch-manifest.js';
-import { parseDiffSections } from './patch-parse.js';
-/** Finds the LAST diff section affecting `file` across the owning patches, in queue order. */
-async function findLastAffectingSection(patchesDir, file, lookup) {
-    // The lookup shares one manifest load + memoized body reads across the
-    // whole classification batch. The fallback keeps single-file callers
-    // (and existing direct tests) working without a context.
-    const patches = lookup !== undefined
-        ? lookup.getAffectingPatches(file)
-        : (await findPatchesAffectingFile(patchesDir, file)).map(({ patch }) => patch);
-    let last;
-    for (const patch of patches) {
-        const body = lookup !== undefined ? await lookup.readPatchBody(patch) : await readText(patch.path);
-        for (const section of parseDiffSections(body)) {
-            if (section.targetPath === file || section.sourcePath === file) {
-                last = section;
-            }
-        }
-    }
-    return last;
-}
-/**
- * Classifies a single-owner file whose comparison is binary. Returns
- * `null` when the comparison is not binary (the live file is text and,
- * for deletions, the owning section is text), so the caller falls
- * through to the existing utf-8 content comparison unchanged.
- *
- * @param args.fileMissing - True when the porcelain status reports the
- *   file deleted (there are no live bytes to probe or hash).
- */
-export async function classifyBinaryOwnedFile(args) {
-    const { entry, engineDir, patchesDir, matchClassification, owner } = args;
-    const fileMissing = args.fileMissing === true;
-    const unsupported = () => ({
-        ...entry,
-        classification: 'binary-unsupported',
-        owner,
-    });
-    // Until the comparison is known to be binary, every failure defers to
-    // the existing text path (`return null`). Classifying a text file as
-    // `binary-unsupported` because a probe failed would hide real drift.
-    let section;
-    try {
-        if (!fileMissing) {
-            const liveBinary = await isBinaryFile(engineDir, entry.file);
-            if (!liveBinary)
-                return null;
-        }
-        section = await findLastAffectingSection(patchesDir, entry.file, args.lookup);
-    }
-    catch (error) {
-        if (fileMissing)
-            return null;
-        verbose(`Classifying ${entry.file} as binary-unsupported because the binary probe failed: ${toError(error).message}`);
-        return unsupported();
-    }
-    try {
-        if (section === undefined) {
-            // Claimed in filesAffected but no diff section touches the file.
-            // A missing file keeps the existing deletion logic. A live binary
-            // has nothing recorded to compare against.
-            return fileMissing ? null : unsupported();
-        }
-        if (!section.isBinary) {
-            // Text section: deletions settle fine through the text path. A
-            // live binary against a text body has no comparable recording.
-            return fileMissing ? null : unsupported();
-        }
-        if (section.isDeletedFile) {
-            return {
-                ...entry,
-                classification: fileMissing ? matchClassification : 'patch-owned-drift',
-                owner,
-            };
-        }
-        if (fileMissing) {
-            // The last binary section expects the file to exist.
-            return { ...entry, classification: 'patch-owned-drift', owner };
-        }
-        if (section.hasBinaryDelta && section.indexNewHash !== undefined) {
-            const fullPath = join(engineDir, entry.file);
-            const live = args.lookup?.liveBlobHash !== undefined
-                ? await args.lookup.liveBlobHash(fullPath)
-                : (await hashObjectBatch(engineDir, [fullPath])).get(fullPath);
-            if (live !== undefined) {
-                // Prefix-compare: recorded hashes may be abbreviated (≥7 chars).
-                const matches = live.startsWith(section.indexNewHash) || section.indexNewHash.startsWith(live);
-                return {
-                    ...entry,
-                    classification: matches ? matchClassification : 'patch-owned-drift',
-                    owner,
-                };
-            }
-        }
-        return unsupported();
-    }
-    catch (error) {
-        verbose(`Classifying ${entry.file} as binary-unsupported because the binary comparison failed: ${toError(error).message}`);
-        return unsupported();
-    }
-}

package/dist/src/core/status-classify.d.ts

@@ -1,96 +0,0 @@
-/**
- * Status classifier: partitions engine file changes into
- * patch-backed / unmanaged / branding / furnace / conflict buckets.
- *
- * Extracted from `src/commands/status.ts` so that command file stays
- * under the per-file line budget as the number of buckets grows.
- */
-/**
- * Classification buckets for engine file changes:
- * - `patch-backed`: content matches the expected post-patch state. Normal
- *   after `fireforge import`.
- * - `patch-owned-drift`: the file is claimed by exactly one patch, but the
- *   live engine content no longer matches that patch's expected post-apply
- *   content. This includes furnace-prefixed paths: a path can be both
- *   Furnace-managed and patch-claimed (export a deployed component, then
- *   edit the workspace source and `furnace deploy` again, and the deployed
- *   copy now has content the patch body lacks). Checking the furnace
- *   prefix first would bucket such files as `furnace` and report the stale
- *   patch as owned.
- * - `unmanaged`: edits not explained by any patch or tool. Local drift to
- *   export or discard.
- * - `branding`: files under tool-managed branding paths, written by
- *   FireForge's branding pipeline.
- * - `furnace`: files under Furnace-managed component prefixes. When exactly
- *   one patch also claims the path, this bucket asserts the live content
- *   matches that patch's expected post-apply content. A mismatch is
- *   reported as `patch-owned-drift` instead (see above).
- * - `conflict`: the file is claimed by two or more patches in
- *   `patches.json`. The human `--ownership` mode surfaces this bucket as
- *   `CONFLICT`. Carrying the classification through the JSON pipeline lets
- *   machine consumers detect the same ownership breakage rather than seeing
- *   it rolled into `unmanaged` as routine local drift.
- * - `binary-unsupported`: the file's comparison is binary and the owning
- *   patch body records no usable blob hash to compare against. It reports an
- *   honest "binary, comparison unsupported" instead of a permanent false
- *   `patch-owned-drift`. Not in the default `--check` fail set. Opt in
- *   with `--fail-on binary-unsupported`.
- */
-export type FileClassification = 'patch-backed' | 'patch-owned-drift' | 'unmanaged' | 'branding' | 'furnace' | 'conflict' | 'binary-unsupported';
-export interface StatusFile {
-    status: string;
-    file: string;
-}
-export interface ClassifiedFile extends StatusFile {
-    classification: FileClassification;
-    /**
-     * Names of patch files that claim this path in `patches.json`.
-     * Populated only when `classification === 'conflict'`. Single-claim
-     * patch-backed entries don't need to expose their owner because the
-     * single claim is fully captured by the classification itself.
-     */
-    claimedBy?: string[];
-    /**
-     * Owning patch filename when exactly one patch claims this path
-     * (patch-backed, patch-owned-drift, and single-owner furnace entries).
-     * Unset for unowned, branding-generated, unowned-furnace, and conflict
-     * entries. Conflicts carry `claimedBy` instead. Exposed through
-     * `status --json` as the `patch` field.
-     */
-    owner?: string;
-}
-/**
- * Builds the file → owning-patch-filenames multimap from manifest rows.
- * Single source of truth for cross-patch claim detection: status
- * classification, verify's cross-claim check, and the ownership table all
- * consume this builder, so they cannot disagree about what "claimed" means.
- */
-export declare function buildPatchClaims(manifestPatches: ReadonlyArray<{
-    filename: string;
-    filesAffected: string[];
-}>): Map<string, string[]>;
-/**
- * Reduces a two-character porcelain XY status to its primary code.
- * Single source of truth, and status-output.ts renders from the same logic.
- */
-export declare function getPrimaryStatusCode(status: string): string;
-/**
- * True for the branding paths whose content FireForge generates itself
- * (configure.sh, brand.properties/ftl, browser/moz.configure). Unlike the
- * broader branding-root test, a brand-new unowned file under the branding
- * directory is not generated: it is a patch candidate and must stay
- * visible as unmanaged (the Assets.car precedent).
- */
-export declare function isGeneratedBrandingPath(file: string, binaryName: string): boolean;
-/**
- * Classifies files into patch-backed, unmanaged, branding, furnace, or
- * conflict buckets.
- *
- * Tracks patch ownership as a `Map<file, patchFilename[]>` rather than a
- * plain `Set<file>` so the classifier can surface cross-patch ownership
- * conflicts the same way the human `--ownership` mode does. With only a Set,
- * `status --json` reports `classification: "unmanaged"` on files that
- * `--ownership` correctly flags as `CONFLICT`, which lies to machine
- * consumers about the nature of the drift.
- */
-export declare function classifyFiles(files: StatusFile[], engineDir: string, patchesDir: string, binaryName: string, furnacePrefixes: Set<string>): Promise<ClassifiedFile[]>;

package/dist/src/core/status-classify.js

@@ -1,244 +0,0 @@
-// SPDX-License-Identifier: EUPL-1.2
-/**
- * Status classifier: partitions engine file changes into
- * patch-backed / unmanaged / branding / furnace / conflict buckets.
- *
- * Extracted from `src/commands/status.ts` so that command file stays
- * under the per-file line budget as the number of buckets grows.
- */
-import { join } from 'node:path';
-import { mapWithConcurrency } from '../utils/concurrency.js';
-import { toError } from '../utils/errors.js';
-import { readText } from '../utils/fs.js';
-import { verbose } from '../utils/logger.js';
-import { normalizePathSlashes } from '../utils/paths.js';
-import { isBrandingManagedPath } from './branding.js';
-import { isBinaryFile } from './git-file-ops.js';
-import { createPatchedContentContext } from './patch-apply.js';
-import { classifyBinaryOwnedFile } from './status-binary.js';
-/**
- * Builds the file → owning-patch-filenames multimap from manifest rows.
- * Single source of truth for cross-patch claim detection: status
- * classification, verify's cross-claim check, and the ownership table all
- * consume this builder, so they cannot disagree about what "claimed" means.
- */
-export function buildPatchClaims(manifestPatches) {
-    const ownersByPath = new Map();
-    for (const patch of manifestPatches) {
-        for (const file of patch.filesAffected) {
-            const existing = ownersByPath.get(file) ?? [];
-            existing.push(patch.filename);
-            ownersByPath.set(file, existing);
-        }
-    }
-    return ownersByPath;
-}
-/**
- * Reduces a two-character porcelain XY status to its primary code.
- * Single source of truth, and status-output.ts renders from the same logic.
- */
-export function getPrimaryStatusCode(status) {
-    if (status.includes('?'))
-        return '?';
-    if (status.includes('!'))
-        return '!';
-    for (const code of status) {
-        if (code !== ' ') {
-            return code;
-        }
-    }
-    return status;
-}
-/**
- * True for the branding paths whose content FireForge generates itself
- * (configure.sh, brand.properties/ftl, browser/moz.configure). Unlike the
- * broader branding-root test, a brand-new unowned file under the branding
- * directory is not generated: it is a patch candidate and must stay
- * visible as unmanaged (the Assets.car precedent).
- */
-export function isGeneratedBrandingPath(file, binaryName) {
-    const normalized = normalizePathSlashes(file);
-    const brandingRoot = `browser/branding/${binaryName}`;
-    return (normalized === 'browser/moz.configure' ||
-        normalized === `${brandingRoot}/configure.sh` ||
-        normalized === `${brandingRoot}/locales/en-US/brand.properties` ||
-        normalized === `${brandingRoot}/locales/en-US/brand.ftl`);
-}
-/**
- * Compares a single-owner file's live engine content against its owning
- * patch's expected post-apply content. `matchClassification` is what a
- * clean match reports: `patch-backed` for ordinary patch-claimed paths,
- * `furnace` for furnace-prefixed paths so healthy deployed components
- * keep landing in the pinned furnace bucket. Any mismatch (including a
- * deletion the patch does not expect, or a failed comparison) reports
- * `patch-owned-drift`.
- */
-async function classifySingleOwnerFile(entry, engineDir, patchesDir, matchClassification, owner, ctx) {
-    // Binary comparisons cannot go through the utf-8 content path below.
-    // Binary patch bodies parse to zero hunks, so the patched-content
-    // computation returned HEAD content unchanged and the comparison
-    // reported `patch-owned-drift` forever. Settle by blob hash,
-    // or classify explicitly as `binary-unsupported` when no hash exists.
-    const binaryResult = await classifyBinaryOwnedFile({
-        entry,
-        engineDir,
-        patchesDir,
-        matchClassification,
-        owner,
-        fileMissing: getPrimaryStatusCode(entry.status) === 'D',
-        lookup: ctx,
-    });
-    if (binaryResult !== null) {
-        return binaryResult;
-    }
-    if (getPrimaryStatusCode(entry.status) === 'D') {
-        // Deleted file: content matches only if the patch expects deletion
-        const expected = await ctx.computePatched(entry.file);
-        return {
-            ...entry,
-            classification: expected === null ? matchClassification : 'patch-owned-drift',
-            owner,
-        };
-    }
-    // File exists on disk: compare actual vs expected
-    try {
-        const [expected, actual] = await Promise.all([
-            ctx.computePatched(entry.file),
-            readText(join(engineDir, entry.file)),
-        ]);
-        return {
-            ...entry,
-            classification: actual === expected ? matchClassification : 'patch-owned-drift',
-            owner,
-        };
-    }
-    catch (error) {
-        verbose(`Treating ${entry.file} as patch-owned drift because patch-backed classification failed: ${toError(error).message}`);
-        return { ...entry, classification: 'patch-owned-drift', owner };
-    }
-}
-/**
- * Classifies files into patch-backed, unmanaged, branding, furnace, or
- * conflict buckets.
- *
- * Tracks patch ownership as a `Map<file, patchFilename[]>` rather than a
- * plain `Set<file>` so the classifier can surface cross-patch ownership
- * conflicts the same way the human `--ownership` mode does. With only a Set,
- * `status --json` reports `classification: "unmanaged"` on files that
- * `--ownership` correctly flags as `CONFLICT`, which lies to machine
- * consumers about the nature of the drift.
- */
-export async function classifyFiles(files, engineDir, patchesDir, binaryName, furnacePrefixes) {
-    // One manifest load + patch discovery + memoized body reads for the
-    // whole batch. The previous per-file computation re-ran all three for
-    // every dirty file (O(dirtyFiles × patches) redundant IO on a broad
-    // engine edit session).
-    const ctx = await createPatchedContentContext(patchesDir, engineDir);
-    // Build a multimap from file path → list of claiming patch filenames so
-    // cross-patch ownership conflicts are detectable. A plain `Set<string>`
-    // captures only whether a path was claimed, not by whom, and collapses
-    // multi-owner files into the single-owner branch where the
-    // expected-vs-actual content comparison then routes them into `unmanaged`
-    // when the content matches neither owner's expectation.
-    const patchClaims = buildPatchClaims(ctx.manifestPatches);
-    await prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx);
-    const deps = {
-        engineDir,
-        patchesDir,
-        binaryName,
-        furnacePrefixes,
-        patchClaims,
-        ctx,
-    };
-    // Bounded pool over per-file classification. Order preserved by the mapper. Per-file failures settle
-    // inside classifySingleOwnerFile's catch, so one bad file never rejects
-    // the batch.
-    return mapWithConcurrency(files, CLASSIFY_CONCURRENCY, (entry) => classifyEntry(entry, deps));
-}
-/**
- * Fetches, in two git processes, what the per-file comparison would
- * otherwise spawn git for file by file: the HEAD content of every
- * single-owner path (one `cat-file --batch`) and the live blob hash of every
- * one that is binary on disk (one `hash-object` per ARG_MAX chunk). On a
- * 1,600-file Firefox scan that was ~1,550 `git show` and `hash-object`
- * spawns. Fetching for a path the classifier ends up routing elsewhere
- * (a branding path, say) costs a few bytes, never a wrong answer.
- */
-async function prefetchSingleOwnerContent(files, engineDir, patchClaims, ctx) {
-    const singleOwner = files.filter((entry) => patchClaims.get(entry.file)?.length === 1);
-    if (singleOwner.length === 0)
-        return;
-    await ctx.prefetchBase(singleOwner.map((entry) => entry.file));
-    const present = singleOwner.filter((entry) => getPrimaryStatusCode(entry.status) !== 'D');
-    const binary = await mapWithConcurrency(present, CLASSIFY_CONCURRENCY, async (entry) => {
-        try {
-            return (await isBinaryFile(engineDir, entry.file)) ? join(engineDir, entry.file) : undefined;
-        }
-        catch {
-            // The per-file path probes again and settles the failure itself.
-            return undefined;
-        }
-    });
-    await ctx.prefetchLiveBlobHashes(binary.filter((path) => path !== undefined));
-}
-/** Concurrency bound for per-file classification (matches import's guard). */
-const CLASSIFY_CONCURRENCY = 8;
-/** Classifies one status entry. Extracted so the pool worker stays flat. */
-async function classifyEntry(entry, deps) {
-    const { engineDir, patchesDir, binaryName, furnacePrefixes, patchClaims, ctx } = deps;
-    const owners = patchClaims.get(entry.file);
-    const primaryCode = getPrimaryStatusCode(entry.status);
-    // Ownership is a structural invariant and takes precedence over the
-    // content-management bucket. Otherwise a branding/Furnace prefix hides a
-    // multi-patch claim from status --check/--json even though --ownership
-    // reports the same path as CONFLICT.
-    if (owners && owners.length >= 2) {
-        return {
-            ...entry,
-            classification: 'conflict',
-            claimedBy: [...owners],
-        };
-    }
-    // Branding paths are tool-managed for generated edits, but a brand-new
-    // unowned branding asset must not disappear from `status --unmanaged`:
-    // classifying every branding path before checking ownership hides a new
-    // patch candidate (an Assets.car appearing under the active branding tree,
-    // for instance) as "branding" even though no patch claims it yet.
-    const isUnownedNewFile = owners === undefined && (primaryCode === '?' || primaryCode === 'A');
-    if (isBrandingManagedPath(entry.file, binaryName) &&
-        (!isUnownedNewFile || isGeneratedBrandingPath(entry.file, binaryName))) {
-        return { ...entry, classification: 'branding' };
-    }
-    // Furnace-managed component paths
-    if (furnacePrefixes.size > 0) {
-        let isFurnace = false;
-        for (const prefix of furnacePrefixes) {
-            if (entry.file.startsWith(prefix)) {
-                isFurnace = true;
-                break;
-            }
-        }
-        if (isFurnace) {
-            // A furnace path claimed by exactly one patch gets the same
-            // expected-vs-actual comparison as any other single-owner path: after
-            // a `furnace deploy` of an edited component the deployed copy has
-            // content the owning patch's body lacks, and an unconditional
-            // short-circuit here would silently bucket that drift as `furnace`.
-            // Multi-owner and unowned furnace paths keep the short-circuit.
-            if (owners && owners.length === 1 && owners[0] !== undefined) {
-                return classifySingleOwnerFile(entry, engineDir, patchesDir, 'furnace', owners[0], ctx);
-            }
-            return { ...entry, classification: 'furnace' };
-        }
-    }
-    // Not in any patch → unmanaged
-    if (!owners) {
-        return { ...entry, classification: 'unmanaged' };
-    }
-    // File is claimed by exactly one patch: compare content.
-    const owner = owners[0];
-    if (owner === undefined) {
-        return { ...entry, classification: 'unmanaged' };
-    }
-    return classifySingleOwnerFile(entry, engineDir, patchesDir, 'patch-backed', owner, ctx);
-}