devbrain-cli 0.2.0 → 0.3.0

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability.types.d.ts

@@ -0,0 +1,104 @@
+export type VulnerabilityCategory = keyof VulnerabilityCategoryFlags;
+export interface Vulnerability {
+    category: VulnerabilityCategory;
+    message: string;
+}
+export interface VulnerabilityCategoryFlags {
+    /**
+     * Use of the `alias.*` configuration settings in simple-git tasks
+     */
+    allowUnsafeAlias: boolean;
+    /**
+     * Use of the `core.askPass` configuration setting and environment variables in simple-git tasks
+     */
+    allowUnsafeAskPass: boolean;
+    /**
+     * Allows using environment variables to set configuration paths in simple-git tasks
+     */
+    allowUnsafeConfigPaths: boolean;
+    /**
+     * Allows setting configuration fields from environment variables in simple-git tasks. Any
+     * configuration set in this way will still be subject to the same block-listing checks and
+     * may require other unsafe flags to be enabled for use.
+     */
+    allowUnsafeConfigEnvCount: boolean;
+    /**
+     * Allows setting credential helper in simple-git tasks
+     */
+    allowUnsafeCredentialHelper: boolean;
+    /**
+     * Allows setting path to the text editor utility in simple-git tasks
+     */
+    allowUnsafeEditor: boolean;
+    /**
+     * Allows use of setting paths for merge tools in simple-git tasks
+     */
+    allowUnsafeMergeDriver: boolean;
+    /**
+     * Allows setting path to the pager utility in simple-git tasks
+     */
+    allowUnsafePager: boolean;
+    /**
+     * By default, `simple-git` prevents the use of inline configuration
+     * options to override the protocols available for the `git` child
+     * process to prevent accidental security vulnerabilities when
+     * unsanitised user data is passed directly into operations such as
+     * `git.addRemote`, `git.clone` or `git.raw`.
+     *
+     * Enable this override to use the `ext::` protocol (see examples on
+     * [git-scm.com](https://git-scm.com/docs/git-remote-ext#_examples)).
+     */
+    allowUnsafeProtocolOverride: boolean;
+    /**
+     * Given the possibility of using `--upload-pack` and `--receive-pack` as
+     * attack vectors, the use of these in any command (or the shorthand
+     * `-u` option in a `clone` operation) are blocked by default.
+     *
+     * Enable this override to permit the use of these arguments.
+     */
+    allowUnsafePack: boolean;
+    /**
+     * Using a `-c` switch to enable custom SSH commands opens up a potential
+     * attack vector for running arbitrary commands.
+     */
+    allowUnsafeSshCommand: boolean;
+    /**
+     * Using a `-c` switch to enable custom proxy command for the `git://` transport
+     * exposes and attack vector for running arbitrary commands.
+     */
+    allowUnsafeGitProxy: boolean;
+    /**
+     * Using a `-c` switch to enable custom hooks path commands to be run automatically
+     * exposes and attack vector for running arbitrary commands.
+     */
+    allowUnsafeHooksPath: boolean;
+    /**
+     * Using a `-c` switch to enable setting binary for processing diffs
+     * exposes and attack vector for running arbitrary commands.
+     */
+    allowUnsafeDiffExternal: boolean;
+    /**
+     * Using a `-c` switch to enable setting binary for retrieving text content of a file
+     */
+    allowUnsafeDiffTextConv: boolean;
+    /**
+     * Using a `-c` switch to enable setting binary for `smudge` and `clean` operations
+     * which can add and remove content to a file during checkout and commit.
+     */
+    allowUnsafeFilter: boolean;
+    /**
+     * Using a `-c` switch to enable setting the binary to which `git` will delegate
+     * file content change detection.
+     */
+    allowUnsafeFsMonitor: boolean;
+    /**
+     * Using a `-c` switch to configure the GPG signing program (`gpg.program`) or a
+     * per-format variant (`gpg.ssh.program`, `gpg.x509.program`). Controlling the signing
+     * binary allows an attacker to run arbitrary code whenever a commit or tag is signed.
+     */
+    allowUnsafeGpgProgram: boolean;
+    /**
+     * Allows overriding template directory either by environment variable or configuration in simple-git tasks
+     */
+    allowUnsafeTemplateDir: boolean;
+}

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/@simple-git/argv-parser/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@simple-git/argv-parser",
+  "version": "1.1.1",
+  "main": "dist/index.cjs",
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "git",
+    "source control",
+    "vcs",
+    "simple-git",
+    "argv"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/steveukx/git-js.git",
+    "directory": "packages/argv-parser"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "module": "dist/index.mjs",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "dependencies": {
+    "@simple-git/args-pathspec": "^1.0.3"
+  }
+}

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/ansi-regex/index.d.ts

@@ -0,0 +1,33 @@
+export type Options = {
+	/**
+	Match only the first ANSI escape.
+
+	@default false
+	*/
+	readonly onlyFirst: boolean;
+};
+
+/**
+Regular expression for matching ANSI escape codes.
+
+@example
+```
+import ansiRegex from 'ansi-regex';
+
+ansiRegex().test('\u001B[4mcake\u001B[0m');
+//=> true
+
+ansiRegex().test('cake');
+//=> false
+
+'\u001B[4mcake\u001B[0m'.match(ansiRegex());
+//=> ['\u001B[4m', '\u001B[0m']
+
+'\u001B[4mcake\u001B[0m'.match(ansiRegex({onlyFirst: true}));
+//=> ['\u001B[4m']
+
+'\u001B]8;;https://github.com\u0007click\u001B]8;;\u0007'.match(ansiRegex());
+//=> ['\u001B]8;;https://github.com\u0007', '\u001B]8;;\u0007']
+```
+*/
+export default function ansiRegex(options?: Options): RegExp;

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/ansi-regex/index.js

@@ -0,0 +1,14 @@
+export default function ansiRegex({onlyFirst = false} = {}) {
+	// Valid string terminator sequences are BEL, ESC\, and 0x9c
+	const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
+
+	// OSC sequences only: ESC ] ... ST (non-greedy until the first ST)
+	const osc = `(?:\\u001B\\][\\s\\S]*?${ST})`;
+
+	// CSI and related: ESC/C1, optional intermediates, optional params (supports ; and :) then final byte
+	const csi = '[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]';
+
+	const pattern = `${osc}|${csi}`;
+
+	return new RegExp(pattern, onlyFirst ? undefined : 'g');
+}

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/ansi-regex/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/ansi-regex/package.json

@@ -0,0 +1,61 @@
+{
+	"name": "ansi-regex",
+	"version": "6.2.2",
+	"description": "Regular expression for matching ANSI escape codes",
+	"license": "MIT",
+	"repository": "chalk/ansi-regex",
+	"funding": "https://github.com/chalk/ansi-regex?sponsor=1",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"type": "module",
+	"exports": "./index.js",
+	"types": "./index.d.ts",
+	"sideEffects": false,
+	"engines": {
+		"node": ">=12"
+	},
+	"scripts": {
+		"test": "xo && ava && tsd",
+		"view-supported": "node fixtures/view-codes.js"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"ansi",
+		"styles",
+		"color",
+		"colour",
+		"colors",
+		"terminal",
+		"console",
+		"cli",
+		"string",
+		"tty",
+		"escape",
+		"formatting",
+		"rgb",
+		"256",
+		"shell",
+		"xterm",
+		"command-line",
+		"text",
+		"regex",
+		"regexp",
+		"re",
+		"match",
+		"test",
+		"find",
+		"pattern"
+	],
+	"devDependencies": {
+		"ansi-escapes": "^5.0.0",
+		"ava": "^3.15.0",
+		"tsd": "^0.21.0",
+		"xo": "^0.54.2"
+	}
+}

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/ansi-regex/readme.md

@@ -0,0 +1,66 @@
+# ansi-regex
+
+> Regular expression for matching [ANSI escape codes](https://en.wikipedia.org/wiki/ANSI_escape_code)
+
+## Install
+
+```sh
+npm install ansi-regex
+```
+
+## Usage
+
+```js
+import ansiRegex from 'ansi-regex';
+
+ansiRegex().test('\u001B[4mcake\u001B[0m');
+//=> true
+
+ansiRegex().test('cake');
+//=> false
+
+'\u001B[4mcake\u001B[0m'.match(ansiRegex());
+//=> ['\u001B[4m', '\u001B[0m']
+
+'\u001B[4mcake\u001B[0m'.match(ansiRegex({onlyFirst: true}));
+//=> ['\u001B[4m']
+
+'\u001B]8;;https://github.com\u0007click\u001B]8;;\u0007'.match(ansiRegex());
+//=> ['\u001B]8;;https://github.com\u0007', '\u001B]8;;\u0007']
+```
+
+## API
+
+### ansiRegex(options?)
+
+Returns a regex for matching ANSI escape codes.
+
+#### options
+
+Type: `object`
+
+##### onlyFirst
+
+Type: `boolean`\
+Default: `false` *(Matches any ANSI escape codes in a string)*
+
+Match only the first ANSI escape.
+
+## Important
+
+If you run the regex against untrusted user input in a server context, you should [give it a timeout](https://github.com/sindresorhus/super-regex).
+
+**I do not consider [ReDoS](https://blog.yossarian.net/2022/12/28/ReDoS-vulnerabilities-and-misaligned-incentives) a valid vulnerability for this package.**
+
+## FAQ
+
+### Why do you test for codes not in the ECMA 48 standard?
+
+Some of the codes we run as a test are codes that we acquired finding various lists of non-standard or manufacturer specific codes. We test for both standard and non-standard codes, as most of them follow the same or similar format and can be safely matched in strings without the risk of removing actual string content. There are a few non-standard control codes that do not follow the traditional format (i.e. they end in numbers) thus forcing us to exclude them from the test because we cannot reliably match them.
+
+On the historical side, those ECMA standards were established in the early 90's whereas the VT100, for example, was designed in the mid/late 70's. At that point in time, control codes were still pretty ungoverned and engineers used them for a multitude of things, namely to activate hardware ports that may have been proprietary. Somewhere else you see a similar 'anarchy' of codes is in the x86 architecture for processors; there are a ton of "interrupts" that can mean different things on certain brands of processors, most of which have been phased out.
+
+## Maintainers
+
+- [Sindre Sorhus](https://github.com/sindresorhus)
+- [Josh Junon](https://github.com/qix-)

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/anynum/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Natural Intelligence
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/anynum/README.md

@@ -0,0 +1,142 @@
+# anynum
+
+Normalize Unicode decimal digits and minus signs to ASCII.
+
+Converts digits from any script — Devanagari, Arabic-Indic, Thai, Bengali, Fullwidth, and [50+ others](#supported-scripts) — to their ASCII equivalents (`0`–`9`). Also normalizes Unicode minus variants (`−`, `－`, `﹣`) to ASCII `-`.
+
+Pairs naturally with [`strnum`](https://github.com/nicolo-ribaudo/strnum) — use `anynum` to normalize first, then `strnum` to detect the numeric type.
+
+```js
+import anynum from 'anynum';
+
+anynum('१२.३४')     // → '12.34'   (Devanagari)
+anynum('٣٫١٤')     // → '3.14'    (Arabic-Indic)
+anynum('−४२')      // → '-42'     (Unicode minus + Devanagari)
+anynum('－９９.５') // → '-99.5'   (Fullwidth minus + Fullwidth digits)
+anynum('hello')    // → 'hello'   (no digits — zero allocation)
+anynum('100')      // → '100'     (already ASCII — zero allocation)
+```
+
+---
+
+## Install
+
+```bash
+npm install anynum
+```
+
+---
+
+## Usage
+
+```js
+// ESM
+import anynum from 'anynum';
+import { anynum } from 'anynum';
+
+```
+
+### API
+
+```ts
+anynum(str: string): string
+```
+
+- Accepts a `string`, returns a `string`.
+- Non-string values are returned as-is (no throw).
+- Non-digit characters pass through unchanged.
+- If no conversion is needed, the **original string is returned** (zero allocation).
+
+---
+
+## What gets converted
+
+### Decimal digits
+
+Any Unicode character in category `Nd` (decimal digit) is mapped to its ASCII equivalent. This covers all positional decimal digit scripts — every script whose digits represent `0`–`9` by position.
+
+```js
+anynum('๑๒๓')   // Thai        → '123'
+anynum('੧੨੩')   // Gurmukhi   → '123'
+anynum('᠑᠒᠓')   // Mongolian  → '123'
+anynum('𝟏𝟐𝟑')   // Math Bold  → '123'
+```
+
+### Unicode minus variants
+
+Three Unicode characters are normalized to ASCII `-` (`U+002D`):
+
+| Code point | Character | Name |
+|---|---|---|
+| `U+2212` | `−` | MINUS SIGN (mathematical) |
+| `U+FF0D` | `－` | FULLWIDTH HYPHEN-MINUS |
+| `U+FE63` | `﹣` | SMALL HYPHEN-MINUS |
+
+Dashes used for punctuation — EN DASH (`–`), EM DASH (`—`), HYPHEN (`‐`) — are intentionally **not** converted.
+
+```js
+anynum('−42')   // U+2212 MINUS SIGN      → '-42'
+anynum('－42')  // U+FF0D FULLWIDTH        → '-42'
+anynum('–42')   // U+2013 EN DASH          → '–42'  (unchanged)
+```
+
+---
+
+## Use with strnum
+
+`anynum` and `strnum` compose cleanly:
+
+```js
+import anynum from 'anynum';
+import strnum from 'strnum';
+
+strnum(anynum('१२.३४'))   // → 12.34  (number, float)
+strnum(anynum('−४२'))     // → '-42'  (string; strnum handles sign detection)
+strnum(anynum('hello'))   // → 'hello'
+```
+
+---
+
+
+## Supported scripts
+
+50+ decimal digit scripts from Unicode `Nd` category, including:
+
+| Script | Zero | Sample |
+|---|---|---|
+| Devanagari (Hindi/Marathi/Nepali) | `U+0966` | `०१२३४५६७८९` |
+| Arabic-Indic | `U+0660` | `٠١٢٣٤٥٦٧٨٩` |
+| Extended Arabic-Indic (Urdu/Persian) | `U+06F0` | `۰۱۲۳۴۵۶۷۸۹` |
+| Bengali | `U+09E6` | `০১২৩৪৫৬৭৮৯` |
+| Gurmukhi | `U+0A66` | `੦੧੨੩੪੫੬੭੮੯` |
+| Gujarati | `U+0AE6` | `૦૧૨૩૪૫૬૭૮૯` |
+| Odia | `U+0B66` | `୦୧୨୩୪୫୬୭୮୯` |
+| Tamil | `U+0BE6` | `௦௧௨௩௪௫௬௭௮௯` |
+| Telugu | `U+0C66` | `౦౧౨౩౪౫౬౭౮౯` |
+| Kannada | `U+0CE6` | `೦೧೨೩೪೫೬೭೮೯` |
+| Malayalam | `U+0D66` | `൦൧൨൩൪൫൬൭൮൯` |
+| Thai | `U+0E50` | `๐๑๒๓๔๕๖๗๘๙` |
+| Lao | `U+0ED0` | `໐໑໒໓໔໕໖໗໘໙` |
+| Tibetan | `U+0F20` | `༠༡༢༣༤༥༦༧༨༩` |
+| Myanmar | `U+1040` | `၀၁၂၃၄၅၆၇၈၉` |
+| Khmer | `U+17E0` | `០១២៣៤៥៦៧៨៩` |
+| Mongolian | `U+1810` | `᠐᠑᠒᠓᠔᠕᠖᠗᠘᠙` |
+| Fullwidth (CJK context) | `U+FF10` | `０１２３４５６７８９` |
+| Mathematical Bold | `U+1D7CE` | `𝟎𝟏𝟐𝟑𝟒𝟓𝟔𝟕𝟖𝟗` |
+| Adlam | `U+1E950` | `𞥐𞥑𞥒𞥓𞥔𞥕𞥖𞥗𞥘𞥙` |
+| … and 30+ more | | |
+
+---
+
+## What it does NOT convert
+
+- **Kanji/Chinese numeral words** (`三`, `百`, `万`) — these are ideographic numerals, not decimal digits. Each language has its own positional system requiring separate parsing logic.
+- **Roman numerals** (`Ⅳ`, `Ⅻ`) — not decimal digits.
+- **Punctuation dashes** (`–` EN, `—` EM, `‐` HYPHEN) — not numeric signs.
+- **Decimal separators** — commas, periods, Arabic decimal comma (`٫`) are passed through as-is. Separator normalization is the caller's responsibility.
+
+---
+
+## License
+
+MIT

package/dist/temp-prefix/node_modules/devbrain-cli/node_modules/anynum/anynum.js

@@ -0,0 +1,135 @@
+'use strict';
+
+import { TABLE, TABLE_OFFSET, HIGH_MAP, NOT_DIGIT } from './digitTable.js';
+
+const CHAR_0 = 48; // '0'.charCodeAt(0)
+const CHAR_9 = 57; // '9'.charCodeAt(0)
+const CHAR_MINUS = 45; // '-'.charCodeAt(0)
+
+// Unicode minus/hyphen variants worth normalizing to ASCII '-' in numeric context:
+//   U+2212  MINUS SIGN       − (mathematically correct minus)
+//   U+FF0D  FULLWIDTH HYPHEN-MINUS  － (Japanese fullwidth context)
+//   U+FE63  SMALL HYPHEN-MINUS     ﹣ (small form variant)
+//
+// NOT normalized (deliberate):
+//   U+2013  EN DASH  –  (punctuation, not a numeric sign)
+//   U+2014  EM DASH  —  (punctuation)
+//   U+2010  HYPHEN   ‐  (typographic hyphen)
+//
+// Rationale: only characters a human or locale formatter would plausibly use
+// as a numeric minus sign are normalized. Dashes used for punctuation are left
+// alone to avoid mangling non-numeric strings.
+const MINUS_SET = new Set([0x2212, 0xFF0D, 0xFE63]);
+
+/**
+ * Normalize all Unicode decimal digit characters in a string to ASCII (0-9),
+ * and normalize Unicode minus variants to ASCII '-' (U+002D).
+ *
+ * Non-digit, non-minus characters are passed through unchanged.
+ *
+ * Performance design:
+ * - Fast path: if the string has no convertible characters, return it unchanged
+ *   (zero allocation).
+ * - BMP digits (0x0660..0xFFFF excl. surrogates): flat Uint8Array lookup (O(1)).
+ * - Supplementary plane digits (> 0xFFFF, encoded as surrogate pairs): Map lookup.
+ * - Minus variants: checked inline with a small fixed Set.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+function anynum(str) {
+  if (typeof str !== 'string') return str;
+
+  const len = str.length;
+  if (len === 0) return str;
+
+  // Scan for first character needing conversion.
+  // If none found, return original string (zero allocation).
+  let firstHit = -1;
+
+  for (let i = 0; i < len; i++) {
+    const cc = str.charCodeAt(i);
+
+    // ASCII digit or ASCII minus — already normalized, skip fast
+    if ((cc >= CHAR_0 && cc <= CHAR_9) || cc === CHAR_MINUS) continue;
+
+    // Below first unicode digit script — check minus variants only
+    if (cc < TABLE_OFFSET) {
+      if (MINUS_SET.has(cc)) { firstHit = i; break; }
+      continue;
+    }
+
+    // Surrogate pairs live in BMP range 0xD800-0xDFFF — check before TABLE
+    if (cc >= 0xD800 && cc <= 0xDBFF) {
+      if (i + 1 < len) {
+        const low = str.charCodeAt(i + 1);
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          const cp = 0x10000 + ((cc - 0xD800) << 10) + (low - 0xDC00);
+          if (HIGH_MAP.has(cp)) { firstHit = i; break; }
+        }
+      }
+      continue;
+    }
+
+    // BMP non-surrogate: flat table lookup; also check minus variants in this range
+    if (TABLE[cc - TABLE_OFFSET] !== NOT_DIGIT || MINUS_SET.has(cc)) {
+      firstHit = i;
+      break;
+    }
+  }
+
+  // Nothing to replace — return original, zero allocation
+  if (firstHit === -1) return str;
+
+  // Build result: copy unchanged prefix, then convert from firstHit onward
+  const chars = [];
+
+  if (firstHit > 0) chars.push(str.slice(0, firstHit));
+
+  for (let i = firstHit; i < len; i++) {
+    const cc = str.charCodeAt(i);
+
+    // ASCII digit or ASCII minus — pass through
+    if ((cc >= CHAR_0 && cc <= CHAR_9) || cc === CHAR_MINUS) {
+      chars.push(str[i]);
+      continue;
+    }
+
+    // Below TABLE_OFFSET — check minus variants, else pass through
+    if (cc < TABLE_OFFSET) {
+      chars.push(MINUS_SET.has(cc) ? '-' : str[i]);
+      continue;
+    }
+
+    // Surrogate pairs
+    if (cc >= 0xD800 && cc <= 0xDBFF) {
+      if (i + 1 < len) {
+        const low = str.charCodeAt(i + 1);
+        if (low >= 0xDC00 && low <= 0xDFFF) {
+          const cp = 0x10000 + ((cc - 0xD800) << 10) + (low - 0xDC00);
+          const d = HIGH_MAP.get(cp);
+          if (d !== undefined) {
+            chars.push(String.fromCharCode(d + 48));
+            i++; // consume low surrogate
+            continue;
+          }
+        }
+      }
+      chars.push(str[i]);
+      continue;
+    }
+
+    // BMP non-surrogate: flat table lookup + minus variants
+    if (MINUS_SET.has(cc)) {
+      chars.push('-');
+      continue;
+    }
+    const d = TABLE[cc - TABLE_OFFSET];
+    chars.push(d !== NOT_DIGIT ? String.fromCharCode(d + 48) : str[i]);
+  }
+
+  return chars.join('');
+}
+
+export { anynum };
+export default anynum;