🐛 Take glob-to-regexp from npm so its types stop drifting

[taras]

Motivation

Verify fails on every pull request to this repo, and has since at least
2026-03-03 — the runs on Deploy To Netlify (#72) and on the merge of #73 fail
with the same error:

TS2305 [ERROR]: Module '"https://esm.sh/v132/@types/glob-to-regexp@0.4.4/index.d.ts"'
has no exported member 'default'.

export { default as globToRegExp } from "https://esm.sh/glob-to-regexp@0.4.1?pin=v132";
    at src/deps.ts:5:10

?pin=v132 pins the runtime package at 0.4.1, but esm.sh resolves the type
declarations separately and now serves @types/glob-to-regexp@0.4.4, which is
CommonJS-shaped:

export as namespace GlobToRegExp;
export = GlobToRegExp;

There is no default to re-export. TypeScript's synthetic-default interop lets
you import from a module like that, but it does not invent a default
binding for export { default as … } from, so the check is right to fail. The
pin covered the code and not the types, and the types moved out from under it.

Approach

- export { default as globToRegExp } from "https://esm.sh/glob-to-regexp@0.4.1?pin=v132";
+ export { default as globToRegExp } from "npm:glob-to-regexp@0.4.1";

Deno does the CommonJS interop itself for an npm: specifier, and takes the
types from the package rather than from a separately-resolved URL, so there is
nothing left to drift.

It is also the direction this repo already took, in
✨ convert inline URL imports to bare specifiers.

I tried keeping the esm.sh url and splitting the re-export into an import
followed by an export; it fails the same way, so the specifier itself has to
change.

hash.js on the next line has the same shape, but esm.sh serves no @types
for it, so there is nothing there to drift. Left alone.

Tests

All three steps the Verify workflow runs now pass locally, where deno task test previously failed on the type check:

deno fmt --check   Checked 32 files
deno lint          Checked 25 files
deno task test     ok | 10 passed (82 steps) | 0 failed

I also confirmed the replacement works at runtime, not only in the type
checker — globToRegExp("*.ts") returns /^.*\.ts$/.

deno.lock gains the npm entry, and along with it the @std/assert and
@std/internal entries the lockfile had been missing since the bare-specifier
conversion.

Note

Unrelated to #74, which touches only deno.json and a route template. That PR
is failing on this same pre-existing error and should go green once this lands.

[github-actions]

🚀 Deploy Preview Ready!

• Stable Review Link: https://pr-75--graphgen-data.netlify.app
• Latest Commit Snapshot: https://6abc570234822060d26e3fcb--graphgen-data.netlify.app

Introduction | graphgen docs

Docs intro

Introduction | graphgen docs

Docs intro