@opengsd/gsd-core 1.7.0-rc.6 → 1.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (195) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.opencode/plugins/gsd-core.js +14 -0
  4. package/README.md +2 -0
  5. package/agents/gsd-debug-session-manager.md +42 -4
  6. package/agents/gsd-debugger.md +87 -29
  7. package/agents/gsd-executor.md +31 -3
  8. package/agents/gsd-planner.md +29 -36
  9. package/agents/gsd-security-auditor.md +13 -15
  10. package/agents/gsd-verifier.md +2 -2
  11. package/bin/install.js +1157 -84
  12. package/commands/gsd/ai-integration-phase.md +1 -1
  13. package/commands/gsd/mempalace-capture.md +31 -1
  14. package/commands/gsd/new-milestone.md +1 -1
  15. package/commands/gsd/plan-phase.md +5 -3
  16. package/commands/gsd/plan-review-convergence.md +3 -2
  17. package/commands/gsd/surface.md +6 -6
  18. package/gsd-core/bin/gsd-tools.cjs +1866 -2434
  19. package/gsd-core/bin/lib/adapter-imperative.cjs +8 -1
  20. package/gsd-core/bin/lib/agent-command-router.cjs +20 -5
  21. package/gsd-core/bin/lib/api-coverage.cjs +341 -49
  22. package/gsd-core/bin/lib/audit.cjs +7 -6
  23. package/gsd-core/bin/lib/broken-windows.cjs +716 -0
  24. package/gsd-core/bin/lib/capability-command-router.cjs +733 -0
  25. package/gsd-core/bin/lib/capability-registry.cjs +157 -88
  26. package/gsd-core/bin/lib/capability-writer.cjs +6 -1
  27. package/gsd-core/bin/lib/check-command-router.cjs +129 -26
  28. package/gsd-core/bin/lib/claude-orchestration-command-router.cjs +115 -27
  29. package/gsd-core/bin/lib/claude-orchestration.cjs +84 -9
  30. package/gsd-core/bin/lib/clock.cjs +19 -0
  31. package/gsd-core/bin/lib/command-aliases.cjs +14 -0
  32. package/gsd-core/bin/lib/commands.cjs +129 -13
  33. package/gsd-core/bin/lib/config-loader.cjs +20 -4
  34. package/gsd-core/bin/lib/config.cjs +81 -18
  35. package/gsd-core/bin/lib/core-utils.cjs +14 -3
  36. package/gsd-core/bin/lib/decisions.cjs +32 -8
  37. package/gsd-core/bin/lib/docs.cjs +6 -0
  38. package/gsd-core/bin/lib/drift.cjs +4 -4
  39. package/gsd-core/bin/lib/external-descriptor-trust.cjs +14 -2
  40. package/gsd-core/bin/lib/frontmatter.cjs +22 -0
  41. package/gsd-core/bin/lib/gap-checker.cjs +17 -2
  42. package/gsd-core/bin/lib/gsd2-import.cjs +2 -1
  43. package/gsd-core/bin/lib/init.cjs +138 -60
  44. package/gsd-core/bin/lib/install-engine.cjs +301 -25
  45. package/gsd-core/bin/lib/install-profiles.cjs +239 -1
  46. package/gsd-core/bin/lib/installer-migration-authoring.cjs +2 -1
  47. package/gsd-core/bin/lib/installer-migrations/005-opencode-baseline-commands-dir.cjs +146 -0
  48. package/gsd-core/bin/lib/installer-migrations/006-pi-extension-cjs-to-js.cjs +91 -0
  49. package/gsd-core/bin/lib/installer-migrations.cjs +45 -6
  50. package/gsd-core/bin/lib/markdown-sectionizer.cjs +449 -0
  51. package/gsd-core/bin/lib/markdown-table.cjs +698 -0
  52. package/gsd-core/bin/lib/milestone.cjs +463 -43
  53. package/gsd-core/bin/lib/model-catalog.cjs +19 -4
  54. package/gsd-core/bin/lib/model-resolver.cjs +189 -7
  55. package/gsd-core/bin/lib/onboard-projection.cjs +11 -8
  56. package/gsd-core/bin/lib/phase-command-router.cjs +50 -2
  57. package/gsd-core/bin/lib/phase-id.cjs +26 -4
  58. package/gsd-core/bin/lib/phase-lifecycle.cjs +62 -36
  59. package/gsd-core/bin/lib/phase-locator.cjs +23 -2
  60. package/gsd-core/bin/lib/phase.cjs +636 -72
  61. package/gsd-core/bin/lib/plan-scan.cjs +73 -2
  62. package/gsd-core/bin/lib/roadmap-parser.cjs +225 -17
  63. package/gsd-core/bin/lib/roadmap.cjs +113 -52
  64. package/gsd-core/bin/lib/runtime-artifact-conversion.cjs +14 -7
  65. package/gsd-core/bin/lib/runtime-artifact-install-plan.cjs +3 -2
  66. package/gsd-core/bin/lib/runtime-artifact-layout.cjs +24 -9
  67. package/gsd-core/bin/lib/runtime-hooks-surface.cjs +41 -17
  68. package/gsd-core/bin/lib/schema-detect.cjs +2 -1
  69. package/gsd-core/bin/lib/security.cjs +1 -1
  70. package/gsd-core/bin/lib/shell-command-projection.cjs +61 -25
  71. package/gsd-core/bin/lib/smart-entry.cjs +73 -7
  72. package/gsd-core/bin/lib/state-document.cjs +7 -4
  73. package/gsd-core/bin/lib/state-transition.cjs +122 -46
  74. package/gsd-core/bin/lib/state.cjs +456 -137
  75. package/gsd-core/bin/lib/surface.cjs +53 -11
  76. package/gsd-core/bin/lib/template.cjs +2 -1
  77. package/gsd-core/bin/lib/uat.cjs +474 -13
  78. package/gsd-core/bin/lib/ui-safety-gate.cjs +23 -1
  79. package/gsd-core/bin/lib/validate.cjs +12 -8
  80. package/gsd-core/bin/lib/verification.cjs +112 -17
  81. package/gsd-core/bin/lib/verify.cjs +224 -25
  82. package/gsd-core/bin/lib/workstream.cjs +3 -2
  83. package/gsd-core/bin/lib/worktree-safety.cjs +1 -1
  84. package/gsd-core/bin/lib/write-set.cjs +38 -0
  85. package/gsd-core/bin/shared/config-schema.manifest.json +5 -2
  86. package/gsd-core/references/api-coverage.md +37 -7
  87. package/gsd-core/references/checkpoints.md +13 -1
  88. package/gsd-core/references/common-bug-patterns.md +13 -0
  89. package/gsd-core/references/debugger-bug-taxonomy.md +111 -0
  90. package/gsd-core/references/debugger-fix-acceptance.md +157 -0
  91. package/gsd-core/references/debugger-philosophy.md +1 -0
  92. package/gsd-core/references/debugger-prevention.md +98 -0
  93. package/gsd-core/references/debugger-rca-branching.md +98 -0
  94. package/gsd-core/references/debugger-repro-hardening.md +130 -0
  95. package/gsd-core/references/debugger-sbfl.md +110 -0
  96. package/gsd-core/references/debugger-semantic-recall.md +81 -0
  97. package/gsd-core/references/execute-phase-quota-recovery.md +55 -0
  98. package/gsd-core/references/execute-phase-requirement-revert.md +8 -0
  99. package/gsd-core/references/execute-phase-response-language.md +7 -0
  100. package/gsd-core/references/planner-antipatterns.md +6 -0
  101. package/gsd-core/references/planner-mvp-mode.md +12 -13
  102. package/gsd-core/references/planner-preconditions.md +156 -0
  103. package/gsd-core/references/planner-reversibility.md +132 -0
  104. package/gsd-core/references/reviewer-instances.md +9 -7
  105. package/gsd-core/references/skeleton-template.md +1 -1
  106. package/gsd-core/references/thinking-models-planning.md +3 -1
  107. package/gsd-core/templates/DEBUG.md +5 -3
  108. package/gsd-core/workflows/add-phase.md +2 -0
  109. package/gsd-core/workflows/add-tests.md +4 -2
  110. package/gsd-core/workflows/add-todo.md +32 -1
  111. package/gsd-core/workflows/ai-integration-phase.md +4 -2
  112. package/gsd-core/workflows/audit-fix.md +2 -2
  113. package/gsd-core/workflows/check-todos.md +3 -1
  114. package/gsd-core/workflows/cleanup.md +7 -1
  115. package/gsd-core/workflows/code-review.md +17 -5
  116. package/gsd-core/workflows/complete-milestone.md +3 -0
  117. package/gsd-core/workflows/debug.md +27 -5
  118. package/gsd-core/workflows/diagnose-issues.md +1 -1
  119. package/gsd-core/workflows/discovery-phase.md +7 -0
  120. package/gsd-core/workflows/discuss-phase/templates/context.md +16 -2
  121. package/gsd-core/workflows/discuss-phase-assumptions.md +3 -0
  122. package/gsd-core/workflows/do.md +7 -1
  123. package/gsd-core/workflows/docs-update.md +1 -0
  124. package/gsd-core/workflows/eval-review.md +3 -0
  125. package/gsd-core/workflows/execute-phase/steps/post-merge-gate.md +4 -4
  126. package/gsd-core/workflows/execute-phase/steps/regression-gate.md +2 -2
  127. package/gsd-core/workflows/execute-phase.md +30 -37
  128. package/gsd-core/workflows/execute-plan.md +15 -4
  129. package/gsd-core/workflows/fast.md +8 -22
  130. package/gsd-core/workflows/graduation.md +3 -0
  131. package/gsd-core/workflows/health.md +7 -1
  132. package/gsd-core/workflows/help/modes/full.md +6 -2
  133. package/gsd-core/workflows/import.md +8 -2
  134. package/gsd-core/workflows/inbox.md +7 -0
  135. package/gsd-core/workflows/ingest-docs.md +15 -10
  136. package/gsd-core/workflows/manager.md +3 -1
  137. package/gsd-core/workflows/map-codebase.md +4 -4
  138. package/gsd-core/workflows/mvp-phase.md +3 -0
  139. package/gsd-core/workflows/new-milestone.md +69 -21
  140. package/gsd-core/workflows/new-project.md +17 -15
  141. package/gsd-core/workflows/new-workspace.md +3 -1
  142. package/gsd-core/workflows/onboard.md +3 -0
  143. package/gsd-core/workflows/plan-phase.md +14 -5
  144. package/gsd-core/workflows/plan-review-convergence.md +48 -3
  145. package/gsd-core/workflows/plant-seed.md +3 -0
  146. package/gsd-core/workflows/profile-user.md +7 -1
  147. package/gsd-core/workflows/progress.md +33 -5
  148. package/gsd-core/workflows/quick.md +21 -7
  149. package/gsd-core/workflows/remove-workspace.md +3 -0
  150. package/gsd-core/workflows/review.md +123 -68
  151. package/gsd-core/workflows/scan.md +1 -1
  152. package/gsd-core/workflows/secure-phase.md +4 -1
  153. package/gsd-core/workflows/settings-integrations.md +3 -0
  154. package/gsd-core/workflows/settings.md +3 -0
  155. package/gsd-core/workflows/ship.md +58 -5
  156. package/gsd-core/workflows/sketch.md +3 -0
  157. package/gsd-core/workflows/smart-entry.md +3 -0
  158. package/gsd-core/workflows/spec-phase.md +1 -1
  159. package/gsd-core/workflows/spike.md +7 -1
  160. package/gsd-core/workflows/transition.md +1 -1
  161. package/gsd-core/workflows/ui-phase.md +3 -1
  162. package/gsd-core/workflows/ui-review.md +3 -0
  163. package/gsd-core/workflows/undo.md +7 -0
  164. package/gsd-core/workflows/update.md +2 -0
  165. package/gsd-core/workflows/validate-phase.md +3 -0
  166. package/gsd-core/workflows/verify-phase.md +2 -2
  167. package/gsd-core/workflows/verify-work.md +7 -3
  168. package/hooks/dist/gsd-context-monitor.js +27 -9
  169. package/hooks/dist/gsd-statusline.js +252 -17
  170. package/hooks/gsd-context-monitor.js +27 -9
  171. package/hooks/gsd-statusline.js +252 -17
  172. package/package.json +8 -4
  173. package/pi/gsd.cjs +8 -2
  174. package/scripts/changeset/lint.cjs +1 -0
  175. package/scripts/changeset/parse.cjs +26 -0
  176. package/scripts/check-glossary-refs.cjs +220 -0
  177. package/scripts/ci-rebase-check.cjs +48 -4
  178. package/scripts/ci-test-scope.cjs +39 -1
  179. package/scripts/gen-adr-index.cjs +526 -0
  180. package/scripts/gen-golden-install-parity-zcode.cjs +35 -45
  181. package/scripts/gen-install-tree-fixtures.cjs +75 -0
  182. package/scripts/gen-test-timings.cjs +201 -0
  183. package/scripts/lint-allow-test-rule-refs.allowlist.json +0 -1
  184. package/scripts/lint-portable-timeout.cjs +140 -0
  185. package/scripts/lint-table-schema-drift.cjs +157 -0
  186. package/scripts/lint-test-file-count.allowlist.json +1 -0
  187. package/scripts/release-tarball-smoke.cjs +18 -11
  188. package/scripts/run-tests.cjs +420 -58
  189. package/skills/gsd-ai-integration-phase/SKILL.md +1 -1
  190. package/skills/gsd-mempalace-capture/SKILL.md +31 -1
  191. package/skills/gsd-new-milestone/SKILL.md +1 -1
  192. package/skills/gsd-plan-phase/SKILL.md +5 -3
  193. package/skills/gsd-plan-review-convergence/SKILL.md +3 -2
  194. package/skills/gsd-surface/SKILL.md +6 -6
  195. package/vscode/package.json +1 -1
@@ -12,13 +12,19 @@
12
12
  */
13
13
  Object.defineProperty(exports, "__esModule", { value: true });
14
14
  exports.stripFencedCode = stripFencedCode;
15
+ exports.stripInlineCode = stripInlineCode;
16
+ exports.scanInlineCodeSpans = scanInlineCodeSpans;
17
+ exports.extractFencedBlock = extractFencedBlock;
15
18
  exports.tokenizeHeadings = tokenizeHeadings;
16
19
  exports.collectSections = collectSections;
17
20
  exports.collectSection = collectSection;
18
21
  exports.iterateBullets = iterateBullets;
22
+ exports.updateBullet = updateBullet;
19
23
  exports.extractTaggedBlocks = extractTaggedBlocks;
20
24
  exports.stripTaggedBlocks = stripTaggedBlocks;
21
25
  exports.replaceSection = replaceSection;
26
+ exports.withSection = withSection;
27
+ exports.deleteSection = deleteSection;
22
28
  // ─── stripFencedCode ──────────────────────────────────────────────────────────
23
29
  /**
24
30
  * CommonMark-correct fenced-code-block stripper.
@@ -80,6 +86,203 @@ function stripFencedCode(content) {
80
86
  }
81
87
  return { text: kept.join('\n'), unterminatedFence: openFence !== null };
82
88
  }
89
+ // ─── stripInlineCode ──────────────────────────────────────────────────────────
90
+ /**
91
+ * Remove CommonMark inline code spans (§6.1) from prose, line by line.
92
+ *
93
+ * A span opens with a run of N backticks and closes at the next run of EXACTLY
94
+ * N backticks on the same line (a longer or shorter run is span content, per
95
+ * CommonMark). The whole span — delimiters and content — is replaced by a
96
+ * single space so the surrounding words do not join. A run with no matching
97
+ * closer is literal text and is kept. Spans never cross line boundaries here:
98
+ * multi-line code in planning prose is fenced-block territory
99
+ * (`stripFencedCode`).
100
+ *
101
+ * Companion to `stripFencedCode` for term-matching callers (#2365): strip
102
+ * fenced blocks first, then inline spans, so a trigger term inside backticks
103
+ * is code, not prose evidence.
104
+ */
105
+ function stripInlineCode(content) {
106
+ if (typeof content !== 'string' || content.length === 0)
107
+ return '';
108
+ return content.split('\n').map(stripInlineCodeLine).join('\n');
109
+ }
110
+ /**
111
+ * Locate every inline code span in `content`, per line (offsets are into the
112
+ * full string; spans never cross a `\n`). Callers that need the span CONTENT
113
+ * (e.g. api-coverage's dependency-evidence scan, #2365) use this; callers that
114
+ * just want spans gone use `stripInlineCode`.
115
+ */
116
+ function scanInlineCodeSpans(content) {
117
+ if (typeof content !== 'string' || content.length === 0)
118
+ return [];
119
+ const out = [];
120
+ let lineStart = 0;
121
+ for (const line of content.split('\n')) {
122
+ for (const s of scanSpansInLine(line)) {
123
+ out.push({ start: lineStart + s.start, end: lineStart + s.end, content: s.content });
124
+ }
125
+ lineStart += line.length + 1;
126
+ }
127
+ return out;
128
+ }
129
+ function scanSpansInLine(line) {
130
+ const spans = [];
131
+ if (line.indexOf('`') === -1)
132
+ return spans;
133
+ // Collect the maximal backtick RUNS once, then match openers to closers using
134
+ // a per-length forward cursor. A naive "search the rest of the line for the
135
+ // closer" loop is O(n²) on a line of many unmatched increasing-length runs
136
+ // (#2365 review 9); precomputing runs makes the whole scan linear while
137
+ // preserving CommonMark semantics (closer = next run of EXACTLY the same len).
138
+ const runs = [];
139
+ for (let i = 0; i < line.length;) {
140
+ if (line[i] === '`') {
141
+ let n = 1;
142
+ while (i + n < line.length && line[i + n] === '`')
143
+ n++;
144
+ runs.push([i, n]);
145
+ i += n;
146
+ }
147
+ else {
148
+ i++;
149
+ }
150
+ }
151
+ const runsByLen = new Map();
152
+ for (let k = 0; k < runs.length; k++) {
153
+ const len = runs[k][1];
154
+ const arr = runsByLen.get(len);
155
+ if (arr)
156
+ arr.push(k);
157
+ else
158
+ runsByLen.set(len, [k]);
159
+ }
160
+ const cursorByLen = new Map();
161
+ let k = 0;
162
+ while (k < runs.length) {
163
+ const [openPos, n] = runs[k];
164
+ const candidates = runsByLen.get(n); // n came from this map, always present
165
+ let ci = cursorByLen.get(n) ?? 0;
166
+ while (ci < candidates.length && candidates[ci] <= k)
167
+ ci++;
168
+ if (ci < candidates.length) {
169
+ const closeK = candidates[ci];
170
+ const closePos = runs[closeK][0];
171
+ spans.push({ start: openPos, end: closePos + n, content: line.slice(openPos + n, closePos) });
172
+ cursorByLen.set(n, ci + 1);
173
+ k = closeK + 1; // resume after the closer — runs inside the span are code
174
+ }
175
+ else {
176
+ cursorByLen.set(n, ci);
177
+ k++; // unmatched run → literal text, next run is a fresh opener
178
+ }
179
+ }
180
+ return spans;
181
+ }
182
+ function stripInlineCodeLine(line) {
183
+ const spans = scanSpansInLine(line);
184
+ if (spans.length === 0)
185
+ return line;
186
+ let out = '';
187
+ let prev = 0;
188
+ for (const s of spans) {
189
+ out += line.slice(prev, s.start) + ' ';
190
+ prev = s.end;
191
+ }
192
+ return out + line.slice(prev);
193
+ }
194
+ /**
195
+ * Shared low-level fence-scanning engine. Walks `lines` and returns every
196
+ * fenced block found, applying the EXACT SAME CommonMark delimiter rules as
197
+ * `stripFencedCode` (≥3 backticks/tildes, ≤3-space indent tolerance, a closer
198
+ * must be the same delimiter char with run length ≥ the opener and no
199
+ * trailing non-whitespace text; a mismatched delimiter char — or a same-char
200
+ * run that is too short or carries trailing text — encountered while a fence
201
+ * is already open is fence CONTENT, not a new open/close event). This is the
202
+ * "engine" `extractFencedBlock` reuses instead of an ad-hoc regex, so a
203
+ * different-info-string fence, a fence nested/indented inside another fence,
204
+ * and a `~~~` fence are all classified exactly as `stripFencedCode` would.
205
+ *
206
+ * Tracked duplication (same status as `tokenizeHeadings`'s copy, see its
207
+ * comment above): this is a second independent copy of the fence state
208
+ * machine, pending a T-tier consolidation.
209
+ */
210
+ function scanFencedBlocks(lines) {
211
+ const delimRe = /^( {0,3})(`{3,}|~{3,})(.*)$/;
212
+ const blocks = [];
213
+ let open = null;
214
+ for (let i = 0; i < lines.length; i++) {
215
+ const line = lines[i].replace(/\r$/, '');
216
+ const m = delimRe.exec(line);
217
+ if (!m)
218
+ continue;
219
+ const char = m[2][0];
220
+ const len = m[2].length;
221
+ const trailing = m[3];
222
+ if (open === null) {
223
+ // CommonMark §4.5: backtick fence info string must not contain a backtick.
224
+ if (char === '`' && trailing.includes('`'))
225
+ continue; // not a valid opener — ordinary content
226
+ open = { char, len, infoString: trailing.trim(), openLineIdx: i };
227
+ }
228
+ else if (char === open.char && len >= open.len && /^\s*$/.test(trailing)) {
229
+ blocks.push({
230
+ char: open.char,
231
+ len: open.len,
232
+ infoString: open.infoString,
233
+ openLineIdx: open.openLineIdx,
234
+ closeLineIdx: i,
235
+ });
236
+ open = null;
237
+ }
238
+ // else: mismatched/insufficient delimiter while a fence is open — content, not a boundary.
239
+ }
240
+ if (open !== null) {
241
+ blocks.push({
242
+ char: open.char,
243
+ len: open.len,
244
+ infoString: open.infoString,
245
+ openLineIdx: open.openLineIdx,
246
+ closeLineIdx: -1,
247
+ });
248
+ }
249
+ return blocks;
250
+ }
251
+ /**
252
+ * Return the INNER text (the lines between the delimiters, joined by `\n`) of
253
+ * the FIRST fenced code block whose opening info string — trimmed,
254
+ * case-insensitive — equals `infoString`. Returns `null` when no such block
255
+ * exists, including when the only matching-name fence is left unterminated
256
+ * (EOF inside the fence — there is no well-defined inner span to return,
257
+ * matching a non-greedy `\n```-anchored` regex's behaviour of also failing to
258
+ * match an unclosed fence).
259
+ *
260
+ * Built on `scanFencedBlocks`, the same CommonMark fence-tracking engine
261
+ * `stripFencedCode` uses — so a fence of a DIFFERENT info string, a fence
262
+ * nested/indented inside another fence, and a `~~~` fence are all handled
263
+ * exactly as `stripFencedCode` would classify them; this is not a fresh
264
+ * ad-hoc regex.
265
+ *
266
+ * Migrated from `api-coverage.cts`'s bespoke
267
+ * `` /```coverage\s*\n([\s\S]*?)\n```/i `` (ADR-1372 tier migration, #2143 audit).
268
+ */
269
+ function extractFencedBlock(content, infoString) {
270
+ if (typeof content !== 'string' || content.length === 0)
271
+ return null;
272
+ if (typeof infoString !== 'string')
273
+ return null;
274
+ const target = infoString.trim().toLowerCase();
275
+ const lines = content.split('\n');
276
+ const blocks = scanFencedBlocks(lines);
277
+ for (const block of blocks) {
278
+ if (block.closeLineIdx === -1)
279
+ continue; // unterminated — no well-defined inner span
280
+ if (block.infoString.trim().toLowerCase() !== target)
281
+ continue;
282
+ return lines.slice(block.openLineIdx + 1, block.closeLineIdx).join('\n');
283
+ }
284
+ return null;
285
+ }
83
286
  // ─── tokenizeHeadings ─────────────────────────────────────────────────────────
84
287
  /**
85
288
  * Extract all ATX headings from `content` in document order.
@@ -391,6 +594,137 @@ function iterateBullets(sectionText) {
391
594
  flush();
392
595
  return items;
393
596
  }
597
+ // ─── updateBullet ─────────────────────────────────────────────────────────────
598
+ /**
599
+ * Locate the FIRST top-level bullet-opening line — checkbox (`- [ ]`/`- [x]`),
600
+ * dash/asterisk/plus (`- `/`* `/`+ `), or numbered (`1. `) — whose bullet text
601
+ * satisfies `match(bulletText, rawLine)`, replace that ONE physical line with
602
+ * `transform(rawLine)`, and return the resulting full content string. Every
603
+ * other byte in `content` — surrounding bullets, indentation, EOL style — is
604
+ * left untouched: this is a pure single-line splice, not a document-wide
605
+ * regex `.replace()`.
606
+ *
607
+ * Unlike `iterateBullets` (read-only, no offsets, and not itself fence-aware
608
+ * — callers pre-strip fences when that matters), `updateBullet` tracks
609
+ * character offsets itself so it can splice the transformed line back into
610
+ * the ORIGINAL `content`, and is fence-aware on its own: a bullet-shaped line
611
+ * inside a fenced code block (``` / ~~~, same CommonMark delimiter rules as
612
+ * `stripFencedCode`) is never offered to `match`/`transform`. (Tracked
613
+ * duplication of the fence state machine — same status as `tokenizeHeadings`'s
614
+ * copy, see its doc comment — pending a T-tier consolidation.)
615
+ *
616
+ * `rawLine` (second argument to both `match` and `transform`) is the
617
+ * UNMODIFIED physical line exactly as it appears between `\n` separators — so
618
+ * on a CRLF document its trailing `\r` is included, matching what a
619
+ * hand-rolled `^...[^\n]*`-shaped, `m`-flagged regex applied to the whole
620
+ * document would have seen. `bulletText` (first argument to `match`) is the
621
+ * bullet's own text with marker/checkbox stripped and any trailing `\r`
622
+ * removed — the same extraction `iterateBullets` uses for `BulletItem.text`.
623
+ *
624
+ * Only the OPENING line of a (possibly multi-line) bullet is ever matched or
625
+ * replaced — indented continuation lines are never presented to `match` or
626
+ * `transform`.
627
+ *
628
+ * The gap between the marker and its content tolerates 1 or more spaces — not
629
+ * only exactly one — mirroring CommonMark/GFM's 1–4-space allowance for
630
+ * list-marker spacing (`checkboxRe`/`numberedRe`/`dashRe`'s own dedicated
631
+ * quantifier caps at 4 per GFM; a wider run still recognises the line as a
632
+ * bullet opener via the uncapped `dashRe` fallback catching the excess as
633
+ * ordinary bullet text). So `- [ ] text` (two spaces), `1. text` (three
634
+ * spaces), and even a pathologically wide run are all recognised bullet
635
+ * openers, just as the canonical single-space `- [ ] text` / `1. text` are.
636
+ *
637
+ * Bounded no-op: if no bullet-opening line satisfies `match`, or `transform`
638
+ * returns a non-string, `content` is returned completely unchanged.
639
+ */
640
+ function updateBullet(content, match, transform) {
641
+ if (typeof content !== 'string' || content.length === 0)
642
+ return content;
643
+ const lines = content.split('\n');
644
+ // Marker-to-content gap: CommonMark/GFM tolerates 1–4 spaces between a list
645
+ // marker and its content (5+ pushes the content into indented-code-block
646
+ // territory) — so `- [ ] Phase 1: Foo` (two spaces) is still a valid
647
+ // bullet opener, not just the single-space `- [ ] …` shape. A hand-rolled
648
+ // single-space-only regex (e.g. the OLD `mutateMilestonePhase` checkbox
649
+ // regex before its `updateBullet` migration, which used `-\s*\[` — no cap,
650
+ // but at least 0+) would flip such a line; matching that requires this
651
+ // primitive's own bullet-opening recognition to tolerate the same gap,
652
+ // otherwise a wider-spaced bullet is silently never offered to `match`.
653
+ // F5 (#2245 review, nit): the gap also tolerates a literal TAB (`\t`), not
654
+ // only spaces — the OLD `-\s*\[` regex's `\s` class matched a tab too, so a
655
+ // `-\t[ ] text` bullet (tab-separated marker) must still be recognised here.
656
+ // Checkbox bullet: `<indent>- [ ] text` or `<indent>- [x] text`
657
+ const checkboxRe = /^(\s*)-[ \t]{1,4}\[([xX ])\] (.*)$/;
658
+ // Plain dash/asterisk/plus bullet: `<indent>- text`, `<indent>* text`, `<indent>+ text`
659
+ const dashRe = /^(\s*)[-*+][ \t]{1,4}(.*)$/;
660
+ // Numbered bullet: `<indent>1. text`
661
+ const numberedRe = /^(\s*)\d+\.[ \t]{1,4}(.*)$/;
662
+ // Fence tracking — same CommonMark delimiter rules as stripFencedCode
663
+ // (tracked duplication, see doc comment above).
664
+ const delimRe = /^( {0,3})(`{3,}|~{3,})(.*)$/;
665
+ let openFence = null;
666
+ let offset = 0;
667
+ for (let i = 0; i < lines.length; i++) {
668
+ const rawLine = lines[i];
669
+ const line = rawLine.replace(/\r$/, '');
670
+ const dm = delimRe.exec(line);
671
+ if (dm) {
672
+ const char = dm[2][0];
673
+ const len = dm[2].length;
674
+ const trailing = dm[3];
675
+ if (openFence === null) {
676
+ // CommonMark §4.5: backtick fence info string must not contain a backtick.
677
+ if (!(char === '`' && trailing.includes('`'))) {
678
+ // Valid opener — record fence state; this delimiter line is not a bullet.
679
+ openFence = { char, len };
680
+ offset += rawLine.length + 1;
681
+ continue;
682
+ }
683
+ // else: not a valid opener — falls through to the bullet check below.
684
+ }
685
+ else if (char === openFence.char && len >= openFence.len && /^\s*$/.test(trailing)) {
686
+ // Closing delimiter — close the fence; this line is not a bullet.
687
+ openFence = null;
688
+ offset += rawLine.length + 1;
689
+ continue;
690
+ }
691
+ else {
692
+ // Mismatched/insufficient delimiter while a fence is open — fence content.
693
+ offset += rawLine.length + 1;
694
+ continue;
695
+ }
696
+ }
697
+ if (openFence !== null) {
698
+ // Inside a fence — never a bullet candidate.
699
+ offset += rawLine.length + 1;
700
+ continue;
701
+ }
702
+ let bulletText = null;
703
+ const cbm = checkboxRe.exec(line);
704
+ if (cbm) {
705
+ bulletText = cbm[3];
706
+ }
707
+ else {
708
+ const dm2 = dashRe.exec(line);
709
+ if (dm2) {
710
+ bulletText = dm2[2];
711
+ }
712
+ else {
713
+ const nm = numberedRe.exec(line);
714
+ if (nm)
715
+ bulletText = nm[2];
716
+ }
717
+ }
718
+ if (bulletText !== null && match(bulletText, rawLine)) {
719
+ const newLine = transform(rawLine);
720
+ if (typeof newLine !== 'string')
721
+ return content;
722
+ return content.slice(0, offset) + newLine + content.slice(offset + rawLine.length);
723
+ }
724
+ offset += rawLine.length + 1;
725
+ }
726
+ return content;
727
+ }
394
728
  // ─── extractTaggedBlocks ──────────────────────────────────────────────────────
395
729
  /**
396
730
  * Return the inner text of every `<tagName>…</tagName>` block in `content`,
@@ -506,5 +840,120 @@ function replaceSection(content, section, newBody) {
506
840
  return content;
507
841
  return content.slice(0, section.bodyStart) + newBody + content.slice(section.bodyEnd);
508
842
  }
843
+ // ─── withSection ──────────────────────────────────────────────────────────────
844
+ /**
845
+ * Locate the section whose heading matches `target`, run `edit` against ONLY
846
+ * that section's body, and splice the result back into `content`.
847
+ *
848
+ * `target` is either an exact (trimmed) heading-text match or a predicate
849
+ * function over `HeadingToken`. `edit` receives ONLY the section body — so any
850
+ * regex it runs is physically confined to that section — an edit cannot cross
851
+ * a section boundary (ADR-2143 §4, structurally retires the #2130/#2067/#2080
852
+ * boundary-crossing class, where a hand-rolled regex escaped its intended
853
+ * section and mutated a sibling/shipped/backticked-literal occurrence instead).
854
+ *
855
+ * Bounded no-op behaviour (Phase 3 of ADR-2143 adds fail-loud diagnostics on
856
+ * top of this):
857
+ * - No heading matches `target` → `content` is returned unchanged.
858
+ * - `edit` returns a non-string, or returns the same string it was given →
859
+ * `content` is returned unchanged (no-op splice avoided).
860
+ *
861
+ * `opts` is forwarded verbatim to `collectSection` (see its doc comment for
862
+ * `levelBounded` / `stopAtLevel` / `stripFences` semantics) — it lets a caller
863
+ * whose heading levels are non-uniform (e.g. a mix of `###`/`####` phase
864
+ * headings) choose the correct section-end rule instead of relying on the
865
+ * `levelBounded: true` default.
866
+ */
867
+ function withSection(content, target, edit, opts = {}) {
868
+ if (typeof content !== 'string')
869
+ return content;
870
+ const predicate = typeof target === 'function'
871
+ ? target
872
+ : (h) => h.text.trim() === target.trim();
873
+ const section = collectSection(content, predicate, opts);
874
+ if (!section)
875
+ return content; // bounded no-op on miss (Phase 3 adds fail-loud)
876
+ const newBody = edit(section.body);
877
+ if (typeof newBody !== 'string' || newBody === section.body)
878
+ return content;
879
+ return replaceSection(content, section, newBody);
880
+ }
881
+ // ─── deleteSection ────────────────────────────────────────────────────────────
882
+ /**
883
+ * Delete an entire section — the matching heading line ITSELF plus its body —
884
+ * and return the resulting full content string.
885
+ *
886
+ * Locates the target heading via the SAME machinery `collectSection` uses
887
+ * (`tokenizeHeadings` + `headingPredicate`), then determines the stop boundary
888
+ * with the SAME level-bounding rule (`levelBounded` / `stopAtLevel`, see
889
+ * `CollectSectionOptions`): the deleted range runs from the target heading's
890
+ * OWN start offset up to (but not including) the next heading whose level is
891
+ * the same-or-higher (lower level number) than the target's — so a level-3
892
+ * `### Phase N` section deletes through any nested `####` content but STOPS at
893
+ * the next `##`/`###` sibling, whatever that heading's text is (unlike a
894
+ * hand-rolled regex anchored to a specific heading TEXT pattern, which keeps
895
+ * scanning past an unrelated heading and can run away to EOF when no further
896
+ * heading of that specific text shape follows — the whole-section-deletion
897
+ * data-loss class this primitive retires).
898
+ *
899
+ * Unlike `collectSection`/`withSection` (which operate on a section's BODY
900
+ * only, leaving the heading line untouched), `deleteSection` removes the
901
+ * heading line too — the counterpart for "delete section" call sites that
902
+ * `withSection` structurally cannot serve.
903
+ *
904
+ * Collapses at most one resulting blank-line seam: if removing the section
905
+ * leaves 2+ blank lines immediately at the splice point (e.g. the original
906
+ * document already had a double-blank separator immediately before the
907
+ * deleted heading), the seam is normalized down to a single blank line so no
908
+ * double-blank gap accumulates where the section used to sit. Content
909
+ * elsewhere in the document is never touched.
910
+ *
911
+ * Returns `content` unchanged when no heading matches `headingPredicate`
912
+ * (bounded no-op, mirroring `withSection`'s miss behaviour).
913
+ */
914
+ function deleteSection(content, headingPredicate, opts = {}) {
915
+ if (typeof content !== 'string')
916
+ return content;
917
+ const { levelBounded = true, stopAtLevel } = opts;
918
+ const headings = tokenizeHeadings(content);
919
+ const targetIdx = headings.findIndex(headingPredicate);
920
+ if (targetIdx === -1)
921
+ return content;
922
+ const target = headings[targetIdx];
923
+ const lines = content.split('\n');
924
+ // Determine the stop line using the SAME level-bounding rule collectSection uses.
925
+ let stopLine = lines.length + 1; // 1-based, exclusive (default: EOF+1)
926
+ for (let j = targetIdx + 1; j < headings.length; j++) {
927
+ const next = headings[j];
928
+ let isStop;
929
+ if (stopAtLevel !== undefined) {
930
+ isStop = next.level <= stopAtLevel;
931
+ }
932
+ else {
933
+ isStop = levelBounded ? next.level <= target.level : true;
934
+ }
935
+ if (isStop) {
936
+ stopLine = next.line;
937
+ break;
938
+ }
939
+ }
940
+ // Character offsets — same line-offset table collectSection builds.
941
+ const lineOffsets = new Array(lines.length);
942
+ let acc = 0;
943
+ for (let i = 0; i < lines.length; i++) {
944
+ lineOffsets[i] = acc;
945
+ acc += lines[i].length + 1; // +1 for the '\n' separator
946
+ }
947
+ const eofOffset = acc;
948
+ const sectionStart = lineOffsets[target.line - 1]; // start of the target heading LINE itself
949
+ const sectionEnd = stopLine <= lines.length ? lineOffsets[stopLine - 1] : eofOffset;
950
+ const before = content.slice(0, sectionStart);
951
+ const after = content.slice(sectionEnd);
952
+ // Collapse a resulting blank-line seam to at most one blank line (2 newlines).
953
+ // Only the tail of `before` (immediately at the splice point) is touched —
954
+ // this never reaches into unrelated content elsewhere in the document.
955
+ const collapsedBefore = before.replace(/(?:\r\n|\n){3,}$/, (m) => (m.includes('\r\n') ? '\r\n\r\n' : '\n\n'));
956
+ return collapsedBefore + after;
957
+ }
509
958
  // Consumers: require('../gsd-core/bin/lib/markdown-sectionizer.cjs')
510
959
  // Named CJS exports are the canonical surface (ADR-457 .cts → .cjs build-at-publish).