v13.0.0

[13.0.0] — 2026-03-03

Added

• Observer API stabilized (B3) — subscribe() and watch() promoted to @stability stable with @since 13.0.0 annotations. Fixed onError callback type from (error: Error) to (error: unknown) to match runtime catch semantics. watch() pattern param now correctly typed as string | string[] in _wiredMethods.d.ts.
• graph.patchMany() batch patch API (B11) — applies multiple patch callbacks sequentially. Each callback sees state from prior commits. Returns array of commit SHAs. Inherits reentrancy guard from graph.patch().
• Causality bisect (B2) — BisectService performs binary search over a writer's patch chain to find the first bad patch. CLI: git warp bisect --good <sha> --bad <sha> --test <cmd> --writer <id>. O(log N) materializations. Exit codes: 0=found, 1=usage, 2=range error, 3=internal.

Changed

• BREAKING: getNodeProps() returns Record<string, unknown> instead of Map<string, unknown> (B100) — aligns with getEdgeProps() which already returns a plain object. Callers must replace .get('key') with .key or ['key'], .has('key') with 'key' in props, and .size with Object.keys(props).length. ObserverView.getNodeProps() follows the same change.
• GraphPersistencePort narrowing (B145) — domain services now declare focused port intersections (CommitPort & BlobPort, etc.) in JSDoc instead of the 23-method composite GraphPersistencePort. Removed ConfigPort from the composite (23 → 21 methods); adapters still implement configGet/configSet on their prototypes. Zero behavioral change.
• Codec trailer validation extraction (B134, B138) — created TrailerValidation.js with requireTrailer(), parsePositiveIntTrailer(), validateKindDiscriminator(). All 4 message codec decoders now use shared helpers exclusively. Patch and Checkpoint decoders now also perform semantic field validation (graph name, writer ID, OID, SHA-256) matching the Audit decoder pattern. Internal refactor for valid inputs, with stricter rejection of malformed messages.
• HTTP adapter shared utilities (B135) — created httpAdapterUtils.js with MAX_BODY_BYTES, readStreamBody(), noopLogger. Eliminates duplication across Node/Bun/Deno HTTP adapters. Internal refactor, no behavioral change.
• Bitmap checksum extraction (B136) — moved duplicated computeChecksum() from both bitmap builders to checksumUtils.js. Internal refactor, no behavioral change.
• BitmapNeighborProvider lazy validation (B141) — constructor no longer throws when neither indexReader nor logicalIndex is provided. Validation moved to getNeighbors()/hasNode() method entry.

Removed

• BREAKING: PerformanceClockAdapter and GlobalClockAdapter exports (B140) — both were deprecated re-exports of ClockAdapter. Deleted shim files, removed from index.js, index.d.ts, and type-surface.m8.json. Use ClockAdapter directly.

Fixed

• Test hardening (B130) — replaced private field access (_idToShaCache, _snapshotState, _cachedState) with behavioral assertions in BitmapIndexReader.test.js, PatchBuilderV2.snapshot.test.js, and WarpGraph.timing.test.js.
• Fake timer lifecycle (B131) — moved vi.useFakeTimers() from beforeAll to beforeEach and vi.useRealTimers() into afterEach in WarpGraph.watch.test.js.
• Test determinism (B132) — seeded Math.random() in benchmarks with Mulberry32 RNG (0xDEADBEEF), added seed: 42 to all fast-check property tests, replaced random delays in stress test with deterministic values.
• Global mutation documentation (B133) — documented intentional globalThis.Buffer mutation in noBufferGlobal.test.js and crypto.randomUUID() usage in SyncAuthService.test.js.
• Code review fixes (B148):
  • CLI hardening — added --writer validation to bisect, SHA format regex on --good/--bad, rethrow ENOENT/EACCES from test command runner instead of swallowing.
  • BisectService cleanup — removed dead code, added invariant comment, replaced BisectResult interface with discriminated union type, fixed exit code constant.
  • Prototype-pollution hardening — Object.create(null) for property bags in getNodeProps, getEdgeProps, getEdges, buildPropsSnapshot; fixed indexed-path null masking in getNodeProps.
  • Docs housekeeping — reconciled ROADMAP inventory counts (24→29 done), fixed M11 sequencing, removed done items from priority tiers, fixed stale test vector counts (6→9), corrected Deno test name, moved B100 to ### Changed.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 13.0.0

If one registry failed, re-run only that job from Actions.

What's Changed

• refactor(ports): narrow persistence JSDoc to focused ports (B145) by @flyingrobots in #60
• M14 HYGIENE: test hardening, DRY extraction, SOLID quick-wins by @flyingrobots in #61
• fix(bisect): harden CLI validation and remove dead code (B148) by @flyingrobots in #62

Full Changelog: v12.4.1...v13.0.0