@hominis/fireforge 0.55.0 → 0.60.0

package/dist/src/config/schema/firefox.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: EUPL-1.2
+/** `firefox`: the pin, which Firefox release the project builds on. */
+import { s } from '../../kernel/schema.js';
+/** The Mozilla products a project can pin. */
+export const FIREFOX_PRODUCTS = [
+    'firefox',
+    'firefox-esr',
+    'firefox-beta',
+    'firefox-devedition',
+];
+/**
+ * Why a version cannot be released as a product, or undefined when they pair:
+ * an ESR product takes an `esr` version, beta and Developer Edition take a
+ * beta version, and the stable product takes neither.
+ *
+ * @param version - Such as `153.4.0esr` or `147.0b1`
+ * @param product - One of {@link FIREFOX_PRODUCTS}
+ */
+function productVersionProblem(version, product) {
+    const esr = /esr$/i.test(version);
+    const beta = /b\d+$/.test(version);
+    if (product === 'firefox-esr' && !esr) {
+        return `must pair product firefox-esr with an ESR version such as 128.0esr (got "${version}")`;
+    }
+    if ((product === 'firefox-beta' || product === 'firefox-devedition') && !beta) {
+        return `must pair product ${product} with a beta version such as 147.0b1 (got "${version}")`;
+    }
+    if (product === 'firefox' && (esr || beta)) {
+        const instead = esr ? 'firefox-esr' : 'firefox-beta';
+        return `must use product ${instead} for version "${version}"; product firefox takes release versions only`;
+    }
+    return undefined;
+}
+/**
+ * The product a version is released as, by its shape: an `esr` version is
+ * ESR, a beta version is the beta product, anything else the stable one.
+ *
+ * @param version - Such as `153.4.0esr` or `147.0b1`
+ */
+export function inferFirefoxProduct(version) {
+    if (/esr$/i.test(version))
+        return 'firefox-esr';
+    return /b\d+$/.test(version) ? 'firefox-beta' : 'firefox';
+}
+/** The `firefox` section. */
+export const firefoxSection = s
+    .object({
+    version: s
+        .string({
+        pattern: /^[1-9]\d{0,2}\.\d+(?:b[1-9]\d*|\.\d+(?:esr)?|esr)?$/,
+        format: 'a Firefox version such as 153.4.0esr or 147.0b1',
+    })
+        .describe('Firefox release to build on, such as 153.4.0esr'),
+    product: s.enum(FIREFOX_PRODUCTS).describe('Mozilla product the version belongs to'),
+    sha256: s
+        .string({ pattern: /^[a-f0-9]{64}$/, format: 'a lowercase 64-character SHA-256 digest' })
+        .describe('Pinned digest of the source archive; wins over the published SHA256SUMS')
+        .optional(),
+    allowUnverifiedDownload: s
+        .boolean()
+        .describe('Accept a download whose published digest cannot be fetched, trusting TLS alone; ignored when sha256 is set')
+        .default(false),
+    candidate: s
+        .string({ pattern: /^build[1-9]\d{0,3}$/, format: 'a candidate directory such as build2' })
+        .describe('Release-candidate build directory, for pre-release verification')
+        .optional(),
+})
+    .refine(({ version, product }) => productVersionProblem(version, product))
+    .describe('The Firefox release the project builds on');

package/dist/src/config/schema/gate.js

@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * `gate`: what `fireforge gate` runs on a clean committed tree besides
+ * `check`: a build, declared test lanes, repeated lanes, negative controls,
+ * smoke starts of the browser, and the decisions only a person can make. A
+ * lane is data, not a shell line, so its environment, arguments and
+ * validator are closed.
+ */
+import { s } from '../../kernel/schema.js';
+import { enginePath, positive, projectPath, text, uniqueBy } from './common.js';
+/** Stands for the step's private output directory in a declared value. */
+export const ARTIFACTS_PLACEHOLDER = '{artifacts}';
+const ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+/** Whether a value names a path outside the workspace: absolute, home-relative or climbing out. */
+function escapesWorkspace(value) {
+    return (value.startsWith('/') ||
+        value.startsWith('~') ||
+        /=\//.test(value) ||
+        /(^|[=\\/])\.\.([\\/]|$)/.test(value));
+}
+/**
+ * Environment names a declaration never sets: each selects code the run
+ * executes, changes how a tool or the build reads, or is owned by FireForge.
+ */
+const RESERVED_ENV_PREFIXES = [
+    'FIREFORGE_',
+    'NODE_',
+    'NPM_',
+    'TSX_',
+    'JITI_',
+    'MOZ_',
+    'MOZBUILD_',
+    'MACH',
+    'GIT_',
+    'PYTHON',
+    'PIP_',
+    'UV_',
+    'VIRTUAL_ENV',
+    'CONDA_',
+    'DYLD_',
+    'LD_',
+    'MALLOC',
+    'CARGO',
+    'RUST',
+    'SCCACHE_',
+    'CCACHE_',
+    'XDG_',
+    'LC_',
+    'SSH_',
+];
+const RESERVED_ENV_NAMES = new Set([
+    ...['PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'PWD', 'OLDPWD', 'IFS', 'ENV', 'BASH_ENV'],
+    ...['CDPATH', 'TMPDIR', 'TMP', 'TEMP', 'LANG', 'LANGUAGE', 'TZ', 'TERM', 'DISPLAY'],
+    ...['WAYLAND_DISPLAY', 'DBUS_SESSION_BUS_ADDRESS', 'MOZCONFIG', 'NODEJS', 'CBINDGEN'],
+    ...['CC', 'CXX', 'CPP', 'AR', 'AS', 'LD', 'NM', 'STRIP', 'RANLIB', 'OBJCOPY', 'DSYMUTIL'],
+    ...['CFLAGS', 'CXXFLAGS', 'CPPFLAGS', 'LDFLAGS', 'HOST_CC', 'HOST_CXX', 'HOST_AR'],
+    ...['CLANG_PATH', 'LIBCLANG_PATH', 'WASI_SYSROOT', 'MACOS_SDK_DIR', 'WASM_CC', 'WASM_CXX'],
+    'ONNX_RUNTIME',
+]);
+function environmentProblem(env) {
+    for (const [name, value] of Object.entries(env)) {
+        if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(name)) {
+            return `names ${name}: names are upper case letters, digits and _`;
+        }
+        if (RESERVED_ENV_NAMES.has(name) || RESERVED_ENV_PREFIXES.some((p) => name.startsWith(p))) {
+            const hint = name === 'MOZ_UPLOAD_DIR' ? '; set uploadDir instead' : '';
+            return `sets ${name}, which FireForge owns${hint}`;
+        }
+        if (value.length > 4096 || /[\0\r\n]/.test(value)) {
+            return `sets ${name} to more than one line of at most 4096 characters`;
+        }
+        const inArtifacts = value === ARTIFACTS_PLACEHOLDER || value.startsWith(`${ARTIFACTS_PLACEHOLDER}/`);
+        const path = inArtifacts ? value.slice(ARTIFACTS_PLACEHOLDER.length + 1) : value;
+        if (path.includes(ARTIFACTS_PLACEHOLDER) || escapesWorkspace(path)) {
+            return `sets ${name} to a path outside the run: use a workspace-relative path or start it with ${ARTIFACTS_PLACEHOLDER}`;
+        }
+    }
+    return undefined;
+}
+const environment = s
+    .record(s.string())
+    .refine(environmentProblem)
+    .describe(`Environment of the harness; a value starting ${ARTIFACTS_PLACEHOLDER} names a path in the run's output directory`);
+const validator = s
+    .object({
+    command: s
+        .array(s.string({ pattern: /^[^\0]+$/, format: 'a non-empty argument' }), { min: 1 })
+        .describe(`Argument vector: node <script> or a committed script; ${ARTIFACTS_PLACEHOLDER} expands`),
+})
+    .refine(({ command }) => {
+    const [program = '', script] = command;
+    if (command.some((arg) => escapesWorkspace(arg.replaceAll(ARTIFACTS_PLACEHOLDER, 'out')))) {
+        return `must name no path outside the workspace; use a relative path or ${ARTIFACTS_PLACEHOLDER}`;
+    }
+    if (program !== 'node' && !program.includes('/')) {
+        return 'must run node or a committed script by its path, not a program name';
+    }
+    return program === 'node' && (script === undefined || script.startsWith('-'))
+        ? 'must run node on a committed script: node <script> [arguments]'
+        : undefined;
+})
+    .describe('Judges what the harness produced, after it exits clean; nonzero reads red');
+/** The one form of mach argument a lane holds: a pref whose value names no path. */
+const machArgument = s
+    .string({
+    pattern: /^--setpref=[A-Za-z][A-Za-z0-9_.-]*=[A-Za-z0-9_.:+,@%-]*$/,
+    format: '--setpref=<name>=<value> with a value that names no path',
+})
+    .refine((arg) => arg.startsWith('--setpref=marionette.') ? 'must not set a marionette.* pref' : undefined);
+const id = s.string({ pattern: ID_PATTERN, format: 'a lowercase ID such as "tiles"' });
+const tests = s.array(enginePath, { min: 1 });
+const laneKeys = {
+    id: id.describe('Lane ID'),
+    files: tests.describe('Engine-relative globs or literal paths of the tests the lane runs'),
+    exclude: tests.describe('Tests left out of files').optional(),
+    dispatch: s
+        .enum(['shards', 'one-browser', 'standalone'])
+        .describe('A browser per file, one browser for all, or a restart between files')
+        .default('shards'),
+    headed: s.boolean().describe('Runs with a visible window, holding the display').default(false),
+    env: environment.optional(),
+    uploadDir: s
+        .boolean()
+        .describe("Gives the harness a MOZ_UPLOAD_DIR in the run's output directory")
+        .default(false),
+    machArgs: s.array(machArgument, { min: 1 }).describe('Mach --setpref arguments').optional(),
+    validate: validator.optional(),
+};
+const laneSchema = s.object(laneKeys);
+const stressSchema = s.object({
+    ...laneKeys,
+    repeat: positive.describe('How many times the lane runs; every repeat must pass'),
+});
+const controlSchema = s.object({
+    id: id.describe('Control ID'),
+    diff: projectPath.describe('Committed diff holding the mutation'),
+    test: enginePath.describe('Engine-relative test that must catch it'),
+    assertions: s
+        .array(text, { min: 1 })
+        .describe('Labels of the reds it must produce, every one and no other'),
+});
+const runSchema = s.object({
+    id: id.describe('Run ID'),
+    smokeExit: positive.describe('Seconds the console is watched before the browser is ended'),
+    headless: s.boolean().describe('Starts without a window').default(false),
+    args: s.array(text, { min: 1 }).describe('Arguments for the browser').optional(),
+    consoleAllowFile: projectPath
+        .describe('Committed file of console line patterns the smoke start accepts')
+        .optional(),
+    validate: validator.optional(),
+});
+const acceptanceSchema = s.object({
+    id: id.describe('Acceptance ID'),
+    reason: text.describe('What the person decides'),
+    evidence: s
+        .array(s.string({ pattern: /^(lane|stress|control|run):/, format: 'kind:id, such as lane:captures' }))
+        .describe('Declared lanes, stress runs, controls or runs whose outputs the person looks at')
+        .optional(),
+});
+const byId = (schema, noun) => s.array(schema).refine(uniqueBy((entry) => entry.id, `${noun} ID`));
+const gateObject = s.object({
+    build: s
+        .enum(['ui', 'full'])
+        .describe('The build the gate runs; a workspace that needs a full build gets one either way')
+        .default('ui'),
+    documents: s
+        .array(text, { min: 1 })
+        .describe('Globs of repository paths that change nothing the gate tests (a pattern without a slash matches a file name at any depth): a commit touching only these needs check alone')
+        .optional(),
+    lanes: byId(laneSchema, 'lane').describe('Groups of tests run as declared').optional(),
+    stress: byId(stressSchema, 'stress').describe('Lanes run repeatedly').optional(),
+    controls: byId(controlSchema, 'control')
+        .describe('Expected reds: a mutation each test must catch')
+        .optional(),
+    runs: byId(runSchema, 'run').describe('Smoke starts of the built browser').optional(),
+    acceptance: byId(acceptanceSchema, 'acceptance')
+        .describe('Decisions only a person can make, recorded by gate accept')
+        .optional(),
+});
+/** An acceptance can only stand on something the gate declares and runs. */
+function evidenceProblem(gate) {
+    const declared = new Set([
+        ...(gate.lanes ?? []).map(({ id }) => `lane:${id}`),
+        ...(gate.stress ?? []).map(({ id }) => `stress:${id}`),
+        ...(gate.controls ?? []).map(({ id }) => `control:${id}`),
+        ...(gate.runs ?? []).map(({ id }) => `run:${id}`),
+    ]);
+    for (const entry of gate.acceptance ?? []) {
+        const missing = (entry.evidence ?? []).find((id) => !declared.has(id));
+        if (missing !== undefined) {
+            return `has acceptance "${entry.id}" naming ${missing}, which the gate does not declare`;
+        }
+    }
+    return undefined;
+}
+/** The `gate` section. */
+export const gateSection = gateObject
+    .refine(evidenceProblem)
+    .describe('What fireforge gate runs besides check');

package/dist/src/config/schema/identity.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * The browser's identity: the root keys that name, brand and license it.
+ * The generated mozconfig is shell-evaluated, so the free-text fields refuse
+ * control characters and the executable name is restricted to what cannot
+ * carry shell syntax.
+ */
+import { s } from '../../kernel/schema.js';
+/** SPDX identifiers a project can be licensed under. */
+export const PROJECT_LICENSES = ['EUPL-1.2', 'MPL-2.0', '0BSD', 'GPL-2.0-or-later'];
+/** The license of a project that names none, and the one `setup` proposes. */
+export const DEFAULT_LICENSE = 'EUPL-1.2';
+const PRINTABLE = /^\P{Cc}*[^\s\p{Cc}]\P{Cc}*$/u;
+/** The identity keys, spread into the root of the schema. */
+export const identityKeys = {
+    name: s
+        .string({ pattern: PRINTABLE, format: 'a non-empty name without control characters' })
+        .describe('Display name of the browser'),
+    vendor: s
+        .string({ pattern: PRINTABLE, format: 'a non-empty name without control characters' })
+        .describe('Vendor or company name'),
+    appId: s
+        .string({
+        pattern: /^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/,
+        format: 'a reverse-domain identifier such as "org.example.browser"',
+    })
+        .describe('Application ID in reverse-domain form'),
+    binaryName: s
+        .string({
+        pattern: /^[a-z][a-z0-9-]*$/,
+        format: 'a lowercase letter followed by lowercase letters, digits and hyphens',
+    })
+        .describe('Executable name of the built browser'),
+    license: s
+        .enum(PROJECT_LICENSES)
+        .describe('SPDX identifier of the project license')
+        .default(DEFAULT_LICENSE),
+    markerComment: s
+        .string({
+        pattern: /^(?!\s)(?!.*\*\/)\P{Cc}*[^\s\p{Cc}]$/u,
+        format: 'a one-line marker without surrounding whitespace or "*/"',
+    })
+        .describe('Marker appended as a comment to lines FireForge writes into upstream files, such as "MYBROWSER"')
+        .optional(),
+};
+/**
+ * The marker word on the lines FireForge and the fork write into upstream
+ * files, such as `MYBROWSER` (lines carry it as `// MYBROWSER:`):
+ * `markerComment` when set, else the binary name in upper case.
+ *
+ * @param config - The project configuration
+ */
+export function markerComment(config) {
+    return config.markerComment ?? config.binaryName.toUpperCase();
+}

package/dist/src/config/schema/index.js

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * The `fireforge.json` schema: the sum of the sections, each declared in its
+ * own file by the feature it configures. A section whose keys are all
+ * optional is filled with its defaults when absent, so a reader never tests
+ * for the block before reading a key.
+ */
+import { s } from '../../kernel/schema.js';
+import { buildAuditSection, buildSection } from './build.js';
+import { checkSection } from './check.js';
+import { exportQueueSection } from './export-queue.js';
+import { firefoxSection } from './firefox.js';
+import { gateSection } from './gate.js';
+import { identityKeys } from './identity.js';
+import { patchLintSection } from './lint.js';
+import { patchPolicySection } from './policy.js';
+import { modeKey, modeProblem, sourceSection } from './source.js';
+import { testSection } from './test.js';
+import { toolchainsSection } from './toolchains.js';
+import { typecheckSection } from './typecheck.js';
+import { wireSection } from './wire.js';
+/** A section that is filled with its own defaults when absent. */
+function filled(section) {
+    return section.default(section.parse({}));
+}
+/** The whole of `fireforge.json`. */
+export const configSchema = s
+    .object({
+    ...identityKeys,
+    mode: modeKey,
+    source: sourceSection.optional(),
+    firefox: firefoxSection,
+    build: buildSection.optional(),
+    buildAudit: buildAuditSection.optional(),
+    test: filled(testSection),
+    patchLint: filled(patchLintSection),
+    patchPolicy: patchPolicySection.optional(),
+    typecheck: typecheckSection.optional(),
+    check: filled(checkSection),
+    gate: gateSection.optional(),
+    exportQueue: filled(exportQueueSection),
+    externalToolchains: toolchainsSection.optional(),
+    wire: filled(wireSection),
+})
+    .refine(modeProblem);

package/dist/src/config/schema/lint.js

@@ -0,0 +1,297 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * `patchLint`: the quality rules over owned changes. The size thresholds and
+ * their defaults live here so that validation can check an override against
+ * the thresholds it actually produces, and the rules read the same table.
+ */
+import { s } from '../../kernel/schema.js';
+import { positive, projectPath, severity, text } from './common.js';
+/** `file-too-large` line counts per file class. */
+const FILE_SIZE_DEFAULTS = {
+    general: { notice: 500, warning: 750, error: 900 },
+    test: { notice: 1200, warning: 1400, error: 1600 },
+};
+/**
+ * `large-patch-lines` per tier. Branding is calibrated against a fresh-fork
+ * branding change (every locale's brand strings, copied assets), which lands
+ * around 15-16k lines and must read as a notice.
+ */
+const PATCH_LINE_DEFAULTS = {
+    general: { notice: 800, warning: 1500, error: 3000 },
+    test: { notice: 1500, warning: 3000, error: 6000 },
+    branding: { notice: 8000, warning: 18000, error: 30000 },
+};
+/**
+ * `large-patch-files` warning per tier. File count expresses scope, so there
+ * is no notice or error band unless one is configured.
+ */
+const PATCH_FILES_WARNING_DEFAULTS = { general: 5, test: 5, branding: 60 };
+/**
+ * The effective `file-too-large` bands of a file class: the override merged
+ * over the defaults.
+ *
+ * @param fileClass - `general` or `test`
+ * @param override - `patchLint.fileSizeThresholds.<class>`, if set
+ */
+export function fileSizeBands(fileClass, override) {
+    return { ...FILE_SIZE_DEFAULTS[fileClass], ...override };
+}
+/**
+ * The effective patch-size bands of a tier. An unset `files.notice` follows
+ * the effective `files.warning` (no notice band) and an unset `files.error`
+ * never fires.
+ *
+ * @param tier - `general`, `test` or `branding`
+ * @param override - `patchLint.patchSizeThresholds.<tier>`, if set
+ */
+export function patchSizeBands(tier, override) {
+    const warning = override?.files?.warning ?? PATCH_FILES_WARNING_DEFAULTS[tier];
+    return {
+        lines: { ...PATCH_LINE_DEFAULTS[tier], ...override?.lines },
+        files: {
+            notice: override?.files?.notice ?? warning,
+            warning,
+            error: override?.files?.error ?? null,
+        },
+    };
+}
+/** An out-of-order triple silently disables a band, so it is refused. */
+function orderProblem(bands) {
+    const ordered = bands.notice <= bands.warning && (bands.error === null || bands.warning <= bands.error);
+    return ordered
+        ? undefined
+        : `must resolve to notice <= warning <= error (resolved: ${bands.notice}/${bands.warning}/${bands.error ?? 'none'})`;
+}
+const bands = s.object({
+    notice: positive.describe('Count above which a notice is reported').optional(),
+    warning: positive.describe('Count above which a warning is reported').optional(),
+    error: positive.describe('Count above which an error is reported').optional(),
+});
+function fileSizeTier(fileClass) {
+    return bands.refine((override) => orderProblem(fileSizeBands(fileClass, override)));
+}
+function patchSizeTier(tier) {
+    const lines = bands.describe('large-patch-lines bands').optional();
+    const files = bands.describe('large-patch-files bands').optional();
+    return s.object({ lines, files }).refine((override) => {
+        const resolved = patchSizeBands(tier, override);
+        const linesProblem = orderProblem(resolved.lines);
+        if (linesProblem !== undefined)
+            return `lines ${linesProblem}`;
+        const filesProblem = orderProblem(resolved.files);
+        return filesProblem === undefined ? undefined : `files ${filesProblem}`;
+    });
+}
+/**
+ * Whether a CSS property name matches a token-scale property list: exact, or
+ * a `*`-suffixed prefix.
+ *
+ * @param name - The property, lower case
+ * @param patterns - `tokenScales[].properties`
+ */
+export function matchesPropertyName(name, patterns) {
+    return patterns.some((pattern) => pattern.endsWith('*') ? name.startsWith(pattern.slice(0, -1)) : name === pattern);
+}
+const tokenPrefix = s.string({
+    pattern: /^--[\w-]+$/,
+    format: 'a custom-property prefix such as "--brand-space-"',
+});
+const tokenScale = s
+    .object({
+    properties: s
+        .array(text, { min: 1 })
+        .describe('CSS properties governed: exact names or *-suffixed prefixes such as padding*'),
+    prefix: s
+        .union(tokenPrefix, s.array(tokenPrefix, { min: 1 }))
+        .describe('Custom-property prefix of the scale tokens, or a list of them'),
+    allowLiterals: s
+        .array(text)
+        .describe('Literal values accepted without a token; * is a wildcard')
+        .optional(),
+    allow: s
+        .array(s.string({ pattern: /^--\S/, format: 'a custom-property name starting with "--"' }))
+        .describe('Further custom properties accepted: exact names or *-suffixed prefixes')
+        .optional(),
+    allowInCalc: s
+        .array(text)
+        .describe('Literal values accepted only inside calc(), min(), max() or clamp()')
+        .optional(),
+    offsetCap: s
+        .number({ min: 0 })
+        .describe('Largest total px a declaration may subtract from scale tokens in a math function')
+        .optional(),
+    exclude: s.array(text).describe('Engine-relative globs of files the scale skips').optional(),
+    minFiles: positive
+        .describe('Fewest created stylesheets that must declare a governed property')
+        .optional(),
+    allowValues: s
+        .array(s.object({ property: text, value: text, reason: text }), { min: 1 })
+        .describe('Reviewed declarations accepted as written, each with its reason')
+        .optional(),
+})
+    .refine((scale) => {
+    const stray = scale.allowValues?.find((entry) => !matchesPropertyName(entry.property.toLowerCase(), scale.properties));
+    return stray === undefined
+        ? undefined
+        : `allows a value for "${stray.property}", which is not a property this scale governs`;
+});
+/**
+ * Every lint rule ID, for validating `patchLint.rules`. The rule registry in
+ * `src/lint` holds the same list with each rule's default and description.
+ */
+export const LINT_RULE_IDS = [
+    'relative-import',
+    'missing-modification-comment',
+    'jsdoc',
+    'jsdoc-class-method',
+    'chrome-script-jsdoc',
+    'test-needs-assertion',
+    'observer-topic-naming',
+    'raw-color-value',
+    'token-prefix-violation',
+    'token-scale',
+    'token-scale-vacuous',
+    'stale-token-scale-exclude',
+    'file-too-large',
+    'large-patch-lines',
+    'large-patch-files',
+    'missing-license-header',
+    'modified-file-missing-header',
+    'mozbuild-unsorted-list',
+    'unregistered-system-module',
+    'dangling-registration',
+    'forward-import',
+    'forward-registration',
+    'staged-dependency-unused',
+    'checkjs-type-error',
+    'upstream-allowlist',
+    'add-only',
+    'scope',
+    'policy-document-missing',
+    'lint-ignore-removable',
+];
+const compilerFlag = (name) => s.boolean().describe(`TypeScript ${name}`).optional();
+const compilerOptions = s
+    .object({
+    strictNullChecks: compilerFlag('strictNullChecks'),
+    strictFunctionTypes: compilerFlag('strictFunctionTypes'),
+    strictBindCallApply: compilerFlag('strictBindCallApply'),
+    noImplicitThis: compilerFlag('noImplicitThis'),
+    useUnknownInCatchVariables: compilerFlag('useUnknownInCatchVariables'),
+    strictPropertyInitialization: compilerFlag('strictPropertyInitialization'),
+    noUnusedLocals: compilerFlag('noUnusedLocals'),
+    noUnusedParameters: compilerFlag('noUnusedParameters'),
+    paths: s
+        .record(s.array(s.string()), {
+        key: s.string({ pattern: /^[^*]*\*?[^*]*$/, format: 'a pattern with at most one "*"' }),
+    })
+        .describe('Module-resolution paths mapping, engine-relative targets')
+        .optional(),
+})
+    .describe('Per-flag overrides applied after the strict checkJs preset');
+const patchLintKeys = {
+    checkJs: s.boolean().describe('Type-check owned plain JS modules').default(false),
+    checkJsStrict: s
+        .boolean()
+        .describe('Run checkJs with strict and noImplicitAny; needs checkJs')
+        .default(false),
+    checkJsCompilerOptions: compilerOptions.optional(),
+    checkJsExtraShim: projectPath
+        .describe('Project-relative .d.ts added to the Firefox globals shim for checkJs')
+        .optional(),
+    checkJsTestFiles: s
+        .boolean()
+        .describe('Also check owned test scripts, each as its own program; needs checkJs')
+        .default(false),
+    checkJsTestShim: projectPath
+        .describe('Project-relative .d.ts of typed harness declarations; needs checkJsTestFiles')
+        .optional(),
+    litTypes: s
+        .boolean()
+        .describe('Type Lit in the checkJs shim with closed member lists; needs checkJs')
+        .default(false),
+    rawColorAllowlist: s
+        .array(s.string())
+        .describe('Paths (exact or basename) exempt from the raw-color check')
+        .optional(),
+    fileSizeThresholds: s
+        .object({
+        general: fileSizeTier('general').describe('Non-test files').optional(),
+        test: fileSizeTier('test').describe('Test files').optional(),
+    })
+        .describe('file-too-large bands per file class, merged over the defaults')
+        .optional(),
+    fileSizeMetric: s
+        .enum(['raw', 'code'])
+        .describe('What file-too-large counts: every line, or lines carrying code')
+        .default('raw'),
+    patchSizeThresholds: s
+        .object({
+        general: patchSizeTier('general').describe('Patches of general code').optional(),
+        test: patchSizeTier('test').describe('Patches of only tests').optional(),
+        branding: patchSizeTier('branding').describe('Branding patches').optional(),
+    })
+        .describe('large-patch-lines and large-patch-files bands per tier, merged over the defaults')
+        .optional(),
+    patchSizeMetric: s
+        .enum(['diff', 'addedCode'])
+        .describe('What large-patch-lines counts: every diff line, or added lines carrying code')
+        .default('diff'),
+    patchSizeRegistrationFiles: s
+        .array(text)
+        .describe('Globs of registration files neither patch-size rule counts')
+        .optional(),
+    rules: s
+        .record(s.enum(['off', 'notice', 'warning', 'error']), {
+        key: s.enum(LINT_RULE_IDS),
+    })
+        .describe('Severity per rule ID, replacing its default; off disables the rule')
+        .optional(),
+    undefinedIdentifiers: severity
+        .describe('How checkJs reports undefined identifiers')
+        .default('warning'),
+    tokenScales: s
+        .array(tokenScale)
+        .describe('CSS property families whose values in created stylesheets must be scale tokens')
+        .optional(),
+    waivers: s
+        .array(s.object({
+        group: text.describe('Group the waiver applies to: a patch or component name such as "ui-sidebar", or the full group ID'),
+        rule: s.enum(LINT_RULE_IDS).describe('Rule waived for the group'),
+        max: s
+            .int({ min: 0 })
+            .describe('Largest measurement still waived; without it the rule is waived at any size')
+            .optional(),
+        reason: text.describe('Why the waiver exists'),
+        share: s
+            .enum(['product', 'test'])
+            .describe('Share of the group a large-patch-lines ceiling bounds; needs max')
+            .optional(),
+    }))
+        .describe('Lint waivers per group of owned changes, beside those a patch manifest carries')
+        .optional(),
+};
+/** Settings that only mean something when another is on. */
+const REQUIRES = [
+    ['checkJsStrict', (lint) => lint.checkJsStrict && !lint.checkJs, 'checkJs'],
+    [
+        'checkJsCompilerOptions',
+        (lint) => lint.checkJsCompilerOptions !== undefined && !lint.checkJsStrict,
+        'checkJsStrict',
+    ],
+    ['checkJsTestFiles', (lint) => lint.checkJsTestFiles && !lint.checkJs, 'checkJs'],
+    [
+        'checkJsTestShim',
+        (lint) => lint.checkJsTestShim !== undefined && !lint.checkJsTestFiles,
+        'checkJsTestFiles',
+    ],
+    ['litTypes', (lint) => lint.litTypes && !lint.checkJs, 'checkJs'],
+];
+const patchLintObject = s.object(patchLintKeys);
+/** The `patchLint` section. Every key is optional. */
+export const patchLintSection = patchLintObject
+    .refine((lint) => {
+    const unmet = REQUIRES.find(([, broken]) => broken(lint));
+    return unmet === undefined ? undefined : `sets ${unmet[0]}, which needs ${unmet[2]}: true`;
+})
+    .describe('Quality rules over owned changes');