@deepseek-ai/dsh-app-boot 0.2.2-alpha.3 → 0.2.2-rc.2

package/src/config-schema/collect.ts

@@ -0,0 +1,249 @@
+/** Boot-free inspection of declared plugin Config schemas using profile module resolution. */
+
+import { readFile, realpath } from 'node:fs/promises'
+import { extname, join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import * as yaml from 'js-yaml'
+import Loader, { EntryGroup, ModuleLoader, isJsExpr, type EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
+import Group from '@deepseek-ai/cordis-plugin-group'
+import Include, { applyEntryPatches, entryListSchema, type PatchOptions } from '@deepseek-ai/cordis-plugin-include'
+import type { Profile, RuntimeResolution } from '../profile.ts'
+import { installRuntimeInterception } from '../profile-resolution/resolver.ts'
+import { buildConfigSchemaDocument } from './document.ts'
+import type { CollectedConfigEntry, ConfigSchemaDiagnostic, ConfigSchemaDump } from './types.ts'
+import { isNativeConfigSchema } from './native.ts'
+
+interface ParsedEntry {
+  id?: string
+  name: string
+  config?: unknown
+  group?: boolean | null
+  disabled?: unknown
+}
+
+function objectLike(value: unknown): value is object {
+  return value !== null && (typeof value === 'object' || typeof value === 'function')
+}
+
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function configOf(plugin: unknown): unknown {
+  return objectLike(plugin) ? Reflect.get(plugin, 'Config') : undefined
+}
+
+function validateMetadata(row: object): void {
+  for (const key of ['id', 'name']) {
+    const value: unknown = Reflect.get(row, key)
+    if (value !== undefined && typeof value !== 'string') throw new Error(`${key} must be a literal string`)
+  }
+  const group: unknown = Reflect.get(row, 'group')
+  if (group !== undefined && group !== null && typeof group !== 'boolean') throw new Error('group must be a literal boolean or null')
+}
+
+function validateEntry(value: unknown): asserts value is ParsedEntry {
+  if (!record(value) || typeof value.name !== 'string') throw new Error('each entry must be a mapping with a literal plugin name')
+  validateMetadata(value)
+}
+
+function entryList(value: unknown): unknown[] {
+  if (value === undefined) throw new Error('entry list config is missing')
+  if (!Array.isArray(value)) throw new Error('expected a literal entry list; config expressions are not evaluated')
+  return value as unknown[]
+}
+
+function includePatches(value: unknown): PatchOptions[] | undefined {
+  if (value === undefined) return undefined
+  if (!Array.isArray(value)) throw new Error('include patches must be a literal patch list; config expressions are not evaluated')
+  for (const patch of value as unknown[]) {
+    if (!record(patch) || isJsExpr(patch)) throw new Error('include patches must be literal mappings; config expressions are not evaluated')
+    validateMetadata(patch)
+    if (patch.insert !== undefined) entryList(patch.insert)
+  }
+  return value as PatchOptions[]
+}
+
+/**
+ * Generate JSON Schema from parsed entry rows and root-tree patches without applying plugins or evaluating expressions.
+ * Imports, Config getters, and lazy schema builders execute trusted plugin code; transform callbacks do not. Calls must not overlap
+ * another profile-resolution interception; module imports remain cached after the interception is released.
+ * @param profile - prepared profile whose directory anchors root module and include resolution.
+ * @param entries - unvalidated rows from profile composition; malformed rows become positioned diagnostics without losing siblings.
+ * @param resolution - the same immutable package resolution used for profile boot.
+ * @param diagnostics - existing composition diagnostics; copied into the returned catalog.
+ * @returns a JSON Schema document with partial-result diagnostics and Config references under `x-cordis`.
+ * @throws when Node's profile module resolution cannot be installed.
+ */
+export async function collectConfigSchemas(
+  profile: Profile,
+  entries: readonly unknown[],
+  resolution: RuntimeResolution,
+  diagnostics: readonly ConfigSchemaDiagnostic[] = [],
+): Promise<ConfigSchemaDump> {
+  const result: { entries: CollectedConfigEntry[]; diagnostics: ConfigSchemaDiagnostic[] } = {
+    entries: [], diagnostics: [...diagnostics],
+  }
+  const byOptions = new Map<object, CollectedConfigEntry>()
+  const interception = installRuntimeInterception(resolution)
+  try {
+    const loader = ModuleLoader.fromInternal()
+    if (loader === undefined) throw new Error('config schema dump requires the Node module loader used by profile resolution')
+    const builtins: Record<string, unknown> = { group: Group, include: Include }
+    const nativeCarriers = new Map<string, Promise<{ group: unknown; include: unknown }>>()
+    const carrier = async (plugin: unknown, baseUrl: string): Promise<'group' | 'include' | undefined> => {
+      if (plugin === Group) return 'group'
+      if (plugin === Include) return 'include'
+      if (!objectLike(plugin) || !Reflect.get(plugin, EntryGroup.key)) return undefined
+      let resolved = nativeCarriers.get(baseUrl)
+      if (resolved === undefined) {
+        // Include may be bundled into app-boot; compare against the native packages resolved for this tree as well.
+        resolved = Promise.allSettled([
+          loader.import('@deepseek-ai/cordis-plugin-group', baseUrl, {}),
+          loader.import('@deepseek-ai/cordis-plugin-include', baseUrl, {}),
+        ]).then(([group, include]) => {
+          const groupPlugin: unknown = group.status === 'fulfilled' ? Loader.prototype.unwrapExports(group.value) : undefined
+          const includePlugin: unknown = include.status === 'fulfilled' ? Loader.prototype.unwrapExports(include.value) : undefined
+          return { group: groupPlugin, include: includePlugin }
+        })
+        nativeCarriers.set(baseUrl, resolved)
+      }
+      const native = await resolved
+      if (plugin === native.group) return 'group'
+      if (plugin === native.include) return 'include'
+      throw new Error('unrecognized Loader tree carrier; use cordis:group or cordis:include for native child collection')
+    }
+    const ancestors = new Set<string>()
+    const report = (path: string, error: unknown): void => {
+      result.diagnostics.push({ level: 'error', path, message: error instanceof Error ? error.message : String(error) })
+    }
+    const warn = (path: string) => (message: string, ...args: unknown[]): void => {
+      let index = 0
+      result.diagnostics.push({ level: 'warning', path, message: message.replace(/%C/g, () => JSON.stringify(args[index++])) })
+    }
+
+    const walkInclude = async (config: unknown, baseUrl: string, path: string): Promise<void> => {
+      if (config === undefined) throw new Error('include config is missing')
+      if (!record(config) || isJsExpr(config)) throw new Error('include config must be literal; config expressions are not evaluated')
+      if (typeof config.path !== 'string') throw new Error('include path must be literal; config expressions are not evaluated')
+      const filename = fileURLToPath(new URL(config.path, baseUrl))
+      const extension = extname(filename)
+      if (!['.json', '.yaml', '.yml'].includes(extension)) throw new Error(`include extension ${JSON.stringify(extension)} is not supported`)
+      let source: unknown
+      let canonical: string
+      try {
+        canonical = await realpath(filename)
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+        canonical = filename
+      }
+      if (ancestors.has(canonical)) throw new Error(`include cycle at ${filename}`)
+      let content: string | undefined
+      try {
+        content = await readFile(filename, 'utf8')
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+        source = config.initial
+        if (source === undefined) throw new Error(`include file not found: ${filename}`)
+      }
+      if (content !== undefined) {
+        try {
+          source = extension === '.json' ? JSON.parse(content) : yaml.load(content, { schema: entryListSchema })
+        } catch (error) {
+          // Parser messages can quote configuration values; retain only the file and location.
+          const at = error instanceof yaml.YAMLException ? ` at line ${error.mark.line + 1}, column ${error.mark.column + 1}` : ''
+          throw new Error(`invalid ${extension === '.json' ? 'JSON' : 'YAML'} include ${filename}${at}`)
+        }
+      }
+      const patches = includePatches(config.patches)
+      const rows = entryList(source)
+      let children: EntryOptions[]
+      try {
+        children = applyEntryPatches(rows as EntryOptions[], patches, warn(path))
+      } catch (error) {
+        throw new Error(`include patches could not be composed for ${filename}; child declarations are unavailable`, { cause: error })
+      }
+      ancestors.add(canonical)
+      try {
+        await walk(children, new URL('.', pathToFileURL(filename)).href, `${path}/include`)
+      } finally {
+        ancestors.delete(canonical)
+      }
+    }
+
+    const walk = async (rows: readonly unknown[], baseUrl: string, prefix: string): Promise<void> => {
+      for (const [index, value] of rows.entries()) {
+        const path = `${prefix}/${index}`
+        const identity = record(value) ? value : undefined
+        const entry: CollectedConfigEntry = {
+          path,
+          ...(typeof identity?.id === 'string' ? { id: identity.id } : {}),
+          ...(typeof identity?.name === 'string' ? { name: identity.name } : {}),
+          status: 'error',
+        }
+        result.entries.push(entry)
+        const row = value
+        try {
+          validateEntry(row)
+        } catch (error) {
+          report(path, error)
+          continue
+        }
+        entry.status = 'absent'
+        byOptions.set(row, entry)
+        let plugin: unknown
+        try {
+          let exports: unknown
+          if (row.name.startsWith('cordis:')) {
+            const name = row.name.slice(7)
+            if (!Object.hasOwn(builtins, name)) throw new Error(`unknown Cordis builtin ${JSON.stringify(row.name)}`)
+            exports = builtins[name]
+          } else exports = await loader.import(row.name, baseUrl, {})
+          plugin = Loader.prototype.unwrapExports(exports)
+          const schema = configOf(plugin)
+          if (schema !== undefined && schema !== null) {
+            if (!isNativeConfigSchema(schema)) {
+              entry.status = 'unsupported'
+              report(path, 'Config is not a native Schemastery schema')
+            } else {
+              entry.status = 'schema'
+              entry.native = schema
+            }
+          }
+        } catch (error) {
+          entry.status = 'error'
+          report(path, error)
+        }
+        try {
+          const kind = await carrier(plugin, baseUrl)
+          if (kind === undefined) continue
+          entry.tree = kind
+          // The Loader never initializes a disabled carrier unless group: true forces it, so a missing config declares no children.
+          if (row.config === undefined && row.group !== true && (row.disabled === true || isJsExpr(row.disabled))) continue
+          if (kind === 'group') await walk(entryList(row.config), baseUrl, `${path}/config`)
+          else await walkInclude(row.config, baseUrl, path)
+        } catch (error) {
+          report(path, error)
+        }
+      }
+    }
+
+    await walk(entries, pathToFileURL(join(profile.dir, 'cordis.yml')).href, '')
+    const targets = new Map<string, CollectedConfigEntry>()
+    const indexTargets = (rows: readonly unknown[]): void => {
+      for (const row of rows) {
+        if (!record(row)) continue
+        if (typeof row.id === 'string' && row.id) {
+          const entry = byOptions.get(row)
+          if (entry) targets.set(row.id, entry)
+          else targets.delete(row.id)
+        }
+        if (row.group && Array.isArray(row.config)) indexTargets(row.config)
+      }
+    }
+    indexTargets(entries)
+    return await buildConfigSchemaDocument(profile.name, result.entries, targets, result.diagnostics)
+  } finally {
+    interception.dispose()
+  }
+}

package/src/config-schema/document.ts

@@ -0,0 +1,169 @@
+/** Compose Loader entry/patch structure and discovered plugin input schemas into one JSON Schema document. */
+
+import { createConfigProjector, LOADER_EXPRESSION_SCHEMA } from './projector.ts'
+import type {
+  CollectedConfigEntry, ConfigJsonSchema, ConfigJsonSchemaObject, ConfigSchemaDiagnostic,
+  ConfigSchemaDump, ConfigSchemaEntry, NativeConfigSchema,
+} from './types.ts'
+
+const ref = (name: string): ConfigJsonSchemaObject => ({ $ref: `#/$defs/${name}` })
+
+function metadata(): Record<string, ConfigJsonSchema> {
+  return {
+    id: { type: 'string', description: 'Entry id. Loader generates an id when an entry omits it; patches use the configured id.' },
+    name: { type: 'string', description: 'Plugin module specifier. Inserted relative plugin paths are anchored beside their patch file.' },
+    config: {},
+    group: { type: ['boolean', 'null'], description: 'Allows patch indexing and insertion into an entry-list config; does not select the plugin implementation.' },
+    disabled: { anyOf: [{ type: ['boolean', 'null'] }, ref('loaderExpression')], description: 'Boolean or !!js expression. The Loader coerces other truthy values as disabled; this schema rejects them.' },
+    inject: { anyOf: [{ type: 'array', items: { type: 'string' } }, { type: 'object' }, { type: 'null' }] },
+    intercept: { type: ['object', 'null'] },
+    isolate: { type: ['object', 'null'], additionalProperties: { anyOf: [{ const: true }, { type: 'string' }] } },
+  }
+}
+
+function patchStructure(): ConfigJsonSchemaObject {
+  return {
+    type: 'object',
+    allOf: [ref('entryMetadata')],
+    properties: { insert: ref('entryList') },
+    description: 'An insert appends entries, optionally inside the group identified by id. Other patches replace supplied fields; config is replaced wholesale, not deep-merged. A truthy name asserts the existing plugin name rather than renaming it. Unknown targets and non-insert patches without a nonempty id are warned and skipped.',
+  }
+}
+
+/**
+ * Build a schema for the composed entry list and a separately addressable root-tree patch list.
+ * Unknown plugin names remain open; only collected schemas supply plugin-specific constraints.
+ * @param profile - selected profile name.
+ * @param collected - declarations discovered without mounting plugins, including include descendants.
+ * @param targets - last-id-wins patch targets from the root tree's patch index, excluding include descendants.
+ * @param initialDiagnostics - composition and import diagnostics already collected.
+ * @returns one JSON Schema document with explicit collection and projection annotations.
+ */
+export async function buildConfigSchemaDocument(
+  profile: string,
+  collected: readonly CollectedConfigEntry[],
+  targets: ReadonlyMap<string, CollectedConfigEntry>,
+  initialDiagnostics: readonly ConfigSchemaDiagnostic[],
+): Promise<ConfigSchemaDump> {
+  const project = await createConfigProjector()
+  const diagnostics = [...initialDiagnostics]
+  const definitions: Record<string, ConfigJsonSchema> = {
+    loaderExpression: LOADER_EXPRESSION_SCHEMA,
+    entryMetadata: { type: 'object', properties: metadata() },
+    entryList: { type: 'array', items: ref('entry') },
+    patchList: { type: 'array', items: ref('patch') },
+    unknownConfig: { $comment: 'No projected Config schema is available; this is unknown configuration, not a prohibition on fields.' },
+    includeConfig: {
+      type: 'object', required: ['path'],
+      properties: {
+        path: { type: 'string', description: 'YAML/JSON filename resolved relative to the owning Loader tree. This field is literal, not a !!js expression.' },
+        initial: ref('entryList'),
+        patches: { type: 'array', items: ref('includePatch') },
+        enableLogs: { type: 'boolean' },
+      },
+      description: 'Native Include configuration stays literal. initial is used only when the file is absent. Included files have their own module-resolution base and patch target index.',
+    },
+    includePatch: patchStructure(),
+  }
+  const entries: ConfigSchemaEntry[] = []
+  const outputByEntry = new Map<CollectedConfigEntry, ConfigSchemaEntry>()
+  const projections = new Map<NativeConfigSchema, { reference: string; required: boolean; limitations: string[] }>()
+  const trees = new Set<string>(['#/$defs/entryList', '#/$defs/includeConfig'])
+  const requiredConfigs = new Set(trees)
+  const names = new Map<string, Set<string>>([
+    ['cordis:group', new Set(['#/$defs/entryList'])],
+    ['cordis:include', new Set(['#/$defs/includeConfig'])],
+  ])
+
+  for (const entry of collected) {
+    const { native, ...output } = entry
+    if (entry.tree) output.configRef = entry.tree === 'group' ? '#/$defs/entryList' : '#/$defs/includeConfig'
+    else if (native) {
+      let projection = projections.get(native)
+      if (projection === undefined) {
+        const name = `config${projections.size}`
+        try {
+          const result = project(native, name)
+          definitions[name] = result.schema
+          Object.assign(definitions, result.definitions)
+          projection = { reference: `#/$defs/${name}`, required: result.acceptsMissing === false, limitations: result.limitations }
+          projections.set(native, projection)
+        } catch (error) {
+          output.status = 'error'
+          diagnostics.push({ level: 'error', path: entry.path, message: error instanceof Error ? error.message : String(error) })
+        }
+      }
+      if (projection) {
+        output.configRef = projection.reference
+        output.status = projection.limitations.length ? 'partial' : 'schema'
+        if (projection.required) requiredConfigs.add(projection.reference)
+        for (const message of projection.limitations) diagnostics.push({ level: 'warning', path: entry.path, message })
+      }
+    }
+    output.configRef ??= '#/$defs/unknownConfig'
+    entries.push(output)
+    outputByEntry.set(entry, output)
+    if (entry.name !== undefined) {
+      const choices = names.get(entry.name) ?? new Set<string>()
+      choices.add(output.configRef)
+      names.set(entry.name, choices)
+    }
+  }
+
+  // The Loader never initializes a disabled row unless group: true forces it, so its required config may be omitted.
+  const dormant: ConfigJsonSchemaObject = {
+    properties: { disabled: { anyOf: [{ const: true }, ref('loaderExpression')] }, group: { not: { const: true } } },
+    required: ['disabled'],
+  }
+  const entryRules: ConfigJsonSchema[] = []
+  for (const [name, choices] of names) {
+    const validated: ConfigJsonSchemaObject = { properties: { config: { anyOf: [...choices].map(reference => ({ $ref: reference })) } } }
+    let then = validated
+    if ([...choices].every(reference => requiredConfigs.has(reference))) {
+      then = { if: dormant, else: { ...validated, required: ['config'] } }
+      // A dormant carrier never creates its children, so their declarations are not validated either.
+      if (![...choices].every(reference => trees.has(reference))) then.then = validated
+    }
+    entryRules.push({ if: { properties: { name: { const: name } }, required: ['name'] }, then })
+    if (choices.size > 1) {
+      diagnostics.push({ level: 'warning', message: `Plugin ${JSON.stringify(name)} has multiple collected schemas; entry validation accepts their union because module resolution depends on the owning tree.` })
+    }
+  }
+  definitions.entry = {
+    type: 'object', required: ['name'], allOf: [ref('entryMetadata'), ...entryRules],
+    description: 'Loader entry. Unknown metadata and plugin names are accepted; plugin-specific validation is available only for the names collected in this profile. Distinct resolutions of one name use a union of their schemas.',
+  }
+
+  const patchRules: ConfigJsonSchema[] = []
+  for (const [id, target] of targets) {
+    if (target.name === undefined) continue
+    const configRef = outputByEntry.get(target)?.configRef ?? '#/$defs/unknownConfig'
+    patchRules.push({
+      if: {
+        required: ['id'], properties: { id: { const: id } },
+        allOf: [
+          { not: { required: ['insert'] } },
+          { anyOf: [{ not: { required: ['name'] } }, { properties: { name: { enum: ['', target.name] } } }] },
+        ],
+      },
+      then: { properties: { config: { $ref: configRef } } },
+    })
+  }
+  definitions.patch = { ...patchStructure(), allOf: [ref('entryMetadata'), ...patchRules] }
+  const positions = new Map(entries.map((entry, index) => [entry.path, index]))
+  diagnostics.sort((left, right) => (positions.get(left.path ?? '') ?? -1) - (positions.get(right.path ?? '') ?? -1))
+  return {
+    $schema: 'https://json-schema.org/draft/2020-12/schema',
+    title: `Cordis configuration for profile ${profile}`,
+    description: 'Describes the parsed entry-list YAML printed by --dump-config. Use $defs.patchList for a profile/home/CLI overlay. Parse !!js with the Cordis entry-list YAML dialect. Expression results, service dependencies, plugin startup checks, and sequence-dependent patch targets still require runtime validation.',
+    $comment: 'Bundle, profile, home, and CLI layers apply in that order. A patch config replaces the whole config. JSON Schema defaults are annotations; Schemastery validates a fallback on null/omission unless required rejects it first. Schemastery unions select the first successful branch. Root patch id constraints describe the current index, not ids introduced or changed by earlier patches. Include-local patches have a separate index. Relative plugin insertions require their source patch directory; this document does not infer future overlay locations.',
+    type: 'array', items: ref('entry'), $defs: definitions,
+    'x-cordis': {
+      profile,
+      complete: !diagnostics.some(item => item.level === 'error')
+        && !entries.some(entry => ['partial', 'unsupported', 'error'].includes(entry.status))
+        && ![...names.values()].some(choices => choices.size > 1),
+      entries, diagnostics, patchSchema: '#/$defs/patchList',
+    },
+  }
+}

package/src/config-schema/index.ts

@@ -0,0 +1,36 @@
+/** Profile schema generation: composition diagnostics, runtime resolution, and boot-free discovery. */
+
+import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
+import { composeEntries, createRuntimeResolution, type Profile } from '../profile.ts'
+import { collectConfigSchemas } from './collect.ts'
+import type { ConfigSchemaDiagnostic, ConfigSchemaDump } from './types.ts'
+export type { ConfigSchemaDump, NativeConfigSchema } from './types.ts'
+
+/**
+ * Generate JSON Schema for a prepared profile's ordered patch layers without mounting plugins or evaluating expressions.
+ * Imports, Config getters, and lazy builders execute trusted code. Native validators and
+ * transform callbacks are not executed. Calls must not overlap another profile-resolution interception; collection
+ * releases its interception on success or rejection, while Node retains imported modules. Supplied layers are not mutated.
+ * Profile preparation, layer selection, process streams, and exit policy belong to the caller.
+ * @param profile - prepared on-disk profile whose directory anchors root module and include resolution.
+ * @param layers - already parsed patch lists in application order, including caller-selected home and argv overlays.
+ * @param installAnchor - package manifest anchoring the installation's runtime dependencies.
+ * @returns a JSON Schema document with declaration references, partial results, and diagnostics under `x-cordis`.
+ * @throws when composition or runtime resolution cannot be prepared.
+ */
+export async function generateConfigSchema(
+  profile: Profile,
+  layers: readonly PatchOptions[][],
+  installAnchor: string,
+): Promise<ConfigSchemaDump> {
+  const diagnostics: ConfigSchemaDiagnostic[] = []
+  for (const { packageName } of profile.skippedBundles) {
+    diagnostics.push({
+      level: 'error',
+      message: `Selected profile bundle ${JSON.stringify(packageName)} could not be loaded; repair or remove its bundle selection.`,
+    })
+  }
+  const entries = composeEntries(layers, message => diagnostics.push({ level: 'warning', message }))
+  const resolution = await createRuntimeResolution({ installAnchor, profile })
+  return collectConfigSchemas(profile, entries, resolution, diagnostics)
+}

package/src/config-schema/native.ts

@@ -0,0 +1,16 @@
+/** Identity checks at the plugin-export and lazy-builder boundaries. */
+
+import type { NativeConfigSchema } from './types.ts'
+
+/**
+ * Recognize the native Schemastery graph protocol without invoking a validator or serialization hook.
+ * @param value - plugin Config export or lazy-builder result.
+ * @returns whether native schema fields can be inspected.
+ */
+export function isNativeConfigSchema(value: unknown): value is NativeConfigSchema {
+  if (value === null || (typeof value !== 'object' && typeof value !== 'function')) return false
+  const meta: unknown = Reflect.get(value, 'meta')
+  return Reflect.get(value, Symbol.for('schemastery')) === true
+    && typeof Reflect.get(value, 'type') === 'string'
+    && meta !== null && typeof meta === 'object'
+}

package/src/config-schema/pattern.ts

@@ -0,0 +1,62 @@
+/** Conservative compatibility checks between native RegExp validation and Unicode JSON Schema patterns. */
+
+import type { AST } from '@eslint-community/regexpp'
+
+function bmpOnly(node: AST.Node): boolean {
+  switch (node.type) {
+    case 'Character': return node.value <= 0xffff && (node.value < 0xd800 || node.value > 0xdfff)
+    case 'CharacterClassRange': return bmpOnly(node.min) && bmpOnly(node.max) && (node.max.value < 0xd800 || node.min.value > 0xdfff)
+    case 'CharacterClass': return !node.negate && node.elements.every(bmpOnly)
+    case 'CharacterSet': return (node.kind === 'digit' || node.kind === 'space' || node.kind === 'word') && !node.negate
+    case 'Quantifier': return bmpOnly(node.element)
+    case 'Assertion': return ['start', 'end', 'word'].includes(node.kind)
+    default: return false
+  }
+}
+
+function broadSet(node: AST.Node): boolean {
+  return node.type === 'CharacterSet' && (node.kind === 'any'
+    || ((node.kind === 'digit' || node.kind === 'space' || node.kind === 'word') && node.negate))
+}
+
+function portableAlternative(alternative: AST.Alternative): boolean {
+  // A lone, unanchored broad set asks only whether a matching character exists.
+  if (alternative.elements.length === 1 && alternative.elements.some(broadSet)) return true
+  let broadRepetitions = 0
+  const wordAssertion = alternative.elements.some(element => element.type === 'Assertion' && element.kind === 'word')
+  return alternative.elements.every((element) => {
+    if (element.type === 'Quantifier' && element.max === Infinity && element.min <= 1 && broadSet(element.element)) {
+      // Word assertions and multiple broad groups can observe a surrogate pair's midpoint.
+      return !wordAssertion && ++broadRepetitions === 1
+    }
+    return bmpOnly(element)
+  })
+}
+
+function signature(pattern: AST.Pattern): string {
+  const incidental = new Set(['parent', 'start', 'end', 'raw', 'references', 'resolved'])
+  return JSON.stringify(pattern, (key: string, value: unknown) => incidental.has(key) ? undefined : value)
+}
+
+/**
+ * Create a checker for patterns that can retain native acceptance under Unicode regex semantics.
+ * Unrecognized flagless syntax stays explicitly partial rather than becoming a misleading constraint.
+ * @returns the compatibility predicate; parsing never executes the regular expression against config values.
+ */
+export async function createPatternCheck(): Promise<(source: string, flags?: string) => boolean> {
+  const { RegExpParser } = await import('@eslint-community/regexpp')
+  const parser = new RegExpParser()
+  return (source, flags = '') => {
+    if (flags !== '' && flags !== 'u') return false
+    try {
+      const unicode = parser.parsePattern(source, 0, source.length, { unicode: true })
+      if (flags === 'u') return true
+      const native = parser.parsePattern(source, 0, source.length, { unicode: false })
+      return signature(native) === signature(unicode) && native.alternatives.every(portableAlternative)
+    } catch (error) {
+      // Invalid Unicode syntax cannot be emitted as a standard pattern constraint.
+      if (error instanceof SyntaxError) return false
+      throw error
+    }
+  }
+}