@weftlet/toolkit 0.7.0 → 0.7.1

package/README.md

@@ -14,7 +14,7 @@ Proposed future capabilities are recorded in the [Weftlet 2.0 product plan](docs
 ## Set up a project
 
 <!-- weftlet:release:start -->
-Package versions in this checkout/archive: `@weftlet/toolkit@0.7.0` and `@weftlet/core@0.7.0`.
+Package versions in this checkout/archive: `@weftlet/toolkit@0.7.1` and `@weftlet/core@0.7.1`.
 <!-- weftlet:release:end -->
 
 Weftlet uses `@weftlet/toolkit`; its neutral `@weftlet/core` dependency is installed
@@ -228,24 +228,31 @@ its sidecar policy is not automatically adopted by hydration. See
 
 Starting with **0.5.0**, identity preflight runs before ontology/RDF work.
 `hydrate --json --quiet` reports conflicts using opaque references; `--validation-details` explicitly
-includes local identities, producer versions and citations. Validation emits phase-boundary times
-and graph counts, without a percentage or live heartbeat. Full SHACL remains required after a
+includes local identities, producer versions and citations. Validation emits phase timings,
+graph counts and completed validation groups. These are not completion-time estimates. Full SHACL remains required after a
 passing preflight. See [ADR 021](docs/ADR-021-identity-preflight-and-validation-timing.md).
 
 Version 0.5.0 also accepts `semantic.timeoutMs: 600000` for an approved ten-minute extraction
 attempt; the default remains two minutes. See [provider limits and reuse](docs/PROVIDERS.md#limits-and-reuse)
 before retrying with compatible cached artifacts.
 
-Starting with 0.3.0, the toolkit indexes a temporary union to accelerate cold validation.
-The toolkit uses JavaScript `rdf-validate-shacl` and an in-memory
-N3 store. Each hydration validates the complete graph; semantic artifact reuse does not make
-validation incremental, and there is no validation-result cache, Rust engine or GraphDB service.
-Saved queries do not rerun SHACL.
+The toolkit uses JavaScript `rdf-validate-shacl` with bounded N3 subject groups. Each hydration
+validates the complete graph; semantic artifact reuse does not make validation incremental.
+There is no validation-result cache, Rust engine or GraphDB service. Saved queries do not rerun SHACL.
 
-The current shapes use subject/predicate/object values independently of graph names. Validation
-now builds one temporary union graph so repeated property lookups avoid scanning every named
-assertion graph. The same shapes and validator run against that union. The original named dataset,
-assertion records and provenance remain the source for SPARQL, queries and serialization.
+Complete identity groups preserve conflicting assertions, and graph-wide class membership retains
+cross-record proof checks. The same strict shapes run on every target. The RDF encoder also serves
+streamed N-Quads exports and SPARQL; traversal projections have SPARQL equivalence tests. Hashing and
+snapshot JSON persistence/reload avoid a whole-graph string. Existing canonical digests, cache keys
+and immutable snapshot bytes are preserved. See [ADR 040](docs/ADR-040-bounded-graph-io.md) for the
+partition correctness boundary, public corpus regression and remaining memory limits.
+
+For large programmatic RDF exports, use `await graph.serializeTo(writable)` or consume
+`graph.serializeChunks()`. The `serialize()` convenience returns a single string and therefore
+remains subject to JavaScript's string-size limit.
+
+The 0.3.0 optimization built a complete temporary validation union. The measurements below describe
+that earlier implementation; they are not timings for the current richer code graph.
 
 In bounded, single-run public experiments, 2,000 facts with unique subject/object nodes took
 31.50 seconds in the original SHACL path, compared with 0.153 seconds to build the union and
@@ -260,12 +267,11 @@ pnpm build
 pnpm benchmark:shacl
 ```
 
-The [T05 closeout](docs/ADR-027-validation-closeout.md) measures cold, repeated and changed inputs,
-plus worker, exact-result-key and Rust prototypes. Direct full validation remains the 1.0 choice:
+The historical [T05 closeout](docs/ADR-027-validation-closeout.md) measures cold, repeated and changed inputs,
+plus worker, exact-result-key and Rust prototypes:
 the 10,000-fact public cases measured about 2.9–5.7 seconds, with material memory use. These are
 fixture measurements, not a private consumer capacity guarantee. The prototypes are development
-tools, not runtime options; every hydration still performs full validation. Current progress reports
-phase boundaries because synchronous work blocks same-thread timers. Reproduce the lifecycle study
+tools, not runtime options; every hydration still performs full validation. Reproduce that lifecycle study
 from a development checkout with `pnpm benchmark:validation`; raw results and commands are linked
 from the ADR.
 
@@ -365,14 +371,14 @@ one-hop reads of saved evidence: no model or indexer is invoked. Each assertion
 citations, authority and review state, including multiple assertions about the same edge.
 Page completion does not establish complete product coverage. See [the query contract](docs/ADR-029-exact-graph-neighborhoods.md).
 
-The development checkout now preserves typed `CodeSymbol` definitions and individual SCIP
+Starting with 0.7.0, Weftlet preserves typed `CodeSymbol` definitions and individual SCIP
 references, including local symbols, repeated same-file uses and one-based UTF-16 columns.
 From a physical-file node, request incoming `definedBy` facts to discover its symbols; from a
 symbol, request incoming/outgoing `references` to inspect exact occurrences. Native lexical
 enclosure is not a call graph. Resolution distinguishes indexed definitions, declaration-only
 targets and absent indexed definitions. Local ordinal IDs are scoped to the exact index; refresh
 code evidence before comparing revisions. See [code evidence and limits](docs/ADR-032-scip-code-evidence.md).
-The development checkout also resolves explicit Markdown symbol selectors in selected documents:
+Weftlet also resolves explicit Markdown symbol selectors in selected documents:
 
 ```md
 [helper](../src/worker.ts#weftlet-symbol=Engine.execute)
@@ -397,14 +403,14 @@ semantic/document-traversal scope and SCIP selection; they require no extra prov
 Validation documents stay outside intent extraction and can declare `verifiedBy`, not `implementedBy`.
 See [ADR 033](docs/ADR-033-document-symbol-bindings.md) for bounds and draft-overlay behavior.
 
-These capabilities are pending the next npm candidate. The development checkout now also derives
+Version 0.7.0 also derives
 `calls` from actual TypeScript call/new syntax and exact SCIP identities. Query a function's
 incoming/outgoing `calls` to inspect callers/callees, or follow a bounded path using `calls` and
 `implementedBy`. Each assertion retains callsite and endpoint proofs, with explicit bodyless,
 external, optional and member-dispatch limits. Runtime execution is not implied. Values, callbacks
 and dynamic dispatch without a known target remain references and cited gaps. See
-[ADR 035](docs/ADR-035-static-call-evidence.md). The remaining inferred-mapping proposal is
-recorded separately in [ADR 034](docs/ADR-034-mapping-gaps.md).
+[ADR 035](docs/ADR-035-static-call-evidence.md). Optional inferred-mapping proposals are available separately; see
+[ADR 039](docs/ADR-039-mapping-proposals.md).
 
 Selected Markdown documents can now declare producer guarantees and consumer requirements in
 optional `weftlet-obligation` JSON fences. Both sides name an exact scoped/versioned queue or
@@ -413,9 +419,9 @@ neighborhoods and paths, with the original statement, citations and any document
 constraint/unit and consumer revalidation requirement. Missing fields remain unknown. Declarations
 do not establish fulfillment, runtime delivery or compatibility; ordinary prose is not automatically
 converted into this format. See [the declaration format and example](docs/ADR-036-contract-obligation-declarations.md).
-This addition is also pending the next npm candidate.
+These declarations are supported starting with 0.7.0.
 
-For two retrieved obligation facts, the development checkout also supports:
+For two retrieved obligation facts, the published CLI supports:
 
 ```sh
 weftlet graph compatibility --snapshot <snapshot-id> --producer-fact <fact-id> --consumer-fact <fact-id> --json
@@ -427,7 +433,7 @@ Results distinguish compatible limits, an insufficient guarantee, disjoint limit
 consumer revalidation and unknowns. Both original citations and source approvals remain visible.
 This advisory assessment does not establish code fulfillment or a CI policy violation. See
 [comparison semantics and limits](docs/ADR-037-selected-contract-compatibility.md). The command
-reads saved evidence during edits without rebuilding it; it is pending the next npm candidate.
+reads saved evidence during edits without rebuilding it and is available starting with 0.7.0.
 
 Saved repository code coverage is separate from the returned-page relationship counts:
 
@@ -483,8 +489,8 @@ ahead of repeated detail and shared-import context. Ranking changes ordering, no
 the reachable scope. Responses identify the ranking version; after a ranking upgrade, restart
 scans whose old continuation tokens are rejected. No snapshot refresh is needed for new ordering.
 
-This source includes a [coverage reporting correction](docs/ADR-024-implementation-coverage.md)
-for the next release: code relationships displayed under contracts also count as implementation
+The published toolkit includes a [coverage reporting correction](docs/ADR-024-implementation-coverage.md)
+that counts code relationships displayed under contracts as implementation
 evidence. New reports identify `coverage.scope: "returned-page"` and `countsAreNonExclusive: true`.
 Counts can overlap and describe returned evidence; they are not completeness percentages or proof
 that behavior is correct. Document/model claims and test-only evidence do not establish production

package/THIRD_PARTY_NOTICES.md

@@ -363,6 +363,7 @@ Do not edit this file manually.
 | `@comunica/utils-metadata` | 5.4.0 | MIT | [link](https://comunica.dev/) |
 | `@comunica/utils-query-operation` | 5.4.0 | MIT | [link](https://comunica.dev/) |
 | `@dabh/diagnostics` | 2.0.9 | MIT | [link](https://github.com/DABH/diagnostics) |
+| `@discoveryjs/json-ext` | 1.1.0 | MIT | [link](https://github.com/discoveryjs/json-ext#readme) |
 | `@hono/node-server` | 2.1.5 | MIT | [link](https://github.com/honojs/node-server) |
 | `@jeswr/prefixcc` | 1.2.1 | MIT | [link](https://github.com/jeswr/prefixcc.js#readme) |
 | `@jeswr/stream-to-string` | 2.0.0 | MIT | [link](https://github.com/jeswr/stream-to-string/README.md) |
@@ -376,6 +377,7 @@ Do not edit this file manually.
 | `@rdfjs/to-ntriples` | 3.0.1 | MIT | [link](https://github.com/rdfjs-base/to-ntriples) |
 | `@rdfjs/types` | 1.1.2, 2.0.1 | MIT | [link](http://rdf.js.org/) |
 | `@so-ric/colorspace` | 1.1.6 | MIT | [link](https://github.com/so-ric/colorspace) |
+| `@streamparser/json` | 0.0.26 | MIT | [link](https://github.com/juanjoDiaz/jsonparse2#readme) |
 | `@tpluscode/rdf-ns-builders` | 5.1.0 | MIT | [link](https://github.com/tpluscode/rdf-ns-builders#readme) |
 | `@traqula/algebra-sparql-1-1` | 1.4.0 | MIT | [link](https://github.com/comunica/traqula#readme) |
 | `@traqula/algebra-sparql-1-2` | 1.4.0 | MIT | [link](https://github.com/comunica/traqula#readme) |

package/dist/application/hydrator.js

@@ -2,7 +2,7 @@ import { scipSourcePatterns } from '../configuration/scip-project.js';
 import { buildCodeInventory } from '../extraction/code-inventory.js';
 import { contractPatternRoots } from "../repository/glob.js";
 import { repositoryFileExtractorIdentity, repositoryContractExtractorIdentity, scipSymbolExtractorIdentity } from '../extraction/static.js';
-import { sha256, stableJson } from "../infrastructure/util.js";
+import { sha256, stableJson, stableJsonDigest } from "../infrastructure/util.js";
 import { assembleDocumentCodeBindings } from './document-code-bindings.js';
 import { documentCodeBindingIdentity } from '../extraction/document-code-bindings.js';
 import { documentObligationIdentity } from '../extraction/document-obligations.js';
@@ -43,7 +43,7 @@ export class ContextGraphHydrator {
             .sort((left, right) => stableJson(left).localeCompare(stableJson(right)));
         return {
             commitSha,
-            digest: sha256(stableJson(references)),
+            digest: stableJsonDigest(references),
             references,
         };
     }
@@ -71,10 +71,11 @@ export class ContextGraphHydrator {
         }
         const { sources } = selection;
         await this.dependencies.ontologyCompiler.checkReady?.();
-        const prior = await snapshotStore.readHead(options.headName);
-        const baseSha = prior?.manifest.commitSha === commitSha
-            ? prior.manifest.baseSha
-            : (prior?.manifest.commitSha ?? (await repository.firstParent(commitSha)));
+        const prior = snapshotStore.readHeadManifest ? await snapshotStore.readHeadManifest(options.headName)
+            : (await snapshotStore.readHead(options.headName))?.manifest;
+        const baseSha = prior?.commitSha === commitSha
+            ? prior.baseSha
+            : (prior?.commitSha ?? (await repository.firstParent(commitSha)));
         const allRoots = [
             ...new Set([
                 ...scopePaths,
@@ -98,8 +99,8 @@ export class ContextGraphHydrator {
         const runtimeSuffix = config.runtimeEvidence.length > 0
             ? `runtime-${runtimeRevision.digest.slice(0, 12)}`
             : undefined;
-        const configurationDigest = sha256(stableJson(config));
-        const scopeDigest = sha256(stableJson(scopePaths)).slice(0, 12);
+        const configurationDigest = stableJsonDigest(config);
+        const scopeDigest = stableJsonDigest(scopePaths).slice(0, 12);
         const effectiveSuffix = [`graph-v${graphAssemblyVersion}`, `links-${documentLinkerIdentity.version}`, `files-${repositoryFileExtractorIdentity.version}`,
             `contracts-${repositoryContractExtractorIdentity.version}`,
             `symbols-${scipSymbolExtractorIdentity.version}`,
@@ -130,7 +131,7 @@ export class ContextGraphHydrator {
         const artifacts = hydrated.map((result) => result.artifact);
         const diagnostics = hydrated.flatMap(({ source, artifact }) => (artifact.diagnostics ?? []).map((item) => ({
             ...item,
-            id: sha256(stableJson({ artifact: artifact.key, diagnostic: item.id, path: source.path })),
+            id: stableJsonDigest({ artifact: artifact.key, diagnostic: item.id, path: source.path }),
             provenance: item.provenance.map((span) => ({
                 ...span,
                 path: source.path,
@@ -140,7 +141,7 @@ export class ContextGraphHydrator {
         })));
         const semanticFacts = classifyHydratedFacts(hydrated.flatMap(({ source, artifact }) => artifact.facts.map((fact) => ({
             ...fact,
-            id: sha256(stableJson({ artifact: artifact.key, fact: fact.id, path: source.path })),
+            id: stableJsonDigest({ artifact: artifact.key, fact: fact.id, path: source.path }),
             provenance: {
                 ...fact.provenance,
                 path: source.path,
@@ -166,7 +167,7 @@ export class ContextGraphHydrator {
                 const path = /^(?:component:file:|document:)(.+)$/.exec(node.id)?.[1];
                 if (path && !tracked.has(path))
                     diagnostics.push({
-                        id: sha256(stableJson({ fact: fact.id, missing: path })),
+                        id: stableJsonDigest({ fact: fact.id, missing: path }),
                         kind: 'implementationGaps',
                         reason: `Cited implementation path ${path} is absent from the committed repository.`,
                         relatedNodeIds: [node.id], provenance: [fact.provenance], evidenceScope: 'snapshot-query',
@@ -222,7 +223,7 @@ export class ContextGraphHydrator {
             codeInventory,
             ...(selection.documentSelection ? { documentSelection: selection.documentSelection } : {}),
         };
-        const contentDigest = sha256(stableJson(logical));
+        const contentDigest = stableJsonDigest(logical);
         const snapshot = {
             manifest: {
                 schemaVersion: 1,
@@ -282,7 +283,9 @@ export class ContextGraphHydrator {
         return { snapshot, semanticExtracted, semanticReused };
     }
     async compareClean(options) {
-        const current = await this.dependencies.snapshotStore.readHead(options.headName);
+        const store = this.dependencies.snapshotStore;
+        const current = store.readHeadManifest ? await store.readHeadManifest(options.headName)
+            : (await store.readHead(options.headName))?.manifest;
         if (!current)
             throw new Error('No incremental snapshot exists to compare');
         const clean = await this.hydrate({
@@ -290,8 +293,8 @@ export class ContextGraphHydrator {
             headName: `${options.headName}-clean`,
             snapshotSuffix: `clean-${Date.now()}`,
         });
-        if (clean.snapshot.manifest.contentDigest !== current.manifest.contentDigest) {
-            throw new Error(`Clean hydration drift: ${current.manifest.contentDigest} != ${clean.snapshot.manifest.contentDigest}`);
+        if (clean.snapshot.manifest.contentDigest !== current.contentDigest) {
+            throw new Error(`Clean hydration drift: ${current.contentDigest} != ${clean.snapshot.manifest.contentDigest}`);
         }
         return clean;
     }

package/dist/application/overlay.js

@@ -7,7 +7,7 @@ import { buildCodeInventory } from '../extraction/code-inventory.js';
 import { GitRepository } from "../repository/git.js";
 import { withCommittedTree } from "../repository/committed-tree.js";
 import { RepositoryContractExtractor, RepositoryFileExtractor, ScipSymbolExtractor, ScipTypeScriptIndexer, repositoryFileExtractorIdentity, repositoryContractExtractorIdentity, scipSymbolExtractorIdentity } from "../extraction/static.js";
-import { sha256, stableJson } from "../infrastructure/util.js";
+import { sha256, stableJsonDigest } from "../infrastructure/util.js";
 import { contextPackEvidenceAuthority } from "../graph/query.js";
 import { inWorkingScope, readWorkingContent } from "../repository/working-content.js";
 import { extractRoutingDeclarations, routingExtractorIdentity } from '../extraction/routing.js';
@@ -34,7 +34,7 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
     const base = await store.read(baseSnapshotId);
     if (!base || base.manifest.overlayDigest)
         throw new Error('Overlay requires a committed base snapshot');
-    if (base.manifest.configurationDigest !== sha256(stableJson(config))) {
+    if (base.manifest.configurationDigest !== stableJsonDigest(config)) {
         throw new Error('Overlay configuration must match its base snapshot');
     }
     const head = await repository.resolveRef('HEAD');
@@ -67,10 +67,10 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
         files: captured.map(({ path, content }) => ({ path, digest: content === null ? null : sha256(content) })),
         sourcePatterns: roots, excludedPaths: excluded,
     };
-    const overlayDigest = sha256(stableJson({ version: 2, ...overlayCapture }));
+    const overlayDigest = stableJsonDigest({ version: 2, ...overlayCapture });
     // Capture identity describes the same working bytes across extractor upgrades. Publication
     // identity also binds the extractor so rebuilding an old base cannot replace an old overlay.
-    const snapshotId = `${head}-overlay-${sha256(stableJson({
+    const snapshotId = `${head}-overlay-${stableJsonDigest({
         baseContentDigest: base.manifest.contentDigest, overlayDigest,
         assembly: graphAssemblyIdentity,
         repositoryFileExtractor: repositoryFileExtractorIdentity,
@@ -79,7 +79,7 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
         ...(routingSources.length ? { routingExtractor: routingExtractorIdentity } : {}),
         ...(config.documentTraversal ? { documentSelection: documentSelectionIdentity,
             documentEvidence: documentEvidenceExtractorIdentity } : {}),
-    })).slice(0, 32)}`;
+    }).slice(0, 32)}`;
     const affected = new Set(captured.map((file) => file.path));
     const extracted = await withCommittedTree(repository.root, head, async (root) => {
         for (const file of captured) {
@@ -113,7 +113,7 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
         const documentSelection = documents?.documentSelection ? {
             ...documents.documentSelection,
             // Temporary Git commit timestamps are not evidence identity. Bind drafts to captured bytes.
-            digest: sha256(stableJson({ ...documents.documentSelection, digest: undefined, baseSha: head, overlayDigest })),
+            digest: stableJsonDigest({ ...documents.documentSelection, digest: undefined, baseSha: head, overlayDigest }),
         } : undefined;
         const scip = await new ScipTypeScriptIndexer(config.scip, storageRoot).index(context);
         const codeInventory = buildCodeInventory(await draftRepository.listEntriesAt(context.commitSha), await draftRepository.listFilesAt(context.commitSha, config.codeRoots), config.codeRoots, config.scip.sourceProject, scip);
@@ -138,7 +138,7 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
         const facts = draftFacts([...codeFacts, ...routing.facts, ...obligations.facts, ...(documents.documentEvidence?.facts ?? []), ...bindings.facts], snapshotId, head);
         const diagnostics = [...extraction.diagnostics, ...bindings.diagnostics, ...obligations.diagnostics, ...routing.diagnostics, ...(documents?.documentEvidence?.diagnostics ?? [])].map(({ id: _id, ...item }) => {
             const draft = { ...item, provenance: item.provenance.map((span) => ({ ...span, commitSha: head })) };
-            return { ...draft, id: sha256(stableJson(draft)) };
+            return { ...draft, id: stableJsonDigest(draft) };
         }).sort((a, b) => a.id.localeCompare(b.id));
         return { facts, diagnostics, documents, documentSelection, retainedSubjects, codeInventory };
     });
@@ -161,9 +161,9 @@ export async function buildWorkingOverlay(repository, config, store, storageRoot
                 [scipSymbolExtractorIdentity.id]: scipSymbolExtractorIdentity.version,
                 [staticCallIdentity.id]: staticCallIdentity.version,
                 ...(routingSources.length ? { [routingExtractorIdentity.id]: routingExtractorIdentity.version } : {}) },
-            generatedAt: new Date().toISOString(), contentDigest: sha256(stableJson({ facts: allFacts, diagnostics: extracted.diagnostics,
+            generatedAt: new Date().toISOString(), contentDigest: stableJsonDigest({ facts: allFacts, diagnostics: extracted.diagnostics,
                 codeInventory: extracted.codeInventory,
-                ...(extracted.documentSelection ? { documentSelection: extracted.documentSelection } : {}) })),
+                ...(extracted.documentSelection ? { documentSelection: extracted.documentSelection } : {}) }),
         },
         facts: allFacts,
         invariants: base.invariants.map((rule) => ({

package/dist/application/semantic-run.d.ts

@@ -7,7 +7,7 @@ export interface HydrationProgressEvent {
     readonly total?: number;
     readonly sourceId?: string;
     readonly elapsedMs?: number;
-    readonly status?: 'started' | 'completed' | 'failed';
+    readonly status?: 'started' | 'completed' | 'failed' | 'progress';
     readonly factCount?: number;
     readonly nodeCount?: number;
 }

package/dist/extraction/ontology.d.ts

@@ -29,4 +29,6 @@ export declare class DirectRdfOntologyCompiler implements OntologyCompiler {
     constructor(storageRoot: string);
     compile(snapshotId: string, artifacts: readonly SemanticArtifact[]): Promise<OntologyCompileResult>;
 }
+/** Exact legacy stableJson([{content, path}, ...]) digest, including UTF-8 decoding/escaping. */
+export declare function digestRdfFiles(root: string, files: readonly string[]): Promise<string>;
 export {};

package/dist/extraction/ontology.js

@@ -1,14 +1,15 @@
 // Modified for standalone extraction; see docs/extraction-manifest.json.
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
 import { withCommittedTree } from "../repository/committed-tree.js";
 import { DataFactory, Store, Writer } from 'n3';
 import { CG, nodeIri } from "../graph/rdf.js";
-import { cp, mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { cp, mkdir, readdir, rm, writeFile } from 'node:fs/promises';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { runProcess } from "../infrastructure/process.js";
-import { sha256, stableJson } from "../infrastructure/util.js";
 const probeDocker = async (cwd) => {
     const { stdout } = await promisify(execFile)('docker', ['info', '--format', '{{.OSType}}'], {
         cwd,
@@ -130,11 +131,7 @@ export class OpenCaesarOntologyCompiler {
         const rdfFiles = await listRdfFiles(rdfRoot);
         if (rdfFiles.length === 0)
             throw new Error('openCAESAR produced no RDF files');
-        const digestParts = await Promise.all(rdfFiles.map(async (path) => ({
-            path: relative(rdfRoot, path),
-            content: await readFile(path, 'utf8'),
-        })));
-        return { root: rdfRoot, rdfFiles, digest: sha256(stableJson(digestParts)) };
+        return { root: rdfRoot, rdfFiles, digest: await digestRdfFiles(rdfRoot, rdfFiles) };
     }
 }
 /** Default compiler preserves asserted semantics without Java, Docker, or an OWL reasoner. */
@@ -152,13 +149,31 @@ export class DirectRdfOntologyCompiler {
             }
         }
         const writer = new Writer({ format: 'N-Triples' });
-        writer.addQuads(dataset.getQuads(null, null, null, null));
-        const text = await new Promise((accept, reject) => writer.end((error, value) => error ? reject(error) : accept(value)));
-        const content = text.split('\n').filter(Boolean).sort().join('\n') + '\n';
+        const lines = Array.from(dataset, quad => writer.quadToString(quad.subject, quad.predicate, quad.object, quad.graph)).sort();
         const root = join(this.storageRoot, 'work', `rdf-${randomUUID()}`);
         await mkdir(root, { recursive: true });
         const path = join(root, 'semantic.nt');
-        await writeFile(path, content);
-        return { root, rdfFiles: [path], digest: sha256(content) };
+        const digest = createHash('sha256');
+        function* content() {
+            // The legacy empty dataset encodes a single newline too.
+            for (const line of lines.length ? lines : ['\n']) {
+                digest.update(line);
+                yield line;
+            }
+        }
+        await pipeline(content(), createWriteStream(path, { flags: 'wx' }));
+        return { root, rdfFiles: [path], digest: digest.digest('hex') };
+    }
+}
+/** Exact legacy stableJson([{content, path}, ...]) digest, including UTF-8 decoding/escaping. */
+export async function digestRdfFiles(root, files) {
+    const hash = createHash('sha256').update('[');
+    for (const [index, path] of files.entries()) {
+        hash.update(`${index ? ',' : ''}{"content":"`);
+        for await (const chunk of createReadStream(path, { encoding: 'utf8' })) {
+            hash.update(JSON.stringify(chunk).slice(1, -1));
+        }
+        hash.update(`","path":${JSON.stringify(relative(root, path))}}`);
     }
+    return hash.update(']').digest('hex');
 }

package/dist/graph/code-coverage.js

@@ -1,4 +1,4 @@
-import { sha256, stableJson } from '../infrastructure/util.js';
+import { stableJsonDigest } from '../infrastructure/util.js';
 import { projectCodeCoverage } from './code-coverage-projection.js';
 import { parseCodeCoverageRequest } from './code-coverage-request.js';
 import { renderCodeCoverage } from './code-coverage-renderer.js';
@@ -37,7 +37,7 @@ export class SnapshotCodeCoverageService {
             throw Error('Duplicate fact identities prevent stable code coverage');
         const projected = projectCodeCoverage({ ...saved, facts });
         const { continuation, ...query } = request;
-        const binding = sha256(stableJson({ version, query, manifest: saved.manifest, facts, diagnostics: saved.diagnostics }));
+        const binding = stableJsonDigest({ version, query, manifest: saved.manifest, facts, diagnostics: saved.diagnostics });
         const fileView = request.projectRoot !== undefined;
         const files = fileView ? projected.files.filter(f => f.projectRoot === request.projectRoot) : [];
         const length = fileView ? files.length : projected.projects.length;

package/dist/graph/code-rdf.d.ts

@@ -1,5 +1,6 @@
 import { type Store, type NamedNode } from 'n3';
-import { type GraphFact, type SourceSpan } from '@weftlet/core';
-export declare function addCodeEvidence(dataset: Store, record: NamedNode, fact: GraphFact, nodeIri: (id: string) => string): void;
+import { type GraphFact, type GraphNode, type SourceSpan } from '@weftlet/core';
+export declare function addCodeEvidence(dataset: Store, record: NamedNode, fact: GraphFact, nodeIri: (id: string) => string, includeNodes?: boolean): void;
+export declare function addCodeNodeEvidence(dataset: Store, node: GraphNode, nodeIri: (id: string) => string): void;
 export declare function invalidCodeRange(range: Pick<SourceSpan, 'startLine' | 'endLine' | 'startColumn' | 'endColumn' | 'columnEncoding'>): boolean;
 export declare function codeEvidenceIssues(fact: GraphFact): readonly string[];

package/dist/graph/code-rdf.js

@@ -2,7 +2,7 @@ import { DataFactory } from 'n3';
 import { repositoryFileNode } from '@weftlet/core';
 import { CG, RDF, XSD } from './shacl-shapes.js';
 const { namedNode: iri, literal } = DataFactory;
-export function addCodeEvidence(dataset, record, fact, nodeIri) {
+export function addCodeEvidence(dataset, record, fact, nodeIri, includeNodes = true) {
     const property = (subject, key, value) => {
         if (value === undefined)
             return;
@@ -26,19 +26,26 @@ export function addCodeEvidence(dataset, record, fact, nodeIri) {
                 property(range, key, value);
         }
     }
-    for (const node of [fact.subject, fact.object]) {
-        if (node.kind !== 'CodeSymbol' && node.codeSymbol === undefined)
-            continue;
-        const term = iri(nodeIri(node.id));
-        dataset.addQuad(term, iri(RDF + 'type'), iri(CG + 'CodeSymbol'));
-        const value = node.codeSymbol;
-        if (value === undefined)
-            continue; // The shape reports missing required metadata.
-        for (const [key, item] of Object.entries({ codeVersion: value.schemaVersion, codeProvider: value.provider,
-            codeRepository: value.repositoryId, nativeSymbol: value.nativeSymbol, codeIdentityScope: value.identityScope,
-            codeDocument: value.documentPath, codeIndex: value.indexDigest, codeResolution: value.resolution }))
-            property(term, key, item);
-    }
+    if (includeNodes)
+        for (const node of [fact.subject, fact.object])
+            addCodeNodeEvidence(dataset, node, nodeIri);
+}
+export function addCodeNodeEvidence(dataset, node, nodeIri) {
+    const property = (subject, key, value) => {
+        if (value !== undefined)
+            dataset.addQuad(subject, iri(CG + key), literal(String(value), iri(XSD + (typeof value === 'number' ? 'integer' : 'string'))));
+    };
+    if (node.kind !== 'CodeSymbol' && node.codeSymbol === undefined)
+        return;
+    const term = iri(nodeIri(node.id));
+    dataset.addQuad(term, iri(RDF + 'type'), iri(CG + 'CodeSymbol'));
+    const value = node.codeSymbol;
+    if (value === undefined)
+        return; // The shape reports missing required metadata.
+    for (const [key, item] of Object.entries({ codeVersion: value.schemaVersion, codeProvider: value.provider,
+        codeRepository: value.repositoryId, nativeSymbol: value.nativeSymbol, codeIdentityScope: value.identityScope,
+        codeDocument: value.documentPath, codeIndex: value.indexDigest, codeResolution: value.resolution }))
+        property(term, key, item);
 }
 export function invalidCodeRange(range) {
     if (range.startColumn === undefined && range.endColumn === undefined && range.columnEncoding === undefined)

package/dist/graph/neighborhood.js

@@ -1,5 +1,5 @@
 import { snapshotContext } from './snapshot-context.js';
-import { sha256, stableJson } from '../infrastructure/util.js';
+import { stableJsonDigest } from '../infrastructure/util.js';
 import { RdfEvidenceGraph } from './rdf.js';
 import { coverageForFacts } from './coverage.js';
 import { parseGraphNeighborsRequest } from './neighborhood-request.js';
@@ -65,8 +65,8 @@ export class SnapshotGraphExplorationService {
         const { continuation: _continuation, ...query } = request;
         // Bind to actual projected facts too: even a corrupt store reusing a manifest digest
         // must not silently turn a saved continuation into a different neighborhood/frontier.
-        const binding = sha256(stableJson({ version: GRAPH_NEIGHBORHOOD_VERSION, query, manifest: saved.manifest,
-            facts: all, diagnostics: saved.diagnostics, unresolved: saved.unresolved }));
+        const binding = stableJsonDigest({ version: GRAPH_NEIGHBORHOOD_VERSION, query, manifest: saved.manifest,
+            facts: all, diagnostics: saved.diagnostics, unresolved: saved.unresolved });
         const offset = pageOffset(request.continuation, binding, selected.length, request.maxFacts);
         const facts = selected.slice(offset, offset + request.maxFacts);
         const end = offset + facts.length;

package/dist/graph/partitioned-shacl.d.ts

@@ -0,0 +1,14 @@
+import { type Quad } from 'n3';
+import type { RdfPartitions } from './rdf-partitions.js';
+export declare function assertPartitionLocalShapes(shapes: readonly Quad[]): void;
+export interface ShaclIssue {
+    category: 'extraction-gap';
+    focus?: string;
+    path?: string;
+    message: string;
+}
+/** Run the same strict validator/shapes on complete subjects with global class membership. */
+export declare function validatePartitions(partitions: RdfPartitions, types: ReadonlyMap<string, ReadonlySet<string>>, progress?: (completed: number) => void): Promise<{
+    conforms: boolean;
+    issues: ShaclIssue[];
+}>;

package/dist/graph/partitioned-shacl.js

@@ -0,0 +1,66 @@
+import { DataFactory, Store } from 'n3';
+import SHACLValidator from 'rdf-validate-shacl';
+import { RDF, evidenceShapes } from './shacl-shapes.js';
+const SH = 'http://www.w3.org/ns/shacl#', { namedNode: iri } = DataFactory;
+const targets = new Set([SH + 'targetClass', SH + 'targetSubjectsOf']);
+// All admitted constraints inspect the focus subject's outgoing triples. sh:class
+// additionally reads rdf:type on referenced objects, supplied from the entire graph.
+const allowed = new Set(['targetClass', 'targetSubjectsOf', 'property', 'path', 'minCount', 'maxCount',
+    'datatype', 'minLength', 'minInclusive', 'maxInclusive', 'hasValue', 'in', 'or', 'nodeKind', 'class']);
+export function assertPartitionLocalShapes(shapes) {
+    const propertyShapes = new Set(shapes.filter(quad => quad.predicate.value === SH + 'path')
+        .map(quad => quad.subject.value));
+    for (const quad of shapes) {
+        if (quad.predicate.value.startsWith(SH) && !allowed.has(quad.predicate.value.slice(SH.length))) {
+            throw Error(`SHACL partition locality must be reviewed for ${quad.predicate.value}`);
+        }
+        if (quad.predicate.value === SH + 'path' && quad.object.termType !== 'NamedNode') {
+            throw Error('SHACL partition locality requires direct predicate paths');
+        }
+        if (propertyShapes.has(quad.subject.value) && [SH + 'property', SH + 'or'].includes(quad.predicate.value)) {
+            throw Error('SHACL partition locality forbids nested value-shape traversal');
+        }
+        if (quad.predicate.value === RDF + 'type' && ![SH + 'NodeShape', SH + 'PropertyShape'].includes(quad.object.value)) {
+            throw Error('SHACL partition locality requires explicit reviewed targets');
+        }
+        if (!quad.predicate.value.startsWith(SH) && ![RDF + 'type', RDF + 'first', RDF + 'rest'].includes(quad.predicate.value)) {
+            throw Error(`Unsupported SHACL partition vocabulary: ${quad.predicate.value}`);
+        }
+    }
+}
+/** Run the same strict validator/shapes on complete subjects with global class membership. */
+export async function validatePartitions(partitions, types, progress) {
+    assertPartitionLocalShapes(evidenceShapes);
+    const targetRules = evidenceShapes.filter(quad => targets.has(quad.predicate.value));
+    const constraints = evidenceShapes.filter(quad => !targets.has(quad.predicate.value));
+    const issues = [];
+    let conforms = true, completed = 0;
+    for (const batch of partitions.validation()) {
+        // Select targets before adding support-only class triples; those objects are
+        // validated with their complete outgoing records in their own partition.
+        const shapes = new Store(constraints);
+        for (const target of targetRules) {
+            const selected = target.predicate.value === SH + 'targetClass'
+                ? batch.getQuads(null, iri(RDF + 'type'), target.object, null)
+                : batch.getQuads(null, target.object, null, null);
+            for (const quad of selected)
+                shapes.addQuad(target.subject, iri(SH + 'targetNode'), quad.subject);
+        }
+        const referenced = new Set();
+        for (const quad of batch)
+            if (quad.object.termType === 'NamedNode')
+                referenced.add(quad.object.value);
+        for (const node of referenced)
+            for (const type of types.get(node) ?? [])
+                batch.addQuad(iri(node), iri(RDF + 'type'), iri(type));
+        const report = await new SHACLValidator(shapes).validate(batch);
+        conforms &&= report.conforms;
+        for (const result of report.results)
+            issues.push({ category: 'extraction-gap', focus: result.focusNode?.value,
+                path: result.path?.value, message: result.message.map(message => message.value).join('; ') });
+        progress?.(++completed);
+        // Allow progress, cancellation observers and GC between bounded batches.
+        await new Promise(resolve => setImmediate(resolve));
+    }
+    return { conforms, issues };
+}

package/dist/graph/paths.js

@@ -1,5 +1,5 @@
 import { snapshotContext } from './snapshot-context.js';
-import { sha256, stableJson } from '../infrastructure/util.js';
+import { stableJsonDigest } from '../infrastructure/util.js';
 import { RdfEvidenceGraph } from './rdf.js';
 import { coverageForFacts } from './coverage.js';
 import { selectDiagnostics } from './diagnostics.js';
@@ -41,8 +41,8 @@ export class SnapshotGraphPathService {
         if (new Set(all.map(fact => fact.id)).size !== all.length)
             throw new Error('Duplicate fact identities prevent stable graph.paths pagination');
         const { continuation, ...query } = request;
-        const binding = sha256(stableJson({ version: GRAPH_PATHS_VERSION, query, manifest: saved.manifest,
-            facts: all, diagnostics: saved.diagnostics, unresolved: saved.unresolved }));
+        const binding = stableJsonDigest({ version: GRAPH_PATHS_VERSION, query, manifest: saved.manifest,
+            facts: all, diagnostics: saved.diagnostics, unresolved: saved.unresolved });
         const offset = continuationOffset(continuation, binding);
         const selected = all.filter(fact => !request.predicates.length || request.predicates.includes(fact.predicate));
         const edges = selected.flatMap(fact => {