[viktar-b]

Summary

Replace the grouped-script regex with a forward scan that preserves existing code names, including empty, nested and mismatched delimiters. Collapse underscores before trimming so malformed glyphs cannot trigger repeated scans during cleanup.

scan to the next script opener
  consume through the first closing delimiter
  if no closer exists, preserve the remaining suffix and stop
join replacements, normalize separators, trim edges

Addresses code-scanning alert 4. Based directly on main; no changes from the method-table branch.

Evidence

• Before: The new 300 KB unmatched-glyph regression fails against main when its child process exceeds the five-second deadline.
• After: All 203 core tests pass, including the bounded child-process regression for plaintext, glyph and ID fallbacks. A 300 KB malformed glyph with surrounding letters completes in about 30 ms locally on Node 24.
• 100,000 deterministic generated compatibility cases match the previous implementation.
• Passed npm test --workspace @cs-object/core, npm run typecheck --workspace @cs-object/core, and npm run lint --workspace @cs-object/core. Lint retains three existing warnings and a Biome schema-version notice outside the changed files.
• Passed npm run test:integration -- tests/integration/python-export-runtime-names.test.ts, all six tests, plus formatting and git diff --check.
• GitHub CI and CodeQL results are pending. The alert has not been dismissed manually.

Merge Danger

Door: two-way

Revert restores the prior implementation. No schema, dependency or public API changes.

Blast Radius: core

Glyph-derived code names used by JSON sheet conversion and Python export. Compatibility cases and existing export tests retain prior naming behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
calculation-source-object	Ready	Preview	Nov 6, 2026 9:07am UTC