opencode-swarm 7.162.0 → 7.163.0

package/dist/pr-review/types.d.ts

@@ -0,0 +1,225 @@
+/**
+ * PR-review typed state boundary (issue #2385).
+ *
+ * The closed event/effect vocabulary for the PR-review transition authority
+ * (`reducer.ts`) plus the PR-review slice of the workflow gate state. The
+ * owning gate's full `PrWorkflowGateState` satisfies this slice structurally
+ * (a compile-time assertion in the gate enforces it), so there is ONE field
+ * definition — the gate adds only non-PR-review fields.
+ *
+ * Invalid transitions from issue #2385 are rejected with typed codes
+ * (`PrReviewTransitionRejectionCode`) rather than made representable-by-type
+ * alone: several of them depend on runtime evidence (generations, digests,
+ * ledger state), so the reducer is the enforcement point.
+ */
+import type { PrReviewBaseDimensionId } from '../background/pr-review-contract.js';
+import type { PrReviewCircuitSignal, PrReviewResiliencePolicyRecord } from './circuit.js';
+/** A declared base-dispatch lane (subset the reducer governs). */
+export interface PrReviewBaseDispatchLane {
+    laneId: string;
+    workflowLane: PrReviewBaseDimensionId;
+    ownedWorkflowLanes?: PrReviewBaseDimensionId[];
+}
+export interface PrReviewBaseDispatchRecordLite {
+    batchId: string;
+    lanes: PrReviewBaseDispatchLane[];
+    validatedAt: string;
+}
+export interface PrReviewDimensionCancellationLite {
+    reason: string;
+    cancelledAt: string;
+    source: 'armed_recovery';
+}
+export interface PrReviewResilienceSlice {
+    policy: PrReviewResiliencePolicyRecord;
+    /** Attempt bookkeeping is adapter-owned; the reducer carries it opaquely. */
+    attempts: readonly unknown[];
+    circuit?: import('./circuit.js').PrReviewCircuitRecord | undefined;
+}
+/**
+ * The PR-review slice of the workflow gate state. The gate's full state type
+ * satisfies this structurally; the reducer may therefore be applied to the
+ * live gate state object without a projection step.
+ */
+export interface PrReviewWorkflowState {
+    sessionID: string;
+    workflowInstanceId?: string | undefined;
+    revision: number;
+    prHeadSha?: string | undefined;
+    prReviewBaseSha?: string | undefined;
+    prReviewBaseDispatches?: PrReviewBaseDispatchRecordLite[] | undefined;
+    prReviewBaseDispatch?: PrReviewBaseDispatchRecordLite | undefined;
+    prReviewResilience?: PrReviewResilienceSlice | undefined;
+    prReviewContractRetryDimensions?: PrReviewBaseDimensionId[] | undefined;
+    prReviewDimensionCancellations?: Partial<Record<PrReviewBaseDimensionId, PrReviewDimensionCancellationLite>> | undefined;
+    /** Coverage disclosure fields are carried opaquely (owned by completion.ts). */
+    prReviewPartialBaseCoverage?: unknown | undefined;
+}
+export type PrReviewTerminalCoverageKind = 'COMPLETE' | 'PARTIAL' | 'NO_COVERAGE';
+export type PrReviewReportVerdict = 'APPROVE' | 'INCOMPLETE' | 'REQUEST_CHANGES';
+export interface PrReviewCoverageSettlementInput {
+    kind: PrReviewTerminalCoverageKind;
+    coveredDimensions: PrReviewBaseDimensionId[];
+    unresolvedDimensions: Array<{
+        dimension: PrReviewBaseDimensionId;
+        terminalState: 'FAILED' | 'CANCELLED' | 'NOT_LAUNCHED';
+        reasonKind: string;
+    }>;
+    /** Dimensions with a live (non-terminal) lane — blocks finalization. */
+    liveDimensions: PrReviewBaseDimensionId[];
+}
+export type PrReviewEffect = {
+    kind: 'persist_state';
+} | {
+    kind: 'settle_delegation';
+    batchId: string;
+    laneId: string;
+    status: 'completed' | 'error' | 'cancelled' | 'stale';
+    replay?: boolean;
+} | {
+    kind: 'emit_diagnostic';
+    source: 'collection_observer' | 'legacy_transcript_adapter';
+    code: string;
+    boundedDetail?: string | undefined;
+} | {
+    kind: 'block_dispatch';
+    reason: 'circuit_open' | 'probe_in_flight';
+};
+/**
+ * Effect kinds map to executors that exist in production (issue #2385
+ * Phase 8b review): `persist_state` is executed by the gate through the
+ * persistence CAS write; `settle_delegation` describes the settlement the
+ * dispatch/collect adapters perform via `pending-delegations.ts`;
+ * `emit_diagnostic` describes the collect observer's bounded diagnostics
+ * channel; `block_dispatch` describes the circuit-open admission refusal.
+ * A kind with no executor is not emitted and not declared.
+ */
+export type PrReviewCircuitProbeOutcome = {
+    result: 'typed_success';
+} | {
+    result: 'provider_failure';
+    providerClass: string;
+} | {
+    result: 'ignored';
+} | {
+    result: 'rolled_back_admission';
+};
+export type PrReviewEvent = {
+    type: 'base_admission_requested';
+    batchId: string;
+    lanes: PrReviewBaseDispatchLane[];
+    depthTier: 'S' | 'M' | 'L';
+    maxBatches: number;
+    validatedAt: string;
+} | {
+    type: 'base_admission_rolled_back';
+    batchId: string;
+    batchDelegationRecordsExist: boolean;
+} | {
+    type: 'collection_observed';
+    diagnostic: 'busy' | 'retry' | 'idle_unknown' | 'host_unavailable' | 'probe_error' | 'wait_expired';
+    pendingLaneIds: readonly string[];
+    boundedDetail?: string | undefined;
+} | {
+    type: 'lane_structured_result_submitted';
+    batchId: string;
+    laneId: string;
+    generation: number;
+    semanticEnvelopeDigest: string;
+    outcome: 'CLEAN' | 'FINDINGS' | 'INCOMPLETE';
+    existingReceiptDigest?: string | undefined;
+} | {
+    type: 'transcript_evidence_presented';
+    batchId: string;
+    laneId: string;
+    laneHasStructuredReceipt: boolean;
+} | {
+    type: 'provider_terminal_observed';
+    batchId: string;
+    laneId: string;
+    generation: number;
+    evidence: {
+        source: 'typed_terminal_error_class';
+        category: string;
+        kind: string;
+    } | {
+        source: 'observer_deadline';
+    } | {
+        source: 'client_unavailable';
+    } | {
+        source: 'parser_or_transcript';
+    } | {
+        source: 'stale_observation';
+    };
+} | {
+    type: 'lane_cancelled';
+    batchId: string;
+    laneId: string;
+    generation: number;
+} | {
+    type: 'circuit_advance_requested';
+    nowMs: number;
+    laneSignals: readonly PrReviewCircuitSignal[];
+    probeObservation?: {
+        terminalStatus: string;
+        signal: PrReviewCircuitSignal | null;
+        terminalAtMs: number;
+    } | undefined;
+    admission?: {
+        batchId: string;
+        laneId: string;
+    } | undefined;
+    policy: PrReviewResiliencePolicyRecord;
+} | {
+    type: 'circuit_probe_settled';
+    outcome: PrReviewCircuitProbeOutcome;
+    nowMs: number;
+    policy: PrReviewResiliencePolicyRecord;
+} | {
+    type: 'resilience_config_changed';
+    enabled: boolean;
+    policy?: import('../config/schema.js').PrReviewResilienceConfig | undefined;
+    nowMs: number;
+} | {
+    type: 'coverage_finalization_requested';
+    settlement: PrReviewCoverageSettlementInput;
+    requestedVerdict?: PrReviewReportVerdict;
+} | {
+    type: 'critic_result_recorded';
+    criticRequiredFindingIds: readonly string[];
+    criticConfirmedFindingIds: readonly string[];
+} | {
+    type: 'publication_armed';
+    coverageKind: PrReviewTerminalCoverageKind;
+    verdict: PrReviewReportVerdict;
+} | {
+    type: 'publication_published';
+    binding: PrReviewAuthorizationBinding;
+} | {
+    type: 'armed_recovery_requested';
+    binding: PrReviewAuthorizationBinding;
+    dimensionsToCancel: PrReviewBaseDimensionId[];
+    nowIso: string;
+} | {
+    type: 'reviewer_authorization_consumed';
+    binding: PrReviewAuthorizationBinding;
+    expectedRole: 'reviewer' | 'test_engineer';
+    role: 'reviewer' | 'test_engineer';
+};
+/**
+ * The exact-identity binding an armed recovery, publication, or re-entry
+ * authorization must carry (issue #2383/#2385). Stale or foreign values are
+ * rejected with `stale_foreign_authorization`.
+ */
+export interface PrReviewAuthorizationBinding {
+    sessionID: string;
+    workflowInstanceId?: string | undefined;
+    prHeadSha: string;
+    revisionDigest?: string;
+    generation: number;
+}
+export type PrReviewTransitionRejectionCode = 'observer_deadline_not_terminal_evidence' | 'client_absence_not_terminal_evidence' | 'parser_failure_not_provider_signal' | 'stale_observation_not_provider_signal' | 'live_lane_blocks_coverage' | 'partial_coverage_cannot_approve' | 'no_coverage_cannot_approve' | 'critic_required_unfulfilled' | 'stale_foreign_authorization' | 'stale_generation_result' | 'receipt_cannot_be_downgraded' | 'duplicate_conflicting_result' | 'base_batch_limit_reached' | 'rollback_preconditions_failed' | 'lane_not_stale_eligible' | 'unknown_event';
+export interface PrReviewTransitionRejection {
+    code: PrReviewTransitionRejectionCode;
+    detail: string;
+}

package/dist/telemetry.d.ts

@@ -32,7 +32,7 @@ export type TelemetryEvent = 'session_started' | 'session_ended' | 'agent_activa
  * `prm_hard_stop` TRIGGER emitted by `src/prm/escalation.ts`. A trigger with
  * no matching delivery means the containment never reached the agent.
  */
- | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health' | 'shell_audit_health' | 'trajectory_health' | 'learning_health_alarm' | 'pr_subscription_health';
+ | 'prm_hard_stop_delivered' | 'agent_conflict_detected' | 'close_archive_result' | 'knowledge_receipt_transition' | 'knowledge_maintenance' | 'residue_health' | 'context_telemetry_health' | 'skill_usage_health' | 'core_events_health' | 'shell_audit_health' | 'trajectory_health' | 'learning_health_alarm' | 'pr_subscription_health' | 'council_attempt' | 'council_round_transition' | 'council_attempt_unscoped';
 /** Stable classification for how a reviewer-gate decision was established. */
 export type ReviewerGateEvidenceKind = 'genuine' | 'fallback' | 'data_quality' | 'block';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.162.0",
+	"version": "7.163.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/curator-llm-factory-g65xmh8f.js

@@ -1,67 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-2rhs7j4r.js";
-import"./index-acnwj4pc.js";
-import"./index-tjaawnws.js";
-import"./index-z4n60b0a.js";
-import"./index-8vwe2qjh.js";
-import"./index-jw7z3gem.js";
-import"./index-txdagbh7.js";
-import"./index-n249fbw7.js";
-import"./index-3146wmgv.js";
-import"./index-sjkxrf06.js";
-import"./index-0h63swrc.js";
-import"./index-3gwkmq53.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-bdmg6yvj.js";
-import"./index-zsrtt42s.js";
-import"./index-r7rn6e5f.js";
-import"./index-3f7hqtgg.js";
-import"./index-9wrmzsnk.js";
-import"./index-77syzssw.js";
-import"./index-ydbd41sv.js";
-import"./index-rtry5xyf.js";
-import"./index-vcv9m2q5.js";
-import"./index-6w468bjy.js";
-import"./index-vkaqrrsc.js";
-import"./index-ddszzne4.js";
-import"./index-mfewnd7j.js";
-import"./index-pde4zn7j.js";
-import"./index-kk9yk7an.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-4wmpv2kn.js";
-import"./index-qw893zqp.js";
-import"./index-5wq0dd30.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import"./index-dtn0pne5.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-tnj464kq.js";
-import"./index-2ze7yqm8.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-80pmq6q2.js";
-import"./index-9xd073d4.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-7z9gyts0.js";
-import"./index-db520vnn.js";
-import"./index-bk5tah7q.js";
-import"./index-nqbqkx4c.js";
-import"./index-q87ht62k.js";
-import"./index-ed5ykebp.js";
-import"./index-fx3em0dr.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};

package/dist/cli/guardrail-explain-s0dzn8c6.js

@@ -1,68 +0,0 @@
-// @bun
-import {
-  handleGuardrailExplain
-} from "./index-1mbwgw4p.js";
-import"./index-2rhs7j4r.js";
-import"./index-acnwj4pc.js";
-import"./index-tjaawnws.js";
-import"./index-z4n60b0a.js";
-import"./index-8vwe2qjh.js";
-import"./index-jw7z3gem.js";
-import"./index-txdagbh7.js";
-import"./index-n249fbw7.js";
-import"./index-3146wmgv.js";
-import"./index-sjkxrf06.js";
-import"./index-0h63swrc.js";
-import"./index-3gwkmq53.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-bdmg6yvj.js";
-import"./index-zsrtt42s.js";
-import"./index-r7rn6e5f.js";
-import"./index-3f7hqtgg.js";
-import"./index-9wrmzsnk.js";
-import"./index-77syzssw.js";
-import"./index-ydbd41sv.js";
-import"./index-rtry5xyf.js";
-import"./index-vcv9m2q5.js";
-import"./index-6w468bjy.js";
-import"./index-vkaqrrsc.js";
-import"./index-ddszzne4.js";
-import"./index-mfewnd7j.js";
-import"./index-pde4zn7j.js";
-import"./index-kk9yk7an.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-4wmpv2kn.js";
-import"./index-qw893zqp.js";
-import"./index-5wq0dd30.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import"./index-dtn0pne5.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-tnj464kq.js";
-import"./index-2ze7yqm8.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-80pmq6q2.js";
-import"./index-9xd073d4.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-7z9gyts0.js";
-import"./index-db520vnn.js";
-import"./index-bk5tah7q.js";
-import"./index-nqbqkx4c.js";
-import"./index-q87ht62k.js";
-import"./index-ed5ykebp.js";
-import"./index-fx3em0dr.js";
-import"./index-7g4c7s5r.js";
-import"./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  handleGuardrailExplain
-};

package/dist/cli/pr-review-reentry-authorization-b7ceja9y.js

@@ -1,301 +0,0 @@
-// @bun
-import {
-  prWorkflowSessionFileStem,
-  readPrReviewReentryBindingContext
-} from "./index-2rhs7j4r.js";
-import"./index-acnwj4pc.js";
-import"./index-tjaawnws.js";
-import"./index-z4n60b0a.js";
-import"./index-8vwe2qjh.js";
-import"./index-jw7z3gem.js";
-import"./index-txdagbh7.js";
-import"./index-n249fbw7.js";
-import"./index-3146wmgv.js";
-import"./index-sjkxrf06.js";
-import"./index-0h63swrc.js";
-import"./index-3gwkmq53.js";
-import"./index-70ha9e09.js";
-import"./index-c8s9a3zh.js";
-import"./index-9ss2m4rs.js";
-import"./index-bdmg6yvj.js";
-import"./index-zsrtt42s.js";
-import"./index-r7rn6e5f.js";
-import"./index-3f7hqtgg.js";
-import"./index-9wrmzsnk.js";
-import"./index-77syzssw.js";
-import"./index-ydbd41sv.js";
-import"./index-rtry5xyf.js";
-import"./index-vcv9m2q5.js";
-import"./index-6w468bjy.js";
-import {
-  PrReviewRunIdSchema
-} from "./index-vkaqrrsc.js";
-import"./index-ddszzne4.js";
-import"./index-mfewnd7j.js";
-import"./index-pde4zn7j.js";
-import"./index-kk9yk7an.js";
-import"./index-556ja8an.js";
-import"./index-4fwbbad3.js";
-import"./index-b43rt5ph.js";
-import"./index-q7sjgr1y.js";
-import"./index-4wmpv2kn.js";
-import"./index-qw893zqp.js";
-import"./index-5wq0dd30.js";
-import"./index-zg9d392c.js";
-import"./index-n832052r.js";
-import {
-  validateSwarmPath
-} from "./index-dtn0pne5.js";
-import"./index-z6xqpmqg.js";
-import"./index-r3mvsbtq.js";
-import"./index-tnj464kq.js";
-import"./index-2ze7yqm8.js";
-import"./index-9e6fdz2h.js";
-import"./index-4rhhvd1a.js";
-import"./index-80pmq6q2.js";
-import"./index-9xd073d4.js";
-import"./index-zjygnfay.js";
-import"./index-ae75rja9.js";
-import"./index-7z9gyts0.js";
-import"./index-db520vnn.js";
-import"./index-bk5tah7q.js";
-import"./index-nqbqkx4c.js";
-import"./index-q87ht62k.js";
-import"./index-ed5ykebp.js";
-import"./index-fx3em0dr.js";
-import {
-  require_proper_lockfile
-} from "./index-7g4c7s5r.js";
-import {
-  exports_external,
-  init_zod
-} from "./index-bpmtbmy9.js";
-import"./index-zgwm4ryv.js";
-import {
-  __toESM
-} from "./index-a76rekgs.js";
-
-// src/hooks/pr-review-reentry-authorization.ts
-init_zod();
-var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import { randomUUID } from "crypto";
-import * as fsp from "fs/promises";
-import * as path from "path";
-var AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
-var MAX_ACTIVE_AUTHORIZATIONS = 8;
-var MAX_PERSISTED_AUTHORIZATIONS = 32;
-var REENTRY_AUTHORIZATIONS_MAX_BYTES = 64 * 1024;
-var PrReviewReentryAuthorizationRecordSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  authorizationId: exports_external.string().min(1).max(64),
-  sessionId: exports_external.string().min(1).max(256),
-  workflowInstanceId: exports_external.string().min(1).max(128).optional(),
-  runId: PrReviewRunIdSchema.optional(),
-  prHeadSha: exports_external.string().regex(/^[0-9a-f]{6,64}$/i),
-  revisionDigest: exports_external.string().min(1).max(256),
-  role: exports_external.enum(["reviewer", "test_engineer"]),
-  generation: exports_external.number().int().nonnegative(),
-  createdAt: exports_external.string().datetime(),
-  expiresAt: exports_external.string().datetime(),
-  consumedAt: exports_external.string().datetime().optional(),
-  consumedCallId: exports_external.string().min(1).max(128).optional()
-}).strict();
-var AuthorizationFileSchema = exports_external.object({
-  schemaVersion: exports_external.literal(1),
-  sessionId: exports_external.string().min(1).max(256),
-  authorizations: exports_external.array(PrReviewReentryAuthorizationRecordSchema).max(MAX_PERSISTED_AUTHORIZATIONS)
-}).strict();
-function reentryAuthorizationFilePath(directory, sessionID) {
-  const relative = path.join("pr-review", "reentry-authorizations", `${prWorkflowSessionFileStem(sessionID)}.json`);
-  return validateSwarmPath(directory, relative);
-}
-async function readAuthorizationFile(filePath) {
-  let raw;
-  try {
-    const stat2 = await fsp.stat(filePath);
-    if (!stat2.isFile() || stat2.size > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-      throw new Error("reentry authorization store is not a bounded regular file");
-    }
-    raw = await fsp.readFile(filePath, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return null;
-    throw error;
-  }
-  const decoded = JSON.parse(raw);
-  const parsed = AuthorizationFileSchema.safeParse(decoded);
-  if (!parsed.success) {
-    throw new Error(`reentry authorization store is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}`);
-  }
-  return parsed.data;
-}
-var RENAME_RETRY_DELAYS_MS = [10, 25, 50, 100, 200];
-var RETRYABLE_RENAME_CODES = new Set(["EPERM", "EBUSY", "EACCES", "EEXIST"]);
-async function renameWithRetryAsync(tempPath, targetPath) {
-  let lastError;
-  for (let attempt = 0;attempt <= _internals.renameRetryDelaysMs.length; attempt++) {
-    try {
-      await _internals.renameImpl(tempPath, targetPath);
-      return;
-    } catch (err) {
-      lastError = err;
-      const code = err?.code;
-      if (!code || !RETRYABLE_RENAME_CODES.has(code))
-        throw err;
-      if (attempt < _internals.renameRetryDelaysMs.length) {
-        await new Promise((resolve) => setTimeout(resolve, _internals.renameRetryDelaysMs[attempt]));
-      }
-    }
-  }
-  throw lastError;
-}
-async function writeAuthorizationFile(filePath, file) {
-  const serialized = `${JSON.stringify(file, null, 2)}
-`;
-  if (Buffer.byteLength(serialized, "utf8") > REENTRY_AUTHORIZATIONS_MAX_BYTES) {
-    throw new Error("reentry authorization store exceeds its write bound");
-  }
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  const tempPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${randomUUID()}.tmp`);
-  try {
-    await fsp.writeFile(tempPath, serialized, { encoding: "utf8", flag: "wx" });
-    await renameWithRetryAsync(tempPath, filePath);
-  } finally {
-    await fsp.rm(tempPath, { force: true }).catch(() => {
-      return;
-    });
-  }
-}
-function pruneAuthorizations(records, nowMs) {
-  const kept = [];
-  for (const record of [...records].sort((left, right) => right.createdAt.localeCompare(left.createdAt)).slice(0, MAX_PERSISTED_AUTHORIZATIONS)) {
-    if (record.consumedAt)
-      continue;
-    if (Date.parse(record.expiresAt) <= nowMs)
-      continue;
-    kept.push(record);
-  }
-  return kept;
-}
-var lf = import_proper_lockfile.default;
-async function withAuthorizationLock(filePath, write) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  const release = await lf.lock(path.dirname(filePath), {
-    lockfilePath: `${filePath}.lock`,
-    retries: { retries: 8, minTimeout: 10, maxTimeout: 100 },
-    stale: 1e4,
-    update: 1000,
-    realpath: false
-  });
-  try {
-    return await write();
-  } finally {
-    await release().catch(() => {
-      return;
-    });
-  }
-}
-async function issuePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession) {
-    throw new Error("BLOCKED: re-entry authorization requires an active sessionID");
-  }
-  const binding = await readPrReviewReentryBindingContext(directory, trimmedSession);
-  if (!binding || binding.prHeadSha !== request.prHeadSha.toLowerCase()) {
-    throw new Error(`BLOCKED: re-entry authorization requires an active PR_REVIEW workflow bound to the declared head (active: ${binding?.prHeadSha ?? "(none)"})`);
-  }
-  if (request.runId && binding.runId && request.runId !== binding.runId) {
-    throw new Error("BLOCKED: re-entry authorization run does not match the active PR-review run");
-  }
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  return withAuthorizationLock(filePath, async () => {
-    const existing = await readAuthorizationFile(filePath);
-    const nowMs = Date.now();
-    const now = new Date(nowMs).toISOString();
-    const records = pruneAuthorizations(existing?.authorizations ?? [], nowMs);
-    const active = records.filter((record2) => !record2.consumedAt && record2.role === request.role && record2.generation === binding.generation);
-    if (active.length > 0) {
-      throw new Error(`BLOCKED: an unconsumed re-entry authorization for role "${request.role}" at generation ${binding.generation} already exists; use it (one immediate Task dispatch) before issuing another`);
-    }
-    if (records.length >= MAX_ACTIVE_AUTHORIZATIONS) {
-      throw new Error(`BLOCKED: re-entry authorization store is at its bound of ${MAX_ACTIVE_AUTHORIZATIONS} active authorizations`);
-    }
-    const record = {
-      schemaVersion: 1,
-      authorizationId: randomUUID(),
-      sessionId: trimmedSession,
-      ...binding.workflowInstanceId ? { workflowInstanceId: binding.workflowInstanceId } : {},
-      ...binding.runId ? { runId: binding.runId } : {},
-      prHeadSha: binding.prHeadSha,
-      revisionDigest: binding.revisionDigest,
-      role: request.role,
-      generation: binding.generation,
-      createdAt: now,
-      expiresAt: new Date(nowMs + AUTHORIZATION_TTL_MS).toISOString()
-    };
-    await writeAuthorizationFile(filePath, {
-      schemaVersion: 1,
-      sessionId: trimmedSession,
-      authorizations: [record, ...records]
-    });
-    return record;
-  });
-}
-async function consumePrReviewReentryAuthorization(directory, sessionID, request) {
-  const trimmedSession = sessionID.trim();
-  if (!trimmedSession)
-    return null;
-  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
-  try {
-    return await withAuthorizationLock(filePath, async () => {
-      const existing = await readAuthorizationFile(filePath);
-      if (!existing)
-        return null;
-      const nowMs = Date.now();
-      const records = pruneAuthorizations(existing.authorizations, nowMs);
-      const index = records.findIndex((record) => !record.consumedAt && record.role === request.role && record.sessionId === trimmedSession && Date.parse(record.expiresAt) > nowMs);
-      if (index < 0) {
-        if (records.length !== existing.authorizations.length) {
-          await writeAuthorizationFile(filePath, {
-            ...existing,
-            authorizations: records
-          });
-        }
-        return null;
-      }
-      const binding = await readPrReviewReentryBindingContext(directory, trimmedSession);
-      const candidate = records[index];
-      if (!binding || binding.prHeadSha !== candidate.prHeadSha || binding.revisionDigest !== candidate.revisionDigest || binding.generation !== candidate.generation || candidate.workflowInstanceId !== undefined && binding.workflowInstanceId !== candidate.workflowInstanceId || candidate.workflowInstanceId === undefined && binding.workflowInstanceId !== undefined) {
-        return null;
-      }
-      const consumed = {
-        ...candidate,
-        consumedAt: new Date(nowMs).toISOString(),
-        consumedCallId: request.callID
-      };
-      records[index] = consumed;
-      await writeAuthorizationFile(filePath, {
-        ...existing,
-        authorizations: records
-      });
-      return consumed;
-    });
-  } catch {
-    return null;
-  }
-}
-var _internals = {
-  AUTHORIZATION_TTL_MS,
-  MAX_ACTIVE_AUTHORIZATIONS,
-  reentryAuthorizationFilePath,
-  pruneAuthorizations,
-  renameImpl: (from, to) => fsp.rename(from, to),
-  renameRetryDelaysMs: RENAME_RETRY_DELAYS_MS,
-  renameWithRetryAsync,
-  writeAuthorizationFile
-};
-export {
-  issuePrReviewReentryAuthorization,
-  consumePrReviewReentryAuthorization,
-  _internals
-};