Skip to content

feat: add graph-source-contract package - #25

Merged
Mearman merged 4 commits into
mainfrom
feat/source-contract
Oct 10, 2026
Merged

Mearman merged 4 commits into
mainfrom
feat/source-contract

Conversation

@Mearman

@Mearman Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member

Phase 2 of the process-graph plan, first half: @exadev/process-graph-source-contract, the GraphSource port.

The port is an @orpc/contract router keyed by version (v1.describe, v1.sync.page, v1.sync.stream), so the same definition is called in process, across a MessagePort or over HTTP. A sync page is a slice of the model: bound activities (the source-qualified id such as github:org/repo#12 is the element id, and source must equal it), participants, transitions, relations (child-of, assigned-to, part-of, for links the model has no field for), overlay status and gaps. Its record schemas come from modelSchema in the schema package, not restated.

Paging and streaming share one cursor. Each page carries next; the stream yields pages only as the consumer pulls and sets each event id to next, so a sync resumes from an explicit after or from the transport's lastEventId, with after winning. Failures that end a call are typed UNAUTHORIZED, TOO_MANY_REQUESTS (with resetAt) and BAD_REQUEST (invalid-cursor or invalid-scope) errors carrying data; anything a source can partly read arrives as gaps in the page.

Adapters implement a one-page-at-a-time GraphSourcePager and createGraphSourceRouter builds the port on it, so streaming, resumption and error mapping are shared. The package also has an in-memory fake, assembleSync (merges pages into one model, later pages winning) and paginate.

The conformance kit is on its own entry point (./conformance, Vitest as an optional peer) and talks only to the oRPC client. It runs here against the fake both in process and across a MessageChannel. The v2 beta resume behaviour I was asked to spike is pinned by resume.unit.test.ts over both transports: a stream closed after its first page resumes with exactly the remaining pages by after and by lastEventId, asserted on activity ids, cursors and the cross-repository transition. I read the behaviour from the installed @orpc/* 2.0.0-beta.41 source rather than the v1 docs: event meta survives the contract's output validation (wrapAsyncIteratorPreservingEventMeta), and handlers receive lastEventId in their options.

The GitHub issues adapter follows as a stacked PR. The npm name needs reserving before this merges: npm-reserve @exadev/process-graph-source-contract --trust ExaDev/process-graph --workflow ci.yml.

The GraphSource port as an @orpc/contract router keyed by version, so one
definition runs in process, over a message port or over HTTP. A sync page is
a slice of the model: bound activities whose source-qualified id doubles as
the element id, participants, transitions, relations, overlay status and
gaps, with record schemas taken from the schema package's modelSchema.

sync.page and sync.stream share a cursor: each page carries next, the stream
yields pages on demand with next as the event id, and a sync resumes from an
explicit after or the transport's lastEventId. Failures that end a call are
typed UNAUTHORIZED, TOO_MANY_REQUESTS and BAD_REQUEST errors with data; what
a source can partly read arrives as gaps.

Adapters implement a pager; createGraphSourceRouter builds the port on it.
The package ships an in-memory fake, assembleSync, and a conformance kit on a
separate entry point that runs through the oRPC client, exercised here over
the fake in process and across a MessageChannel.
… connections

Adapters walk cursor-linked connections of their own source, such as nested
GraphQL connections, with the same on-demand iteration the router streams
pages with.
inProcessClient and messagePortClient move from the package's test support into the
conformance entry point, so an adapter runs the kit over the same transports as the fake.
…rkspace

The workspace moved to vitest 5.0.3 and released the schema package as 1.0.2 while this
package was in review, so its dev dependency, its optional conformance peer and its
sibling pin follow.
@Mearman
Mearman force-pushed the feat/source-contract branch from bf859d2 to 569bb4c Compare October 10, 2026 16:15
@Mearman
Mearman marked this pull request as ready for review October 10, 2026 16:16
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-10-10T16:40:41.253315Z 569bb4c Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 569bb4c989

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@Mearman

Mearman commented Oct 10, 2026

Copy link
Copy Markdown
Member Author

@codex security review

@Mearman
Mearman merged commit f291799 into main Oct 10, 2026
14 checks passed
@github-actions

Copy link
Copy Markdown

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 569bb4c989

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant