v14.1.0

[14.1.0] — 2026-03-14

Added

• Content attachment metadata API — attachContent() and attachEdgeContent() now accept optional { mime, size } metadata hints, persist logical content byte size alongside the _content OID, and expose getContentMeta() / getEdgeContentMeta() for structured { oid, mime, size } reads without manual _content.* property handling. Metadata reads stay aligned with the current _content attachment instead of inheriting stale sibling props from later manual rewrites.
• Streaming transitive closure traversal — Added transitiveClosureStream() to the traversal stack so callers can consume reachability edges lazily as an AsyncGenerator<{ from, to }> without materializing the full closure array. The existing transitiveClosure() API remains and now collects from the stream for backward compatibility.
• First-class sync trust configuration — WarpGraph.open({ trust }) and graph.syncWith(..., { trust }) now expose an explicit public trust-config surface for sync evaluation instead of relying on hidden controller wiring alone.
• Fluent WarpStateV5 test builder — Added createStateBuilder() in test/helpers/stateBuilder.js so state-heavy tests can seed nodes, edges, removals, properties, frontier state, and graph materialization through one fluent helper instead of ad hoc OR-Set/LWW mutation.
• Seeded tree-construction determinism fuzzer — Added property-based coverage for patch and checkpoint tree construction, proving stable tree OIDs across internal content-anchor permutations in PatchBuilderV2 and shuffled content-property insertion order in CheckpointService.createV5().
• Focused markdownlint gate — Added npm run lint:md backed by markdownlint-cli and a repo config that enforces fenced code-block languages (MD040) across Markdown files.
• Markdown JS/TS code-sample linter — Added npm run lint:md:code, which scans fenced JavaScript and TypeScript blocks in Markdown and syntax-checks them with the TypeScript parser for file/line-accurate diagnostics.
• Pre-push hook regression harness — Added a focused Vitest behavioral harness for scripts/hooks/pre-push that exercises the real shell hook with stubbed commands, proves quick mode skips Gate 8, and verifies Gate 1–8 failure labels at runtime.

Changed

• Release audit override for transitive tar — Added an npm overrides pin for tar@7.5.11 so the published/runtime dependency tree can resolve past the tar@<=7.5.10 high-severity advisory blocking the v14.1.0 release audit.
• Content metadata review follow-ups — ContentMeta and ContentAttachmentOptions are now exported as public type-only symbols, the consumer smoke test imports them directly, and the git-cas adapter docs now explicitly note that MIME/size hints are accepted for CRDT metadata but are not embedded in CAS manifests.
• Content metadata surface manifest follow-up — the declaration contract manifest now matches the shipped API: attachContent() / attachEdgeContent() include the optional metadata parameter for both patch builders and patch sessions, and WarpGraph exports getContentMeta() / getEdgeContentMeta() in the tracked public surface.
• Backlog expanded for roaring runtime evaluation — ROADMAP.md now tracks B170, a dedicated benchmark slice for native roaring versus roaring-wasm across the bitmap-heavy hot paths used by the index builders and readers.
• Roadmap reconciled after PR #69 merge — ROADMAP.md now reflects the merged issue-45 content metadata work on main, records that the GitHub issue queue is empty, and keeps B88 as the next tracked backlog slice.
• Roadmap reconciled after PR #67 / #68 merges — ROADMAP.md and docs/ROADMAP/COMPLETED.md now reflect the merged pre-push gate regression work (B168) and the current main baseline before the issue-45 slice branches off.
• Large-graph traversal memory profile — topologicalSort() now has a lightweight mode that avoids retaining discovery adjacency when callers do not need it. levels() and transitiveReduction() were refactored to re-fetch neighbors on demand instead of pinning full topo adjacency in memory, reducing steady-state large-graph working sets.
• Roadmap reconciled after B87 merge — ROADMAP.md now treats the Markdown code-sample linter as merged work on main, advances the CI/tooling wave to start at B88, and records the follow-up backlog items for pre-push gate-message regression coverage (B168) and archived-doc status guardrails (B169).
• Surface validation accounting — The declaration surface checker now distinguishes runtime-backed exports from type-only manifest entries and understands namespace declarations, which makes the type-surface contract tighter without forcing runtime exports for pure types.
• Local push firewall now matches CI surface and docs checks — scripts/hooks/pre-push now runs npm run typecheck:surface, npm run lint:md, and npm run lint:md:code alongside lint, strict typecheck, policy, and consumer surface checks before unit tests, so declaration-surface drift and Markdown sample regressions are blocked locally instead of waiting for CI.
• Trust test infrastructure deduplicated — The TrustRecordService suites now share a single in-memory ref/blob/tree/commit fixture and JSON codec via test/helpers/trustTestUtils.js, eliminating the four forked mock implementations that had started to drift.
• Explicit type-only export manifest section — type-surface.m8.json now separates runtime exports from declaration-only typeExports, and the surface checker now fails on misplaced or duplicate entries across those sections.
• Constructor option-bag defaults made explicit — Added an ESLint rule banning constructor({ ... } = {}) in source files and rewrote the remaining constructors to destructure an explicit options bag inside the constructor body. This avoids accidentally marking required constructor params optional in JSDoc and strict type checking.
• Checkpoint content-anchor batching — CheckpointService.createV5() now folds content blob OIDs into sorted anchor entries in batches instead of building one monolithic Set before tree serialization. Added direct checkpoint coverage for anchor dedupe, deterministic ordering, and load-path indifference to _content_* anchor entries.
• CI gate dedupe — Folded the duplicate lint workflow job into type-firewall and carried forward the advisory runtime npm audit step there, leaving one authoritative lint/type gate in the main CI workflow.
• Markdown fence labeling sweep — Unlabeled Markdown code fences now declare a language such as text, letting the new markdown gate verify docs/examples without broad style-rule churn.
• Docs static firewall extended — The CI fast gate now runs both markdown fence-language checks and JavaScript/TypeScript code-sample syntax validation before the runtime matrix jobs.

Fixed

• Missing content blob OIDs now throw instead of reading as empty bytes — GitGraphAdapter.readBlob() now disambiguates real zero-byte blobs from swallowed missing-object reads by checking object existence when a blob stream collects to zero bytes. Corrupted _content / edge-content references now surface PersistenceError(E_MISSING_OBJECT) through getContent() / getEdgeContent() instead of returning a truthy empty buffer.
• Deno CI resolver drift — The Deno test image now imports a Node 22 npm toolchain from node:22-slim, installs dependencies with npm ci, and runs tests with --node-modules-dir=manual, avoiding runtime npm re-resolution of cbor-extract optional platform packages while keeping the container on the repo’s supported Node engine line.
• Markdown code-sample linter edge cases — The Markdown JS/TS sample linter now recognizes fenced code blocks indented by up to three spaces, rejects malformed mixed-marker fences, fails on unterminated JS/TS fences, and parses snippets with the repository’s configured TypeScript target from tsconfig.base.json.
• B87 review follow-ups — Clarified the ADR folds snippet as a wholly proposed graph.view() sketch, corrected the pre-push quick-mode gate label to Gate 8, aligned the local hook’s gate numbers with CI for faster failure triage, and removed the self-expiring pending merge wording from the completed-roadmap archive entry.
• Signed trust verification now performs real crypto checks — Trust evaluation now verifies Ed25519 signatures and key fingerprints during evidence processing instead of stopping at envelope/shape validation.
• Browser/WebSocket serve payload parity for edge properties — WarpServeService state payloads now include edge properties, so served graph views no longer drop part of the graph model.
• attachContent() / attachEdgeContent() orphan blob writes — Content attachment now validates the target node/edge before writing blob content, preventing orphaned blob storage on invalid mutations.
• NodeWsAdapter cleanup contracts — Failed startup paths now clean up partial internal state, and shutdown is idempotent instead of leaving stale listener/server state behind.
• Public export surface drift — WarpServeService and WebSocketServerPort are exported from index.js, bringing runtime exports back into alignment with the declared public surface.
• Type-policy false positives from declaration comments — ts-policy-check now ignores inline declaration comments instead of flagging any mentions that exist only inside explanatory comments.
• Trust/canonical property coverage — Added property-based determinism coverage for canonicalStringify() and trust-schema canonical parse behavior, and tightened the trust property generators to avoid invalid whitespace-only writerId counterexamples.

Registry publish summary

• npm: success
• JSR: success

Dist-tag: latest
Version: 14.1.0

If one registry failed, re-run only that job from Actions.

What's Changed

• ci: lint Markdown JS/TS code samples by @flyingrobots in #66
• test: add pre-push gate regression coverage by @flyingrobots in #67
• fix: throw on missing content blob oids by @flyingrobots in #68
• feat: attach content metadata to content blobs by @flyingrobots in #69

Full Changelog: v14.0.0...v14.1.0