picomatch 4.0.5: Exclude files from a glob match when adding a "!pattern" to the array does nothing

{"case":{"caseId":"case:sha256:c73f0f62077ec10dd67cd4c65cdcb1adf0e514c52705172de7e326416e1bdb14","constraints":{"moduleSystem":"esm","runtime":"node"},"contract":["assert * stops at a path separator while ** crosses them","assert dotfiles need dot:true","assert an array of patterns is OR-ed, so a negated entry excludes nothing","assert the ignore option is what actually excludes"],"goal":"Exclude files from a glob match when adding a \"!pattern\" to the array does nothing","kind":"FIX","packages":["pkg:npm/picomatch@4.0.5"],"schemaVersion":1,"symbols":["picomatch","ignore"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","ecosystem":"npm","executionContext":"node","language":"javascript","moduleSystem":"esm","os":"linux","packageManager":"npm","runtime":"node","runtimeVersion":"22","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/picomatch@4.0.5"],"schemaVersion":1,"symbols":["picomatch","ignore"],"verifierAdapter":"node-typescript@1"}

{
  "name": "csx-sample-picomatch-glob-match",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "csx-sample-picomatch-glob-match",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "picomatch": "4.0.5"
      }
    },
    "node_modules/picomatch": {
      "version": "4.0.5",
      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
      "license": "MIT",
      "engines": {
        "node": ">=12"
      },
      "funding": {
        "url": "https://github.com/sponsors/jonschlinkert"
      }
    }
  }
}

{
  "name": "csx-sample-picomatch-glob-match",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "license": "MIT-0",
  "dependencies": {
    "picomatch": "4.0.5"
  }
}

import picomatch from 'picomatch';

// Three rules cause most glob surprises here:
//   1. `*` stops at a path separator; `**` crosses them.
//   2. Dotfiles are NOT matched unless dot:true, so "src/**/*.js" misses
//      "src/.config/a.js".
//   3. An ARRAY of patterns is OR-ed. Adding "!**/*.test.js" to the array
//      therefore excludes nothing — the file still matches the positive
//      pattern, so the result is true. Exclusion needs the `ignore`
//      option (or a lone negated pattern, which inverts by itself).
export function matcher(pattern, options = {}) {
  return picomatch(pattern, options);
}

// The correct way to say "these, except those".
export function matcherExcluding(pattern, ignore) {
  return picomatch(pattern, { ignore });
}

import { strict as assert } from 'node:assert';
import { matcher, matcherExcluding } from '../src/index.mjs';

// 1. Separator crossing.
const shallow = matcher('src/*.js');
assert.equal(shallow('src/a.js'), true);
assert.equal(shallow('src/nested/a.js'), false, '* must not cross a separator');
assert.equal(matcher('src/**/*.js')('src/nested/deep/a.js'), true);

// 2. Dotfiles are invisible by default.
assert.equal(matcher('src/**/*.js')('src/.hidden/a.js'), false);
assert.equal(matcher('src/**/*.js', { dot: true })('src/.hidden/a.js'), true);

// 3. The trap: an array is OR-ed, so a "!" entry excludes NOTHING.
const arrayForm = matcher(['src/**/*.js', '!**/*.test.js']);
assert.equal(arrayForm('src/a.js'), true);
assert.equal(arrayForm('src/a.test.js'), true,
  'the negated entry does not subtract - the file still matches the positive pattern');

// The option that actually excludes.
const excluding = matcherExcluding('src/**/*.js', ['**/*.test.js']);
assert.equal(excluding('src/a.js'), true);
assert.equal(excluding('src/a.test.js'), false);

// A lone negated pattern inverts by itself, which is why the array form
// looks like it should work.
const loneNegation = matcher('!**/*.test.js');
assert.equal(loneNegation('src/a.test.js'), false);
assert.equal(loneNegation('src/a.js'), true);

// Braces still expand as expected.
assert.equal(matcher('src/*.{js,ts}')('src/a.ts'), true);

console.log('CONTRACT PASS: picomatch OR-ed the array and excluded only via ignore');