@gobing-ai/ts-rule-engine 0.3.1 → 0.3.2

package/dist/evaluators/file-utils.js

@@ -1,19 +1,23 @@
-import { dirname, relative, resolve } from 'node:path';
-import { NodeFileSystem, walkDir } from '@gobing-ai/ts-runtime';
-const DEFAULT_EXCLUDES = new Set(['.git', 'node_modules', 'dist', '.coverage', '.astro', '.wrangler']);
+import { dirnamePath, NodeFileSystem, relativePath, resolvePath, walkDir, } from '@gobing-ai/ts-runtime';
+/**
+ * Directory names pruned from every file walk — heavy or generated trees that no rule
+ * should scan. Shared so subprocess-backed evaluators (e.g. `sg`) can forward the same
+ * skip-list to the external tool instead of relying on each rule to remember it.
+ */
+export const DEFAULT_EXCLUDES = new Set(['.git', 'node_modules', 'dist', '.coverage', '.astro', '.wrangler']);
 /** Resolve source files for evaluators using conservative path-fragment matching. */
 export async function discoverFiles(options) {
     const fs = options.fs ?? new NodeFileSystem();
-    const allFiles = await walkDir(options.workdir, fs);
+    const allFiles = await walkDir(options.workdir, fs, DEFAULT_EXCLUDES);
     return allFiles
-        .map((path) => relative(options.workdir, path))
+        .map((path) => relativePath(options.workdir, path))
         .filter((path) => !path.split('/').some((segment) => DEFAULT_EXCLUDES.has(segment)))
         .filter((path) => matchesAny(path, options.include) &&
         (options.exclude === undefined || !matchesAny(path, options.exclude)));
 }
 /** Read a file from a workdir-relative path. */
 export async function readWorkdirFile(workdir, filePath, fs = new NodeFileSystem()) {
-    return await fs.readFile(resolve(workdir, filePath));
+    return await fs.readFile(resolvePath(workdir, filePath));
 }
 /**
  * Discover in-scope files and read each once — the shared scaffolding behind the
@@ -44,11 +48,11 @@ async function discoverFilesByGlob(workdir, include, exclude, fs) {
 }
 /** Ensure a path is workdir-relative for findings. */
 export function relativeToWorkdir(workdir, path) {
-    return relative(workdir, resolve(path));
+    return relativePath(workdir, resolvePath(path));
 }
 /** Return parent directory for a workdir-relative path. */
 export function relativeParent(path) {
-    const parent = dirname(path);
+    const parent = dirnamePath(path);
     return parent === '.' ? '' : parent;
 }
 /** Return true when a path matches any supplied fragment or suffix. */
@@ -108,6 +112,42 @@ export function escapeRegExp(value) {
 export function stringArray(value) {
     return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : undefined;
 }
+function requiredConfigError(kind, key, evaluator) {
+    const who = evaluator !== undefined ? `${evaluator} evaluator` : 'evaluator';
+    return new Error(`${who} requires ${kind} config "${key}"`);
+}
+/**
+ * Read a string entry from a rule's evaluator config. Returns the value when it is a string,
+ * the `fallback` when one is supplied, otherwise throws — so required keys fail loudly.
+ */
+export function configString(config, key, fallback, options = {}) {
+    const value = config[key];
+    if (typeof value === 'string')
+        return value;
+    if (fallback !== undefined)
+        return fallback;
+    throw requiredConfigError('string', key, options.evaluator);
+}
+/**
+ * Read a string-array entry from a rule's evaluator config. A bare string is coerced to a
+ * single-element array. Returns the `fallback` when one is supplied and the value is absent;
+ * otherwise throws — so required keys fail loudly.
+ */
+export function configArray(config, key, fallback, options = {}) {
+    const value = config[key];
+    if (Array.isArray(value) && value.every((item) => typeof item === 'string'))
+        return value;
+    if (typeof value === 'string')
+        return [value];
+    if (fallback !== undefined)
+        return fallback;
+    throw requiredConfigError('string[]', key, options.evaluator);
+}
+/** Read a finite-number entry from a rule's evaluator config, falling back when absent or invalid. */
+export function configNumber(config, key, fallback) {
+    const value = config[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : fallback;
+}
 /**
  * Split a leading ripgrep/PCRE-style `(?flags)` inline group off a regex source.
  *

package/dist/evaluators/forbidden-import-evaluator.js

@@ -1,5 +1,5 @@
 import { createFinding, } from '../types.js';
-import { escapeRegExp, scanFiles, stringArray } from './file-utils.js';
+import { configArray, escapeRegExp, scanFiles, stringArray } from './file-utils.js';
 /**
  * Detects forbidden imports / API usage.
  *
@@ -26,7 +26,7 @@ export class ForbiddenImportEvaluator {
     }
     /** Legacy path: `{ patterns: string[] }`, substring-matched against import specifiers. */
     async evaluateSimple(rule, context, config) {
-        const forbidden = arrayConfig(config, 'patterns');
+        const forbidden = configArray(config, 'patterns', undefined, { evaluator: 'forbidden-import' });
         const files = await scanFiles({
             workdir: context.workdir,
             include: rule.include ?? ['.ts', '.tsx', '.js', '.jsx'],
@@ -94,11 +94,3 @@ function compileEntry(entry) {
     }
     return { regex: new RegExp(entry.pattern), label: entry.pattern };
 }
-function arrayConfig(config, key) {
-    const value = config[key];
-    if (Array.isArray(value) && value.every((item) => typeof item === 'string'))
-        return value;
-    if (typeof value === 'string')
-        return [value];
-    throw new Error(`forbidden-import evaluator requires string[] config "${key}"`);
-}

package/dist/evaluators/path-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/path-evaluator.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;GASG;AACH,qBAAa,aAAc,YAAW,aAAa;IAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;;IAMpC,kEAAkE;IAC5D,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASzF,qEAAqE;YACvD,YAAY;IAuC1B,uEAAuE;YACzD,gBAAgB;CAmBjC"}
+{"version":3,"file":"path-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/path-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;GASG;AACH,qBAAa,aAAc,YAAW,aAAa;IAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;;IAMpC,kEAAkE;IAC5D,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASzF,qEAAqE;YACvD,YAAY;IAuC1B,uEAAuE;YACzD,gBAAgB;CAmBjC"}

package/dist/evaluators/path-evaluator.js

@@ -1,7 +1,6 @@
-import { resolve } from 'node:path';
-import { NodeFileSystem } from '@gobing-ai/ts-runtime';
+import { joinPath, NodeFileSystem } from '@gobing-ai/ts-runtime';
 import { createFinding, } from '../types.js';
-import { discoverFiles, matchesGlob } from './file-utils.js';
+import { configArray, configString, discoverFiles, matchesGlob } from './file-utils.js';
 /**
  * Evaluates file/directory presence constraints.
  *
@@ -56,11 +55,11 @@ export class PathEvaluator {
     }
     /** Explicit form: exact `paths` checked with `mode` require/forbid. */
     async evaluateExplicit(rule, context, config) {
-        const paths = arrayConfig(config, 'paths');
-        const mode = stringConfig(config, 'mode', 'require');
+        const paths = configArray(config, 'paths', undefined, { evaluator: 'path' });
+        const mode = configString(config, 'mode', 'require');
         const findings = [];
         for (const path of paths) {
-            const exists = await this.fs.exists(resolve(context.workdir, path));
+            const exists = await this.fs.exists(joinPath(context.workdir, path));
             if (mode === 'forbid' && exists) {
                 findings.push(createFinding(rule, `Forbidden path exists: ${path}`, path, { code: 'path:forbidden' }));
             }
@@ -71,15 +70,3 @@ export class PathEvaluator {
         return { findings, fixes: [] };
     }
 }
-function arrayConfig(config, key) {
-    const value = config[key];
-    if (Array.isArray(value) && value.every((item) => typeof item === 'string'))
-        return value;
-    if (typeof value === 'string')
-        return [value];
-    throw new Error(`path evaluator requires config "${key}" (string[]) or "must" (present|absent)`);
-}
-function stringConfig(config, key, fallback) {
-    const value = config[key];
-    return typeof value === 'string' ? value : fallback;
-}

package/dist/evaluators/regex-evaluator.js

@@ -1,5 +1,5 @@
 import { createFinding, } from '../types.js';
-import { parseInlineFlags, scanFiles } from './file-utils.js';
+import { configString, parseInlineFlags, scanFiles } from './file-utils.js';
 /**
  * Evaluates whether source files match or avoid a regex pattern.
  *
@@ -16,8 +16,8 @@ export class RegexEvaluator {
     /** Evaluate regex-based presence or absence constraints. */
     async evaluate(rule, context) {
         const config = rule.evaluator.config ?? {};
-        const { pattern, flags } = normalizePattern(stringConfig(config, 'pattern'), stringConfig(config, 'flags', ''), config.multiline === true);
-        const mode = stringConfig(config, 'mode', 'forbid');
+        const { pattern, flags } = normalizePattern(configString(config, 'pattern', undefined, { evaluator: 'regex' }), configString(config, 'flags', ''), config.multiline === true);
+        const mode = configString(config, 'mode', 'forbid');
         const regex = new RegExp(pattern, flags);
         const files = await scanFiles({
             workdir: context.workdir,
@@ -81,14 +81,6 @@ function normalizePattern(rawPattern, rawFlags, multiline) {
         flagSet.add('s');
     return { pattern, flags: [...flagSet].join('') };
 }
-function stringConfig(config, key, fallback) {
-    const value = config[key];
-    if (typeof value === 'string')
-        return value;
-    if (fallback !== undefined)
-        return fallback;
-    throw new Error(`regex evaluator requires string config "${key}"`);
-}
 /** Return the one-based line containing a string offset. */
 function lineForOffset(content, offset) {
     let line = 1;

package/dist/evaluators/ripgrep-evaluator.d.ts

@@ -0,0 +1,50 @@
+import { type ProcessExecutor } from '@gobing-ai/ts-runtime';
+import { type ConstraintRule, type RuleContext, type RuleEvaluationResult, type RuleEvaluator } from '../types';
+/**
+ * Evaluates source files against a regex using the `rg` (ripgrep) CLI.
+ *
+ * This is the real ripgrep-backed engine registered under the `rg` rule type. Unlike
+ * the {@link import('./regex-evaluator').RegexEvaluator} (`regex` type, JS `RegExp`),
+ * it runs ripgrep's linear-time Rust regex engine: ReDoS-immune, parallel, and pruning
+ * heavy trees during traversal. The dialect differs from JS `RegExp` — no lookbehind or
+ * backreferences — so rule patterns must be ripgrep-compatible (enforced by the
+ * `rg-dialect` spur rule; see {@link isRipgrepCompatiblePattern}).
+ *
+ * ## Options (in `evaluator.config`)
+ * - `pattern` — ripgrep regex to search for (required).
+ * - `mode` — `forbid` (default): each match is a finding. `require`: a finding per file
+ *   that lacks the pattern.
+ * - `multiline` — when `true`, patterns may span lines (`rg -U --multiline-dotall`).
+ *
+ * Inline flags like `(?i)` are passed through to ripgrep, which supports them natively.
+ *
+ * The rule's `include` globs and `exclude` globs (plus {@link DEFAULT_EXCLUDES}) are
+ * forwarded as `--glob` / `--glob '!…'` so ripgrep prunes during traversal rather than
+ * walking everything — the same skip-list the in-process discovery path uses, applied
+ * regardless of whether the workspace is a git repo or has a `.gitignore`.
+ */
+export declare class RipgrepEvaluator implements RuleEvaluator {
+    private readonly executor;
+    constructor(executor?: ProcessExecutor);
+    /** Run ripgrep and emit findings for matches (forbid) or absent files (require). */
+    evaluate(rule: ConstraintRule, context: RuleContext): Promise<RuleEvaluationResult>;
+}
+/**
+ * Report whether a regex `pattern` is safe to run under ripgrep's engine.
+ *
+ * ripgrep's Rust `regex` crate is linear-time and therefore omits features that require
+ * backtracking — lookbehind and backreferences. A pattern using them works under the JS
+ * `regex` evaluator but fails to compile under `rg`. The `rg-dialect` spur rule and the
+ * downstream rule-file converter use this to keep incompatible patterns on the `regex`
+ * type instead of silently breaking them on `rg`.
+ *
+ * @returns `{ compatible: true }` or `{ compatible: false, feature }` naming the first
+ *   unsupported construct found.
+ */
+export declare function isRipgrepCompatiblePattern(pattern: string): {
+    compatible: true;
+} | {
+    compatible: false;
+    feature: string;
+};
+//# sourceMappingURL=ripgrep-evaluator.d.ts.map

package/dist/evaluators/ripgrep-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ripgrep-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/ripgrep-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAE/B,QAAQ,GAAE,eAA2C;IAIjE,oFAAoF;IAC9E,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA2B5F;AA+ED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACtC,OAAO,EAAE,MAAM,GAChB;IAAE,UAAU,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK/D"}

package/dist/evaluators/ripgrep-evaluator.js

@@ -0,0 +1,145 @@
+import { NodeProcessExecutor } from '@gobing-ai/ts-runtime';
+import { createFinding, } from '../types.js';
+import { configString, DEFAULT_EXCLUDES } from './file-utils.js';
+/**
+ * Evaluates source files against a regex using the `rg` (ripgrep) CLI.
+ *
+ * This is the real ripgrep-backed engine registered under the `rg` rule type. Unlike
+ * the {@link import('./regex-evaluator.js').RegexEvaluator} (`regex` type, JS `RegExp`),
+ * it runs ripgrep's linear-time Rust regex engine: ReDoS-immune, parallel, and pruning
+ * heavy trees during traversal. The dialect differs from JS `RegExp` — no lookbehind or
+ * backreferences — so rule patterns must be ripgrep-compatible (enforced by the
+ * `rg-dialect` spur rule; see {@link isRipgrepCompatiblePattern}).
+ *
+ * ## Options (in `evaluator.config`)
+ * - `pattern` — ripgrep regex to search for (required).
+ * - `mode` — `forbid` (default): each match is a finding. `require`: a finding per file
+ *   that lacks the pattern.
+ * - `multiline` — when `true`, patterns may span lines (`rg -U --multiline-dotall`).
+ *
+ * Inline flags like `(?i)` are passed through to ripgrep, which supports them natively.
+ *
+ * The rule's `include` globs and `exclude` globs (plus {@link DEFAULT_EXCLUDES}) are
+ * forwarded as `--glob` / `--glob '!…'` so ripgrep prunes during traversal rather than
+ * walking everything — the same skip-list the in-process discovery path uses, applied
+ * regardless of whether the workspace is a git repo or has a `.gitignore`.
+ */
+export class RipgrepEvaluator {
+    executor;
+    constructor(executor = new NodeProcessExecutor()) {
+        this.executor = executor;
+    }
+    /** Run ripgrep and emit findings for matches (forbid) or absent files (require). */
+    async evaluate(rule, context) {
+        const config = rule.evaluator.config ?? {};
+        const pattern = configString(config, 'pattern', undefined, { evaluator: 'rg' });
+        const mode = configString(config, 'mode', 'forbid');
+        const multiline = config.multiline === true;
+        const args = buildArgs(pattern, mode, multiline, rule.include ?? [], rule.exclude ?? []);
+        const result = await this.executor.run({
+            command: 'rg',
+            args,
+            cwd: context.workdir,
+            timeout: 60_000,
+            rejectOnError: false,
+            label: 'rg',
+        });
+        // ripgrep exits 0 with matches, 1 when none, 2 on error. Treat 2 (or any non-0/1
+        // with stderr) as a hard failure so a broken pattern or missing `rg` fails loud.
+        if (result.exitCode !== 0 && result.exitCode !== 1) {
+            const detail = result.stderr.trim();
+            throw new Error(`rg failed (exit ${result.exitCode})${detail.length > 0 ? `: ${detail}` : ''}`);
+        }
+        return mode === 'require'
+            ? { findings: requireFindings(rule, pattern, result.stdout), fixes: [] }
+            : { findings: forbidFindings(rule, pattern, result.stdout), fixes: [] };
+    }
+}
+/** Build the ripgrep argument list for the given mode and scope. */
+function buildArgs(pattern, mode, multiline, include, exclude) {
+    const args = [];
+    if (multiline)
+        args.push('-U', '--multiline-dotall');
+    if (mode === 'require') {
+        // Files lacking the pattern, one path per line.
+        args.push('--files-without-match');
+    }
+    else {
+        // Structured events carrying file + line_number for precise findings.
+        args.push('--json');
+    }
+    // Scope: includes as positive globs, DEFAULT_EXCLUDES + rule excludes as negated globs
+    // so ripgrep prunes during traversal (not after) regardless of .gitignore presence.
+    for (const glob of include)
+        args.push('--glob', glob);
+    for (const dir of DEFAULT_EXCLUDES)
+        args.push('--glob', `!**/${dir}/**`);
+    for (const glob of exclude)
+        args.push('--glob', `!${glob}`);
+    // `--` guards against a pattern that begins with `-`.
+    args.push('--', pattern);
+    return args;
+}
+/** Parse `rg --json` match events into one finding per matched line. */
+function forbidFindings(rule, pattern, stdout) {
+    const findings = [];
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0)
+            continue;
+        let event;
+        try {
+            event = JSON.parse(trimmed);
+        }
+        catch {
+            continue; // Skip non-JSON noise.
+        }
+        if (event.type !== 'match')
+            continue;
+        const file = event.data?.path?.text;
+        const lineNumber = event.data?.line_number;
+        if (typeof file !== 'string' || typeof lineNumber !== 'number')
+            continue;
+        findings.push(createFinding(rule, `forbidden pattern found: ${pattern}`, file, {
+            line: lineNumber,
+            code: 'rg:found',
+        }));
+    }
+    return findings;
+}
+/** Build one finding per file path printed by `rg --files-without-match`. */
+function requireFindings(rule, pattern, stdout) {
+    const findings = [];
+    for (const line of stdout.split('\n')) {
+        const file = line.trim();
+        if (file.length === 0)
+            continue;
+        findings.push(createFinding(rule, `required pattern not found: ${pattern}`, file, { code: 'rg:missing' }));
+    }
+    return findings;
+}
+/** JS-`RegExp`-only constructs that ripgrep's Rust regex engine does not support. */
+const JS_ONLY_REGEX_FEATURES = [
+    { name: 'lookbehind', test: /\(\?<[=!]/ },
+    { name: 'backreference', test: /\\[1-9]/ },
+    { name: 'named backreference', test: /\\k<[^>]+>/ },
+];
+/**
+ * Report whether a regex `pattern` is safe to run under ripgrep's engine.
+ *
+ * ripgrep's Rust `regex` crate is linear-time and therefore omits features that require
+ * backtracking — lookbehind and backreferences. A pattern using them works under the JS
+ * `regex` evaluator but fails to compile under `rg`. The `rg-dialect` spur rule and the
+ * downstream rule-file converter use this to keep incompatible patterns on the `regex`
+ * type instead of silently breaking them on `rg`.
+ *
+ * @returns `{ compatible: true }` or `{ compatible: false, feature }` naming the first
+ *   unsupported construct found.
+ */
+export function isRipgrepCompatiblePattern(pattern) {
+    for (const { name, test } of JS_ONLY_REGEX_FEATURES) {
+        if (test.test(pattern))
+            return { compatible: false, feature: name };
+    }
+    return { compatible: true };
+}

package/dist/evaluators/schema-artifact-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-artifact-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/schema-artifact-evaluator.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;GAYG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;;IAMpC,oDAAoD;IAC9C,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAiG5F"}
+{"version":3,"file":"schema-artifact-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/schema-artifact-evaluator.ts"],"names":[],"mappings":"AACA,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;;;;GAYG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAiB;;IAMpC,oDAAoD;IAC9C,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAiG5F"}

package/dist/evaluators/schema-artifact-evaluator.js

@@ -1,6 +1,6 @@
-import { resolve } from 'node:path';
-import { NodeFileSystem } from '@gobing-ai/ts-runtime';
+import { joinPath, NodeFileSystem } from '@gobing-ai/ts-runtime';
 import { createFinding, } from '../types.js';
+import { stringArray } from './file-utils.js';
 /**
  * Evaluates JSON schema artifact files for structural integrity.
  *
@@ -31,7 +31,7 @@ export class SchemaArtifactEvaluator {
         const requiredDefs = stringArray(config.requiredDefs);
         const requireRequiredArray = config.requireRequiredArray === true;
         // Check existence.
-        const absolutePath = resolve(context.workdir, file);
+        const absolutePath = joinPath(context.workdir, file);
         const exists = await this.fs.exists(absolutePath);
         if (!exists) {
             return {
@@ -96,7 +96,3 @@ export class SchemaArtifactEvaluator {
         return { findings, fixes: [] };
     }
 }
-/** Return a string array if value is a string array, otherwise undefined. */
-function stringArray(value) {
-    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : undefined;
-}

package/dist/evaluators/sg-evaluator.d.ts

@@ -7,8 +7,16 @@ import { type ConstraintRule, type RuleContext, type RuleEvaluationResult, type
  * - `pattern` — ast-grep pattern to search for (required).
  * - `language` — language for ast-grep parsing (default: `typescript`).
  *
- * Include globs from the rule are forwarded to sg via `--glob` arguments.
- * Exclude globs from the rule are applied in-process after parsing sg output.
+ * Scope is forwarded to `sg` via `--globs` so the subprocess **prunes during traversal**
+ * rather than walking everything and filtering after:
+ * - the rule's `include` globs become positive `--globs` patterns;
+ * - {@link DEFAULT_EXCLUDES} (`node_modules`, `dist`, …) and the rule's `exclude` globs
+ *   become negated `--globs '!…'` patterns, so heavy generated trees are never descended
+ *   into even when a rule forgets to exclude them. ast-grep takes the later glob on
+ *   precedence, so exclusions are appended after includes.
+ *
+ * The rule's `exclude` is also re-applied in-process as a belt-and-suspenders against any
+ * difference between ast-grep's glob semantics and {@link matchesGlob}.
  */
 export declare class SgEvaluator implements RuleEvaluator {
     private readonly executor;

package/dist/evaluators/sg-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sg-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/sg-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;GASG;AACH,qBAAa,WAAY,YAAW,aAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAE/B,QAAQ,GAAE,eAA2C;IAIjE,wDAAwD;IAClD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAgD5F"}
+{"version":3,"file":"sg-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/sg-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAClF,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAGlB;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,WAAY,YAAW,aAAa;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAE/B,QAAQ,GAAE,eAA2C;IAIjE,wDAAwD;IAClD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAyD5F"}

package/dist/evaluators/sg-evaluator.js

@@ -1,6 +1,6 @@
 import { NodeProcessExecutor } from '@gobing-ai/ts-runtime';
 import { createFinding, } from '../types.js';
-import { matchesGlob } from './file-utils.js';
+import { DEFAULT_EXCLUDES, matchesGlob } from './file-utils.js';
 /**
  * Evaluates source code against an ast-grep pattern using the `sg` CLI.
  *
@@ -8,8 +8,16 @@ import { matchesGlob } from './file-utils.js';
  * - `pattern` — ast-grep pattern to search for (required).
  * - `language` — language for ast-grep parsing (default: `typescript`).
  *
- * Include globs from the rule are forwarded to sg via `--glob` arguments.
- * Exclude globs from the rule are applied in-process after parsing sg output.
+ * Scope is forwarded to `sg` via `--globs` so the subprocess **prunes during traversal**
+ * rather than walking everything and filtering after:
+ * - the rule's `include` globs become positive `--globs` patterns;
+ * - {@link DEFAULT_EXCLUDES} (`node_modules`, `dist`, …) and the rule's `exclude` globs
+ *   become negated `--globs '!…'` patterns, so heavy generated trees are never descended
+ *   into even when a rule forgets to exclude them. ast-grep takes the later glob on
+ *   precedence, so exclusions are appended after includes.
+ *
+ * The rule's `exclude` is also re-applied in-process as a belt-and-suspenders against any
+ * difference between ast-grep's glob semantics and {@link matchesGlob}.
  */
 export class SgEvaluator {
     executor;
@@ -27,8 +35,17 @@ export class SgEvaluator {
         const include = rule.include ?? [];
         const exclude = rule.exclude ?? [];
         const args = ['run', '--pattern', pattern, '--lang', language, '--json'];
+        // Positive include globs first.
         for (const glob of include) {
-            args.push(`--glob=${glob}`);
+            args.push('--globs', glob);
+        }
+        // Negated globs prune at traversal time. Default excludes go first so a rule's own
+        // exclude (later → higher precedence in ast-grep) can still re-include if intended.
+        for (const dir of DEFAULT_EXCLUDES) {
+            args.push('--globs', `!**/${dir}/**`);
+        }
+        for (const glob of exclude) {
+            args.push('--globs', `!${glob}`);
         }
         const result = await this.executor.run({
             command: 'sg',

package/dist/evaluators/test-location-evaluator.d.ts

@@ -1,5 +1,5 @@
-import type { CapabilityRegistry } from '../host/capability-registry';
-import type { TestPathResolver } from '../resolvers/test-path-resolver';
+import type { CapabilityRegistry } from '@gobing-ai/ts-runtime/plugin';
+import { type TestPathResolver } from '../resolvers/test-path-resolver';
 import { type ConstraintRule, type RuleContext, type RuleEvaluationResult, type RuleEvaluator } from '../types';
 /**
  * Evaluator that enforces where test files live and, optionally, that every

package/dist/evaluators/test-location-evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-location-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/test-location-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAWlB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IAE3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IADvC,kFAAkF;gBACrD,SAAS,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,YAAA;IAE7E,0EAA0E;IACpE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyDzF;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CASzB"}
+{"version":3,"file":"test-location-evaluator.d.ts","sourceRoot":"","sources":["../../src/evaluators/test-location-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,gBAAgB,EAA8B,MAAM,iCAAiC,CAAC;AACpG,OAAO,EACH,KAAK,cAAc,EAEnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACrB,MAAM,UAAU,CAAC;AAWlB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,aAAa;IAE3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IADvC,kFAAkF;gBACrD,SAAS,CAAC,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,YAAA;IAE7E,0EAA0E;IACpE,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyDzF;;;;;OAKG;IACH,OAAO,CAAC,cAAc;CASzB"}

package/dist/evaluators/test-location-evaluator.js

@@ -1,3 +1,4 @@
+import { TypeScriptTestPathResolver } from '../resolvers/test-path-resolver.js';
 import { createFinding, } from '../types.js';
 import { discoverFiles, matchesGlob } from './file-utils.js';
 /**
@@ -88,18 +89,4 @@ export class TestLocationEvaluator {
     }
 }
 /** Built-in TypeScript convention used when no resolver registry is injected. */
-const TYPESCRIPT_FALLBACK = {
-    name: 'typescript',
-    resolveTestPath(srcRelPath) {
-        if (srcRelPath.includes('.test.') || srcRelPath.includes('.spec.'))
-            return srcRelPath;
-        const srcIdx = srcRelPath.indexOf('/src/');
-        if (srcIdx !== -1) {
-            const pkg = srcRelPath.slice(0, srcIdx);
-            const rel = srcRelPath.slice(srcIdx + '/src/'.length).replace(/\.(ts|tsx|js|jsx)$/, '.test.ts');
-            return `${pkg}/tests/${rel}`;
-        }
-        const withoutExt = srcRelPath.replace(/\.(ts|tsx|js|jsx)$/, '');
-        return `tests/${withoutExt.replace(/^src\//, '')}.test.ts`;
-    },
-};
+const TYPESCRIPT_FALLBACK = new TypeScriptTestPathResolver();

package/dist/events.d.ts

@@ -0,0 +1,33 @@
+/** Typed event map for rule-engine run observability. All events prefixed `rule.`. */
+export type RuleEngineEvents = {
+    /** Emitted before the first rule is evaluated. */
+    'rule.run.start': (data: {
+        rules: number;
+        total: number;
+    }) => void;
+    /** Emitted immediately before a single rule's evaluator is invoked. */
+    'rule.eval.start': (data: {
+        ruleId: string;
+        index: number;
+        total: number;
+    }) => void;
+    /** Emitted after a single rule evaluation finishes successfully. */
+    'rule.eval.done': (data: {
+        ruleId: string;
+        findings: number;
+        durationMs: number;
+    }) => void;
+    /** Emitted when a rule evaluator throws (in addition to the `kind:'error'` finding). */
+    'rule.eval.error': (data: {
+        ruleId: string;
+        error: string;
+    }) => void;
+    /** Emitted after the last rule finishes (or was short-circuited). */
+    'rule.run.done': (data: {
+        rules: number;
+        findings: number;
+        durationMs: number;
+        stoppedEarly: boolean;
+    }) => void;
+};
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACnE,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpF,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC3F,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACrE,qEAAqE;IACrE,eAAe,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;CACnH,CAAC"}

package/dist/fixers/fixers.d.ts

@@ -5,7 +5,7 @@
  * @module rule-engine/fixers
  */
 import { NodeFileSystem, type ProcessExecutor } from '@gobing-ai/ts-runtime';
-import type { CapabilityRegistry } from '../host/capability-registry';
+import type { CapabilityRegistry } from '@gobing-ai/ts-runtime/plugin';
 import type { TestPathResolver } from '../resolvers/test-path-resolver';
 import type { ConstraintFinding, ConstraintRule, Fix, FixMode, RuleContext } from '../types';
 /** Numeric ordering for fix authority; higher means more write authority. */

package/dist/fixers/fixers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fixers.d.ts","sourceRoot":"","sources":["../../src/fixers/fixers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG7F,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAIjD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC9B;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAC9B,uDAAuD;IACvD,WAAW,CAAC,KAAK,EAAE,cAAc,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;CAC9D;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAC9B,qDAAqD;IACrD,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAa9G;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,iFAAiF;AACjF,wBAAsB,UAAU,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GAAG,EAAE,EACrB,MAAM,UAAQ,EACd,EAAE,GAAE,cAAqC,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzF;AA8BD;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAwB;IAE3C,kDAAkD;IAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAkCtF;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAwB;IAE3C,0DAA0D;IACpD,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoBtF"}
+{"version":3,"file":"fixers.d.ts","sourceRoot":"","sources":["../../src/fixers/fixers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAGH,cAAc,EACd,KAAK,eAAe,EAGvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG7F,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAIjD,CAAC;AAEF,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IACzB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,sCAAsC;IACtC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC9B;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAC9B,uDAAuD;IACvD,WAAW,CAAC,KAAK,EAAE,cAAc,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;CAC9D;AAED,yDAAyD;AACzD,MAAM,WAAW,oBAAoB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAC9B,qDAAqD;IACrD,SAAS,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;CACnD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAa9G;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,iFAAiF;AACjF,wBAAsB,UAAU,CAC5B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GAAG,EAAE,EACrB,MAAM,UAAQ,EACd,EAAE,GAAE,cAAqC,GAC1C,OAAO,CAAC,oBAAoB,CAAC,CA0D/B;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzF;AA8BD;;;;;;GAMG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAwB;IAE3C,kDAAkD;IAC5C,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAkCtF;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAwB;IAE3C,0DAA0D;IACpD,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;CAoBtF"}

package/dist/fixers/fixers.js

@@ -4,8 +4,7 @@
  *
  * @module rule-engine/fixers
  */
-import { isAbsolute, join, relative, resolve } from 'node:path';
-import { NodeFileSystem } from '@gobing-ai/ts-runtime';
+import { isAbsolutePath, joinPath, NodeFileSystem, relativePath, resolvePath, } from '@gobing-ai/ts-runtime';
 import { TestStubFixer } from './test-stub-fixer.js';
 /** Numeric ordering for fix authority; higher means more write authority. */
 export const FIX_MODE_RANK = {
@@ -30,7 +29,7 @@ export function builtInFixers(host, exec) {
 }
 /** Resolve a workdir-relative or absolute path to an absolute path. */
 export function resolveWorkdirPath(workdir, filePath) {
-    return isAbsolute(filePath) ? filePath : join(workdir, filePath);
+    return isAbsolutePath(filePath) ? filePath : joinPath(workdir, filePath);
 }
 /** Apply byte-range fixes to files, optionally returning a dry-run diff only. */
 export async function applyFixes(workdir, fixes, dryRun = false, fs = new NodeFileSystem()) {
@@ -111,8 +110,8 @@ function selectNonOverlappingFixes(fixes) {
 }
 /** Return true when absPath is at or below workdir. */
 function isInsideWorkdir(workdir, absPath) {
-    const rel = relative(resolve(workdir), resolve(absPath));
-    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+    const rel = relativePath(resolvePath(workdir), resolvePath(absPath));
+    return rel === '' || (!rel.startsWith('..') && !isAbsolutePath(rel));
 }
 /** Return true when [start, end] is a valid byte range for a string of contentLength bytes. */
 function isValidRange(start, end, contentLength) {