@unbrained/pm-cli 2026.9.4 → 2026.9.6

package/dist/sdk/merge/abandoned-receipts.js

@@ -0,0 +1,47 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cd45ee09-e4c3-5fc6-8253-1f1dc709a3a8")}catch(e){}}();
+import { runHistoryRepair } from "../history-repair.js";
+import { isOriginalGitStateRestored } from "./receipt-operation.js";
+import { markMergeReceiptReconciled, summarizeMergeReceipt, } from "./receipts.js";
+/** Preview or record restored-origin dispositions without treating them as applied merges. */
+export async function settleAbandonedMergeReceipts(params) {
+    if (params.cwd === null)
+        return [];
+    const settled = [];
+    for (const receipt of params.receipts) {
+        if (receipt.operation === undefined ||
+            !(await isOriginalGitStateRestored(params.cwd, receipt.item_path, receipt.operation)))
+            continue;
+        const mergeAbandonmentProof = { gitWorkspaceRoot: params.cwd, receipt };
+        await runHistoryRepair(receipt.item_id, { dryRun: true, mergeAbandonmentProof }, params.global);
+        if (!params.dryRun) {
+            await runHistoryRepair(receipt.item_id, {
+                author: params.author ?? params.global.author,
+                mergeAbandonmentProof,
+                message: params.message ??
+                    "Settle rebase receipt after exact original Git state restoration",
+                auditOperation: "merge_reconcile",
+                forceAuditEntry: true,
+                auditContext: {
+                    merge: {
+                        abandoned_receipts: [
+                            {
+                                ...summarizeMergeReceipt(receipt),
+                                reason: "original_git_state_restored",
+                                operation: receipt.operation,
+                            },
+                        ],
+                    },
+                },
+            }, params.global);
+            await markMergeReceiptReconciled(params.cwd, receipt, {
+                requireExisting: true,
+                settlement: "original_git_state_restored",
+            });
+        }
+        settled.push(receipt.id);
+    }
+    return settled;
+}
+//# sourceMappingURL=abandoned-receipts.js.map
+//# debugId=cd45ee09-e4c3-5fc6-8253-1f1dc709a3a8

package/dist/sdk/merge/driver.js

@@ -9,7 +9,7 @@
  * merge never corrupts tracker storage the way raw conflict markers do.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5dc5f70c-0b04-51bb-983b-49b15be11587")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="22b1f103-54de-5a63-a2d2-2f99181a73e2")}catch(e){}}();
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { getActiveExtensionRegistrations } from "../../core/extensions/index.js";
@@ -22,6 +22,7 @@ import { nowIso } from "../../core/shared/time.js";
 import { getSettingsPath, resolvePmRoot } from "../../core/store/paths.js";
 import { readSettings } from "../../core/store/settings.js";
 import { hashItemScalarDecisionValue, mergeHistoryStreams, mergeItemDocuments, mergeJsonDocuments, mergeRelationshipEventStreams, } from "./three-way.js";
+import { captureMergeReceiptOperation } from "./receipt-operation.js";
 import { summarizeMergeReceipt, writeMergeReceipt, } from "./receipts.js";
 /** Supported values accepted by the merge driver artifact contract across CLI, SDK, and MCP surfaces. */
 export const MERGE_DRIVER_ARTIFACT_VALUES = [
@@ -166,6 +167,7 @@ export async function runMergeDriver(options, global) {
                     hashItemScalarDecisionValue(field === "body" ? mergedDocument.body : mergedMetadata[field]),
                 ])),
                 decisions: itemMerge.conflict_decisions,
+                operation: await captureMergeReceiptOperation(process.cwd(), options.itemPath),
             };
         }
     }
@@ -208,4 +210,4 @@ export async function runMergeDriver(options, global) {
     };
 }
 //# sourceMappingURL=driver.js.map
-//# debugId=5dc5f70c-0b04-51bb-983b-49b15be11587
+//# debugId=22b1f103-54de-5a63-a2d2-2f99181a73e2

package/dist/sdk/merge/index.d.ts

@@ -11,3 +11,4 @@ export { inspectMergeReceiptEvidence, listMergeReceipts, markMergeReceiptReconci
 export { MERGE_DRIVER_ARTIFACT_VALUES, runMergeDriver, type MergeDriverArtifact, type MergeDriverOptions, type MergeDriverResult, } from "./driver.js";
 export { auditMergeAttributeFence, auditMergeDriverConfiguration, buildMergeAttributePatterns, findGitWorkspaceRoot, PM_GITATTRIBUTES_END, PM_GITATTRIBUTES_START, PM_GITATTRIBUTES_V2_END, PM_GITATTRIBUTES_V2_START, refreshMergeAttributeFenceIfInstalled, resolveMergeInstallContext, runMergeInstall, type MergeFenceAuditResult, type MergeDriverConfigurationAuditResult, type MergeFenceRefreshOutcome, type MergeInstallOptions, type MergeInstallContextResolution, type MergeInstallResult, } from "./install.js";
 export { runMergeReconcile, type MergeReconcileOptions, type MergeReconcileResult, } from "./reconcile.js";
+export type { MergeReceiptOperation } from "./receipt-operation.js";

package/dist/sdk/merge/index.js

@@ -7,11 +7,11 @@
  * this module so packages and hosts can reuse the same merge behavior.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="925be497-bdd3-527b-9a88-cf9c9f682ab2")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5079995b-ef00-5fe3-b87d-0882ef976d10")}catch(e){}}();
 export { ITEM_SCALAR_MISSING_VALUE, ITEM_LATEST_TIMESTAMP_FIELDS, ITEM_UNION_COLLECTION_FIELDS, encodeItemScalarDecisionValue, hashItemScalarDecisionValue, isItemScalarMissingValue, mergeHistoryStreams, mergeItemDocuments, mergeJsonDocuments, mergeRelationshipEventStreams, } from "./three-way.js";
 export { inspectMergeReceiptEvidence, listMergeReceipts, markMergeReceiptReconciled, runMergeReceiptEvidenceReport, runMergeReceiptReport, summarizeMergeReceipt, } from "./receipts.js";
 export { MERGE_DRIVER_ARTIFACT_VALUES, runMergeDriver, } from "./driver.js";
 export { auditMergeAttributeFence, auditMergeDriverConfiguration, buildMergeAttributePatterns, findGitWorkspaceRoot, PM_GITATTRIBUTES_END, PM_GITATTRIBUTES_START, PM_GITATTRIBUTES_V2_END, PM_GITATTRIBUTES_V2_START, refreshMergeAttributeFenceIfInstalled, resolveMergeInstallContext, runMergeInstall, } from "./install.js";
 export { runMergeReconcile, } from "./reconcile.js";
 //# sourceMappingURL=index.js.map
-//# debugId=925be497-bdd3-527b-9a88-cf9c9f682ab2
+//# debugId=5079995b-ef00-5fe3-b87d-0882ef976d10

package/dist/sdk/merge/receipt-operation.d.ts

@@ -0,0 +1,15 @@
+/** Immutable pre-rebase coordinates, without branch names or item contents. */
+export interface MergeReceiptOperation {
+    /** Git operation whose original state can be checked after it ends. */
+    kind: "rebase";
+    /** Commit from which the rebase began. */
+    original_head: string;
+    /** Original item blob at that commit. */
+    original_blob: string;
+}
+/** Capture a rebase's original commit and item blob, or omit unprovable coordinates. */
+export declare function captureMergeReceiptOperation(cwd: string, itemPath: string): Promise<MergeReceiptOperation | undefined>;
+/** Validate only the bounded, privacy-safe operation schema accepted by receipt readers. */
+export declare function isMergeReceiptOperation(value: unknown): value is MergeReceiptOperation;
+/** Prove HEAD, index, and working item all match the captured origin after Git leaves the operation. */
+export declare function isOriginalGitStateRestored(cwd: string, itemPath: string, operation: MergeReceiptOperation, expectedItemRaw?: string): Promise<boolean>;

package/dist/sdk/merge/receipt-operation.js

@@ -0,0 +1,97 @@
+/**
+ * @module sdk/merge/receipt-operation
+ * Records Git coordinates that let reconciliation prove a rebase restored its original state.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7bef66b4-7131-5998-84bd-07983a25d762")}catch(e){}}();
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { readBoundedRegularFile } from "./receipt-file-boundary.js";
+const execFileAsync = promisify(execFile);
+const GIT_OBJECT_ID = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
+/** Capture a rebase's original commit and item blob, or omit unprovable coordinates. */
+export async function captureMergeReceiptOperation(cwd, itemPath) {
+    const trimmedItemPath = itemPath.trim();
+    const normalizedItemPath = /^(['"])(.*)\1$/su.exec(trimmedItemPath)?.[2] ?? trimmedItemPath;
+    for (const backend of ["rebase-merge", "rebase-apply"]) {
+        try {
+            const { stdout: marker } = await execFileAsync("git", [
+                "rev-parse",
+                "--path-format=absolute",
+                "--git-path",
+                `${backend}/orig-head`,
+            ], { cwd, timeout: 10_000 });
+            const originalHead = (await readBoundedRegularFile(marker.trim(), 128))?.trim();
+            if (originalHead === undefined || !GIT_OBJECT_ID.test(originalHead))
+                continue;
+            const { stdout } = await execFileAsync("git", ["rev-parse", "--verify", `${originalHead}:${normalizedItemPath}`], { cwd, timeout: 10_000 });
+            const originalBlob = stdout.trim();
+            return {
+                kind: "rebase",
+                original_head: originalHead,
+                original_blob: originalBlob,
+            };
+        }
+        catch {
+            // No evidence is safer than inferring an abandoned operation from item drift.
+        }
+    }
+    return undefined;
+}
+/** Validate only the bounded, privacy-safe operation schema accepted by receipt readers. */
+export function isMergeReceiptOperation(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const record = value;
+    return (Object.keys(record).length === 3 &&
+        record.kind === "rebase" &&
+        typeof record.original_head === "string" &&
+        GIT_OBJECT_ID.test(record.original_head) &&
+        typeof record.original_blob === "string" &&
+        GIT_OBJECT_ID.test(record.original_blob));
+}
+/** Prove HEAD, index, and working item all match the captured origin after Git leaves the operation. */
+export async function isOriginalGitStateRestored(cwd, itemPath, operation, expectedItemRaw) {
+    if (expectedItemRaw !== undefined) {
+        const snapshotBlob = createHash(operation.original_blob.length === 40 ? "sha1" : "sha256")
+            .update(`blob ${Buffer.byteLength(expectedItemRaw)}\0`)
+            .update(expectedItemRaw)
+            .digest("hex");
+        if (snapshotBlob !== operation.original_blob)
+            return false;
+    }
+    try {
+        const { stdout: gitDirectory } = await execFileAsync("git", ["rev-parse", "--absolute-git-dir"], { cwd, timeout: 10_000 });
+        const activeMarkers = new Set([
+            "rebase-merge",
+            "rebase-apply",
+            "MERGE_HEAD",
+            "CHERRY_PICK_HEAD",
+            "REVERT_HEAD",
+        ]);
+        if ((await readdir(gitDirectory.trim())).some((entry) => activeMarkers.has(entry)))
+            return false;
+        const { stdout: head } = await execFileAsync("git", ["rev-parse", "HEAD"], {
+            cwd,
+            timeout: 10_000,
+        });
+        if (head.trim() !== operation.original_head)
+            return false;
+        const { stdout: originalBlob } = await execFileAsync("git", ["rev-parse", "--verify", `HEAD:${itemPath}`], { cwd, timeout: 10_000 });
+        if (originalBlob.trim() !== operation.original_blob)
+            return false;
+        const { stdout: blob } = await execFileAsync("git", ["hash-object", "--", path.resolve(cwd, itemPath)], { cwd, timeout: 10_000 });
+        if (blob.trim() !== operation.original_blob)
+            return false;
+        await execFileAsync("git", ["diff", "--cached", "--quiet", "HEAD", "--", itemPath], { cwd, timeout: 10_000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=receipt-operation.js.map
+//# debugId=7bef66b4-7131-5998-84bd-07983a25d762

package/dist/sdk/merge/receipt-schema.d.ts

@@ -0,0 +1,20 @@
+import type { MergeDecisionReceipt, MergeReceiptInvalidEvidence } from "./receipts.js";
+/** Return whether a receipt id is safe to expose in cleartext diagnostics. */
+export declare function isSafeReceiptId(value: string): boolean;
+/** Versioned allowlist controlling which scalar evidence may enter tracked receipt sidecars. */
+export declare const DURABLE_VALUE_POLICY: "bounded_non_sensitive_scalars_v1";
+/** Return the narrowest validation class for untrusted receipt evidence. */
+export declare function receiptValidationError(value: unknown, evidenceSource: "clone_local" | "durable"): MergeReceiptInvalidEvidence["validation_error"] | null;
+/** Restore omitted non-selected slots from identified v1 clone-local writer contracts; never infer a missing retained or discarded value. */
+export declare function normalizeLegacyReceipt(value: unknown): unknown;
+/** Identify the rejected collection without exposing its values. */
+export declare function receiptCollectionValidationPath(value: unknown): string | undefined;
+/** Validate a complete receipt against its clone-local or durable evidence policy. */
+export declare function isMergeDecisionReceipt(value: unknown, evidenceSource: "clone_local" | "durable"): value is MergeDecisionReceipt;
+/** Extract a structurally valid precomputed SHA-256 decision hash. */
+export declare function isPrehashedValue(value: unknown): string | undefined;
+/** Convert a raw scalar into hashed evidence with an allowlisted preview. */
+export declare function durableValueEvidence(field: string, value: unknown): {
+    pm_value_hash: string;
+    pm_value?: unknown;
+};

package/dist/sdk/merge/receipt-schema.js

@@ -0,0 +1,398 @@
+/**
+ * @module sdk/merge/receipt-schema
+ * Validates historical and current receipt encodings and enforces durable-value privacy policy.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1f6aa507-79da-5d11-a580-72141b725947")}catch(e){}}();
+import path from "node:path";
+import { stableStringify } from "../../core/shared/serialization.js";
+import { isRfc3339DateTime } from "../../core/shared/time.js";
+import { encodeItemScalarDecisionValue, hashItemScalarDecisionValue, isItemScalarMissingValue, } from "./three-way.js";
+import { isMergeReceiptOperation } from "./receipt-operation.js";
+const RECEIPT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+const RECEIPT_ITEM_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u;
+const RECEIPT_FIELD_MAX = 2_048;
+const RECEIPT_VALUE_MAX_DEPTH = 64;
+const RECEIPT_VALUE_MAX_NODES = 100_000;
+const RECEIPT_KEYS = new Set([
+    "version",
+    "id",
+    "item_path",
+    "item_id",
+    "requested_preference",
+    "requested_preference_applied",
+    "preferred",
+    "conflict_resolution",
+    "fields_from_theirs",
+    "union_fields",
+    "merged_field_hashes",
+    "decisions",
+    "state",
+    "created_at",
+    "reconciled_at",
+    "value_availability",
+    "value_policy",
+    "evidence_source",
+    "operation",
+    "settlement",
+]);
+/** Return whether a receipt id is safe to expose in cleartext diagnostics. */
+export function isSafeReceiptId(value) {
+    return RECEIPT_ID_PATTERN.test(value);
+}
+const RECEIPT_DECISION_KEYS = new Set([
+    "field",
+    "base",
+    "ours",
+    "theirs",
+    "retained",
+    "discarded",
+    "retained_side",
+    "resolution_basis",
+]);
+/** Versioned allowlist controlling which scalar evidence may enter tracked receipt sidecars. */
+export const DURABLE_VALUE_POLICY = "bounded_non_sensitive_scalars_v1";
+const REVIEWABLE_BUILTIN_STATUSES = new Set([
+    "open",
+    "in_progress",
+    "blocked",
+    "closed",
+    "canceled",
+]);
+const REVIEWABLE_ORDINAL_FIELDS = new Set(["risk", "confidence", "severity"]);
+const REVIEWABLE_ORDINAL_VALUES = new Set([
+    "low",
+    "medium",
+    "high",
+    "critical",
+]);
+const REVIEWABLE_DURABLE_VALUES_BY_FIELD = new Map([
+    ["priority", new Set([0, 1, 2, 3, 4].map(stableStringify))],
+    ["status", new Set([...REVIEWABLE_BUILTIN_STATUSES].map(stableStringify))],
+    ...[...REVIEWABLE_ORDINAL_FIELDS].map((field) => [
+        field,
+        new Set([...REVIEWABLE_ORDINAL_VALUES].map(stableStringify)),
+    ]),
+]);
+/** Narrow untrusted JSON to a non-array object before schema inspection. */
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Refuse receipt extensions outside the versioned schema key set. */
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key));
+}
+/** Validate bounded dense string collections used in receipt coordinates. */
+function isStringArray(value) {
+    return (Array.isArray(value) &&
+        value.length <= RECEIPT_FIELD_MAX &&
+        value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= 256));
+}
+/** Bound JSON depth and node count before retaining untrusted decision values. */
+function hasBoundedJsonStructure(value) {
+    const pending = [
+        { value, depth: 0 },
+    ];
+    let nodes = 0;
+    while (pending.length > 0) {
+        const current = pending.pop();
+        nodes += 1;
+        if (nodes > RECEIPT_VALUE_MAX_NODES ||
+            current.depth > RECEIPT_VALUE_MAX_DEPTH) {
+            return false;
+        }
+        if (Array.isArray(current.value)) {
+            for (const entry of current.value) {
+                pending.push({ value: entry, depth: current.depth + 1 });
+            }
+        }
+        else if (isRecord(current.value)) {
+            for (const entry of Object.values(current.value)) {
+                pending.push({ value: entry, depth: current.depth + 1 });
+            }
+        }
+    }
+    return true;
+}
+/** Validate one clone-local scalar decision and its optional resolution evidence. */
+function isMergeDecision(value) {
+    if (!isRecord(value))
+        return false;
+    const retainedSides = [undefined, "ours", "theirs"];
+    const resolutionBases = [
+        undefined,
+        "requested_preference",
+        "document_updated_at",
+        "stable_value_tiebreak",
+    ];
+    return [
+        hasOnlyKeys(value, RECEIPT_DECISION_KEYS),
+        typeof value.field === "string",
+        typeof value.field === "string" && value.field.length > 0,
+        typeof value.field === "string" && value.field.length <= 256,
+        Object.hasOwn(value, "base"),
+        Object.hasOwn(value, "ours"),
+        Object.hasOwn(value, "theirs"),
+        Object.hasOwn(value, "retained"),
+        Object.hasOwn(value, "discarded"),
+        hasBoundedJsonStructure(value.base),
+        hasBoundedJsonStructure(value.ours),
+        hasBoundedJsonStructure(value.theirs),
+        hasBoundedJsonStructure(value.retained),
+        hasBoundedJsonStructure(value.discarded),
+        retainedSides.includes(value.retained_side),
+        resolutionBases.includes(value.resolution_basis),
+    ].every(Boolean);
+}
+/** Validate the complete field-to-SHA-256 proof map used during repair. */
+function isMergedFieldHashes(value) {
+    if (!isRecord(value))
+        return false;
+    const entries = Object.entries(value);
+    return (entries.length <= RECEIPT_FIELD_MAX &&
+        entries.every(([field, hash]) => field.length > 0 &&
+            field.length <= 256 &&
+            typeof hash === "string" &&
+            /^[a-f0-9]{64}$/u.test(hash)));
+}
+/** Require a normalized tracker item path whose basename matches the receipt item. */
+function isSafeReceiptItemPath(value, itemId) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 4_096 ||
+        value.includes("\0") ||
+        value.includes("\\") ||
+        path.posix.isAbsolute(value)) {
+        return false;
+    }
+    const normalized = path.posix.normalize(value);
+    return (normalized !== ".." &&
+        !normalized.startsWith("../") &&
+        path.posix.basename(normalized, path.posix.extname(normalized)) === itemId);
+}
+/** Validate receipt arrays and optional merged-field proof coverage. */
+function hasValidReceiptCollections(value) {
+    return !isStringArray(value.fields_from_theirs) ||
+        !isStringArray(value.union_fields) ||
+        !Array.isArray(value.decisions) ||
+        value.decisions.length > RECEIPT_FIELD_MAX ||
+        !value.decisions.every(isMergeDecision)
+        ? false
+        : value.merged_field_hashes === undefined ||
+            isMergedFieldHashes(value.merged_field_hashes);
+}
+/** Validate every closed-domain lifecycle and merge-policy field. */
+function hasValidReceiptEnums(value) {
+    const preferences = [undefined, "ours", "theirs"];
+    const resolutions = [
+        undefined,
+        "preferred_side",
+        "stable_value_order",
+        "latest_document_update",
+    ];
+    const availabilities = [
+        undefined,
+        "clone_local",
+        "hash_only",
+        "bounded_inline",
+        "mixed",
+    ];
+    const sources = [undefined, "clone_local", "durable"];
+    return (preferences.includes(value.requested_preference) &&
+        preferences.includes(value.preferred) &&
+        (value.requested_preference_applied === undefined ||
+            typeof value.requested_preference_applied === "boolean") &&
+        resolutions.includes(value.conflict_resolution) &&
+        (value.state === "pending" || value.state === "reconciled") &&
+        availabilities.includes(value.value_availability) &&
+        (value.value_policy === undefined ||
+            value.value_policy === DURABLE_VALUE_POLICY) &&
+        sources.includes(value.evidence_source));
+}
+/** Validate creation and optional settlement timestamps as RFC 3339 values. */
+function hasValidReceiptTimestamps(value) {
+    return (typeof value.created_at === "string" &&
+        isRfc3339DateTime(value.created_at) &&
+        (value.reconciled_at === undefined ||
+            (typeof value.reconciled_at === "string" &&
+                isRfc3339DateTime(value.reconciled_at))));
+}
+/** Validate one hash-only or policy-bounded durable decision value. */
+function hasDurableDecisionValue(field, value) {
+    if (!isRecord(value) || isPrehashedValue(value) === undefined)
+        return false;
+    const keys = Object.keys(value);
+    if (!keys.every((key) => key === "pm_value_hash" || key === "pm_value")) {
+        return false;
+    }
+    if (!Object.hasOwn(value, "pm_value"))
+        return keys.length === 1;
+    const preview = value.pm_value;
+    const allowed = preview === null ||
+        REVIEWABLE_DURABLE_VALUES_BY_FIELD.get(field)?.has(stableStringify(preview)) === true;
+    return (allowed && hashItemScalarDecisionValue(preview) === value.pm_value_hash);
+}
+/** Validate durable decision redaction and the declared availability summary. */
+function hasValidDurableDecisions(receipt) {
+    if (!receipt.decisions.every((decision) => decision.base === null &&
+        decision.ours === null &&
+        decision.theirs === null &&
+        hasDurableDecisionValue(decision.field, decision.retained) &&
+        hasDurableDecisionValue(decision.field, decision.discarded))) {
+        return false;
+    }
+    const inlineValueCount = receipt.decisions.reduce((count, decision) => count +
+        (isRecord(decision.retained) &&
+            Object.hasOwn(decision.retained, "pm_value")
+            ? 1
+            : 0) +
+        (isRecord(decision.discarded) &&
+            Object.hasOwn(decision.discarded, "pm_value")
+            ? 1
+            : 0), 0);
+    const expectedAvailability = inlineValueCount === 0
+        ? "hash_only"
+        : inlineValueCount === receipt.decisions.length * 2
+            ? "bounded_inline"
+            : "mixed";
+    return (receipt.value_availability === expectedAvailability &&
+        (inlineValueCount === 0 || receipt.value_policy === DURABLE_VALUE_POLICY));
+}
+/** Require restored-origin settlements to retain the immutable operation they disposition. */
+function hasValidReceiptOperation(value) {
+    if (value.operation !== undefined &&
+        !isMergeReceiptOperation(value.operation))
+        return false;
+    return (value.settlement === undefined ||
+        (value.settlement === "original_git_state_restored" &&
+            value.state === "reconciled" &&
+            value.operation !== undefined));
+}
+/** Validate schema identity before inspecting values or lifecycle policy. */
+function receiptIdentityValidationError(value) {
+    for (const key of [
+        "version",
+        "id",
+        "item_path",
+        "item_id",
+        "fields_from_theirs",
+        "union_fields",
+        "decisions",
+        "state",
+        "created_at",
+    ]) {
+        if (!Object.hasOwn(value, key))
+            return "required_fields";
+    }
+    if (value.version !== 1 || !hasOnlyKeys(value, RECEIPT_KEYS)) {
+        return "required_fields";
+    }
+    if (typeof value.id !== "string" || !isSafeReceiptId(value.id)) {
+        return "receipt_id";
+    }
+    if (typeof value.item_id !== "string" ||
+        !RECEIPT_ITEM_ID_PATTERN.test(value.item_id)) {
+        return "item_id";
+    }
+    if (!isSafeReceiptItemPath(value.item_path, value.item_id)) {
+        return "item_path";
+    }
+    return null;
+}
+/** Return the narrowest validation class for untrusted receipt evidence. */
+export function receiptValidationError(value, evidenceSource) {
+    if (!isRecord(value))
+        return "required_fields";
+    const identityError = receiptIdentityValidationError(value);
+    if (identityError !== null)
+        return identityError;
+    if (!hasValidReceiptOperation(value))
+        return "operation";
+    if (!hasValidReceiptCollections(value))
+        return "collections";
+    if (!hasValidReceiptEnums(value))
+        return "enums";
+    if (!hasValidReceiptTimestamps(value))
+        return "timestamps";
+    if (evidenceSource === "durable" &&
+        !hasValidDurableDecisions(value)) {
+        return "durable_decisions";
+    }
+    return null;
+}
+/** Restore omitted non-selected slots from identified v1 clone-local writer contracts; never infer a missing retained or discarded value. */
+export function normalizeLegacyReceipt(value) {
+    if (!isRecord(value) ||
+        value.version !== 1 ||
+        value.value_policy !== undefined ||
+        !Array.isArray(value.decisions))
+        return value;
+    const preferredEra = (value.preferred === "ours" || value.preferred === "theirs") &&
+        value.requested_preference === undefined;
+    const requestedPreferenceEra = (value.requested_preference === "ours" ||
+        value.requested_preference === "theirs") &&
+        value.value_availability === "clone_local";
+    if (!preferredEra && !requestedPreferenceEra)
+        return value;
+    return {
+        ...value,
+        decisions: value.decisions.map((decision) => {
+            if (!isRecord(decision) ||
+                !Object.hasOwn(decision, "retained") ||
+                !Object.hasOwn(decision, "discarded"))
+                return decision;
+            return {
+                base: encodeItemScalarDecisionValue(undefined),
+                ours: encodeItemScalarDecisionValue(undefined),
+                theirs: encodeItemScalarDecisionValue(undefined),
+                ...decision,
+            };
+        }),
+    };
+}
+/** Identify the rejected collection without exposing its values. */
+export function receiptCollectionValidationPath(value) {
+    if (!isRecord(value))
+        return undefined;
+    if (!isStringArray(value.fields_from_theirs))
+        return "fields_from_theirs";
+    if (!isStringArray(value.union_fields))
+        return "union_fields";
+    if (!Array.isArray(value.decisions) ||
+        value.decisions.length > RECEIPT_FIELD_MAX)
+        return "decisions";
+    const index = value.decisions.findIndex((decision) => !isMergeDecision(decision));
+    if (index >= 0)
+        return `decisions[${index}]`;
+    return "merged_field_hashes";
+}
+/** Validate a complete receipt against its clone-local or durable evidence policy. */
+export function isMergeDecisionReceipt(value, evidenceSource) {
+    return receiptValidationError(value, evidenceSource) === null;
+}
+/** Extract a structurally valid precomputed SHA-256 decision hash. */
+export function isPrehashedValue(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Array.isArray(value) ||
+        !("pm_value_hash" in value)) {
+        return undefined;
+    }
+    const hash = value.pm_value_hash;
+    return typeof hash === "string" && /^[a-f0-9]{64}$/u.test(hash)
+        ? hash
+        : undefined;
+}
+/** Convert a raw scalar into hashed evidence with an allowlisted preview. */
+export function durableValueEvidence(field, value) {
+    const missing = isItemScalarMissingValue(value);
+    const pmValueHash = hashItemScalarDecisionValue(missing ? undefined : value);
+    const reviewable = !missing &&
+        (value === null ||
+            REVIEWABLE_DURABLE_VALUES_BY_FIELD.get(field)?.has(stableStringify(value)) === true);
+    return reviewable
+        ? { pm_value_hash: pmValueHash, pm_value: value }
+        : { pm_value_hash: pmValueHash };
+}
+//# sourceMappingURL=receipt-schema.js.map
+//# debugId=1f6aa507-79da-5d11-a580-72141b725947