@ok-ggwp/git-gloss 0.3.0 → 0.5.0

package/dist/config.js

@@ -0,0 +1,248 @@
+import { z } from 'zod';
+import { git, GitError, GlossError, gitTry } from './git.js';
+import { globToRegExp } from './glob.js';
+// Settings for the computed signals, in three layers (later wins for scalars,
+// repo config extends the lists of the one before):
+//   1. DEFAULTS below: only conventions true almost everywhere, no language,
+//      framework or build tool beyond well-known file names.
+//   2. `.gloss/config.json`, committed in the repo that uses git-gloss.
+//   3. `git config gloss.attention.<key>`, for the scalars.
+// A path or pattern class in the repo config is a list that is added to the
+// default list, or `{ "extends": false, "globs": [...] }` (`"regexes"` for a
+// pattern class) to replace the default list instead.
+export const CONFIG_FILE = '.gloss/config.json';
+export class ConfigError extends GlossError {
+}
+// Classes whose paths decide a hunk's floor, and the ones that only mark it.
+export const PATH_CLASSES = ['sensitive', 'shared', 'contract', 'generated', 'test', 'docs', 'lockfile', 'manifest'];
+// Impact a pattern hit raises a hunk to.
+export const PATTERN_CLASSES = ['sensitive', 'contract', 'shared'];
+export const DEFAULTS = {
+    attention: { largeChangeFiles: 50 },
+    paths: {
+        sensitive: ['**/auth/**', '**/*crypto*', '**/*secret*', '**/*password*', '**/permissions/**', '**/migrations/**'],
+        shared: [],
+        contract: [
+            '**/package.json', '**/package-lock.json', '**/pnpm-lock.yaml', '**/yarn.lock',
+            '**/Cargo.toml', '**/Cargo.lock', '**/go.mod', '**/go.sum',
+            '**/pyproject.toml', '**/poetry.lock', '**/requirements*.txt',
+            '.github/workflows/**', '.gitlab-ci.yml', 'azure-pipelines*.yml', 'Jenkinsfile',
+            '**/Dockerfile', '**/*.proto', '**/openapi*.{yml,yaml,json}',
+        ],
+        generated: ['**/*.lock', '**/*-lock.*', '**/*.snap', '**/__snapshots__/**'],
+        test: ['**/*.{spec,test}.*', '**/test/**', '**/tests/**', '**/__tests__/**'],
+        docs: ['**/*.md', '**/docs/**'],
+        // Dependency files: always at least `contract`; changes to them are listed
+        // as dependency changes, and package-lock.json and pnpm-lock.yaml are
+        // parsed for version bumps.
+        lockfile: ['**/package-lock.json', '**/pnpm-lock.yaml', '**/yarn.lock', '**/Cargo.lock', '**/go.sum', '**/poetry.lock', '**/*.lock'],
+        manifest: ['**/package.json', '**/Cargo.toml', '**/go.mod', '**/pyproject.toml', '**/requirements*.txt'],
+    },
+    patterns: {
+        sensitive: [
+            { regex: '\\b(password|secret|private[_-]?key|api[_-]?key)\\b', name: 'secret or credential' },
+            { regex: '\\b(encrypt|decrypt)\\b', name: 'encryption' },
+            { regex: '\\b(DROP|TRUNCATE|ALTER)\\s+TABLE\\b', name: 'schema change' },
+        ],
+        contract: [],
+        shared: [],
+    },
+};
+const Glob = z.string().min(1).superRefine((g, ctx) => {
+    try {
+        globToRegExp(g);
+    }
+    catch (e) {
+        ctx.addIssue({ code: 'custom', message: `invalid glob "${g}": ${e.message}` });
+    }
+});
+const Globs = z.union([
+    z.array(Glob),
+    z.object({ extends: z.boolean().optional(), globs: z.array(Glob) }).strict(),
+]);
+// One place for how a pattern entry reads: the source, its flags (case-insensitive
+// unless it sets some) and the name shown for its hits.
+function normalise(p) {
+    if (typeof p === 'string')
+        return { source: p, flags: 'i', name: p };
+    // g and y make a RegExp remember where it last matched, which would skip hits
+    // on the next line; each line is tested on its own, so they are dropped.
+    return { source: p.regex, flags: (p.flags ?? 'i').replace(/[gy]/g, ''), name: p.name ?? p.regex };
+}
+const Regex = z.union([
+    z.string().min(1),
+    z.object({ regex: z.string().min(1), name: z.string().optional(), flags: z.string().optional() }).strict(),
+]).superRefine((p, ctx) => {
+    const { source, flags } = normalise(p);
+    try {
+        new RegExp(source, flags);
+    }
+    catch (e) {
+        ctx.addIssue({ code: 'custom', message: `invalid regular expression ${JSON.stringify(source)}: ${e.message}` });
+    }
+});
+const Regexes = z.union([
+    z.array(Regex),
+    z.object({ extends: z.boolean().optional(), regexes: z.array(Regex) }).strict(),
+]);
+const shape = (keys, v) => z.object(Object.fromEntries(keys.map((k) => [k, v.optional()]))).strict();
+export const RepoConfig = z.object({
+    attention: z.object({
+        largeChangeFiles: z.number().int().min(1).optional(),
+    }).strict().optional(),
+    paths: shape(PATH_CLASSES, Globs).optional(),
+    patterns: shape(PATTERN_CLASSES, Regexes).optional(),
+}).strict();
+const compile = (p) => {
+    const n = normalise(p);
+    return { ...n, re: new RegExp(n.source, n.flags) };
+};
+function describe(file, err) {
+    const lines = err.issues.map((i) => {
+        const where = i.path.length ? i.path.map(String).join('.') : '(top level)';
+        // Name the unknown key rather than "Unrecognized key".
+        const extra = i.code === 'unrecognized_keys' ? ` ${i.keys.map((k) => `"${k}"`).join(', ')}` : '';
+        return `  ${where}: ${i.message}${extra}`;
+    });
+    return `${file} is not a valid git-gloss config:\n${lines.join('\n')}`;
+}
+// Merge a repo config over the defaults. Pure, so tests can call it directly.
+export function mergeConfig(raw) {
+    const list = (base, over, key) => {
+        if (!over)
+            return base;
+        if (Array.isArray(over))
+            return [...base, ...over];
+        const items = over[key];
+        return over.extends === false ? items : [...base, ...items];
+    };
+    const paths = {};
+    for (const k of PATH_CLASSES)
+        paths[k] = list(DEFAULTS.paths[k], raw?.paths?.[k], 'globs');
+    const patterns = {};
+    for (const k of PATTERN_CLASSES)
+        patterns[k] = list(DEFAULTS.patterns[k], raw?.patterns?.[k], 'regexes').map(compile);
+    // Editing the config changes how every later change is rated; no repo config can drop this.
+    paths.sensitive = [...paths.sensitive, CONFIG_FILE];
+    return { attention: { ...DEFAULTS.attention, ...raw?.attention }, paths, patterns };
+}
+// `git config gloss.attention.<key>` as a positive integer; throws naming the key.
+function gitInt(key) {
+    const v = gitTry(['config', '--get', `gloss.attention.${key}`])?.trim();
+    if (v === undefined || v === '')
+        return undefined;
+    if (!/^[1-9]\d*$/.test(v))
+        throw new ConfigError(`git config gloss.attention.${key} must be a positive integer, got "${v}"`);
+    return Number(v);
+}
+// Git failing (a broken repo, an unreadable object, no permission) is not the
+// same as "no base" or "no file": the repo's own, perhaps stricter, config
+// would silently not apply. It is not fatal either (the built-in defaults
+// still give a floor, and refusing to rate anything would make every command
+// fail in a damaged repo), so it is warned about on stderr, once per message,
+// and the defaults are used.
+const warned = new Set();
+function warnOnce(msg) {
+    if (warned.has(msg))
+        return;
+    warned.add(msg);
+    console.error(`warning: ${msg}`);
+}
+// git's output, or null when it exits 1 with nothing to say (its way of
+// answering "no"); any other failure is thrown.
+function gitAnswer(args) {
+    try {
+        return git(args);
+    }
+    catch (err) {
+        if (err instanceof GitError && err.status === 1 && /failed$/.test(err.message))
+            return null;
+        throw err;
+    }
+}
+// The config is read from the base branch, not the working tree: a change under
+// review must not be able to reclassify its own paths or add patterns that
+// lower its own floor. The base is the merge base of the checked-out HEAD (not
+// the commit under review) and the first of origin/main, main, origin/master,
+// master that shares history with it, so a long-lived branch sees the config as
+// of its fork point. With none of them there
+// is no trusted base, so the built-in defaults apply (with a warning), never
+// the change's own config. Editing the file in a change is itself flagged: it
+// is always a `sensitive` path.
+function trustedRef() {
+    // No commits yet: no base, and nothing failed.
+    if (gitAnswer(['rev-parse', '--verify', '-q', 'HEAD']) === null)
+        return noBase();
+    let failed = false;
+    // Full ref names, so a tag called "main" cannot stand in for the branch.
+    for (const b of ['refs/remotes/origin/main', 'refs/heads/main', 'refs/remotes/origin/master', 'refs/heads/master']) {
+        try {
+            if (gitAnswer(['rev-parse', '--verify', '-q', b]) === null)
+                continue;
+            const mb = gitAnswer(['merge-base', 'HEAD', b])?.trim();
+            if (mb)
+                return mb;
+        }
+        catch (err) {
+            // A broken candidate does not hide the ones after it.
+            failed = true;
+            warnOnce(`git failed finding the base branch with ${b} (${err.message}); trying the next candidate`);
+        }
+    }
+    // Some candidate failed: git's warning above is the reason, not an absent branch.
+    return failed ? (console.error(`warning: no working base branch, so ${CONFIG_FILE} is not read; using the built-in defaults`), null) : noBase();
+}
+function noBase() {
+    console.error('warning: no base branch (origin/main, main, origin/master, master) found, so .gloss/config.json is not read; using the built-in defaults');
+    return null;
+}
+// The config file at `ref`: null when the file is not there (the usual case),
+// a warning and null when git could not tell or could not read it. Presence
+// is asked of ls-tree (empty output: absent), not read off an error message.
+function configAt(ref) {
+    try {
+        if (!git(['ls-tree', '--full-tree', '--name-only', ref, '--', CONFIG_FILE]).trim())
+            return null;
+        return git(['show', `${ref}:${CONFIG_FILE}`]);
+    }
+    catch (err) {
+        warnOnce(`${CONFIG_FILE} could not be read from the base branch (${err.message}); using the built-in defaults, so the repo's own patterns do not apply`);
+        return null;
+    }
+}
+function readRepoConfig() {
+    const ref = trustedRef();
+    const text = ref ? configAt(ref) : null;
+    if (text === null)
+        return undefined;
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch (err) {
+        throw new ConfigError(`${CONFIG_FILE} is not valid JSON: ${err.message}`);
+    }
+    const parsed = RepoConfig.safeParse(json);
+    if (!parsed.success)
+        throw new ConfigError(describe(CONFIG_FILE, parsed.error));
+    return parsed.data;
+}
+// Per working directory, so a command over many commits resolves the repo once.
+const cache = new Map();
+export const resetConfigCache = () => cache.clear();
+// The effective config for the repository the process runs in (the repo file
+// as of the base branch, see trustedRef). Throws ConfigError (with the file
+// and key) for a malformed repo config or git setting. Memoised per working
+// directory.
+export function loadConfig() {
+    const hit = cache.get(process.cwd());
+    if (hit)
+        return hit;
+    const raw = readRepoConfig();
+    const config = mergeConfig(raw);
+    const files = gitInt('largeChangeFiles');
+    if (files !== undefined)
+        config.attention.largeChangeFiles = files;
+    cache.set(process.cwd(), config);
+    return config;
+}

package/dist/floor.js

@@ -0,0 +1,148 @@
+import { ConfigError, loadConfig } from './config.js';
+import { attentionForImpact, attentionRank, impactRank, maxAttention, maxImpact, raise } from './attention.js';
+import { servesOf } from './schema.js';
+import { analyze, CONFIG_EDIT_NOTE, partFloor, timedOutNotes } from './signals.js';
+import { changedCount, selections } from './selection.js';
+// The groups of a loaded gloss with their current hunks (a hunk that is gone is skipped).
+export function groupInputs(gloss) {
+    return gloss.groups.map((g) => ({
+        group: g.group,
+        parts: g.hunks.flatMap((h) => (h.current ? [{ hunk: h.current, lines: h.lines }] : [])),
+    }));
+}
+// The groups of an annotation over hunks of the diff (as `add` has them).
+export function groupInputsFor(a, hunks) {
+    const byId = new Map(hunks.map((h) => [h.id, h]));
+    return a.groups.map((group) => ({
+        group,
+        parts: [...selections(group.hunks, (id) => { const h = byId.get(id); return h && changedCount(h); })]
+            .flatMap(([id, lines]) => { const hunk = byId.get(id); return hunk ? [{ hunk, lines }] : []; }),
+    }));
+}
+// Group floors, and the derivation of the attention for when the author declares none:
+//
+//   start from the highest group impact (declared, else the group's floor):
+//     local skim, module look, shared and contract careful, sensitive must-read;
+//   raise it ONE step (capped at must-read), however many of these apply:
+//     - a behaviour-changing group no test-only group serves (see GroupFloor);
+//     - a speculative or defensive group that is not made only of test hunks;
+//     - more than attention.largeChangeFiles files changed;
+//   never below the change's floor (which is the highest hunk floor, and at
+//   least careful for a large change).
+export function analyzeGroups(hunks, groups, cfg) {
+    const signals = analyze(hunks, cfg);
+    const sigOf = new Map(signals.hunks.map((s) => [s.id, s]));
+    const floors = new Map();
+    for (const { group, parts } of groups) {
+        let floor = 'local';
+        const found = [];
+        for (const { hunk, lines } of parts) {
+            const s = sigOf.get(hunk.id);
+            if (!s)
+                continue;
+            const p = partFloor(s, lines);
+            floor = maxImpact(floor, p.floor);
+            found.push({ floor: p.floor, why: p.why.map((w) => `${hunk.file}: ${w}`) });
+        }
+        const sigs = parts.map((p) => sigOf.get(p.hunk.id)).filter((s) => !!s);
+        floors.set(group.id, {
+            floor,
+            why: [...new Set(found.filter((f) => f.floor === floor).flatMap((f) => f.why))].slice(0, 3),
+            behaviour: group.necessity !== 'mechanical' && sigs.some((s) => !s.inert),
+            testsOnly: sigs.length > 0 && sigs.every((s) => s.test),
+            tested: false,
+        });
+    }
+    // A test-only group serves what it names, and what those groups serve in turn.
+    const byId = new Map(groups.map((g) => [g.group.id, g.group]));
+    for (const { group } of groups) {
+        if (!floors.get(group.id).testsOnly)
+            continue;
+        const seen = new Set();
+        const queue = servesOf(group).filter((t) => t !== 'task');
+        while (queue.length) {
+            const id = queue.shift();
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            const f = floors.get(id);
+            if (f)
+                f.tested = true;
+            const g = byId.get(id);
+            if (g)
+                queue.push(...servesOf(g).filter((t) => t !== 'task'));
+        }
+    }
+    // Derivation.
+    let top = { impact: undefined, id: '', declared: false };
+    for (const { group } of groups) {
+        const impact = group.impact ?? floors.get(group.id).floor;
+        if (impactRank(impact) > impactRank(top.impact))
+            top = { impact, id: group.id, declared: !!group.impact };
+    }
+    const reasons = [];
+    let level = top.impact ? attentionForImpact(top.impact) : signals.floor.attention;
+    if (top.impact)
+        reasons.push(`highest group impact: ${top.impact} (${top.id}, ${top.declared ? 'declared' : 'from the diff'})`);
+    const raises = [];
+    const untested = groups.filter((g) => floors.get(g.group.id).behaviour && !floors.get(g.group.id).tested).map((g) => g.group.id);
+    if (untested.length)
+        raises.push(`behaviour change without a test serving it: ${untested.join(', ')}`);
+    const hedged = groups.filter((g) => (g.group.necessity === 'speculative' || g.group.necessity === 'defensive') && !floors.get(g.group.id).testsOnly);
+    if (hedged.length)
+        raises.push(`speculative or defensive code: ${hedged.map((g) => g.group.id).join(', ')}`);
+    if (signals.stats.files > cfg.attention.largeChangeFiles)
+        raises.push(`${signals.stats.files} files changed (more than ${cfg.attention.largeChangeFiles})`);
+    if (raises.length) {
+        level = raise(level);
+        reasons.push(...raises.map((r) => `raised one step: ${r}`));
+    }
+    if (attentionRank(signals.floor.attention) > attentionRank(level)) {
+        level = maxAttention(level, signals.floor.attention);
+        reasons.push(`floor ${signals.floor.attention}: ${signals.floor.reasons[0] ?? signals.floor.impact}`);
+    }
+    return { signals, groups: floors, floor: signals.floor.attention, derived: { level, reasons }, timedOut: timedOutNotes(signals.hunks) };
+}
+export const analyzeGloss = (gloss, cfg) => analyzeGroups(gloss.hunks, groupInputs(gloss), cfg);
+export function ratingProblems(a, an) {
+    const warnings = [];
+    if (an.signals.floor.reasons.includes(CONFIG_EDIT_NOTE))
+        warnings.push(CONFIG_EDIT_NOTE);
+    for (const g of a.groups) {
+        const f = an.groups.get(g.id);
+        // A floor of plain "module" is the baseline for source files, not a signal
+        // to warn about: a private helper may honestly be `local`.
+        if (!g.impact || !f || impactRank(f.floor) <= impactRank('module') || impactRank(g.impact) >= impactRank(f.floor))
+            continue;
+        warnings.push(`group "${g.id}" is rated impact "${g.impact}" but its floor is "${f.floor}" (${f.why.join('; ') || 'computed from the diff'}); raise it, or say why in impact_reason`);
+    }
+    let underrated = null;
+    const att = a.attention;
+    if (att && attentionRank(att.level) < attentionRank(an.floor) && !att.override_reason) {
+        const why = an.signals.floor.reasons.length ? an.signals.floor.reasons.join('; ') : `${an.signals.floor.impact}: ordinary source changes`;
+        underrated = `attention.level "${att.level}" is below the computed floor "${an.floor}" (${why}); raise it, or explain with attention.override_reason`;
+    }
+    return { warnings, underrated };
+}
+let warned = false;
+// Run something that needs the signals' config; null when the config is
+// malformed (say why once on stderr), so callers fall back to what is declared.
+export function withSignals(fn) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        if (!(err instanceof ConfigError))
+            throw err;
+        if (!warned)
+            console.error(`warning: signals unavailable: ${err.message}`);
+        warned = true;
+        return null;
+    }
+}
+// The analysis of a loaded gloss, or null when the signals cannot be computed.
+export const tryAnalyze = (gloss) => withSignals(() => analyzeGloss(gloss, loadConfig()));
+// Whether a gloss's groups get an impact column (show) or badges (html): some
+// group declares an impact, or the diff puts a group's floor above the module
+// baseline. Then undeclared groups show their floor as a derived impact.
+export const showsImpact = (groups, an) => groups.some((g) => g.impact || impactRank(an?.groups.get(g.id)?.floor) > impactRank('module'));

package/dist/git.js

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Annotation, NOTE_FORMAT } from './schema.js';
 import { parsePath, unquote } from './diff.js';
+import { plain } from './plain.js';
 export const NOTES_REF = 'refs/notes/gloss';
 // Glosses of uncommitted work (wip snapshots) live in their own notes ref,
 // which sync never pushes, and the latest snapshot in a private ref that
@@ -18,6 +19,8 @@ export const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
 export class GlossError extends Error {
 }
 export class GitError extends GlossError {
+    // git's exit code, when it ran and failed (1 is often "no", 128 a real failure).
+    status;
 }
 export function git(args, input, env = {}) {
     try {
@@ -32,7 +35,9 @@ export function git(args, input, env = {}) {
     }
     catch (err) {
         const stderr = err.stderr?.trim();
-        throw new GitError(stderr || `git ${args.join(' ')} failed`);
+        const e = new GitError(stderr || `git ${args.join(' ')} failed`);
+        e.status = typeof err.status === 'number' ? err.status : undefined;
+        throw e;
     }
 }
 export function gitTry(args, input) {
@@ -142,6 +147,16 @@ export function wipStaleness(sha) {
         return 'the working tree has changed since this snapshot was taken';
     return null;
 }
+// The diff of uncommitted work against HEAD, as a snapshot would have it,
+// without taking a snapshot: no ref is written (only objects). Hunk ids match
+// those of `hunks wip` for the same working tree.
+export function workingDiff() {
+    const { tree, excluded } = workingTree();
+    const head = headSha();
+    if (head && git(['rev-parse', `${head}^{tree}`]).trim() === tree)
+        throw new GlossError('there are no uncommitted changes');
+    return { diff: diffBetween(head ?? EMPTY_TREE, tree), excluded };
+}
 export function resolveCommit(rev) {
     // "wip": the latest snapshot of uncommitted work (made by `hunks wip`). A
     // branch or tag named wip still works when there is no snapshot, and can be
@@ -214,6 +229,15 @@ function rawNote(ref, sha) {
         throw err;
     }
 }
+function cleanStrings(v) {
+    if (typeof v === 'string')
+        return plain(v, true);
+    if (Array.isArray(v))
+        return v.map(cleanStrings);
+    if (v && typeof v === 'object')
+        return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, cleanStrings(x)]));
+    return v;
+}
 export function readNote(sha) {
     // A commit's gloss, or a wip snapshot's (they are never the same object).
     const raw = rawNote(NOTES_REF, sha) ?? rawNote(WIP_NOTES_REF, sha);
@@ -236,10 +260,12 @@ export function readNote(sha) {
         throw new GlossError(`${at} was written by a newer git-gloss (format ${data.gloss}); upgrade to read it`);
     }
     const annotation = Annotation.safeParse(data?.annotation);
-    if (![1, 2, 3].includes(data?.gloss) || !Array.isArray(data.hunks) || !annotation.success) {
+    if (![1, 2, 3, 4].includes(data?.gloss) || !Array.isArray(data.hunks) || !annotation.success) {
         throw new GlossError(`${at} is malformed; replace it with \`git gloss add --force\``);
     }
-    return { ...data, annotation: annotation.data };
+    // The gloss's text is shown in a terminal, and a note can come from anyone
+    // who can push to the remote: no escape sequences or control characters get through.
+    return { ...data, annotation: cleanStrings(annotation.data) };
 }
 export function writeNote(sha, note, ref = NOTES_REF) {
     git(['notes', '--ref', ref, 'add', '-f', '-F', '-', sha], JSON.stringify(note, null, 2) + '\n');

package/dist/glob.js

@@ -0,0 +1,76 @@
+// A small glob matcher for repo paths (always "/"-separated, relative to the
+// repo root). Supports `**` (any number of directories, including none when
+// written as `**/` or `/**`), `*` (anything but "/"), `?` (one character but
+// "/"), `{a,b}` alternatives (nestable) and `\` to escape. A pattern without a
+// "/" matches the file name at any depth, as in .gitignore ("Jenkinsfile",
+// "*.lock"). Node's path.matchesGlob is not used: it is missing before Node 22.
+const SPECIAL = /[.+^$()|[\]\\]/;
+export class GlobError extends Error {
+}
+function translate(glob) {
+    let out = '';
+    let depth = 0;
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '\\') {
+            if (i + 1 >= glob.length)
+                throw new GlobError('trailing backslash');
+            out += glob[++i].replace(/[^a-zA-Z0-9]/, '\\$&');
+            continue;
+        }
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                let j = i + 1;
+                while (glob[j + 1] === '*')
+                    j++;
+                const atStart = i === 0 || glob[i - 1] === '/';
+                if (glob[j + 1] === '/' && atStart) {
+                    out += '(?:.*/)?';
+                    i = j + 1;
+                } // "**/": any directories, or none
+                else {
+                    out += '.*';
+                    i = j;
+                }
+            }
+            else
+                out += '[^/]*';
+            continue;
+        }
+        if (c === '?') {
+            out += '[^/]';
+            continue;
+        }
+        if (c === '{') {
+            depth++;
+            out += '(?:';
+            continue;
+        }
+        if (c === ',' && depth > 0) {
+            out += '|';
+            continue;
+        }
+        if (c === '}' && depth > 0) {
+            depth--;
+            out += ')';
+            continue;
+        }
+        out += SPECIAL.test(c) ? '\\' + c : c;
+    }
+    if (depth > 0)
+        throw new GlobError('unclosed "{"');
+    return out;
+}
+const cache = new Map();
+// The regular expression for a glob; throws GlobError if it is malformed.
+export function globToRegExp(glob) {
+    let re = cache.get(glob);
+    if (!re) {
+        const body = translate(glob);
+        // Without a "/", match the last path component at any depth.
+        re = new RegExp('^' + (glob.includes('/') ? '' : '(?:.*/)?') + body + '$');
+        cache.set(glob, re);
+    }
+    return re;
+}
+export const matchGlob = (glob, path) => globToRegExp(glob).test(path);