@anionex/dsh-turn-rewind 0.1.1 → 0.1.2

package/lib/types/deadline.d.ts

@@ -0,0 +1,6 @@
+export interface Deadline {
+    readonly signal: AbortSignal;
+    cancel(): void;
+}
+/** Create a cancellable timeout whose timer keeps Node alive until it fires. */
+export declare function createDeadline(timeoutMs: number): Deadline;

package/lib/types/engine.d.ts

@@ -11,6 +11,12 @@ export declare class ChangeLedgerEngine {
     constructor(config?: ChangeLedgerConfig);
     /** Wait for startup reconciliation and return the number of interrupted journals found. */
     initialize(): Promise<number>;
+    private initializeStore;
+    private acquireWorkspace;
+    private reconcileGitCheckpointJournals;
+    private publishGitManifest;
+    private deleteManifestWithGit;
+    private tryReadManifest;
     /** Create a durable restore point for the current Git worktree. */
     create(options: {
         readonly cwd: string;
@@ -26,6 +32,25 @@ export declare class ChangeLedgerEngine {
         readonly turnStartSeq: number;
         readonly signal?: AbortSignal;
     }): Promise<RestorePointSummary>;
+    /** Persist one bounded automatic-checkpoint skip without blocking a later turn retry. */
+    recordTurnCheckpointSkip(options: {
+        readonly cwd: string;
+        readonly sessionId: string;
+        readonly turn: number;
+        readonly turnStartSeq: number;
+        readonly reason: string;
+        readonly signal?: AbortSignal;
+    }): Promise<void>;
+    /** Read a durable skip marker for one exact prompt boundary. */
+    findTurnCheckpointSkip(options: {
+        readonly cwd: string;
+        readonly sessionId: string;
+        readonly turn: number;
+        readonly turnStartSeq: number;
+        readonly signal?: AbortSignal;
+    }): Promise<{
+        readonly reason: string;
+    } | undefined>;
     /** Find the prompt-anchored checkpoint captured before one session turn. */
     findTurnCheckpoint(options: {
         readonly cwd: string;
@@ -82,7 +107,9 @@ export declare class ChangeLedgerEngine {
     }): Promise<RecoverySummary[]>;
     private createLocked;
     private restorePaths;
+    private assertPathFresh;
     private verifyPaths;
+    private captureSelectedEntries;
     private assertStorageSeparated;
     private expirePlans;
 }

package/lib/types/git-checkpoint.d.ts

@@ -0,0 +1,46 @@
+import { type ResolvedChangeLedgerConfig, type RestorePointManifestV2 } from './types.js';
+interface CacheRecord {
+    readonly kind: 'file' | 'symlink';
+    readonly mode: number;
+    readonly size: string;
+    readonly mtimeNs: string;
+    readonly ctimeNs: string;
+    readonly dev: string;
+    readonly ino: string;
+    readonly indexOid?: string;
+    readonly attributes: string;
+    readonly oid: string;
+    readonly target?: string;
+}
+interface GitCache {
+    readonly version: 2;
+    readonly storeId: string;
+    readonly worktreeId: string;
+    readonly paths: Readonly<Record<string, CacheRecord>>;
+    readonly checksum: string;
+}
+export interface GitCheckpointCapture {
+    readonly manifest: RestorePointManifestV2;
+    readonly cache: GitCache;
+}
+/** Create a complete Git-native turn checkpoint without writing the real index. */
+export declare function captureGitTurnCheckpoint(options: {
+    readonly cwd: string;
+    readonly id: string;
+    readonly sessionId: string;
+    readonly turn: number;
+    readonly turnStartSeq: number;
+    readonly config: ResolvedChangeLedgerConfig;
+    readonly signal?: AbortSignal;
+}): Promise<GitCheckpointCapture>;
+/** Publish a prepared checkpoint under its exact private ref. */
+export declare function publishGitCheckpoint(manifest: RestorePointManifestV2, storageDir: string, signal?: AbortSignal): Promise<void>;
+/** Verify persisted Git metadata before exposing or restoring a v2 point. */
+export declare function verifyGitCheckpoint(manifest: RestorePointManifestV2, signal?: AbortSignal): Promise<void>;
+/** Compare-and-swap delete a v2 private ref. */
+export declare function deleteGitCheckpoint(manifest: RestorePointManifestV2, storageDir: string, signal?: AbortSignal): Promise<void>;
+/** Delete an exact private ref target, including during startup journal reconciliation. */
+export declare function deleteGitCheckpointRef(workspace: string, ref: string, commit: string, storageDir: string, signal?: AbortSignal): Promise<void>;
+/** Read one v2 Git blob for selective restore. */
+export declare function readGitBlob(workspace: string, oid: string, expectedSize: number, signal?: AbortSignal): Promise<Buffer>;
+export {};

package/lib/types/git.d.ts

@@ -4,11 +4,42 @@ export interface RepositorySnapshotSource {
     readonly state: RepositoryState;
     readonly paths: readonly string[];
 }
+/** Durable identity and shared lock location for one concrete Git worktree. */
+export interface GitWorktreeIdentity {
+    readonly root: string;
+    readonly gitDir: string;
+    readonly commonDir: string;
+    readonly worktreeId: string;
+    readonly lockPath: string;
+}
 /** Discover the Git worktree owning `cwd` and enumerate tracked/non-ignored paths. */
 export declare function discoverRepository(cwd: string, signal?: AbortSignal): Promise<RepositorySnapshotSource>;
 /** Resolve the canonical Git worktree root owning `cwd` without inventorying its files. */
 export declare function discoverRepositoryRoot(cwd: string, signal?: AbortSignal): Promise<string>;
+/** Create or read the per-worktree identity used by refs and cross-store locking. */
+export declare function ensureGitWorktreeIdentity(cwd: string, signal?: AbortSignal): Promise<GitWorktreeIdentity>;
+/** Resolve a moved linked worktree from its common directory and durable identity. */
+export declare function resolveGitWorktreeRoot(commonDir: string, worktreeId: string, fallback: string, signal?: AbortSignal): Promise<string>;
 /** Return true when two repository fences refer to the same checkout state. */
 export declare function sameRepositoryFence(left: RepositoryState, right: RepositoryState): boolean;
+/** Run Git with stable non-interactive defaults and return UTF-8 output. */
+export declare function runGit(cwd: string, args: readonly string[], signal?: AbortSignal, options?: {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly maxBuffer?: number;
+}): Promise<string>;
+/** Run Git and return undefined for its ordinary "not found" exit status. */
+export declare function runGitOptional(cwd: string, args: readonly string[], signal?: AbortSignal, options?: {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly maxBuffer?: number;
+}): Promise<string | undefined>;
+/** Run Git with binary stdin and return UTF-8 stdout. */
+export declare function runGitInput(cwd: string, args: readonly string[], input: Buffer | string, signal?: AbortSignal, options?: {
+    readonly env?: NodeJS.ProcessEnv;
+}): Promise<string>;
+/** Run Git and return raw stdout bytes. */
+export declare function runGitBuffer(cwd: string, args: readonly string[], signal?: AbortSignal, options?: {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly maxBuffer?: number;
+}): Promise<Buffer>;
 /** Return the Git metadata directory for diagnostics. */
 export declare function gitMetadataParent(state: RepositoryState): string;

package/lib/types/path-utils.d.ts

@@ -16,6 +16,8 @@ export declare function readJson(path: string): Promise<unknown>;
 export declare function pathExists(path: string): Promise<boolean>;
 /** Ensure every existing parent below `root` is a real directory, never a symlink. */
 export declare function ensureSafeParents(root: string, target: string): Promise<void>;
+/** Validate existing parents without creating missing directories. */
+export declare function assertSafeParents(root: string, target: string): Promise<void>;
 /** Replace a path with a regular file using a sibling temporary file. */
 export declare function replaceRegularFile(path: string, content: Buffer, mode: number): Promise<void>;
 /** Replace a path with a symbolic link using a sibling temporary name. */

package/lib/types/rewind-host.d.ts

@@ -115,14 +115,16 @@ export declare class TurnCheckpointCoordinator {
     private readonly captures;
     private readonly pending;
     private readonly failures;
+    private readonly skips;
     private readonly workspaceTails;
     constructor(engine: ChangeLedgerEngine);
     /** Install the first-step gate; checkpoint failures are recorded but never reject the user turn. */
     install(ctx: Context): void;
     /** Current capture state for a session turn when no durable checkpoint exists yet. */
     state(sessionId: string, turn: number): {
-        readonly status: 'pending' | 'failed' | 'missing';
+        readonly status: 'pending' | 'failed' | 'skipped' | 'missing';
         readonly error?: string;
+        readonly reason?: string;
     };
     private capture;
     private serializeWorkspace;

package/lib/types/snapshot.d.ts

@@ -5,6 +5,7 @@ import type { ResolvedChangeLedgerConfig, SnapshotEntry, WorkspaceChange } from
 export interface CapturedTree {
     readonly source: RepositorySnapshotSource;
     readonly entries: Readonly<Record<string, SnapshotEntry>>;
+    readonly gitEntries?: Readonly<Record<string, SnapshotEntry>>;
     readonly treeHash: string;
     readonly fileCount: number;
     readonly totalBytes: number;
@@ -14,6 +15,7 @@ export declare function captureTree(options: {
     readonly cwd: string;
     readonly config: ResolvedChangeLedgerConfig;
     readonly store?: LedgerStore;
+    readonly gitObjectFormat?: 'sha1' | 'sha256';
     readonly signal?: AbortSignal;
 }): Promise<CapturedTree>;
 /**
@@ -25,11 +27,14 @@ export declare function captureStableTree(options: {
     readonly cwd: string;
     readonly config: ResolvedChangeLedgerConfig;
     readonly store?: LedgerStore;
+    readonly gitObjectFormat?: 'sha1' | 'sha256';
     readonly signal?: AbortSignal;
 }): Promise<CapturedTree>;
 /** Compute stable path-level differences between two captured trees. */
-export declare function diffTrees(before: Readonly<Record<string, SnapshotEntry>>, after: Readonly<Record<string, SnapshotEntry>>): WorkspaceChange[];
+export declare function diffTrees(before: Readonly<Record<string, SnapshotEntry>>, after: Readonly<Record<string, SnapshotEntry>>, comparisonBefore?: Readonly<Record<string, SnapshotEntry>>, comparisonAfter?: Readonly<Record<string, SnapshotEntry>>): WorkspaceChange[];
 /** Return whether two snapshot entries are byte/type/mode equivalent. */
 export declare function entriesEqual(left: SnapshotEntry | undefined, right: SnapshotEntry | undefined): boolean;
 /** Hash a complete path map into a deterministic tree identity. */
 export declare function hashTree(entries: Readonly<Record<string, SnapshotEntry>>): string;
+/** Byte-verify one workspace-relative path without following a final symlink. */
+export declare function captureSnapshotEntry(root: string, path: string, maxFileBytes: number, signal?: AbortSignal, gitObjectFormat?: 'sha1' | 'sha256'): Promise<SnapshotEntry | undefined>;

package/lib/types/store.d.ts

@@ -1,12 +1,41 @@
-import type { ResolvedChangeLedgerConfig, RestoreOperation, RestorePointManifest } from './types.js';
+import type { ResolvedChangeLedgerConfig, RestoreOperation, RestorePointManifest, RestorePointManifestV2 } from './types.js';
+export interface GitCheckpointJournal {
+    readonly version: 1;
+    readonly action: 'publish' | 'delete';
+    readonly storeId: string;
+    readonly workspace: string;
+    readonly commonDir: string;
+    readonly worktreeId: string;
+    readonly restorePointId: string;
+    readonly ref: string;
+    readonly commit: string;
+    readonly createdAt: number;
+}
+export interface TurnCheckpointSkip {
+    readonly version: 1;
+    readonly sessionId: string;
+    readonly turn: number;
+    readonly turnStartSeq: number;
+    readonly reason: string;
+    readonly createdAt: number;
+}
 /** Durable content-addressed storage and per-workspace locking. */
 export declare class LedgerStore {
     readonly config: ResolvedChangeLedgerConfig;
+    private readonly workspaceKeys;
+    private storeIdValue;
     constructor(config: ResolvedChangeLedgerConfig);
     /** Create the state root and reconcile crash-interrupted operations. */
     initialize(): Promise<number>;
+    /** Durable owner of this storage root's private Git namespace. */
+    get storeId(): string;
     /** Acquire the exclusive lock for one canonical workspace. */
-    acquire(workspace: string): Promise<() => Promise<void>>;
+    acquire(workspace: string, sharedLockPath?: string, binding?: {
+        readonly commonDir: string;
+        readonly gitDir: string;
+        readonly worktreeId: string;
+    }, signal?: AbortSignal): Promise<() => Promise<void>>;
+    private acquireOne;
     /** Persist a blob if it is not already present, and verify existing content. */
     putBlob(workspace: string, hash: string, content: Buffer): Promise<void>;
     /** Read and verify one content-addressed blob. */
@@ -16,9 +45,25 @@ export declare class LedgerStore {
     /** Load and validate one restore-point manifest. */
     readManifest(workspace: string, id: string): Promise<RestorePointManifest>;
     /** List all validated restore points for one workspace, newest first. */
-    listManifests(workspace: string): Promise<RestorePointManifest[]>;
+    listManifests(workspace: string, signal?: AbortSignal): Promise<RestorePointManifest[]>;
     /** Delete one restore-point manifest. Blobs remain until garbage collection succeeds. */
     deleteManifest(workspace: string, id: string): Promise<void>;
+    /** Persist the intent needed to finish or roll back a Git ref/manifest transition after a crash. */
+    writeGitCheckpointJournal(action: GitCheckpointJournal['action'], manifest: RestorePointManifestV2): Promise<void>;
+    /** List every pending Git checkpoint transition across this storage root. */
+    listGitCheckpointJournals(): Promise<GitCheckpointJournal[]>;
+    /** Remove one completed Git checkpoint transition journal. */
+    deleteGitCheckpointJournal(workspace: string, id: string): Promise<void>;
+    /** Persist one explicit automatic-checkpoint skip so the UI survives restarts. */
+    writeTurnCheckpointSkip(workspace: string, skip: TurnCheckpointSkip): Promise<void>;
+    /** Read one durable automatic-checkpoint skip. */
+    readTurnCheckpointSkip(workspace: string, sessionId: string, turn: number, turnStartSeq: number): Promise<TurnCheckpointSkip | undefined>;
+    /** Remove a stale skip after the same turn obtains a ready checkpoint. */
+    deleteTurnCheckpointSkip(workspace: string, sessionId: string, turn: number, turnStartSeq: number): Promise<void>;
+    /** Mark a legacy capture whose unreferenced blobs need crash recovery. */
+    writeSnapshotCleanup(workspace: string): Promise<void>;
+    /** Clear a completed legacy-capture cleanup marker. */
+    deleteSnapshotCleanup(workspace: string): Promise<void>;
     /** Persist one restore-operation journal. */
     writeOperation(operation: RestoreOperation): Promise<void>;
     /** List validated restore operations for one workspace. */
@@ -26,14 +71,33 @@ export declare class LedgerStore {
     /** Return whether an incomplete operation still references a restore point. */
     isReferencedByRecovery(workspace: string, restorePointId: string): Promise<boolean>;
     /** Delete blobs not referenced by any remaining manifest. */
-    collectGarbage(workspace: string, additionalReferenced?: Iterable<string>): Promise<{
+    collectGarbage(workspace: string, additionalReferenced?: Iterable<string>, signal?: AbortSignal): Promise<{
         deletedBlobs: number;
         retainedBlobs: number;
     }>;
+    /** Finish a prior bounded legacy capture's orphan cleanup, if one is pending. */
+    reconcileSnapshotCleanup(workspace: string, signal?: AbortSignal): Promise<boolean>;
     private workspaceDir;
+    private assertManifestOwned;
+    private assertGitCheckpointJournalOwned;
+    private assertManifestWorkspaceIdentity;
+    private assertGitCheckpointJournalWorkspaceIdentity;
     private manifestPath;
     private operationPath;
+    private gitCheckpointJournalPath;
+    private turnCheckpointSkipPath;
     private blobPath;
-    private reclaimStaleLock;
-    private workspaceAppearsActive;
+    private bindGitWorkspace;
+    private reconcileWorkspaceMigrations;
+    private completeWorkspaceMigration;
+    private assertNoUnresolvedWorkspaceOwnership;
+    private ensureWorktreeClaim;
+    private completeWorkspaceRebind;
+    private rewriteWorkspaceRoot;
+    private prepareLockReclaim;
+    private completeLockReclaims;
+    private acquireLockReclaimOwnership;
+    private lockIsReclaimable;
 }
+/** Create or read the durable owner of one storage root's private Git namespace. */
+export declare function ensureStoreId(storageDir: string): Promise<string>;

package/lib/types/types.d.ts

@@ -1,5 +1,7 @@
 /** Durable format version. Readers reject every other version. */
 export declare const LEDGER_FORMAT_VERSION: 1;
+/** Git-native checkpoint format used by bounded automatic turn capture. */
+export declare const GIT_CHECKPOINT_FORMAT_VERSION: 2;
 /** A persisted restore-point identifier. */
 export type RestorePointId = string;
 /** A persisted restore-operation identifier. */
@@ -12,6 +14,8 @@ export interface FileSnapshotEntry {
     readonly blob: string;
     readonly size: number;
     readonly mode: number;
+    /** Absent for v1 Ledger blobs; `git` means `blob` is a Git object ID. */
+    readonly provider?: 'git';
 }
 /** One symbolic-link snapshot. */
 export interface SymlinkSnapshotEntry {
@@ -33,7 +37,7 @@ export interface RepositoryState {
 /** Why a restore point exists. */
 export type RestorePointKind = 'user' | 'rescue' | 'turn';
 /** Durable workspace restore point. */
-export interface RestorePointManifest {
+export interface RestorePointManifestV1 {
     readonly version: typeof LEDGER_FORMAT_VERSION;
     readonly id: RestorePointId;
     readonly kind: RestorePointKind;
@@ -56,6 +60,31 @@ export interface RestorePointManifest {
     readonly restoreCount: number;
     readonly lastRestoredAt?: number;
 }
+/** Git-native metadata pinned by a private ref. */
+export interface GitCheckpointMetadata {
+    readonly objectFormat: 'sha1' | 'sha256';
+    readonly trust: 'metadata-fenced' | 'byte-verified';
+    /** Stable owner of refs created by one Change Ledger storage root. */
+    readonly storeId: string;
+    /** Durable identity stored inside this specific Git worktree metadata directory. */
+    readonly worktreeId: string;
+    readonly headTree: string;
+    readonly indexTree: string;
+    readonly worktreeTree: string;
+    readonly envelopeTree: string;
+    readonly commit: string;
+    readonly ref: string;
+    readonly newlyStoredBytes: number;
+}
+/** Automatic turn checkpoint whose content is stored in the repository object database. */
+export interface RestorePointManifestV2 extends Omit<RestorePointManifestV1, 'version' | 'treeHash'> {
+    readonly version: typeof GIT_CHECKPOINT_FORMAT_VERSION;
+    /** Deterministic sidecar identity; Git tree integrity is verified separately. */
+    readonly treeHash: string;
+    readonly git: GitCheckpointMetadata;
+}
+/** Durable workspace restore point in either supported format. */
+export type RestorePointManifest = RestorePointManifestV1 | RestorePointManifestV2;
 /** Observable difference between a restore point and the current workspace. */
 export interface WorkspaceChange {
     readonly path: string;
@@ -77,6 +106,7 @@ export interface RestorePointInspection {
 }
 /** Compact restore-point metadata for lists and tool results. */
 export interface RestorePointSummary {
+    readonly format: typeof LEDGER_FORMAT_VERSION | typeof GIT_CHECKPOINT_FORMAT_VERSION;
     readonly id: RestorePointId;
     readonly kind: RestorePointKind;
     readonly workspace: string;
@@ -96,6 +126,7 @@ export interface RestorePointSummary {
     readonly branch?: string;
     readonly operation?: string;
     readonly stagedPathCount: number;
+    readonly trust?: GitCheckpointMetadata['trust'];
 }
 /** An expiring restore plan whose confirmation must be echoed exactly. */
 export interface RestorePlan {
@@ -152,6 +183,14 @@ export interface ChangeLedgerConfig {
     readonly planTtlMs?: number;
     /** Age after which a lock whose owner is gone may be reclaimed. */
     readonly staleLockMs?: number;
+    /** Automatic turn-checkpoint implementation. Git-native is bounded and avoids rereading clean tracked content. */
+    readonly turnCheckpointMode?: 'off' | 'git-native' | 'legacy';
+    /** Maximum time one automatic checkpoint may block the first Agent step. */
+    readonly turnCheckpointTimeoutMs?: number;
+    /** Maximum uncached worktree bytes read by one automatic Git-native checkpoint. */
+    readonly turnCheckpointMaxNewBytes?: number;
+    /** Fast trusts fenced Git/stat metadata; strict rereads every eligible path. */
+    readonly turnCheckpointTrust?: 'fast' | 'strict';
 }
 /** Fully resolved plugin configuration. */
 export interface ResolvedChangeLedgerConfig {
@@ -163,6 +202,10 @@ export interface ResolvedChangeLedgerConfig {
     readonly maxSnapshotBytes: number;
     readonly planTtlMs: number;
     readonly staleLockMs: number;
+    readonly turnCheckpointMode: 'off' | 'git-native' | 'legacy';
+    readonly turnCheckpointTimeoutMs: number;
+    readonly turnCheckpointMaxNewBytes: number;
+    readonly turnCheckpointTrust: 'fast' | 'strict';
 }
 /** Current incomplete restore operation. */
 export interface RecoverySummary {

package/lib/types.js

@@ -1,2 +1,4 @@
 /** Durable format version. Readers reject every other version. */
 export const LEDGER_FORMAT_VERSION = 1;
+/** Git-native checkpoint format used by bounded automatic turn capture. */
+export const GIT_CHECKPOINT_FORMAT_VERSION = 2;

package/lib/validate.js

@@ -2,7 +2,7 @@ import { ChangeLedgerError } from './errors.js';
 import { isAbsolute } from 'node:path';
 import { validateRelativePath } from './path-utils.js';
 import { hashTree } from './snapshot.js';
-import { LEDGER_FORMAT_VERSION, } from './types.js';
+import { GIT_CHECKPOINT_FORMAT_VERSION, LEDGER_FORMAT_VERSION, } from './types.js';
 const HASH_PATTERN = /^[0-9a-f]{64}$/;
 const GIT_OBJECT_PATTERN = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
 const ID_PATTERN = /^(?:rp|op)_[0-9a-z]+_[0-9a-f]{12}$/;
@@ -23,14 +23,17 @@ export function validateOperationId(value) {
 /** Parse an untrusted durable restore-point manifest. */
 export function parseManifest(value) {
     const record = objectRecord(value, 'restore-point manifest');
-    if (record.version !== LEDGER_FORMAT_VERSION)
-        corrupt(`unsupported restore-point version ${String(record.version)}`);
+    const version = record.version;
+    if (version !== LEDGER_FORMAT_VERSION && version !== GIT_CHECKPOINT_FORMAT_VERSION) {
+        corrupt(`unsupported restore-point version ${String(version)}`);
+    }
     const id = stringField(record, 'id');
     validateRestorePointId(id);
     const kind = record.kind;
     if (kind !== 'user' && kind !== 'rescue' && kind !== 'turn') {
         corrupt('restore-point kind must be "user", "rescue", or "turn"');
     }
+    const restorePointKind = kind;
     const workspace = absoluteString(record, 'workspace');
     const repository = parseRepository(record.repository);
     if (repository.root !== workspace)
@@ -40,7 +43,7 @@ export function parseManifest(value) {
     let totalBytes = 0;
     for (const [path, entryValue] of Object.entries(entriesRecord)) {
         validateRelativePath(path);
-        const entry = parseEntry(entryValue, path);
+        const entry = parseEntry(entryValue, path, version);
         entries[path] = entry;
         if (entry.kind === 'file')
             totalBytes += entry.size;
@@ -73,10 +76,9 @@ export function parseManifest(value) {
         corrupt('only turn restore points may carry turn metadata');
     }
     const lastRestoredAt = optionalNonNegativeInteger(record, 'lastRestoredAt');
-    return {
-        version: LEDGER_FORMAT_VERSION,
+    const common = {
         id,
-        kind,
+        kind: restorePointKind,
         workspace,
         repository,
         ...(sessionId === undefined ? {} : { sessionId }),
@@ -93,6 +95,11 @@ export function parseManifest(value) {
         restoreCount,
         ...(lastRestoredAt === undefined ? {} : { lastRestoredAt }),
     };
+    if (version === LEDGER_FORMAT_VERSION)
+        return { version, ...common };
+    if (restorePointKind !== 'turn')
+        corrupt('Git-native v2 restore points are automatic turn checkpoints');
+    return { version, ...common, git: parseGitCheckpoint(record.git, id) };
 }
 /** Parse an untrusted durable restore-operation journal. */
 export function parseOperation(value) {
@@ -168,18 +175,24 @@ function parseRepository(value) {
         stagedPaths,
     };
 }
-function parseEntry(value, path) {
+function parseEntry(value, path, version) {
     const record = objectRecord(value, `snapshot entry ${JSON.stringify(path)}`);
     const kind = record.kind;
     const mode = nonNegativeInteger(record, 'mode');
     if (mode > 0o777)
         corrupt(`snapshot mode is out of range for ${JSON.stringify(path)}`);
     if (kind === 'file') {
+        const blob = stringField(record, 'blob');
+        if (version === LEDGER_FORMAT_VERSION)
+            validateBlobHash(blob);
+        else
+            validateGitObject(blob);
         return {
             kind,
-            blob: validateBlobHash(stringField(record, 'blob')),
+            blob,
             size: nonNegativeInteger(record, 'size'),
             mode,
+            ...(version === GIT_CHECKPOINT_FORMAT_VERSION ? { provider: 'git' } : {}),
         };
     }
     if (kind === 'symlink') {
@@ -190,6 +203,52 @@ function parseEntry(value, path) {
     }
     corrupt(`invalid snapshot entry kind for ${JSON.stringify(path)}`);
 }
+function parseGitCheckpoint(value, restorePointId) {
+    const record = objectRecord(value, 'Git checkpoint metadata');
+    const objectFormat = record.objectFormat;
+    if (objectFormat !== 'sha1' && objectFormat !== 'sha256')
+        corrupt('Git checkpoint objectFormat must be sha1 or sha256');
+    const trust = record.trust;
+    if (trust !== 'metadata-fenced' && trust !== 'byte-verified')
+        corrupt('Git checkpoint trust is invalid');
+    const expectedLength = objectFormat === 'sha1' ? 40 : 64;
+    const object = (key) => {
+        const oid = validateGitObject(stringField(record, key));
+        if (oid.length !== expectedLength)
+            corrupt(`${key} length does not match Git object format`);
+        return oid;
+    };
+    const storeId = hexIdentifier(record, 'storeId');
+    const worktreeId = hexIdentifier(record, 'worktreeId');
+    const ref = stringField(record, 'ref');
+    if (ref !== `refs/dsh-turn-rewind/v2/${storeId}/${worktreeId}/${restorePointId}`) {
+        corrupt('Git checkpoint ref does not match its durable store/worktree/restore-point identity');
+    }
+    return {
+        objectFormat,
+        trust,
+        storeId,
+        worktreeId,
+        headTree: object('headTree'),
+        indexTree: object('indexTree'),
+        worktreeTree: object('worktreeTree'),
+        envelopeTree: object('envelopeTree'),
+        commit: object('commit'),
+        ref,
+        newlyStoredBytes: nonNegativeInteger(record, 'newlyStoredBytes'),
+    };
+}
+function hexIdentifier(record, key) {
+    const value = stringField(record, key);
+    if (!/^[0-9a-f]{32}$/.test(value))
+        corrupt(`${key} must be a 128-bit lowercase hexadecimal identifier`);
+    return value;
+}
+function validateGitObject(value) {
+    if (!GIT_OBJECT_PATTERN.test(value))
+        corrupt('invalid Git object id');
+    return value;
+}
 function objectRecord(value, label) {
     if (value === null || typeof value !== 'object' || Array.isArray(value))
         corrupt(`${label} must be an object`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anionex/dsh-turn-rewind",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Turn-level conversation and workspace rewind for DeepSeek Harness, powered by a persistent Change Ledger",
   "repository": {
     "type": "git",
@@ -39,6 +39,7 @@
   "files": [
     "lib",
     "src",
+    "scripts",
     "docs",
     "cordis.patch.yml",
     "README.md",
@@ -59,6 +60,7 @@
     }
   },
   "scripts": {
+    "benchmark:git-checkpoint": "pnpm run build && node scripts/benchmark-git-checkpoint.mjs",
     "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.client.json && node scripts/wrap-client.mjs",
     "check": "tsc -p tsconfig.json && pnpm run build && node --test tests/*.test.mjs && pnpm pack --dry-run",
     "prepack": "pnpm run build",