@sigloch/graph-api-core 5.1.0 → 5.3.0

package/dist/browser.d.ts

@@ -13,7 +13,7 @@
  */
 export { findRoot } from './find-root.js';
 export type { RootQueryGraph } from './find-root.js';
-export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph } from './se-descriptor.js';
+export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph, fromOntologyGraph } from './se-descriptor.js';
 export { FormatECodec } from './format-e-codec.js';
 export { isValidTrace, tracePatternsOf } from './types.js';
 export type { GraphNode, GraphEdge, Graph } from './types.js';

package/dist/browser.js

@@ -12,6 +12,6 @@
  * @author andreas@siglochconsulting
  */
 export { findRoot } from './find-root.js';
-export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph } from './se-descriptor.js';
+export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph, fromOntologyGraph } from './se-descriptor.js';
 export { FormatECodec } from './format-e-codec.js';
 export { isValidTrace, tracePatternsOf } from './types.js';

package/dist/edge-ops.js

@@ -31,13 +31,20 @@ export function mergeNodes(graph, sourceUid, targetUid) {
     if (!graph.nodes.some(n => n.uid === sourceUid)) {
         throw new Error(`merge-nodes: source node not found: ${sourceUid}`);
     }
-    const edges = [];
+    // CR-SM-253: two passes, not one. The single-pass form checked the REWIRED edge
+    // against what the loop had collected so far, but appended an untouched edge
+    // unchecked — so the result depended on the order of `graph.edges`: source's edge
+    // first gave `B-verify->R` twice, target's edge first gave it once. Kuzu keys on
+    // (source, type, target) and silently keeps one, so the in-memory graph then claimed
+    // an edge the store did not have. Collecting every survivor first and deduplicating
+    // against the complete set makes the result order-independent.
     const removedEdges = [];
-    const addedEdges = [];
+    const kept = [];
+    const rewiredEdges = [];
     for (const e of graph.edges) {
         const touchesSource = e.sourceId === sourceUid || e.targetId === sourceUid;
         if (!touchesSource) {
-            edges.push(e);
+            kept.push(e);
             continue;
         }
         removedEdges.push(e);
@@ -49,11 +56,18 @@ export function mergeNodes(graph, sourceUid, targetUid) {
         if (rewired.sourceId === rewired.targetId) {
             continue; // self-edge created by rewiring — discarded
         }
+        rewiredEdges.push(rewired);
+    }
+    // `addedEdges` is the delta the store persists. An edge the target already carried
+    // is not an addition — persisting it would write the duplicate into the store path
+    // that the in-memory dedup just prevented.
+    const edges = kept.slice();
+    const addedEdges = [];
+    for (const rewired of rewiredEdges) {
+        if (edges.some(x => sameEdge(x, rewired)))
+            continue;
+        edges.push(rewired);
         addedEdges.push(rewired);
-        // Two incident edges (or one incident + one pre-existing) can rewire onto
-        // the same (source,target,type) — keep the result graph free of duplicates.
-        if (!edges.some(x => sameEdge(x, rewired)))
-            edges.push(rewired);
     }
     const nodes = graph.nodes.filter(n => n.uid !== sourceUid);
     return { graph: { nodes, edges }, removedNode: sourceUid, removedEdges, addedEdges };

package/dist/graph-service.js

@@ -72,7 +72,6 @@ export class GraphService {
         let rejected = 0;
         const violations = [];
         const nodesToCreate = [];
-        const edgesToCreate = [];
         // CR-195d: Hoist kinds/asil/method from attributes to top-level for SE schema
         const isSESchema = this.ontology.name === 'SE';
         for (const op of diff.operations) {
@@ -103,13 +102,6 @@ export class GraphService {
                             const node = await this.applyNodeCreate(op, isSESchema);
                             await this.storage.saveNodes([node]);
                             nodesToCreate.push(op.semanticId);
-                            if (consumerId !== 'system') {
-                                edgesToCreate.push({
-                                    sourceId: consumerId,
-                                    targetId: op.semanticId,
-                                    edgeType: 'produces',
-                                });
-                            }
                             applied++;
                         }
                         catch (e) {
@@ -142,13 +134,6 @@ export class GraphService {
                         const node = await this.applyNodeCreate(op, isSESchema);
                         await this.storage.saveNodes([node]);
                         nodesToCreate.push(op.semanticId);
-                        if (consumerId !== 'system') {
-                            edgesToCreate.push({
-                                sourceId: consumerId,
-                                targetId: op.semanticId,
-                                edgeType: 'produces',
-                            });
-                        }
                         applied++;
                     }
                     catch (e) {
@@ -381,18 +366,11 @@ export class GraphService {
                     rejected++;
             }
         }
-        // CR-195d: Create produces edges for newly created nodes (audit trail)
-        if (edgesToCreate.length > 0) {
-            try {
-                await this.storage.saveEdges(edgesToCreate.map(e => ({
-                    ...e,
-                    attributes: {},
-                })));
-            }
-            catch (e) {
-                console.warn('[GraphService] Failed to create audit produces edges:', e);
-            }
-        }
+        // CR-SM-266 D5: der CR-195d-Block, der je neuem Knoten eine `produces`-Kante vom Consumer
+        // schrieb, ist WEG — mit dem TraceType und dem SESSION-Elementtyp. Er war schon vorher tot:
+        // 0 produces-Kanten in allen 9 aktiven Familie-Graphen nach 195 gegateten Versionen, weil
+        // der schreibende Weg (Bridge) read-only ist und der lebende (MCP-Gate) ihn nie ging.
+        // Provenance liegt seit CR-GC-347 in `.graphcode/audit.jsonl`, ausserhalb des Graphen.
         // Add parse errors as violations
         for (const err of diff.errors) {
             violations.push({

package/dist/index.d.ts

@@ -22,7 +22,7 @@ export { MemoryAdapter } from './memory-adapter.js';
 export type { TransportAdapter, TransportConfig } from './transport-adapter.js';
 export { createGraphApi } from './factory.js';
 export type { GraphApiConfig } from './factory.js';
-export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph } from './se-descriptor.js';
+export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph, fromOntologyGraph } from './se-descriptor.js';
 export { findRoot } from './find-root.js';
 export type { RootQueryGraph } from './find-root.js';
 export { applyEdgeOps, updateEdge, mergeNodes } from './edge-ops.js';

package/dist/index.js

@@ -19,7 +19,7 @@ export { MemoryAdapter } from './memory-adapter.js';
 // Factory
 export { createGraphApi } from './factory.js';
 // SE OntologyDescriptor (derived from @sigloch/contracts/se) [CR-195a]
-export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph } from './se-descriptor.js';
+export { SE_DESCRIPTOR, createSeDescriptor, projectToOntologyGraph, fromOntologyGraph } from './se-descriptor.js';
 // Root-Suche — strukturelle Wurzel (SYS ohne eingehende compose), statt UID-Hardcode
 export { findRoot } from './find-root.js';
 // Edge ops — update-edge (flip/retype) + merge-nodes, shared by GraphService.mutate()

package/dist/se-descriptor.d.ts

@@ -17,6 +17,30 @@ import type { Graph, OntologyDescriptor } from './types.js';
  * attributes (asil/method/kinds/status) are lifted out of `attributes`.
  */
 export declare function projectToOntologyGraph(graph: Graph): OntologyGraph;
+/**
+ * The INVERSE of `projectToOntologyGraph`: an OntologyGraph (elements/traces) back
+ * to the ontology-agnostic Graph (nodes/edges) — every attribute restored under
+ * `attributes`, where the rules read them.
+ *
+ * Why this must be published (CR-SM-254): only the forward direction was exported,
+ * so every consumer that READS a committed `*.graph.json` hand-rolled its own mirror
+ * — and the mirrors drifted. Two were found wrong the same day, both in the same
+ * half: they lifted `status/asil/method/kinds` and forgot `realRef`/`testRefs`, so
+ * `R-19`/`R-20` silently read "unbound" on a fully bound graph and a dashboard
+ * reported `TRR 0/214` against a store that said `214/214`. A hand-rolled inverse
+ * cannot be kept honest by review; it has to have one home.
+ *
+ * Accepts BOTH shapes in the wild, which is the whole point:
+ *   - what THIS module emits — attributes nested under `attributes`, plus the
+ *     lifted convenience fields (status/asil/method/kinds) alongside;
+ *   - a FLATTENED snapshot — `{id, type, name, description, ...attributes}` with no
+ *     `attributes` key at all (graphcode's committed SSOT since its CR-GC-219, which
+ *     drops the nested duplicate so the file a human diffs carries each value once).
+ *
+ * Nested wins nothing: a key already present at top level is never clobbered, so
+ * re-import of an already-flat element is idempotent.
+ */
+export declare function fromOntologyGraph(json: OntologyGraph): Graph;
 /**
  * Canonical SE OntologyDescriptor (ontology + V3 rules + MT metrics), version-pinned
  * to contracts/se ONTOLOGY_VERSION. Plug into GraphService / FormatECodec.

package/dist/se-descriptor.js

@@ -33,7 +33,9 @@ export function projectToOntologyGraph(graph) {
         source: e.sourceId,
         target: e.targetId,
         type: e.edgeType,
-        category: e.attributes?.category,
+        // CR-SM-266 D5: `category` ist nicht mehr Teil des Trace-Vertrags. Die Projektion hob es
+        // aus den Kanten-Attributen aufs Top-Level, wo R-08/R-18 es als Pruef-Ausnahme lasen —
+        // genau der Weg, ueber den eine Kante die Pattern-Matrix haette umgehen koennen.
         label: e.attributes?.label,
         weight: e.attributes?.weight ?? 1,
         created_at: e.attributes?.created_at ?? '',
@@ -42,6 +44,67 @@ export function projectToOntologyGraph(graph) {
     }));
     return { elements, traces };
 }
+/**
+ * The INVERSE of `projectToOntologyGraph`: an OntologyGraph (elements/traces) back
+ * to the ontology-agnostic Graph (nodes/edges) — every attribute restored under
+ * `attributes`, where the rules read them.
+ *
+ * Why this must be published (CR-SM-254): only the forward direction was exported,
+ * so every consumer that READS a committed `*.graph.json` hand-rolled its own mirror
+ * — and the mirrors drifted. Two were found wrong the same day, both in the same
+ * half: they lifted `status/asil/method/kinds` and forgot `realRef`/`testRefs`, so
+ * `R-19`/`R-20` silently read "unbound" on a fully bound graph and a dashboard
+ * reported `TRR 0/214` against a store that said `214/214`. A hand-rolled inverse
+ * cannot be kept honest by review; it has to have one home.
+ *
+ * Accepts BOTH shapes in the wild, which is the whole point:
+ *   - what THIS module emits — attributes nested under `attributes`, plus the
+ *     lifted convenience fields (status/asil/method/kinds) alongside;
+ *   - a FLATTENED snapshot — `{id, type, name, description, ...attributes}` with no
+ *     `attributes` key at all (graphcode's committed SSOT since its CR-GC-219, which
+ *     drops the nested duplicate so the file a human diffs carries each value once).
+ *
+ * Nested wins nothing: a key already present at top level is never clobbered, so
+ * re-import of an already-flat element is idempotent.
+ */
+export function fromOntologyGraph(json) {
+    const nodes = (json.elements ?? []).map((e) => {
+        const { id, type, name, description, created_at, updated_at, ...rest } = e;
+        return {
+            uid: id,
+            type,
+            name: name ?? id,
+            description: description ?? '',
+            createdAt: created_at,
+            updatedAt: updated_at,
+            attributes: liftAttributes(rest),
+        };
+    });
+    const edges = (json.traces ?? []).map((t) => {
+        const { source, target, type, ...rest } = t;
+        return { sourceId: source, targetId: target, edgeType: type, attributes: liftAttributes(rest) };
+    });
+    return { nodes, edges };
+}
+/**
+ * Merge a nested `attributes` object UP one level and drop the nesting key, so both
+ * the nested and the flattened shape yield the same `attributes`. Idempotent: an
+ * entry with no nested object is returned unchanged.
+ */
+function liftAttributes(rest) {
+    const nested = rest.attributes;
+    if (nested === null || typeof nested !== 'object' || Array.isArray(nested)) {
+        const { attributes: _absent, ...flat } = rest;
+        return flat;
+    }
+    const { attributes: _drop, ...top } = rest;
+    const out = { ...top };
+    for (const [k, v] of Object.entries(nested)) {
+        if (!(k in out))
+            out[k] = v;
+    }
+    return out;
+}
 /**
  * The contracts/se rule catalog, adapted to graph-api-core's Rule shape.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigloch/graph-api-core",
-  "version": "5.1.0",
+  "version": "5.3.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -43,7 +43,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@sigloch/contracts": ">=5 <7",
+    "@sigloch/contracts": ">=5 <10",
     "kuzu-wasm": "^0.11.3"
   },
   "peerDependenciesMeta": {
@@ -52,7 +52,7 @@
     }
   },
   "devDependencies": {
-    "@sigloch/contracts": "^6.0.0",
+    "@sigloch/contracts": ">=6 <10",
     "kuzu-wasm": "^0.11.3"
   }
 }