v13.1.0

[13.1.0] - 2026-03-04

Added

• 5 new graph algorithms in GraphTraversal — levels() (longest-path level assignment for DAGs), transitiveReduction() (minimal edge set preserving reachability), transitiveClosure() (all implied reachability edges with maxEdges safety), rootAncestors() (find all in-degree-0 ancestors via backward BFS). All methods respect NeighborProviderPort abstraction, support AbortSignal cancellation, and produce deterministic output. Corresponding LogicalTraversal facade methods added. New error code: E_MAX_EDGES_EXCEEDED.
• 4 new test fixtures — F15_WIDE_DAG_FOR_LEVELS, F16_TRANSITIVE_REDUCTION, F17_MULTI_ROOT_DAG, F18_TRANSITIVE_CLOSURE_CHAIN in the canonical fixture DSL.
• BFS reverse reachability verification tests — confirms bfs(node, { direction: 'in' }) correctly discovers all backward-reachable ancestors.
• roaring-wasm WASM fallback for Bun/Deno bitmap indexes — initRoaring() now has a three-tier fallback chain: (1) ESM import('roaring'), (2) CJS createRequire('roaring'), (3) import('roaring-wasm') with WASM initialization. The WASM tier activates automatically when native V8 bindings are unavailable (Bun's JSC, Deno). Bitmap index tests (materializedView, materialize.checkpointIndex.notStale) are no longer excluded from the Bun test suite. Serialization formats are wire-compatible — portable bitmaps produced by native and WASM are byte-identical.

Fixed

• Roaring native module loading under Bun — initRoaring() now catches dynamic import('roaring') failures and falls back to createRequire() for direct .node binary loading.
• Stale nativeAvailability cache on initRoaring() reinit — getNativeRoaringAvailable() now returns the correct value after swapping roaring implementations via initRoaring(mod). Previously, the cached availability from the old module was returned.
• Lost root causes on roaring load failure — when all three tiers (native ESM, CJS require, WASM) fail, initRoaring() now throws AggregateError with per-tier errors instead of a plain Error, preserving diagnostic detail.

Changed

• ROADMAP priority triage — 45 standalone items sorted into 6 priority tiers (P0–P6) with wave-based execution order and dependency chain mapping. Replaced flat Near-Term table with priority-grouped sub-tables. All milestones (M10–M14) marked complete. Inventory corrected to 133 total tracked items.
• Vitest 2.1.9 → 4.0.18 — major test framework upgrade. Migrated deprecated test(name, fn, { timeout }) signatures to test(name, { timeout }, fn) across 7 test files (40 call sites). Fixed vi.fn().mockImplementation() constructor mocks to use function expressions per Vitest 4 requirements. Resolves 5 remaining moderate-severity npm audit advisories (esbuild GHSA-67mh-4wv8-2f99, vite, @vitest/mocker, vite-node, vitest). npm audit now reports 0 vulnerabilities.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 13.1.0

If one registry failed, re-run only that job from Actions.

What's Changed

• fix(deps): upgrade vitest 2→4, resolve all npm audit findings by @flyingrobots in #63

Full Changelog: v13.0.1...v13.1.0

v13.0.1

[13.0.1] — 2026-03-03

Fixed

• Dev dependency security updates — resolved 4 high-severity advisories in transitive dev dependencies: tar 7.5.2 → 7.5.9 (GHSA-r6q2-hw4h-h46w, GHSA-34x7-hfp2-rc4v, GHSA-8qq5-rm4j-mr97, GHSA-83g3-92jg-28cx), rollup 4.55.1 → 4.59.0 (GHSA-mw96-cpmx-2vgc), minimatch 3.1.2/9.0.5/10.1.1 → 3.1.5/9.0.9/10.2.4 (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74), @isaacs/brace-expansion 5.0.0 replaced by brace-expansion 5.0.4 (GHSA-7h2j-956f-4vf2). No runtime dependencies affected.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 13.0.1

If one registry failed, re-run only that job from Actions.

Full Changelog: v13.0.0...v13.0.1

v13.0.0

[13.0.0] — 2026-03-03

Added

• Observer API stabilized (B3) — subscribe() and watch() promoted to @stability stable with @since 13.0.0 annotations. Fixed onError callback type from (error: Error) to (error: unknown) to match runtime catch semantics. watch() pattern param now correctly typed as string | string[] in _wiredMethods.d.ts.
• graph.patchMany() batch patch API (B11) — applies multiple patch callbacks sequentially. Each callback sees state from prior commits. Returns array of commit SHAs. Inherits reentrancy guard from graph.patch().
• Causality bisect (B2) — BisectService performs binary search over a writer's patch chain to find the first bad patch. CLI: git warp bisect --good <sha> --bad <sha> --test <cmd> --writer <id>. O(log N) materializations. Exit codes: 0=found, 1=usage, 2=range error, 3=internal.

Changed

• BREAKING: getNodeProps() returns Record<string, unknown> instead of Map<string, unknown> (B100) — aligns with getEdgeProps() which already returns a plain object. Callers must replace .get('key') with .key or ['key'], .has('key') with 'key' in props, and .size with Object.keys(props).length. ObserverView.getNodeProps() follows the same change.
• GraphPersistencePort narrowing (B145) — domain services now declare focused port intersections (CommitPort & BlobPort, etc.) in JSDoc instead of the 23-method composite GraphPersistencePort. Removed ConfigPort from the composite (23 → 21 methods); adapters still implement configGet/configSet on their prototypes. Zero behavioral change.
• Codec trailer validation extraction (B134, B138) — created TrailerValidation.js with requireTrailer(), parsePositiveIntTrailer(), validateKindDiscriminator(). All 4 message codec decoders now use shared helpers exclusively. Patch and Checkpoint decoders now also perform semantic field validation (graph name, writer ID, OID, SHA-256) matching the Audit decoder pattern. Internal refactor for valid inputs, with stricter rejection of malformed messages.
• HTTP adapter shared utilities (B135) — created httpAdapterUtils.js with MAX_BODY_BYTES, readStreamBody(), noopLogger. Eliminates duplication across Node/Bun/Deno HTTP adapters. Internal refactor, no behavioral change.
• Bitmap checksum extraction (B136) — moved duplicated computeChecksum() from both bitmap builders to checksumUtils.js. Internal refactor, no behavioral change.
• BitmapNeighborProvider lazy validation (B141) — constructor no longer throws when neither indexReader nor logicalIndex is provided. Validation moved to getNeighbors()/hasNode() method entry.

Removed

• BREAKING: PerformanceClockAdapter and GlobalClockAdapter exports (B140) — both were deprecated re-exports of ClockAdapter. Deleted shim files, removed from index.js, index.d.ts, and type-surface.m8.json. Use ClockAdapter directly.

Fixed

• Test hardening (B130) — replaced private field access (_idToShaCache, _snapshotState, _cachedState) with behavioral assertions in BitmapIndexReader.test.js, PatchBuilderV2.snapshot.test.js, and WarpGraph.timing.test.js.
• Fake timer lifecycle (B131) — moved vi.useFakeTimers() from beforeAll to beforeEach and vi.useRealTimers() into afterEach in WarpGraph.watch.test.js.
• Test determinism (B132) — seeded Math.random() in benchmarks with Mulberry32 RNG (0xDEADBEEF), added seed: 42 to all fast-check property tests, replaced random delays in stress test with deterministic values.
• Global mutation documentation (B133) — documented intentional globalThis.Buffer mutation in noBufferGlobal.test.js and crypto.randomUUID() usage in SyncAuthService.test.js.
• Code review fixes (B148):
  • CLI hardening — added --writer validation to bisect, SHA format regex on --good/--bad, rethrow ENOENT/EACCES from test command runner instead of swallowing.
  • BisectService cleanup — removed dead code, added invariant comment, replaced BisectResult interface with discriminated union type, fixed exit code constant.
  • Prototype-pollution hardening — Object.create(null) for property bags in getNodeProps, getEdgeProps, getEdges, buildPropsSnapshot; fixed indexed-path null masking in getNodeProps.
  • Docs housekeeping — reconciled ROADMAP inventory counts (24→29 done), fixed M11 sequencing, removed done items from priority tiers, fixed stale test vector counts (6→9), corrected Deno test name, moved B100 to ### Changed.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 13.0.0

If one registry failed, re-run only that job from Actions.

What's Changed

• refactor(ports): narrow persistence JSDoc to focused ports (B145) by @flyingrobots in #60
• M14 HYGIENE: test hardening, DRY extraction, SOLID quick-wins by @flyingrobots in #61
• fix(bisect): harden CLI validation and remove dead code (B148) by @flyingrobots in #62

Full Changelog: v12.4.1...v13.0.0

v12.4.1

[12.4.1] — 2026-02-28

Fixed

• tsconfig.src.json / tsconfig.test.json missing d.ts includes — added globals.d.ts and _wiredMethods.d.ts to both split configs; eliminated 113 + 634 false TS2339 errors for WarpGraph wired methods.
• TestPatch typedef divergence — TemporalQuery.checkpoint.test.js used hand-rolled TestPatch that drifted from PatchV2 (schema: number vs 2|3, context: Map vs plain object); replaced with PatchV2 import.
• JSR dry-run deno_ast panic — deduplicated @git-stunts/alfred import specifiers in GitGraphAdapter.js to work around deno_ast 0.52.0 overlapping text-change bug.
• check-dts-surface.js default-export regex — extractJsExports and extractDtsExports captured class/function keywords instead of identifier names for export default class Foo / export default function Foo patterns.

Changed

• @param {Object} → inline typed shapes (190 sites, 72 files) — every @param {Object} foo + @param {type} foo.bar sub-property group collapsed to @param {{ bar: type }} foo.
• @property {Object} → typed shapes (6 sites) — StateDiffResult, HealthResult, TrustAssessment, PatchEntry.
• {Function} → typed signatures (4 sites) — NodeHttpAdapter, BunHttpAdapter, DenoHttpAdapter handler/logger params.
• {Object} → Record<string, unknown> (1 site) — defaultCodec.js constructor guard cast.
• {Buffer} → {Uint8Array} across ports/adapters — multi-runtime alignment (Node/Bun/Deno).
• globals.d.ts augmented — added declare var Bun / declare var Deno for globalThis.* access.
• parseCommandArgs generic return — @template T + ZodType<T> so callers get schema-inferred types.
• JoinReducer typed shapes — added OpLike/PatchLike typedefs; replaced 10 {Object} params.
• GitGraphAdapter typed shapes — added GitPlumbingLike/CollectableStream typedefs; extracted RetryOptions typedef to deduplicate import specifiers.
• onError callback type widened — subscribe.methods.js onError param changed from Error to unknown to match runtime catch semantics.
• WriterId.resolveWriterId param type — explicitWriterId widened from string|undefined to string|null|undefined to match defensive null check.
• ConsoleLogger level param type — widened from number to number|string to match string-based LEVEL_NAMES lookup.
• StateSerializerV5 typedef extraction — StateHashOptions typedef replaces duplicated inline type on computeStateHashV5.
• StreamingBitmapIndexBuilder.onFlush type — replaced Function|undefined with precise callback signature.
• HealthCheckService._computeHealth return type — narrowed status: string to 'healthy'|'degraded'|'unhealthy'.
• DagTraversal/DagTopology constructors — removed redundant inline type casts (JSDoc @param suffices).
• parseCursorBlob examples — replaced Buffer.from() with TextEncoder.encode() to match Uint8Array param type.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.4.1

If one registry failed, re-run only that job from Actions.

What's Changed

• chore: JSDoc total coverage — eliminate all unsafe type patterns by @flyingrobots in #59
• release: v12.4.0 — standalone lane batch by @flyingrobots in #58

Full Changelog: v12.3.0...v12.4.1

v12.3.0

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.3.0

If one registry failed, re-run only that job from Actions.

What's Changed

• fix: immediate standalone items + backlog reconciliation by @flyingrobots in #56
• feat: M13 ADR 1 — canonical edge property ops, wire gate split, ADR governance by @flyingrobots in #57

Full Changelog: v12.2.1...v12.3.0

v12.2.1

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.2.1

If one registry failed, re-run only that job from Actions.

What's Changed

• fix(M12): sync safety + cache coherence (T1 + T2) by @flyingrobots in #50
• fix: J9/J10/J12/J13/J15/J17/J18/J19 safe fixes by @flyingrobots in #54
• fix(T7): add _committed guard to PatchBuilderV2 — prevent use-after-commit by @flyingrobots in #51
• fix(T4): optimize incremental index — O(degree) re-add scan + single bitmap deser by @flyingrobots in #52
• fix: B114 eager diff pass-through + B115 tip-only checkpoint ancestry validation by @flyingrobots in #53
• fix(M12): complete T8 JANK + T9 TSK TSK — 42 STANK items by @flyingrobots in #55

Full Changelog: v12.2.0...v12.2.1

v12.2.0

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.2.0

If one registry failed, re-run only that job from Actions.

What's Changed

• feat: multi-pattern glob support for observers and queries; v12.1.0 by @flyingrobots in #49

Full Changelog: v12.1.0...v12.2.0

v12.1.0

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.1.0

If one registry failed, re-run only that job from Actions.

Full Changelog: v12.0.0...v12.1.0

v12.0.0

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 12.0.0

If one registry failed, re-run only that job from Actions.

What's Changed

• docs: replace Graphviz SVG diagrams with inline Mermaid by @flyingrobots in #47
• v12.0.0 — MaterializedView architecture + GraphTraversal engine by @flyingrobots in #48

Full Changelog: v11.5.1...v12.0.0

v11.5.1

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 11.5.1

If one registry failed, re-run only that job from Actions.

What's Changed

• feat(partition): M9 — SyncController extraction, JoinReducer split, bitmap OID validation by @flyingrobots in #44

Full Changelog: v11.5.0...v11.5.1