fix(deps): upgrade vitest 2→4, resolve all npm audit findings

CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **5 new graph algorithms in `GraphTraversal`** — `levels()` (longest-path level assignment for DAGs), `transitiveReduction()` (minimal edge set preserving reachability), `transitiveClosure()` (all implied reachability edges with `maxEdges` safety), `rootAncestors()` (find all in-degree-0 ancestors via backward BFS). All methods respect `NeighborProviderPort` abstraction, support `AbortSignal` cancellation, and produce deterministic output. Corresponding `LogicalTraversal` facade methods added. New error code: `E_MAX_EDGES_EXCEEDED`.
+- **4 new test fixtures** — `F15_WIDE_DAG_FOR_LEVELS`, `F16_TRANSITIVE_REDUCTION`, `F17_MULTI_ROOT_DAG`, `F18_TRANSITIVE_CLOSURE_CHAIN` in the canonical fixture DSL.
+- **BFS reverse reachability verification tests** — confirms `bfs(node, { direction: 'in' })` correctly discovers all backward-reachable ancestors.
+- **`roaring-wasm` WASM fallback for Bun/Deno bitmap indexes** — `initRoaring()` now has a three-tier fallback chain: (1) ESM `import('roaring')`, (2) CJS `createRequire('roaring')`, (3) `import('roaring-wasm')` with WASM initialization. The WASM tier activates automatically when native V8 bindings are unavailable (Bun's JSC, Deno). Bitmap index tests (`materializedView`, `materialize.checkpointIndex.notStale`) are no longer excluded from the Bun test suite. Serialization formats are wire-compatible — portable bitmaps produced by native and WASM are byte-identical.
+
+### Fixed
+
+- **Roaring native module loading under Bun** — `initRoaring()` now catches dynamic `import('roaring')` failures and falls back to `createRequire()` for direct `.node` binary loading.
+- **Stale `nativeAvailability` cache on `initRoaring()` reinit** — `getNativeRoaringAvailable()` now returns the correct value after swapping roaring implementations via `initRoaring(mod)`. Previously, the cached availability from the old module was returned.
+- **Lost root causes on roaring load failure** — when all three tiers (native ESM, CJS require, WASM) fail, `initRoaring()` now throws `AggregateError` with per-tier errors instead of a plain `Error`, preserving diagnostic detail.
+
+### Changed
+
+- **ROADMAP priority triage** — 45 standalone items sorted into 6 priority tiers (P0–P6) with wave-based execution order and dependency chain mapping. Replaced flat Near-Term table with priority-grouped sub-tables. All milestones (M10–M14) marked complete. Inventory corrected to 133 total tracked items.
+- **Vitest 2.1.9 → 4.0.18** — major test framework upgrade. Migrated deprecated `test(name, fn, { timeout })` signatures to `test(name, { timeout }, fn)` across 7 test files (40 call sites). Fixed `vi.fn().mockImplementation()` constructor mocks to use `function` expressions per Vitest 4 requirements. Resolves 5 remaining moderate-severity npm audit advisories (`esbuild` [GHSA-67mh-4wv8-2f99](https://github.com/advisories/GHSA-67mh-4wv8-2f99), `vite`, `@vitest/mocker`, `vite-node`, `vitest`). **`npm audit` now reports 0 vulnerabilities.**
+
 ## [13.0.1] — 2026-03-03
 
 ### Fixed

README.md

@@ -8,8 +8,10 @@
   <img src="docs/images/hero.gif" alt="git-warp CLI demo" width="600">
 </p>
 
-## What's New in v13.0.1
+## What's New (Unreleased)
 
+- **5 new graph algorithms** — `levels()`, `transitiveReduction()`, `transitiveClosure()`, `rootAncestors()` in `GraphTraversal`, plus BFS reverse reachability verification. All use `NeighborProviderPort` and support cancellation.
+- **`roaring-wasm` WASM fallback for Bun/Deno bitmap indexes** — bitmap indexes now work on Bun (JSC) and Deno via a three-tier fallback: native V8 bindings → CJS require → WASM. Wire-compatible, byte-identical serialization.
 - **Dev dependency security updates** — resolved 4 high-severity advisories (`tar`, `rollup`, `minimatch`, `@isaacs/brace-expansion`). No runtime dependencies affected.
 
 See the [full changelog](CHANGELOG.md) for details.
@@ -642,6 +644,7 @@ The codebase follows hexagonal architecture with ports and adapters:
 | `@git-stunts/trailer-codec` | Git trailer encoding |
 | `cbor-x` | CBOR binary serialization |
 | `roaring` | Roaring bitmap indexes (native C++ bindings) |
+| `roaring-wasm` | Roaring bitmap WASM fallback (Bun/Deno) |
 | `zod` | Schema validation |
 
 ## Testing

docker-compose.test.yml

@@ -32,14 +32,16 @@ services:
     command: ["sh", "-c", "npx vitest run test/unit test/integration && bats test/bats/"]
     profiles: [node22, full]
 
-  # Bun: API integration tests only (CLI is Node-only)
+  # Bun: API integration tests only (CLI is Node-only).
+  # Bitmap index tests pass via roaring-wasm WASM fallback (native roaring uses
+  # V8 C++ API, incompatible with Bun's JSC runtime).
   test-bun:
     build:
       context: ..
       dockerfile: git-warp/docker/Dockerfile.bun
     environment:
       - GIT_STUNTS_DOCKER=1
-    command: ["bunx", "vitest", "run", "test/integration/api/"]
+    command: bunx vitest run test/integration/api/
     profiles: [bun, full]
 
   # Deno: API integration tests via Deno.test() wrappers

docker/Dockerfile.bun

@@ -3,12 +3,8 @@
 # CLI tests are excluded — the CLI uses node: built-ins.
 # Build context is the parent monorepo directory (context: ..).
 FROM oven/bun:1.2-slim
-# make/g++: native module compilation (roaring bitmaps).
-# No bats/python3 — BATS CLI tests are Node-only.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
-    make \
-    g++ \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY git-warp/package*.json ./
@@ -26,4 +22,7 @@ RUN git init -q \
 RUN useradd -m warp && chown -R warp:warp /app
 USER warp
 ENV GIT_STUNTS_DOCKER=1
+# Bitmap index tests now pass under Bun via the roaring-wasm WASM fallback.
+# The native roaring package (V8 C++ API) is incompatible with Bun's JSC runtime,
+# but initRoaring() falls through to roaring-wasm automatically.
 CMD ["bunx", "vitest", "run", "test/integration/api/"]

docs/ROADMAP/COMPLETED.md

@@ -368,3 +368,13 @@ Investigation revealed the correct approach is a two-phase split:
 | B92 | ~~**SURFACE VALIDATOR UNIT TESTS**~~ — **DONE.** 34 tests for `parseExportBlock`, `extractJsExports`, `extractDtsExports`. |
 | B93 | ~~**DEDUP EXPORT PARSING LOGIC**~~ — **DONE.** `parseExportBlock()` extracted as shared helper; `collectExportBlocks()` internal. |
 | B94 | ~~**STANDALONE EXPORT DECLARATIONS**~~ — **DONE.** `extractJsExports` now handles `export const/function/class`. |
+
+### v13.0.0 Standalone Items (completed)
+
+| ID | Item |
+|----|------|
+| B44 | ~~**SUBSCRIBER UNSUBSCRIBE-DURING-CALLBACK E2E**~~ — **DONE (v13.0.0).** 3 edge-case tests (cross-unsubscribe, subscribe-during-callback, unsubscribe-in-onError). |
+| B124 | ~~**TRUST PAYLOAD PARITY TESTS**~~ — **DONE (v13.0.0).** 22 tests verifying CLI vs service shape parity. |
+| B125 | ~~**`CachedValue` NULL-PAYLOAD SEMANTIC TESTS**~~ — **DONE (v13.0.0).** 3 tests documenting null = "no value" sentinel. |
+| B146 | ~~**UNIFY `CorePersistence` / `FullPersistence` TYPEDEFS**~~ — **DONE (v13.0.0).** Replaced `FullPersistence` with imported `CorePersistence`. |
+| B148 | ~~**REVIEW NITS + INVENTORY RECONCILIATION**~~ — **DONE (v13.0.0).** Fix inventory counts, COMPLETED.md ordering, stale Deno test name, BisectService invariant comment. |

index.d.ts

@@ -295,6 +295,27 @@ export interface LogicalTraversal {
     labelFilter?: string | string[];
     signal?: AbortSignal;
   }): Promise<{ path: string[]; totalCost: number }>;
+  levels(start: string | string[], options?: {
+    dir?: 'out' | 'in' | 'both';
+    labelFilter?: string | string[];
+    signal?: AbortSignal;
+  }): Promise<{ levels: Map<string, number>; maxLevel: number }>;
+  transitiveReduction(start: string | string[], options?: {
+    dir?: 'out' | 'in' | 'both';
+    labelFilter?: string | string[];
+    signal?: AbortSignal;
+  }): Promise<{ edges: Array<{ from: string; to: string; label: string }>; removed: number }>;
+  transitiveClosure(start: string | string[], options?: {
+    dir?: 'out' | 'in' | 'both';
+    labelFilter?: string | string[];
+    maxEdges?: number;
+    signal?: AbortSignal;
+  }): Promise<{ edges: Array<{ from: string; to: string }> }>;
+  rootAncestors(start: string, options?: {
+    labelFilter?: string | string[];
+    maxDepth?: number;
+    signal?: AbortSignal;
+  }): Promise<{ roots: string[] }>;
 }
 
 /**