fix(context): order prereleases and build metadata correctly

[moshest]

Two bugs in the version comparator shipped in 1.2.1, found by an independent review of #105 run after it merged. Both make a bare package name resolve to the wrong installed version.

1. 2.0.0-rc.10 ranked below 2.0.0-rc.2

installed: 2.0.0-rc.2, 2.0.0-rc.10
context query pkg   ->  serves 2.0.0-rc.2

Numeric segments were compared numerically, but the prerelease suffix still went through a plain text comparison — so "rc.10" < "rc.2". That is precisely the inversion #102 was about, surviving one field deeper in the same function that fixed it.

Identifiers are now compared one at a time, numerically where both are numbers, with a shorter run sorting lower (semver §11).

2. 1.0.0+20130313144700 ranked below 0.0.1

installed: 0.9.0, 1.0.0+20130313144700
context query pkg   ->  serves 0.9.0

Only a - prerelease was stripped before parsing, so build metadata left the last segment as 0+20130313144700. That fails the numeric test, which classified the entire version as having no numeric part and dropped it into the bucket reserved for floating labels like latest — deliberately below every real release. A package installed at a semver-legal version became unreachable by bare name, silently serving older documentation.

Build metadata is now stripped before parsing, as it carries no ordering meaning (semver §10).

Verification

Both reproduced against the shipped build before fixing, in both insertion orders, then confirmed fixed.

The comparator is still a total order — the property that keeps results independent of filesystem order, which was the whole point of #102:

24-version pool (leading zeros, v-prefix, >MAX_SAFE_INTEGER segments,
prereleases, build metadata, latest/main, empty, whitespace, non-ASCII)
  reflexivity   0 violations
  antisymmetry  0 violations
  transitivity  0 violations   (13,824 triples)
  list() drift  0 across 300 shuffles

Both new tests are mutation-verified: reverting the prerelease fix fails only the prerelease test, reverting the build-metadata fix fails only the build-metadata test.

pnpm lint    ✓
pnpm build   ✓
pnpm test    ✓  221 + 39 passed

Why this exists

#105 merged without an independent review — the reviewer died on a session limit while a nightly job had been failing five nights, and I judged the trade worth it. This is the second batch of defects from that call; the first was #106. The review has now run against the shipped code, and it confirmed the rest is sound: no data loss in context remove (including scoped names like @trpc/server), --libs agrees across CLI and MCP server, and openDb cannot serve a different version than the caller resolved.

---

Generated by Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: b0c3793

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@neuledge/context	Patch
@neuledge/registry	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR