@opengsd/gsd-core 1.10.0 → 1.11.0

package/gsd-core/bin/lib/validate.cjs

@@ -40,24 +40,37 @@ exports.buildNotStartedPhaseVariants = buildNotStartedPhaseVariants;
 exports.textEncodingError = textEncodingError;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, PHASE_NUMBER_TOKEN_SOURCE, PHASE_CONTINUATION_SEGMENT_SOURCE, } = phaseIdMod;
+const { OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, 
+// #2528 review: taken from the owner rather than derived here by
+// `replaceAll('A-Z', 'A-Za-z')` — that derivation silently no-ops (and narrows
+// this module to uppercase-only) the day phase-id.cts renders the class any
+// other way. See the constants' doc comment in phase-id.cts.
+CASE_FLEXIBLE_PROJECT_CODE_PREFIX_SOURCE, CASE_FLEXIBLE_PHASE_NUMBER_TOKEN_SOURCE, PHASE_CONTINUATION_SEGMENT_SOURCE, } = phaseIdMod;
 // ── Issue #26: regex constants (W005, W006-archived) ────────────────────────
 // Matches legacy numeric dirs (01-setup), milestone-prefixed dirs (02-01-setup),
 // deep dirs (02-04-01-deep), and project-code-prefixed variants (GSD-02-01-setup).
 exports.phaseDirNameRe = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}\\d{2,}(?:-\\d+)*(?:\\.\\d+)*-[\\w-]+$`, 'i');
-// Extracts the full phase token from a directory name, including milestone-prefixed
-// multi-segment tokens like "02-01" from "02-01-setup" or "GSD-02-01-setup".
+// Extracts the full phase token from a directory name, including project-code and
+// milestone prefixes plus multi-segment tokens like "02-01" from "02-01-setup"
+// or "GSD-02-01" from "GSD-02-01-setup". The capture intentionally matches
+// extractPhaseToken() exactly; health-validation consumers strip the project code
+// only where their historical disk/roadmap comparison requires a numeric token.
 // #2043: a *continuation* sub-phase segment must be zero-padded, so a
 // single-digit slug word after a phase number (e.g. "46-6-rs-…", slug "6 Rs …") is
 // NOT absorbed — it captures "46", not "46-6". #2232: the continuation width is
 // exactly 2 (PHASE_CONTINUATION_SEGMENT_SOURCE), so a ≥3-digit slug word (a year:
 // "14-2026-photos-…") is not absorbed either — it captures "14", not "14-2026".
-// The first component stays "\d+"
+// #2528: this regex stays the LITERAL reading of the name and does NOT try to
+// re-classify an absorbed 2-digit continuation as a slug word — see the
+// extractPhaseToken doc comment for why that is a resolution-layer job
+// (matchPhaseDirs), not a tokenizer one. The two surfaces must agree, and they
+// agree on the literal reading. The first component stays "\d+"
 // (with the "[A-Z]?" suffix) so single-digit letter-suffixed phase ids ("1A") and
 // milestone-prefixed single-digit sub-phases ("M1-2" → prefix "M1-" stripped, then
 // "2") still match. The trailing boundary "(?:-|$)" (was "(?:-[a-z]|$)") lets a slug
 // that starts with a digit terminate the token.
-exports.PHASE_TOKEN_FROM_DIR_RE = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(\\d+(?:-${PHASE_CONTINUATION_SEGMENT_SOURCE})*[A-Z]?(?:\\.\\d+)*)(?:-|$)`, 'i');
+exports.PHASE_TOKEN_FROM_DIR_RE = new RegExp(`^(${CASE_FLEXIBLE_PROJECT_CODE_PREFIX_SOURCE}` +
+    `\\d+[A-Za-z]?(?:-${PHASE_CONTINUATION_SEGMENT_SOURCE}[A-Z]?)*(?:\\.\\d+)*)(?:-|$)`);
 exports.MILESTONE_ARCHIVE_DIR_RE = /^v\d+.*-phases$/i;
 // ── Issue #26: I001 canonicalization ────────────────────────────────────────
 function canonicalPlanStem(stem) {
@@ -65,7 +78,8 @@ function canonicalPlanStem(stem) {
     // so a digit-leading slug word (e.g. "46-6-rs-…") is not mistaken
     // for a "46-6" phase/plan pair. #2232: exactly 2 digits, so a year-leading
     // slug ("14-2026-photos-…") is not mistaken for a "14-2026" pair either.
-    const m = stem.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE}-${PHASE_CONTINUATION_SEGMENT_SOURCE})`, 'i'));
+    const m = stem.match(new RegExp(`^(${CASE_FLEXIBLE_PHASE_NUMBER_TOKEN_SOURCE}-${PHASE_CONTINUATION_SEGMENT_SOURCE})` +
+        `(?=[A-Z](?:-|$)|-|$)`));
     return m ? m[1] : stem;
 }
 // ── Issue #6: phase variant helpers (W006/W007) ──────────────────────────────

package/gsd-core/bin/lib/vendor/README.md

@@ -0,0 +1,37 @@
+# vendor/
+
+This directory holds **verbatim, unmodified** copies of third-party build
+artifacts that `gsd-core/bin/**` needs at runtime.
+
+## Why
+
+`gsd-core/bin/**` is copied by the installer into trees that have **no
+`node_modules`** (e.g. `~/.claude/gsd-core/`). Any external (non-relative,
+non-builtin) `require()`/`import` under `gsd-core/bin/**` breaks `verify`
+(and everything else) for every installed user, because the module simply
+cannot be resolved there. The fix is to vendor the compiled artifact
+in-tree instead of depending on it being installed as an npm package.
+`eslint-rules/no-external-require-in-bin.cjs` enforces this at lint time.
+
+## Contents
+
+- `re2js.cjs` — verbatim copy of `node_modules/re2js/build/index.cjs`
+  (upstream package `re2js`, pinned version see `package.json`
+  `devDependencies.re2js`). Used by `src/pattern.cts` (compiled to
+  `gsd-core/bin/lib/pattern.cjs`) for linear-time RE2 pattern compilation.
+- `re2js.d.cts` — verbatim copy of `node_modules/re2js/build/index.d.cts`,
+  so TypeScript resolves types for the relative import from `src/pattern.cts`.
+
+## Do not hand-edit
+
+These files are **verbatim** copies of the upstream build output. Never
+edit them directly — refresh them from `node_modules` instead:
+
+```
+cp node_modules/re2js/build/index.cjs gsd-core/bin/lib/vendor/re2js.cjs
+cp node_modules/re2js/build/index.d.cts gsd-core/bin/lib/vendor/re2js.d.cts
+```
+
+`node scripts/lint-vendored-deps.cjs` fails CI if the vendored copy drifts
+byte-for-byte from `node_modules/re2js/build/` or from the `re2js` version
+pinned in `package.json` `devDependencies`.