dsh-hashline-edit 0.2.1 → 0.2.2

package/src/bash-display-transform.ts

@@ -0,0 +1,50 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import type { DisplayTransform } from "./bash-classifier.js";
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * WHY: (ADR-0048 D2) the transform is a closed display set. The re-run is the oracle: the same
+ * executable and flags run on a temporary copy of the exact raw head bytes, so platform-specific
+ * `od`/`xxd`/`hexdump` layouts cannot drift between what bash printed and what this proves.
+ * `cat -A` is GNU-only; `cat -vet` is the BSD/GNU-portable equivalent. A missing command, a
+ * timeout, or over-budget output returns undefined and the serve seam passes the whole command
+ * through raw with zero leases.
+ */
+const COMMANDS: Record<DisplayTransform["kind"], readonly [string, ...string[]]> = {
+  "cat-A": ["cat", "-A"],
+  "cat-vet": ["cat", "-vet"],
+  "od-c": ["od", "-c"],
+  xxd: ["xxd"],
+  "hexdump-C": ["hexdump", "-C"],
+};
+
+const MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+const TIMEOUT_MS = 5_000;
+
+export async function runDisplayTransform(
+  transform: DisplayTransform,
+  input: string,
+): Promise<string | undefined> {
+  const [program, ...args] = COMMANDS[transform.kind];
+  let dir: string | undefined;
+  try {
+    dir = await mkdtemp(join(tmpdir(), "pi-bash-display-"));
+    const file = join(dir, "slice");
+    await writeFile(file, input);
+    const { stdout } = await execFileAsync(program, [...args, file], {
+      encoding: "utf8",
+      maxBuffer: MAX_OUTPUT_BYTES,
+      timeout: TIMEOUT_MS,
+    });
+    return stdout;
+  } catch {
+    return undefined;
+  } finally {
+    if (dir !== undefined) await rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+}

package/src/bash-multifile-config.ts

@@ -0,0 +1,239 @@
+/**
+ * `bash.multiFile` — the multi-file view caps (ADR-0049 M6), the sibling of `bash.view`.
+ *
+ * WHY the caps are settings: they are operator policy over how much one bash result may spend, not
+ * a correctness bound (the ADR's safety bound IS the allowed range — a config can only lower a cap,
+ * never raise it past the hard maximum). They resolve per KEY through the shared project/global
+ * ladder so "the project file is set" never stands in for "this key came from the project file".
+ *
+ * WHY an out-of-range value warns instead of falling through silently: ADR-0049 M6 requires the
+ * warning, and a dropped cap changes how much the session serves — the silent drop this ladder
+ * refuses to make at file level is the same drop one level down. A MISSING key still warns about
+ * nothing, and a broken file keeps warning exactly once through `readScopeConfig`.
+ *
+ * This module never touches the filesystem itself: reads go through `readScopeConfig`, writes
+ * through `updateConfigFile`, so the config file keeps one owner.
+ */
+import { DomainError } from "./domain-errors.js";
+import {
+  configFilePath,
+  isConfigScope,
+  isRecord,
+  readScopeConfig,
+  updateConfigFile,
+  type ConfigOnWarn,
+  type ConfigRung,
+  type ConfigScope,
+} from "./json-config.js";
+
+/** The two caps, both integers in their allowed range. */
+export interface BashMultiFileSettings {
+  readonly maxFiles: number;
+  readonly maxRows: number;
+}
+
+/** One scope file's accepted keys; every key is optional and absent means "not set here". */
+export type BashMultiFilePatch = Partial<BashMultiFileSettings>;
+
+/** The key ADR-0049 M6 puts under `bash`. */
+const BASH_MULTI_FILE_SUBTREE = "multiFile";
+
+/** The per-key names, in report order. */
+const BASH_MULTI_FILE_KEYS = {
+  maxFiles: "maxFiles",
+  maxRows: "maxRows",
+} as const;
+
+/** The declared defaults: an unconfigured session gets both. */
+export const BASH_MULTI_FILE_DEFAULTS: BashMultiFileSettings = { maxFiles: 10, maxRows: 2000 };
+
+/**
+ * WHY the ranges are closed at the top: ADR-0049 M6 fixes them, and the upper bound is the safety
+ * bound (the row cap fits the built-in bash result cap). Lowering is allowed — an operator may want
+ * a tighter page — raising is not a supported way to exceed it.
+ */
+export const BASH_MULTI_FILE_LIMITS = {
+  maxFiles: { min: 2, max: 10 },
+  maxRows: { min: 1, max: 2000 },
+} as const;
+
+type BashMultiFileKey = keyof BashMultiFileSettings;
+
+const KEY_ORDER: readonly BashMultiFileKey[] = [
+  BASH_MULTI_FILE_KEYS.maxFiles,
+  BASH_MULTI_FILE_KEYS.maxRows,
+];
+
+/** One cap's rung: the value the session will use and where it came from. */
+interface ResolvedBashMultiFileCap {
+  readonly value: number;
+  readonly source: ConfigRung;
+}
+
+/** Both caps with their rungs — the shape `/pi-better-edit settings` reports. */
+export interface ResolvedBashMultiFileSettings {
+  readonly maxFiles: ResolvedBashMultiFileCap;
+  readonly maxRows: ResolvedBashMultiFileCap;
+}
+
+function withinRange(value: unknown, limit: { min: number; max: number }): value is number {
+  return (
+    typeof value === "number" && Number.isInteger(value) && value >= limit.min && value <= limit.max
+  );
+}
+
+/** Runtime guard for `bash.multiFile.maxFiles` (integer, 2–10). */
+export function isBashMultiFileMaxFiles(value: unknown): value is number {
+  return withinRange(value, BASH_MULTI_FILE_LIMITS.maxFiles);
+}
+
+/** Runtime guard for `bash.multiFile.maxRows` (integer, 1–2000). */
+export function isBashMultiFileMaxRows(value: unknown): value is number {
+  return withinRange(value, BASH_MULTI_FILE_LIMITS.maxRows);
+}
+
+const GUARDS: Readonly<Record<BashMultiFileKey, (value: unknown) => value is number>> = {
+  maxFiles: isBashMultiFileMaxFiles,
+  maxRows: isBashMultiFileMaxRows,
+};
+
+/** Runtime guard for the two config scopes. */
+export function isBashMultiFileScope(value: unknown): value is ConfigScope {
+  return isConfigScope(value);
+}
+
+/** `2-10` / `1-2000`, the range text every warning and guard message uses. */
+function rangeText(key: BashMultiFileKey): string {
+  const limit = BASH_MULTI_FILE_LIMITS[key];
+  return `${limit.min}-${limit.max}`;
+}
+
+/**
+ * One scope file's accepted caps. Reads only; a key that is present but unusable is dropped WITH a
+ * warning naming the file, the key, the value and the allowed range, then falls through the ladder.
+ */
+function readScopeSettings(
+  scope: ConfigScope,
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): BashMultiFilePatch {
+  const config = readScopeConfig(scope, cwd, onWarn);
+  if (config === undefined) return {};
+  const bash = config.bash;
+  if (!isRecord(bash)) return {};
+  const subtree = bash[BASH_MULTI_FILE_SUBTREE];
+  if (subtree === undefined) return {};
+  const path = configFilePath(scope, cwd);
+  if (!isRecord(subtree)) {
+    onWarn?.(`config ${path}: ignoring bash.${BASH_MULTI_FILE_SUBTREE} (not an object)`);
+    return {};
+  }
+  const accepted: Record<string, number> = {};
+  for (const key of KEY_ORDER) {
+    const raw = subtree[key];
+    if (raw === undefined) continue;
+    if (!GUARDS[key](raw)) {
+      onWarn?.(
+        `config ${path}: ignoring bash.${BASH_MULTI_FILE_SUBTREE}.${key} ${JSON.stringify(
+          raw,
+        )} (allowed ${rangeText(key)})`,
+      );
+      continue;
+    }
+    accepted[key] = raw;
+  }
+  return accepted;
+}
+
+/**
+ * Both scopes' accepted caps. A scope is absent (rather than an empty object) when its file is
+ * missing, carries no `bash.multiFile` object, or holds no accepted key.
+ */
+export function readBashMultiFileConfig(
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): { project?: BashMultiFilePatch; global?: BashMultiFilePatch } {
+  const project = readScopeSettings("project", cwd, onWarn);
+  const global = readScopeSettings("global", cwd, onWarn);
+  return {
+    ...(Object.keys(project).length > 0 ? { project } : {}),
+    ...(Object.keys(global).length > 0 ? { global } : {}),
+  };
+}
+
+/**
+ * The effective caps WITH their rungs: project, then global, then the declared default — per key, so
+ * one key can come from a different rung than its sibling. Never throws.
+ */
+export function resolveBashMultiFileSettingsWithSources(
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): ResolvedBashMultiFileSettings {
+  const config = readBashMultiFileConfig(cwd, onWarn);
+  const pick = (key: BashMultiFileKey): ResolvedBashMultiFileCap => {
+    const fromProject = config.project?.[key];
+    if (fromProject !== undefined) return { value: fromProject, source: "project" };
+    const fromGlobal = config.global?.[key];
+    if (fromGlobal !== undefined) return { value: fromGlobal, source: "global" };
+    return { value: BASH_MULTI_FILE_DEFAULTS[key], source: "default" };
+  };
+  return { maxFiles: pick("maxFiles"), maxRows: pick("maxRows") };
+}
+
+/** Effective caps only — the ladder's value half. Never throws. */
+export function resolveBashMultiFileSettings(
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): BashMultiFileSettings {
+  const resolved = resolveBashMultiFileSettingsWithSources(cwd, onWarn);
+  return { maxFiles: resolved.maxFiles.value, maxRows: resolved.maxRows.value };
+}
+
+/**
+ * Persist the given caps for `scope`, preserving `$schema`, unknown top-level keys, every other
+ * `bash.*` key (including `view`) and every `multiFile` key not being written. Throws
+ * `E_INTERNAL_INVARIANT` — and writes nothing — for an out-of-range value or an unknown scope: a
+ * defensive guard, unreachable from the command, because a silently dropped cap would read back as
+ * the default.
+ */
+export function saveBashMultiFileConfig(
+  patch: BashMultiFilePatch,
+  scope: ConfigScope,
+  cwd: string,
+): { path: string } {
+  const keys = KEY_ORDER.filter((key) => patch[key] !== undefined);
+  if (keys.length === 0) {
+    throw new DomainError("E_INTERNAL_INVARIANT", {
+      message: `Missing bash.${BASH_MULTI_FILE_SUBTREE} setting to write.`,
+    });
+  }
+  for (const key of keys) {
+    const value = patch[key];
+    if (!GUARDS[key](value)) {
+      throw new DomainError("E_INTERNAL_INVARIANT", {
+        message: `Unknown bash.${BASH_MULTI_FILE_SUBTREE}.${key} "${String(value)}" (allowed ${rangeText(
+          key,
+        )}).`,
+      });
+    }
+  }
+  if (!isBashMultiFileScope(scope)) {
+    throw new DomainError("E_INTERNAL_INVARIANT", {
+      message: `Unknown bash.${BASH_MULTI_FILE_SUBTREE} scope "${String(scope)}".`,
+    });
+  }
+
+  const path = configFilePath(scope, cwd);
+  updateConfigFile(path, (existing) => {
+    const bash = isRecord(existing.bash) ? existing.bash : {};
+    const subtree = isRecord(bash[BASH_MULTI_FILE_SUBTREE]) ? bash[BASH_MULTI_FILE_SUBTREE] : {};
+    return {
+      ...existing,
+      bash: {
+        ...bash,
+        [BASH_MULTI_FILE_SUBTREE]: { ...subtree, ...patch },
+      },
+    };
+  });
+  return { path };
+}

package/src/bash-view-config.ts

@@ -0,0 +1,158 @@
+/**
+ * Bash view setting — the `bash.view` key of the shared config file, resolved
+ * through the shared ladder: env override, then project file, then global file,
+ * then the default.
+ *
+ * WHY the interception is configurable at all: the view replacement swaps bash
+ * stdout for anchored lines, which is a display decision about the model's own
+ * session — an operator who would rather see raw output turns one key off, and
+ * every other session keeps the default without restating it.
+ *
+ * WHY a warning is part of the contract here: a dropped setting changes what the
+ * session shows, so an existing-but-unusable file is reported through `onWarn`
+ * while the value falls through the ladder. A missing file warns about nothing,
+ * and a value outside the accepted shape is ignored exactly as the sibling
+ * ladders ignore one. Nothing here throws on the read side.
+ */
+import { DomainError } from "./domain-errors.js";
+import {
+  configFilePath,
+  isConfigScope,
+  isRecord,
+  readScopeConfig,
+  updateConfigFile,
+  type ConfigOnWarn,
+  type ConfigRung,
+  type ConfigScope,
+} from "./json-config.js";
+
+export type BashViewMode = "on" | "off";
+
+/** Environment override; wins over both files. Values outside the enum are ignored, not fatal. */
+export const BASH_VIEW_ENV_VAR = "PI_BETTER_EDIT_BASH_VIEW";
+
+/** The mode an unconfigured session gets: interception stays on. */
+export const BASH_VIEW_DEFAULT: BashViewMode = "on";
+
+const BASH_VIEW_MODES: readonly BashViewMode[] = ["on", "off"];
+
+/** The single key this owner reads and writes under `bash`. */
+const BASH_VIEW_KEY = "view";
+
+/** Runtime guard for values arriving from files, env vars and command arguments. */
+export function isBashViewMode(value: unknown): value is BashViewMode {
+  return typeof value === "string" && BASH_VIEW_MODES.some((mode) => mode === value);
+}
+
+/** Runtime guard for the two config scopes. */
+export function isBashViewScope(value: unknown): value is ConfigScope {
+  return isConfigScope(value);
+}
+
+/** One scope file's mode, or `undefined` when the file carries no accepted value. */
+function readScopeMode(
+  scope: ConfigScope,
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): BashViewMode | undefined {
+  const config = readScopeConfig(scope, cwd, onWarn);
+  if (config === undefined) return undefined;
+  const bash = config.bash;
+  if (!isRecord(bash)) return undefined;
+  const mode = bash[BASH_VIEW_KEY];
+  return isBashViewMode(mode) ? mode : undefined;
+}
+
+/**
+ * Both scopes' configured modes. Pure read: never creates the directory or the file, never
+ * throws. A scope is absent (rather than `undefined`-valued) when its file is missing or holds a
+ * value outside the enum.
+ */
+export function readBashViewConfig(
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): { project?: BashViewMode; global?: BashViewMode } {
+  const project = readScopeMode("project", cwd, onWarn);
+  const global = readScopeMode("global", cwd, onWarn);
+  return {
+    ...(project !== undefined ? { project } : {}),
+    ...(global !== undefined ? { global } : {}),
+  };
+}
+
+/** A trimmed environment value, or `undefined` when the variable is unset. */
+function envText(name: string): string | undefined {
+  const raw = process.env[name];
+  return raw === undefined ? undefined : raw.trim();
+}
+
+function readEnvMode(): BashViewMode | undefined {
+  const mode = envText(BASH_VIEW_ENV_VAR)?.toLowerCase();
+  return mode !== undefined && isBashViewMode(mode) ? mode : undefined;
+}
+
+/**
+ * One resolved setting: the value the session will use, and the rung of the ladder
+ * that supplied it.
+ */
+export interface ResolvedBashViewMode {
+  readonly value: BashViewMode;
+  readonly source: ConfigRung;
+}
+
+/**
+ * The effective mode WITH its rung: env override, then project, then global, then `"on"`.
+ * Never throws. This is the ladder itself, and `resolveBashViewMode` is its value half, so the
+ * two cannot disagree about which rung won — a caller that has to NAME the winner (the
+ * `/pi-better-edit` status text does) reads it here instead of re-walking the two files.
+ */
+export function resolveBashViewModeWithSource(
+  cwd: string,
+  onWarn?: ConfigOnWarn,
+): ResolvedBashViewMode {
+  const fromEnv = readEnvMode();
+  if (fromEnv !== undefined) return { value: fromEnv, source: "env" };
+  const config = readBashViewConfig(cwd, onWarn);
+  if (config.project !== undefined) return { value: config.project, source: "project" };
+  if (config.global !== undefined) return { value: config.global, source: "global" };
+  return { value: BASH_VIEW_DEFAULT, source: "default" };
+}
+
+/** Effective mode: env override, then project, then global, then `"on"`. Never throws. */
+export function resolveBashViewMode(cwd: string, onWarn?: ConfigOnWarn): BashViewMode {
+  return resolveBashViewModeWithSource(cwd, onWarn).value;
+}
+
+/**
+ * Persist `mode` for `scope`, preserving unknown top-level keys and other `bash.*` keys already
+ * in the file. Creates the directory as needed and replaces the file atomically. Throws
+ * `E_INTERNAL_INVARIANT` — and writes nothing — for a value outside its accepted shape or a
+ * scope outside the enum: a defensive guard, unreachable from the command and the overlay,
+ * because a silently dropped value would read back as the default.
+ */
+export function saveBashViewConfig(
+  mode: BashViewMode,
+  scope: ConfigScope,
+  cwd: string,
+): { path: string } {
+  if (!isBashViewMode(mode)) {
+    throw new DomainError("E_INTERNAL_INVARIANT", {
+      message: `Unknown bash view mode "${String(mode)}".`,
+    });
+  }
+  if (!isBashViewScope(scope)) {
+    throw new DomainError("E_INTERNAL_INVARIANT", {
+      message: `Unknown bash view scope "${String(scope)}".`,
+    });
+  }
+
+  const path = configFilePath(scope, cwd);
+  // WHY: only `bash.view` is ours to set — an existing `$schema` is a deliberate editor-time
+  // WHY: choice and unknown top-level or `bash.*` keys belong to the user, so all of them survive.
+  updateConfigFile(path, (existing) => ({
+    ...existing,
+    bash: { ...(isRecord(existing.bash) ? existing.bash : {}), [BASH_VIEW_KEY]: mode },
+  }));
+
+  return { path };
+}

package/src/cut-repair.ts

@@ -1,6 +1,5 @@
 import { restoreEndings, type LineEnding } from "./edit-diff.js";
 import { readBytes, writeAtomic } from "./fs-write.js";
-import { pathKind, removeFile, renameFile } from "./fs-lifecycle.js";
 import { withSortedMutationQueues } from "./mutation-queue.js";
 import { errCode } from "./utils.js";
 import { loadHashStore, type HashStore } from "./hash-store.js";
@@ -74,87 +73,20 @@ function candidateFor(row: MemberRow, which: "pre" | "post"): Buffer | undefined
 }
 
 async function stateOf(row: MemberRow): Promise<MemberState> {
-  const lifecycle = row.lifecycle ?? "edit";
-  const post = candidateFor(row, "post");
-  const pre = candidateFor(row, "pre");
-  const readOrUndefined = async (path: string | null | undefined): Promise<Buffer | undefined> => {
-    if (path === null || path === undefined) return undefined;
-    try {
-      return await readBytes(path);
-    } catch (error) {
-      if (errCode(error) === "ENOENT") return undefined;
-      throw error;
-    }
-  };
-  if (lifecycle === "add") {
-    const bytes = await readOrUndefined(row.path);
-    if (bytes === undefined) return "pre";
-    return post !== undefined && bytes.equals(post) ? "post" : "other";
-  }
-  if (lifecycle === "delete") {
-    const bytes = await readOrUndefined(row.path);
-    if (bytes === undefined) return "post";
-    return pre !== undefined && bytes.equals(pre) ? "pre" : "other";
-  }
-  if (lifecycle === "move") {
-    const to = await readOrUndefined(row.path);
-    const from = await readOrUndefined(row.fromPath);
-    if (to !== undefined && post !== undefined && to.equals(post)) return "post";
-    if (from !== undefined && pre !== undefined && from.equals(pre)) return "pre";
-    // WHY: crash after the rename but before the content rewrite — the destination holds the raw
-    // WHY: pre bytes and the source is gone. That is the PRE state of an as-yet-unapplied move.
-    if (to !== undefined && pre !== undefined && to.equals(pre) && from === undefined) return "pre";
-    return "other";
+  let bytes: Buffer;
+  try {
+    bytes = await readBytes(row.path);
+  } catch (error) {
+    if (errCode(error) === "ENOENT") return "other";
+    throw error;
   }
-  const bytes = await readOrUndefined(row.path);
-  if (bytes === undefined) return "other";
+  const post = candidateFor(row, "post");
   if (post !== undefined && bytes.equals(post)) return "post";
+  const pre = candidateFor(row, "pre");
   if (pre !== undefined && bytes.equals(pre)) return "pre";
   return "other";
 }
 
-/** Write one lifecycle row to its named state; returns false when the row cannot express it. */
-async function writeState(row: MemberRow, which: "pre" | "post"): Promise<boolean> {
-  const lifecycle = row.lifecycle ?? "edit";
-  const bytes = candidateFor(row, which);
-  if (lifecycle === "add") {
-    if (which === "post") {
-      if (bytes === undefined) return false;
-      await writeAtomic(row.path, bytes);
-      return true;
-    }
-    if ((await pathKind(row.path)) !== "absent") await removeFile(row.path);
-    return true;
-  }
-  if (lifecycle === "delete") {
-    if (which === "post") {
-      if ((await pathKind(row.path)) !== "absent") await removeFile(row.path);
-      return true;
-    }
-    if (bytes === undefined) return false;
-    await writeAtomic(row.path, bytes);
-    return true;
-  }
-  if (lifecycle === "move") {
-    const source = row.fromPath;
-    if (source === null || source === undefined) return false;
-    if (which === "post") {
-      if ((await pathKind(row.path)) === "absent") {
-        if ((await pathKind(source)) === "absent") return false;
-        await renameFile(source, row.path);
-      }
-      if (bytes !== undefined) await writeAtomic(row.path, bytes);
-      return true;
-    }
-    if ((await pathKind(row.path)) !== "absent") await renameFile(row.path, source);
-    if (bytes !== undefined) await writeAtomic(source, bytes);
-    return true;
-  }
-  if (bytes === undefined) return false;
-  await writeAtomic(row.path, bytes);
-  return true;
-}
-
 /** Returns true when the resolution completed (bytes written or nothing to write) and the intent retired. */
 async function applyResolution(
   store: HashStore,
@@ -174,7 +106,9 @@ async function applyResolution(
         if (now !== expected) return false;
       }
       for (const row of toWrite) {
-        if (!(await writeState(row, which))) return false;
+        const bytes = candidateFor(row, which);
+        if (bytes === undefined) return false;
+        await writeAtomic(row.path, bytes);
       }
       deleteCutIntent(store, txnId);
       return true;

package/src/domain-errors.ts

@@ -54,27 +54,19 @@ export type DomainErrorCode =
   | "E_UNDO_REVERT_FAILED"
   | "E_UNKNOWN"
   | "E_LARGE_FILE"
-  | "E_INTERNAL_INVARIANT"
-  // WHY: apply_patch's two genuinely new codes (E_STALE_ANCHOR already exists above).
-  | "E_PATCH_SYNTAX"
-  | "E_UNIQUE_MATCH";
+  | "E_INTERNAL_INVARIANT";
 
 /**
  * The registered tool whose call produced an `E_BAD_PAYLOAD`. WHY the registered name: the model
  * reads the tool list, so `undo_last_edit` names the call it must repair and a short form would
  * name nothing. A tool belongs here only after a live path is measured, never by assumption.
  */
-export type PayloadSubject = "read" | "edit" | "apply_patch" | "undo_last_edit";
+export type PayloadSubject = "read" | "edit" | "undo_last_edit";
 
 // WHY: this is the runtime companion of the `PayloadSubject` union, like `isDomainErrorCode`.
 // WHY: Only a member may name a tool.
 // WHY: A non-member renders the neutral wording instead.
-const PAYLOAD_SUBJECTS: readonly PayloadSubject[] = [
-  "read",
-  "edit",
-  "apply_patch",
-  "undo_last_edit",
-];
+const PAYLOAD_SUBJECTS: readonly PayloadSubject[] = ["read", "edit", "undo_last_edit"];
 
 export function isPayloadSubject(value: unknown): value is PayloadSubject {
   return typeof value === "string" && (PAYLOAD_SUBJECTS as readonly string[]).includes(value);
@@ -260,20 +252,6 @@ export interface ErrorPayloadMap {
      */
     subject?: PayloadSubject;
   };
-  E_PATCH_SYNTAX: {
-    message: string;
-    path?: string;
-    patchLine?: number;
-    servedRows?: ServedRow[];
-    servedBlock?: string;
-  };
-  E_UNIQUE_MATCH: {
-    message: string;
-    path?: string;
-    patchLine?: number;
-    servedRows?: ServedRow[];
-    servedBlock?: string;
-  };
 }
 
 export interface CodeSpec<P> {
@@ -600,16 +578,6 @@ export const ERROR_REGISTRY: { [K in DomainErrorCode]: CodeSpec<ErrorPayloadMap[
     // WHY: no options — read needs `mode: "verbatim"` and edit needs a split, but the payload
     // WHY: names neither tool. Add `subject` before serving advice (ADR-0047).
   },
-  E_PATCH_SYNTAX: {
-    audience: "MODEL",
-    // WHY: the parser already rendered every problem with its patch line; the envelope carries
-    // WHY: that aggregate so one resubmission can fix every syntax problem.
-    format: ({ message }) => message,
-  },
-  E_UNIQUE_MATCH: {
-    audience: "MODEL",
-    format: ({ message }) => message,
-  },
 };
 
 export interface WarningPayloadMap {

package/src/edit-normalize.ts

@@ -0,0 +1,8 @@
+/** SAFETY: @deprecated Import from "./payload-contract.js" instead — compatibility shim retained until next MAJOR per ADR-0007. Single source: src/payload-contract.ts. */
+/** SAFETY: @deprecated Use `import { normReq } from "./payload-contract.js"` */
+export {
+  /** SAFETY: @deprecated Use `import { normReq } from "./payload-contract.js"` */
+  normReq,
+  /** SAFETY: @deprecated Use `import { prepareEditArguments } from "./payload-contract.js"` */
+  prepareEditArguments,
+} from "./payload-contract.js";