@sigloch/graph-api-core 5.4.0 → 5.5.0

package/dist/format-e-codec.d.ts

@@ -3,8 +3,6 @@ export declare class FormatECodec {
     private readonly ontology;
     private readonly edgeArrowToType;
     private readonly validNodeTypes;
-    /** Trace-legality patterns (CR-GC-247) — the SSOT the parser validates edges against. */
-    private readonly patterns;
     constructor(ontology: OntologyDescriptor);
     /** Extract a ```format-e block from LLM output. Returns null if not found. */
     extractFromLlm(llmOutput: string): string | null;

package/dist/format-e-codec.js

@@ -8,7 +8,6 @@
  * every foreign convention fail silently instead of loudly.
  */
 import { hydrateAttrValue, attributeTypeOf } from '@sigloch/contracts/se';
-import { isValidTrace, tracePatternsOf } from './types.js';
 // ---------------------------------------------------------------------------
 // Regex patterns
 // ---------------------------------------------------------------------------
@@ -27,8 +26,6 @@ export class FormatECodec {
     ontology;
     edgeArrowToType;
     validNodeTypes;
-    /** Trace-legality patterns (CR-GC-247) — the SSOT the parser validates edges against. */
-    patterns;
     constructor(ontology) {
         this.ontology = ontology;
         // Build arrow → edge type lookup
@@ -40,8 +37,6 @@ export class FormatECodec {
         }
         // Valid node type abbreviations
         this.validNodeTypes = new Set(Object.keys(ontology.nodeTypes));
-        // Meta-model legality: descriptor.patterns (or derived from validPairs).
-        this.patterns = tracePatternsOf(ontology);
     }
     /** Extract a ```format-e block from LLM output. Returns null if not found. */
     extractFromLlm(llmOutput) {
@@ -290,12 +285,9 @@ export class FormatECodec {
                 errors.push(`Cannot resolve type of target "${targetId}" — not declared under a "### <TYPE>" section and no resolveType provided`);
                 continue;
             }
-            // Meta-model validation (CR-GC-247: single checker, patterns SSOT — honors
-            // '*' wildcards, unlike the old per-edgeType validPairs set-membership).
-            if (!isValidTrace({ source: srcType, target: tgtType, type: edgeType }, this.patterns)) {
-                errors.push(`Meta-model violation: ${srcType} -${edgeType}-> ${tgtType} is not valid`);
-                continue;
-            }
+            // CR-SM-324: no legality verdict while parsing — the parser knows neither label nor
+            // the kinds of existing nodes. The write path judges with the one rule (gate R-18,
+            // GraphService.validateAndApplyEdge).
             const opType = action === 'remove'
                 ? 'remove_edge'
                 : action === 'strict_add'

package/dist/graph-service.js

@@ -199,6 +199,7 @@ export class GraphService {
                             sourceId: op.sourceId,
                             targetId: op.targetId,
                             edgeType: op.edgeType,
+                            label: op.attributes?.label,
                         });
                         const edge = {
                             sourceId: op.sourceId,
@@ -249,6 +250,7 @@ export class GraphService {
                             sourceId: op.sourceId,
                             targetId: op.targetId,
                             edgeType: op.edgeType,
+                            label: op.attributes?.label,
                         });
                         const edge = {
                             sourceId: op.sourceId,
@@ -299,6 +301,7 @@ export class GraphService {
                         const { removed, added } = updateEdge(graph, { sourceId: op.sourceId, targetId: op.targetId, edgeType: op.edgeType }, op.set);
                         await this.validateAndApplyEdge({
                             sourceId: added.sourceId, targetId: added.targetId, edgeType: added.edgeType,
+                            label: added.attributes?.label,
                         });
                         await this.storage.deleteEdges([{
                                 sourceId: removed.sourceId, targetId: removed.targetId, edgeType: removed.edgeType,
@@ -337,6 +340,7 @@ export class GraphService {
                         for (const edge of addedEdges) {
                             await this.validateAndApplyEdge({
                                 sourceId: edge.sourceId, targetId: edge.targetId, edgeType: edge.edgeType,
+                                label: edge.attributes?.label,
                             });
                         }
                         if (removedEdges.length > 0) {
@@ -565,9 +569,11 @@ export class GraphService {
         };
     }
     // CR-GC-247: one legality path for every ontology (SE + foreign). The edge type
-    // must be declared (menu enumeration via edgeTypes), then the (source,target,type)
-    // trace is checked against descriptor.patterns via the single isValidTrace —
-    // no SE/foreign fork, no validPairs re-implementation.
+    // must be declared (menu enumeration via edgeTypes), then the trace is checked against
+    // descriptor.patterns. CR-SM-323: that checker delegates to contracts' isValidTrace — the
+    // routine R-18 runs — fed label and endpoint kinds exactly as R-18 reads them. A foreign
+    // ontology's patterns (derived from validPairs) carry neither label nor where, so there
+    // the type pair alone decides.
     async validateAndApplyEdge(op) {
         if (!this.ontology.edgeTypes[op.edgeType]) {
             const known = Object.keys(this.ontology.edgeTypes).join(', ');
@@ -575,7 +581,14 @@ export class GraphService {
         }
         const src = await this.storage.getNode(op.sourceId);
         const tgt = await this.storage.getNode(op.targetId);
-        if (src && tgt && !isValidTrace({ source: src.type, target: tgt.type, type: op.edgeType }, this.patterns)) {
+        if (src && tgt && !isValidTrace({
+            source: src.type,
+            target: tgt.type,
+            type: op.edgeType,
+            label: op.label,
+            sourceKinds: src.attributes?.kinds,
+            targetKinds: tgt.attributes?.kinds,
+        }, this.patterns)) {
             const allowed = this.patterns
                 .filter(p => p.type === op.edgeType)
                 .map(p => `${p.source}->${p.target}`)

package/dist/kuzu/graph-cypher-engine.js

@@ -12,7 +12,27 @@
  * Cypher) does not break consumers.
  */
 import { generateSchema } from './schema-generator.js';
-async function loadKuzu() {
+/**
+ * Prozessweit genau EINE kuzu-Instanz (CR-SM-316).
+ *
+ * `kuzu.init()` ist nicht idempotent: jeder Aufruf legt eine NEUE Emscripten-Instanz
+ * mit eigenem Heap an (~186 MB) und haengt die alte ab. Zurueck gibt die niemand —
+ * WASM-Speicher schrumpft nicht, und weder `db.close()` noch der GC raeumen ihn ab.
+ * Vorher rief jedes `GraphCypherEngine.init()` erneut auf; im graphcode-Volllauf waren
+ * das 544 Aufrufe und 9641 MB Spitzenverbrauch, bis der Heap mit "memory access out of
+ * bounds" faultete und dabei traf, was gerade lief — in drei Laeufen drei verschiedene
+ * Testdateien.
+ *
+ * Der Cache haelt das PROMISE, nicht das Ergebnis: zwei Engines, die gleichzeitig
+ * initialisieren, warten damit auf denselben Ladevorgang statt zwei zu starten.
+ */
+let kuzuModule = null;
+function loadKuzu() {
+    if (!kuzuModule)
+        kuzuModule = initKuzu();
+    return kuzuModule;
+}
+async function initKuzu() {
     // Node path: sync nodejs variant. Detect Node by checking for `process.versions.node`.
     const isNode = typeof process !== 'undefined' && !!process.versions?.node;
     if (isNode) {

package/dist/se-descriptor.js

@@ -133,8 +133,14 @@ function liftAttributes(rest) {
  * otherwise the 114 pre-existing errors in graphcode's own graph would block every
  * write on debt the writer did not create. Promotion is a per-family decision, not a
  * side effect of being registered.
+ *
+ * CR-SM-309: IO is promoted (decision 2026-09-11). IO-02 ("a FLOW has exactly ONE
+ * producer", error) guards the one-FLOW-per-connection cut; without gate power a
+ * suggested merge put two producers back into one FLOW and passed the gate. The delta
+ * baseline keeps the switch-on safe: only NEW findings block, graphcode's own graph is
+ * at IO-02 = 0, and IO-01 shares the prefix but is a warning, which never blocks.
  */
-const GATING_PREFIXES = ['R-', 'RD-', 'MT-'];
+const GATING_PREFIXES = ['R-', 'RD-', 'MT-', 'IO-'];
 const SE_RULE_DEFS = [
     ...V3_RULES,
     ...UC_RULES,

package/dist/types.d.ts

@@ -1,7 +1,3 @@
-/**
- * Core types for graph-api-core — ontology-agnostic.
- * Domains register their node/edge types via OntologyDescriptor.
- */
 export interface GraphNode {
     uid: string;
     type: string;
@@ -135,21 +131,18 @@ export interface FormatEDiff {
     errors: string[];
 }
 /**
- * Structural trace-legality check. Ontology-agnostic: matches a trace against
- * TracePattern[] with '*' wildcards on source/target. Both graph-service and
- * format-e-codec route every check through this — validPairs is no longer a
- * parallel re-implementation.
- *
- * A pattern's `label` is descriptive metadata (e.g. MS→MS relation 'depends-on'),
- * NOT a gate: label is trace data that isn't uniformly carried through the
- * Graph/codec pipeline, and the legality this replaces (validPairs) never keyed on
- * it. Enforcing label is a deliberate tightening (needs codec label round-tripping),
- * out of scope for the centralization.
+ * Trace legality for any ontology, decided by contracts' `isValidTrace` — the routine R-18
+ * runs. No logic of its own: `label` and endpoint `kinds` are part of the rule exactly as
+ * R-18 reads them. This signature only opens the SE-closed contracts types to the
+ * ontology-agnostic strings this package speaks; the runtime pattern shape is the same.
  */
 export declare function isValidTrace(trace: {
     source: string;
     target: string;
     type: string;
+    label?: string;
+    sourceKinds?: readonly string[];
+    targetKinds?: readonly string[];
 }, patterns: TracePattern[]): boolean;
 /**
  * The patterns a descriptor validates against: explicit `patterns` (SSOT) if set,

package/dist/types.js

@@ -2,25 +2,18 @@
  * Core types for graph-api-core — ontology-agnostic.
  * Domains register their node/edge types via OntologyDescriptor.
  */
+import { isValidTrace as contractsIsValidTrace } from '@sigloch/contracts/se';
 // ---------------------------------------------------------------------------
-// Trace legality — the ONE checker (CR-GC-247)
+// Trace legality — ONE rule (CR-GC-247, CR-SM-323)
 // ---------------------------------------------------------------------------
 /**
- * Structural trace-legality check. Ontology-agnostic: matches a trace against
- * TracePattern[] with '*' wildcards on source/target. Both graph-service and
- * format-e-codec route every check through this — validPairs is no longer a
- * parallel re-implementation.
- *
- * A pattern's `label` is descriptive metadata (e.g. MS→MS relation 'depends-on'),
- * NOT a gate: label is trace data that isn't uniformly carried through the
- * Graph/codec pipeline, and the legality this replaces (validPairs) never keyed on
- * it. Enforcing label is a deliberate tightening (needs codec label round-tripping),
- * out of scope for the centralization.
+ * Trace legality for any ontology, decided by contracts' `isValidTrace` — the routine R-18
+ * runs. No logic of its own: `label` and endpoint `kinds` are part of the rule exactly as
+ * R-18 reads them. This signature only opens the SE-closed contracts types to the
+ * ontology-agnostic strings this package speaks; the runtime pattern shape is the same.
  */
 export function isValidTrace(trace, patterns) {
-    return patterns.some((p) => (p.source === '*' || p.source === trace.source) &&
-        (p.target === '*' || p.target === trace.target) &&
-        p.type === trace.type);
+    return contractsIsValidTrace(trace, patterns);
 }
 /**
  * The patterns a descriptor validates against: explicit `patterns` (SSOT) if set,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sigloch/graph-api-core",
-  "version": "5.4.0",
+  "version": "5.5.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",