@pugi/cli 0.1.0-beta.99 → 1.0.0-alpha.1

package/dist/core/pugi-md/cc-compat-rules.js

@@ -1,735 +0,0 @@
-/**
- * Backlog — CLAUDE.md `@import` + `paths:` glob
- * rule loader, the upstream tool parity for the ambient-context
- * pipeline.
- *
- * Why this module is separate from `core/context/markdown-loader.ts`:
- *
- *  - `markdown-loader.ts` is the *workspace-bounded* loader. Its
- *    `@import` rejects anything that escapes the workspace root, and
- *    it inlines imports into the body without preserving per-rule
- *    metadata. That model fits PUGI.md / AGENTS.md at the workspace
- *    root but does NOT match the upstream tool's CLAUDE.md semantics where
- *    `@~/global.md` (homedir-anchored) is a first-class citizen.
- *
- *  - This module implements the *home-aware* CLAUDE.md loader the
- *    ambient walk-up needs. It walks `@import` directives anchored to
- *    `./`, `../`, or `~/`, refuses bare or absolute paths, and
- *    surfaces `paths:` frontmatter glob arrays so downstream layers
- *    can decide per-rule whether to inject a given rule based on the
- *    files the operator is editing right now.
- *
- * Contract recap (see backlog task):
- *
- *  - `loadRulesFile(entryPath, opts)` returns one `LoadedRule` per
- *    loaded markdown file. The first entry is always the entry file;
- *    subsequent entries are recursively-imported children in DFS
- *    order. Each rule's `body` has its frontmatter stripped and
- *    `@import` lines removed. Imports are NOT inlined into the
- *    parent's body — the caller decides how to compose the multi-file
- *    rule set.
- *
- *  - `@import` resolution:
- *      `@./foo.md` → relative to dirname(currentFile)
- *      `@../foo.md` → relative parent
- *      `@~/foo.md` → relative to options.homedir
- *    Absolute (`@/...`) and bare (`@org/pkg`) imports are rejected.
- *
- *  - Cycle detection through `realpathSync` so symlink loops trip the
- *    visited-set even when they go via different surface paths.
- *
- *  - Hard hop cap `maxHops` (default 4); throws `RuleImportError` on
- *    overflow. Each loaded file counts as one hop — the entry file is
- *    hop 1, its direct `@import` children are hop 2, and so on. A
- *    chain of 5 files (A → B → C → D → E) trips the default 4-hop
- *    cap on hop 5 (file E).
- *
- *  - Byte caps: per-file `maxFileBytes` (default 256 KiB) and
- *    aggregate `maxTotalBytes` (default 1 MiB) refuse the load.
- *
- *  - Minimal YAML frontmatter parser scoped strictly to
- *    `paths: [glob, glob, ...]`. No dependency on a full YAML lib.
- *
- *  - `pathMatchesRule(filePath, rule)` is pure (no I/O): given a rule
- *    and a candidate path, it returns true when ANY of the rule's
- *    `paths` globs match. A rule with no `paths` matches every path
- *    (sentinel "rule applies globally").
- *
- * Determinism:
- *
- *  - Glob matching uses a hand-rolled converter to a `RegExp`
- *    supporting `**` (any depth), `*` (single segment wildcard), `?`
- *    (single char), and `[abc]` character classes. We deliberately do
- *    NOT pull in `node:fs.globSync` for matching — globSync is an fs
- *    walker, not a string matcher, and shimming it would re-introduce
- *    I/O into `pathMatchesRule` which the contract forbids.
- *
- *  - All paths are canonicalized through `path.resolve` then
- *    `realpathSync` BEFORE the visited-set check so an A → symlink → A
- *    loop is detected the same way as a direct A → A loop.
- *
- *  - UTF-8 BOM is stripped from every loaded file before frontmatter
- *    parse — operators sometimes save CLAUDE.md via Windows tools
- *    that prepend `` and a BOM-prefixed `---` would fail the
- *    frontmatter detection.
- *
- * No I/O, no fs writes; only `readFileSync` + `realpathSync` +
- * `statSync`. No new dependencies.
- */
-import { readFileSync, realpathSync, statSync } from 'node:fs';
-import { dirname, isAbsolute, posix, resolve, sep } from 'node:path';
-/**
- * Default per-file byte cap. 256 KiB is generous for an operator-
- * authored CLAUDE.md (typical 5-20 KiB) while keeping a runaway
- * generated file from blowing the prompt budget on its own.
- */
-export const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
-/**
- * Default aggregate byte cap across the entire import graph. 1 MiB is
- * higher than any realistic CLAUDE.md graph and exists as a hard floor
- * against pathological imports (e.g. an accidentally-imported full
- * source-code dump).
- */
-export const DEFAULT_MAX_TOTAL_BYTES = 1024 * 1024;
-/**
- * Default hop cap matches the upstream tool's documented 4-deep recursion
- * for `@import` directives. The entry file is hop 1; each
- * `@import` it issues lands at hop 2, and so on. A 5-level chain
- * (A → B → C → D → E) exceeds the default 4 and throws on file E.
- */
-export const DEFAULT_MAX_HOPS = 4;
-/**
- * Error thrown when the loader refuses to complete a load. The
- * `path` carries the offending file (or the importer's path for
- * resolution failures). `cycle` is populated for the `cycle` reason
- * with the import stack at the point of detection.
- */
-export class RuleImportError extends Error {
-    path;
-    reason;
-    cycle;
-    constructor(message, detail) {
-        super(message);
-        this.name = 'RuleImportError';
-        this.path = detail.path;
-        this.reason = detail.reason;
-        if (detail.cycle)
-            this.cycle = detail.cycle;
-    }
-}
-/**
- * Load `entryPath` and recursively expand its `@import` directives.
- * Returns one `LoadedRule` per visited file. The first entry is always
- * the entry file (`source: 'file'`); transitively-imported children
- * follow in depth-first order (`source: 'imported'`).
- *
- * Throws `RuleImportError` on cycle, hop overflow, byte overflow,
- * or any rejected import target. fs errors on the entry file itself
- * propagate as `RuleImportError` with reason `read_failed`.
- */
-export async function loadRulesFile(entryPath, options) {
-    const maxHops = options.maxHops ?? DEFAULT_MAX_HOPS;
-    const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
-    const maxTotalBytes = options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
-    const visited = new Set();
-    const stack = [];
-    const rules = [];
-    const totalBytes = { value: 0 };
-    const allowedRoots = resolveAllowedRoots(options);
-    await loadRecursive({
-        rawPath: entryPath,
-        importerDir: options.cwd,
-        sourceLabel: 'file',
-        hop: 1,
-        maxHops,
-        maxFileBytes,
-        maxTotalBytes,
-        homedir: options.homedir,
-        visited,
-        stack,
-        rules,
-        totalBytes,
-        allowedRoots,
-    });
-    return rules;
-}
-/**
- * Resolve the canonical allowed-root set. Each root is realpath'd so
- * symlinked workspace / home directories still match the descendant
- * predicate. Roots that do not exist on disk are silently dropped —
- * an operator without `~/.claude` should not see a load failure on
- * every file, but their `@~/foo.md` will fail the containment check
- * with a clear `path_escape` error.
- *
- * Triple-review P0 fix.
- */
-function resolveAllowedRoots(options) {
-    if (options.allowedRoots && options.allowedRoots.length > 0) {
-        return options.allowedRoots
-            .map((root) => safeRealpath(root))
-            .filter((root) => root !== null);
-    }
-    const candidates = [
-        options.cwd,
-        resolve(options.homedir, '.claude'),
-        resolve(options.homedir, '.pugi'),
-    ];
-    return candidates
-        .map((c) => safeRealpath(c))
-        .filter((c) => c !== null);
-}
-function safeRealpath(p) {
-    try {
-        return realpathSync(resolve(p));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Containment predicate: is `candidate` a descendant of any allowed
- * root? Trailing-separator normalised so `/foo/bar` is NOT a
- * descendant of `/foo/ba`. Both `candidate` and `roots` must already
- * be realpath'd by the caller — this is a pure path predicate, no
- * I/O.
- */
-function isContainedIn(candidate, roots) {
-    for (const root of roots) {
-        if (candidate === root)
-            return true;
-        const rootWithSep = root.endsWith(sep) ? root : `${root}${sep}`;
-        if (candidate.startsWith(rootWithSep))
-            return true;
-    }
-    return false;
-}
-/**
- * Recursive worker. Resolves `rawPath` to an absolute realpath, gates
- * it against the byte + hop budgets, parses frontmatter, then walks
- * any `@import` directives in source order.
- */
-async function loadRecursive(input) {
-    const { rawPath, importerDir, sourceLabel, hop, maxHops, maxFileBytes, maxTotalBytes, homedir, visited, stack, rules, totalBytes, } = input;
-    // Hop cap is enforced BEFORE the read so a cycle that gets reported
-    // as `cycle` first (preferred diagnostic) does not first trip the
-    // hop cap when both apply.
-    if (hop > maxHops) {
-        throw new RuleImportError(`import hop cap exceeded at depth ${hop} (max ${maxHops}) loading ${rawPath}`, { path: rawPath, reason: 'hop_cap_exceeded' });
-    }
-    const absolutePath = resolve(rawPath);
-    let realPath;
-    try {
-        realPath = realpathSync(absolutePath);
-    }
-    catch (error) {
-        throw new RuleImportError(`realpath failed for ${absolutePath}: ${error.message}`, { path: absolutePath, reason: 'realpath_failed' });
-    }
-    // Security gates run on the post-realpath canonical identity so a
-    // symlink to `/etc/passwd` is rejected the same as a literal
-    // `@/etc/passwd`. Triple-review P0 fix.
-    if (!isContainedIn(realPath, input.allowedRoots)) {
-        throw new RuleImportError(`rule import escapes allowed roots: ${realPath}`, { path: realPath, reason: 'path_escape' });
-    }
-    if (!/\.md$/i.test(realPath)) {
-        throw new RuleImportError(`rule import target must be a .md file: ${realPath}`, { path: realPath, reason: 'extension_not_allowed' });
-    }
-    // Reject dotfile segments AFTER the allowed root prefix. We allow
-    // dotfile ROOTS (e.g. `.claude`, `.pugi`) but not deeper dotfile
-    // segments like `.ssh/id_rsa.md`. Compute the path relative to the
-    // matched root and split on `sep`.
-    for (const root of input.allowedRoots) {
-        if (realPath === root)
-            break;
-        const rootWithSep = root.endsWith(sep) ? root : `${root}${sep}`;
-        if (!realPath.startsWith(rootWithSep))
-            continue;
-        const relative = realPath.slice(rootWithSep.length);
-        const segments = relative.split(sep);
-        for (const segment of segments) {
-            if (segment.length > 0 && segment.startsWith('.')) {
-                throw new RuleImportError(`rule import traverses dotfile segment: ${realPath}`, { path: realPath, reason: 'dotfile_segment' });
-            }
-        }
-        break;
-    }
-    // Cycle detection uses the post-realpath absolute path so a loop
-    // routed through a symlink lands in the same visited-set bucket as
-    // a direct loop. The stack carries the full chain for the
-    // diagnostic message.
-    if (visited.has(realPath)) {
-        const cycle = [...stack, realPath];
-        throw new RuleImportError(`import cycle detected: ${cycle.join(' -> ')}`, { path: realPath, reason: 'cycle', cycle });
-    }
-    let stats;
-    try {
-        stats = statSync(realPath);
-    }
-    catch (error) {
-        throw new RuleImportError(`stat failed for ${realPath}: ${error.message}`, { path: realPath, reason: 'read_failed' });
-    }
-    if (stats.size > maxFileBytes) {
-        throw new RuleImportError(`file exceeds per-file byte cap (${stats.size} > ${maxFileBytes}): ${realPath}`, { path: realPath, reason: 'file_too_large' });
-    }
-    if (totalBytes.value + stats.size > maxTotalBytes) {
-        throw new RuleImportError(`import graph exceeds aggregate byte cap (${totalBytes.value + stats.size} > ${maxTotalBytes}) at ${realPath}`, { path: realPath, reason: 'aggregate_too_large' });
-    }
-    let raw;
-    try {
-        raw = readFileSync(realPath, 'utf8');
-    }
-    catch (error) {
-        throw new RuleImportError(`read failed for ${realPath}: ${error.message}`, { path: realPath, reason: 'read_failed' });
-    }
-    // Reserve the budget before recursing so children see the post-
-    // increment value. We never refund: a partially-loaded graph still
-    // counts against the cap.
-    totalBytes.value += stats.size;
-    visited.add(realPath);
-    stack.push(realPath);
-    // Strip UTF-8 BOM. Saved-from-Windows CLAUDE.md often carries ``
-    // at byte 0 and a BOM-prefixed `---` would defeat the frontmatter
-    // detection regex below.
-    const stripped = stripBom(raw);
-    const { paths, bodyAfterFrontmatter } = parseFrontmatter(stripped);
-    // Split into lines once; we use the line slice both for `@import`
-    // detection and for body assembly. Lines that match the import
-    // pattern are removed from the body — the loader's job is to expand
-    // them, not preserve the source-level directive.
-    const lines = bodyAfterFrontmatter.split('\n');
-    const bodyLines = [];
-    const importTargets = [];
-    for (const line of lines) {
-        const match = IMPORT_LINE_PATTERN.exec(line);
-        if (!match) {
-            bodyLines.push(line);
-            continue;
-        }
-        const target = match[1];
-        // Capture group is required — defensive guard for strict TS.
-        if (typeof target !== 'string' || target.length === 0) {
-            throw new RuleImportError(`empty @import target in ${realPath}`, { path: realPath, reason: 'invalid_import_target' });
-        }
-        importTargets.push(target);
-    }
-    rules.push({
-        path: realPath,
-        body: bodyLines.join('\n'),
-        paths,
-        source: sourceLabel,
-    });
-    // Resolve + recurse imports in source order so the resulting
-    // `LoadedRule[]` reflects the DFS traversal — the operator can
-    // reason about which `@import` produced which rule simply by reading
-    // top-to-bottom.
-    for (const target of importTargets) {
-        const resolved = resolveImportTarget(target, {
-            importerFile: realPath,
-            importerDir: dirname(realPath),
-            homedir,
-        });
-        await loadRecursive({
-            rawPath: resolved,
-            importerDir: dirname(realPath),
-            sourceLabel: 'imported',
-            hop: hop + 1,
-            maxHops,
-            maxFileBytes,
-            maxTotalBytes,
-            homedir,
-            visited,
-            stack,
-            rules,
-            totalBytes,
-            allowedRoots: input.allowedRoots,
-        });
-    }
-    // Pop AFTER the recursion so sibling imports do not see each other
-    // in the stack (they are not on the same DFS path).
-    stack.pop();
-}
-/**
- * Line pattern for `@import <target>`. Anchored to line start so a
- * literal `@import` inside a fenced code block (indented or otherwise
- * not at column 0) is left alone. Trailing whitespace is tolerated.
- */
-const IMPORT_LINE_PATTERN = /^@import\s+(\S+)\s*$/;
-/**
- * Resolve an `@import` target string to an absolute path. Enforces the
- * security rules from the contract:
- *
- *  - `./foo.md`, `../foo.md` → resolved against `importerDir`
- *  - `~/foo.md`             → resolved against `homedir`
- *  - `/etc/passwd`          → REJECTED (absolute path)
- *  - `org/pkg`              → REJECTED (bare prefix without ./ ~/ ../)
- *
- * The returned path is NOT realpath-resolved here — the caller does
- * that on read so the cycle-detection set always keys on the canonical
- * file identity.
- */
-function resolveImportTarget(target, ctx) {
-    if (target.length === 0) {
-        throw new RuleImportError(`empty @import target from ${ctx.importerFile}`, { path: ctx.importerFile, reason: 'invalid_import_target' });
-    }
-    if (isAbsolute(target)) {
-        throw new RuleImportError(`@import absolute path rejected: ${target} (from ${ctx.importerFile})`, { path: ctx.importerFile, reason: 'absolute_import' });
-    }
-    if (target.startsWith('~/')) {
-        return resolve(ctx.homedir, target.slice(2));
-    }
-    if (target.startsWith('./') || target.startsWith('../')) {
-        return resolve(ctx.importerDir, target);
-    }
-    // Anything else (bare prefix like `org/pkg` or `some-file.md`) is
-    // rejected so the operator can never accidentally import a sibling
-    // file without an explicit `./` qualifier. The strict prefix rule
-    // also makes the loader's behaviour easy to predict by inspection.
-    throw new RuleImportError(`@import target must start with ./, ../ or ~/: ${target} (from ${ctx.importerFile})`, { path: ctx.importerFile, reason: 'bare_prefix_import' });
-}
-/**
- * Parse the file's YAML frontmatter block, scoped strictly to the
- * single key we need: `paths`. Returns the body with the frontmatter
- * block removed and the parsed `paths` array (or `undefined` when no
- * frontmatter / no `paths:` key was present).
- *
- * Supported `paths:` syntax:
- *
- *  paths:
- *    - src/**\/*.ts
- *    - "tests/**"
- *    - 'docs/*.md'
- *
- * AND the inline-flow form:
- *
- *  paths: [src/**\/*.ts, "tests/**", 'docs/*.md']
- *
- * Unsupported (intentionally — out of scope for the CLAUDE.md
- * compat surface):
- *  - nested keys
- *  - multi-line strings
- *  - YAML anchors / aliases
- *  - any key other than `paths`
- *
- * If `paths:` exists but is empty (`paths: []` or `paths:\n` with no
- * entries) the result is `paths: []` so the caller can distinguish
- * "no paths key" (matches everything) from "paths explicitly empty"
- * (matches nothing).
- */
-function parseFrontmatter(input) {
-    // Frontmatter must start at byte 0 with `---` on its own line. We
-    // tolerate a trailing CR (Windows line endings) but nothing else
-    // before the opening fence.
-    const fence = /^---\s*\r?\n/;
-    if (!fence.test(input)) {
-        return { paths: undefined, bodyAfterFrontmatter: input };
-    }
-    // Search for the closing `---` on its own line. We use a multi-line
-    // anchored regex so a literal `---` inside the body (not on its own
-    // line) does not falsely close the frontmatter.
-    const closing = /\r?\n---\s*(?:\r?\n|$)/;
-    const opening = input.match(fence);
-    if (!opening) {
-        return { paths: undefined, bodyAfterFrontmatter: input };
-    }
-    const afterOpening = input.slice(opening[0].length);
-    const closingMatch = afterOpening.match(closing);
-    if (!closingMatch || typeof closingMatch.index !== 'number') {
-        // Malformed frontmatter (opening fence, no closing fence). We
-        // refuse to guess where the operator intended the YAML to end and
-        // treat the file as having no frontmatter; the body is then the
-        // raw input minus the opening fence-line for safety.
-        return { paths: undefined, bodyAfterFrontmatter: input };
-    }
-    const yamlBlock = afterOpening.slice(0, closingMatch.index);
-    const body = afterOpening.slice(closingMatch.index + closingMatch[0].length);
-    const paths = extractPathsKey(yamlBlock);
-    return { paths, bodyAfterFrontmatter: body };
-}
-/**
- * Extract the `paths:` array from a YAML frontmatter block. Returns
- * `undefined` when the key is absent (rule matches every file) and an
- * empty array when the key is present but explicitly empty (rule
- * matches nothing).
- */
-function extractPathsKey(yaml) {
-    const lines = yaml.split('\n');
-    let i = 0;
-    while (i < lines.length) {
-        const raw = lines[i] ?? '';
-        const line = raw.replace(/\r$/, '');
-        i += 1;
-        // Top-level keys only — anything indented belongs to a nested
-        // structure we explicitly do not support.
-        if (line.length === 0 || /^\s/.test(line))
-            continue;
-        if (line.startsWith('#'))
-            continue;
-        const keyMatch = /^([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$/.exec(line);
-        if (!keyMatch)
-            continue;
-        const key = keyMatch[1];
-        const after = keyMatch[2] ?? '';
-        if (key !== 'paths')
-            continue;
-        // Inline flow form: `paths: [a, b, c]`.
-        if (after.startsWith('[')) {
-            return parseInlineFlowArray(after);
-        }
-        // Block form: a sequence of `- entry` lines that follow.
-        if (after.length === 0 || /^\s*#/.test(after)) {
-            return parseBlockSequence(lines, i);
-        }
-        // Anything else (e.g. `paths: ./src`) is unsupported. Fail closed
-        // by returning an empty array so the rule matches nothing rather
-        // than silently behaving as a global rule.
-        return [];
-    }
-    return undefined;
-}
-/**
- * Parse an inline-flow YAML array like `[a, "b c", 'd']`. Accepts
- * single-quoted, double-quoted, and bare entries. Trailing comments
- * after the closing `]` are ignored. Whitespace around commas is
- * trimmed. Returns an empty array for `[]`.
- */
-function parseInlineFlowArray(input) {
-    // Strip the opening `[` and find the matching `]`. We scan
-    // character-by-character so quoted commas do not split entries.
-    if (input[0] !== '[')
-        return [];
-    const items = [];
-    let i = 1;
-    let buffer = '';
-    let quote = null;
-    while (i < input.length) {
-        const ch = input[i];
-        if (quote) {
-            if (ch === quote) {
-                quote = null;
-            }
-            else {
-                buffer += ch;
-            }
-            i += 1;
-            continue;
-        }
-        if (ch === '"' || ch === "'") {
-            quote = ch;
-            i += 1;
-            continue;
-        }
-        if (ch === ',' || ch === ']') {
-            const trimmed = buffer.trim();
-            if (trimmed.length > 0)
-                items.push(trimmed);
-            buffer = '';
-            if (ch === ']')
-                return items;
-            i += 1;
-            continue;
-        }
-        buffer += ch;
-        i += 1;
-    }
-    // Unterminated `[ ... ]` — fail closed and return what we have so
-    // far so a typo does not silently match everything.
-    return items;
-}
-/**
- * Parse a YAML block sequence starting at line `start`. Entries look
- * like ` - foo` or ` - "foo bar"`. Stops at the first non-indented
- * non-comment line, returning the collected entries.
- */
-function parseBlockSequence(lines, start) {
-    const items = [];
-    for (let j = start; j < lines.length; j += 1) {
-        const raw = lines[j] ?? '';
-        const line = raw.replace(/\r$/, '');
-        if (line.length === 0)
-            continue;
-        if (/^\s*#/.test(line))
-            continue;
-        // Indented `-` only — once we hit a flush-left line we have left
-        // the sequence and the parent key's value is complete.
-        if (!/^\s/.test(line))
-            break;
-        const itemMatch = /^\s+-\s+(.*)$/.exec(line);
-        if (!itemMatch)
-            break;
-        const rawValue = itemMatch[1] ?? '';
-        items.push(unquoteScalar(rawValue.trim()));
-    }
-    return items;
-}
-/**
- * Strip surrounding single or double quotes from a YAML scalar. Bare
- * scalars are returned as-is. We do NOT process YAML escape sequences
- * — glob patterns never contain them in practice and supporting them
- * would push us toward a full YAML library.
- */
-function unquoteScalar(input) {
-    if (input.length >= 2) {
-        const first = input[0];
-        const last = input[input.length - 1];
-        if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
-            return input.slice(1, -1);
-        }
-    }
-    return input;
-}
-/**
- * Strip a leading UTF-8 BOM (``) if present. Idempotent.
- */
-function stripBom(input) {
-    return input.charCodeAt(0) === 0xfeff ? input.slice(1) : input;
-}
-/**
- * Pure path-vs-rule predicate. Returns true when `filePath` matches
- * any glob in the rule's `paths` array. A rule with `paths === undefined`
- * matches every path (the rule applies globally). A rule with an empty
- * `paths` array matches nothing (operator explicitly limited the rule
- * to zero files, e.g. via `paths: []`).
- *
- * `filePath` may be relative or absolute. The matcher operates on the
- * POSIX-style normalised form so glob patterns authored on macOS /
- * Linux (forward slashes) match consistently on Windows where the
- * runtime may produce backslash-separated paths.
- *
- * No I/O. No fs calls. Pure string match.
- */
-export function pathMatchesRule(filePath, rule) {
-    if (rule.paths === undefined)
-        return true;
-    if (rule.paths.length === 0)
-        return false;
-    const normalized = toPosix(filePath);
-    for (const pattern of rule.paths) {
-        if (matchGlob(normalized, toPosix(pattern)))
-            return true;
-    }
-    return false;
-}
-/**
- * Convert any platform-native path separator to POSIX `/`. Glob
- * patterns are authored with forward slashes by convention; this
- * normalisation keeps the matcher single-codepath.
- */
-function toPosix(input) {
-    if (sep === '/')
-        return input;
-    return input.split(sep).join('/');
-}
-/**
- * Compile a glob pattern to a `RegExp` and test against the candidate
- * path. Cached patterns are not memoised — `pathMatchesRule` is called
- * at most a few dozen times per session and a Map cache would add
- * surface area for no measurable win.
- *
- * Glob grammar supported:
- *  `**`  — zero or more path segments (any depth)
- *  `*`   — zero or more characters within a single segment
- *  `?`   — exactly one character
- *  `[abc]` / `[a-z]` — character class
- *
- * Anything else is treated as a literal and regex-escaped.
- */
-function matchGlob(filePath, pattern) {
-    const regex = compileGlob(pattern);
-    return regex.test(filePath);
-}
-/**
- * Translate a glob pattern into an equivalent anchored `RegExp`. The
- * conversion handles the four wildcard tokens individually:
- *
- *  - `**\/` → `(?:.*\/)?`  (zero or more leading segments)
- *  - `/**` → `(?:\/.*)?`  (zero or more trailing segments)
- *  - bare `**` → `.*`
- *  - `*`   → `[^/]*` (single-segment wildcard)
- *  - `?`   → `[^/]`
- *  - `[abc]` → preserved as a regex character class
- *
- * The result is anchored with `^` / `$` so partial matches do not
- * surface as positives.
- */
-function compileGlob(pattern) {
-    let out = '';
-    let i = 0;
-    while (i < pattern.length) {
-        const ch = pattern[i] ?? '';
-        if (ch === '*') {
-            // Check for `**`.
-            if (pattern[i + 1] === '*') {
-                // Distinguish `**/`, `/**`, and bare `**`. The slash-bearing
-                // forms eat the slash too so a pattern like `src/**\/*.ts`
-                // matches both `src/foo.ts` and `src/a/b.ts`.
-                const before = i > 0 ? pattern[i - 1] : '';
-                const after = pattern[i + 2] ?? '';
-                if (after === '/') {
-                    out += '(?:.*\\/)?';
-                    i += 3;
-                    continue;
-                }
-                if (before === '/' && (i + 2 === pattern.length)) {
-                    // Trailing `/**` consumed: pop the slash we already emitted
-                    // and replace with the optional-segment form.
-                    out = out.slice(0, -2);
-                    out += '(?:\\/.*)?';
-                    i += 2;
-                    continue;
-                }
-                out += '.*';
-                i += 2;
-                continue;
-            }
-            out += '[^/]*';
-            i += 1;
-            continue;
-        }
-        if (ch === '?') {
-            out += '[^/]';
-            i += 1;
-            continue;
-        }
-        if (ch === '[') {
-            // Take the class verbatim until the matching `]`. We do not
-            // attempt to validate the class contents — Node's RegExp parser
-            // is the source of truth there.
-            const close = pattern.indexOf(']', i + 1);
-            if (close < 0) {
-                // Unterminated class — escape the literal `[` and continue.
-                out += '\\[';
-                i += 1;
-                continue;
-            }
-            out += pattern.slice(i, close + 1);
-            i = close + 1;
-            continue;
-        }
-        // Everything else is a literal. Escape the regex metacharacters
-        // that survive the wildcard handling above. The `/` separator is
-        // emitted as `\/` so the compiled regex is readable when
-        // inspected via the debugger.
-        if (REGEX_ESCAPE_CHARS.has(ch)) {
-            out += '\\' + ch;
-            i += 1;
-            continue;
-        }
-        out += ch;
-        i += 1;
-    }
-    return new RegExp('^' + out + '$');
-}
-/**
- * Regex special characters that need escaping when emitted as glob
- * literals. `*`, `?`, and `[` are handled by their own branches above
- * so they are NOT in this set.
- */
-const REGEX_ESCAPE_CHARS = new Set([
-    '.', '+', '(', ')', '{', '}', '^', '$', '|', '\\', '/',
-]);
-/**
- * Re-export `posix` as a type-level utility for downstream callers
- * that want to canonicalise their own paths consistently with the
- * matcher's normalisation. Cheap re-export, no runtime cost.
- */
-export const PATH_POSIX_NAMESPACE = posix;
-//# sourceMappingURL=cc-compat-rules.js.map