@smartergpt/lexrunner 1.0.0 → 1.3.0

package/dist/errors/index.cjs

@@ -0,0 +1,879 @@
+var __lexrunnerImportMetaUrl = require("node:url").pathToFileURL(__filename).href;
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/errors/index.ts
+var errors_exports = {};
+__export(errors_exports, {
+  AXErrorException: () => AXErrorException,
+  AXErrorSchema: () => AXErrorSchema,
+  ErrorCodes: () => ErrorCodes,
+  configInvalidError: () => configInvalidError,
+  createAXError: () => createAXError,
+  cycleDetectedError: () => cycleDetectedError,
+  gateFailedError: () => gateFailedError,
+  gitOperationError: () => gitOperationError,
+  githubApiError: () => githubApiError,
+  isAXError: () => isAXError,
+  isAXErrorException: () => isAXErrorException,
+  mcpToolError: () => mcpToolError,
+  mergeConflictError: () => mergeConflictError,
+  planNotFoundError: () => planNotFoundError,
+  planValidationError: () => planValidationError,
+  profileNotFoundError: () => profileNotFoundError,
+  runNotFoundError: () => runNotFoundError,
+  securityAuthFailedError: () => securityAuthFailedError,
+  securityCommandBlockedError: () => securityCommandBlockedError,
+  securityComplianceViolationError: () => securityComplianceViolationError,
+  securitySarifParseError: () => securitySarifParseError,
+  securityScanFailedError: () => securityScanFailedError,
+  securitySecretDetectedError: () => securitySecretDetectedError,
+  securitySecretNotFoundError: () => securitySecretNotFoundError,
+  securityUnauthorizedError: () => securityUnauthorizedError,
+  throwAXError: () => throwAXError,
+  toAXError: () => toAXError,
+  toolBudgetExceededError: () => toolBudgetExceededError,
+  unknownDependencyError: () => unknownDependencyError,
+  weaveLockConflictError: () => weaveLockConflictError,
+  weavePreflightFailedError: () => weavePreflightFailedError,
+  weaveStateInvalidError: () => weaveStateInvalidError,
+  wrapAsAXError: () => wrapAsAXError,
+  writeProtectionError: () => writeProtectionError
+});
+module.exports = __toCommonJS(errors_exports);
+
+// node_modules/@smartergpt/lex/dist/shared/errors/ax-error.js
+var import_zod = require("zod");
+var AXErrorSchema = import_zod.z.object({
+  /**
+   * Stable error code in UPPER_SNAKE_CASE
+   * Must be unique and documented in error-codes.ts
+   */
+  code: import_zod.z.string().regex(/^[A-Z][A-Z0-9_]*$/, "Error code must be UPPER_SNAKE_CASE (e.g., FRAME_NOT_FOUND)"),
+  /**
+   * Human-readable error message
+   * Should be concise but descriptive
+   */
+  message: import_zod.z.string().min(1, "Message is required"),
+  /**
+   * Optional structured context about the error
+   * Include relevant IDs, paths, or values that help diagnose
+   */
+  context: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional(),
+  /**
+   * Recovery suggestions - at least one required
+   * These tell the agent what to try next
+   */
+  nextActions: import_zod.z.array(import_zod.z.string().min(1)).min(1, "At least one nextAction is required")
+});
+function isAXError(value) {
+  return AXErrorSchema.safeParse(value).success;
+}
+function createAXError(code, message, nextActions, context) {
+  return AXErrorSchema.parse({ code, message, nextActions, context });
+}
+function wrapAsAXError(error, code, nextActions, additionalContext) {
+  return createAXError(code, error.message, nextActions, {
+    originalError: error.name,
+    stack: error.stack?.split("\n").slice(0, 5),
+    ...additionalContext
+  });
+}
+var AXErrorException = class extends Error {
+  constructor(code, message, nextActions, context) {
+    super(message);
+    __publicField(this, "axError");
+    this.name = "AXErrorException";
+    this.axError = createAXError(code, message, nextActions, context);
+  }
+  /**
+   * Get the structured error for JSON output
+   */
+  toAXError() {
+    return this.axError;
+  }
+  /**
+   * Serialize to JSON (for CLI --json output)
+   */
+  toJSON() {
+    return this.axError;
+  }
+};
+function isAXErrorException(error) {
+  return error instanceof AXErrorException;
+}
+
+// node_modules/@smartergpt/lex/dist/shared/errors/error-codes.js
+var CONFIG_ERROR_CODES = {
+  /** lex.yaml not found after workspace is initialized */
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  /** lex.yaml exists but has invalid YAML syntax */
+  CONFIG_PARSE_ERROR: "CONFIG_PARSE_ERROR",
+  /** lex.yaml exists but fails schema validation */
+  CONFIG_INVALID: "CONFIG_INVALID"
+};
+var POLICY_ERROR_CODES = {
+  /** No policy file found in any search path */
+  POLICY_NOT_FOUND: "POLICY_NOT_FOUND",
+  /** Policy file exists but has invalid JSON */
+  POLICY_PARSE_ERROR: "POLICY_PARSE_ERROR",
+  /** Policy file fails schema validation */
+  POLICY_INVALID: "POLICY_INVALID",
+  /** Policy module ID not found */
+  POLICY_MODULE_NOT_FOUND: "POLICY_MODULE_NOT_FOUND"
+};
+var STORE_ERROR_CODES = {
+  /** Database connection failed */
+  DB_CONNECTION_FAILED: "DB_CONNECTION_FAILED",
+  /** Database query failed */
+  DB_QUERY_FAILED: "DB_QUERY_FAILED",
+  /** Database migration failed */
+  DB_MIGRATION_FAILED: "DB_MIGRATION_FAILED",
+  /** Frame not found by ID */
+  FRAME_NOT_FOUND: "FRAME_NOT_FOUND",
+  /** Frame validation failed */
+  FRAME_INVALID: "FRAME_INVALID",
+  /** Frame save operation failed */
+  FRAME_SAVE_FAILED: "FRAME_SAVE_FAILED",
+  /** Store initialization failed */
+  STORE_INIT_FAILED: "STORE_INIT_FAILED"
+};
+var PROMPT_ERROR_CODES = {
+  /** Prompt file not found in any search path */
+  PROMPT_NOT_FOUND: "PROMPT_NOT_FOUND",
+  /** Prompt template has invalid syntax */
+  PROMPT_INVALID: "PROMPT_INVALID",
+  /** Prompt rendering failed (missing variables, etc.) */
+  PROMPT_RENDER_FAILED: "PROMPT_RENDER_FAILED"
+};
+var SCHEMA_ERROR_CODES = {
+  /** Schema file not found */
+  SCHEMA_NOT_FOUND: "SCHEMA_NOT_FOUND",
+  /** Schema file has invalid JSON */
+  SCHEMA_PARSE_ERROR: "SCHEMA_PARSE_ERROR",
+  /** Data failed schema validation */
+  SCHEMA_VALIDATION_FAILED: "SCHEMA_VALIDATION_FAILED"
+};
+var INSTRUCTIONS_ERROR_CODES = {
+  /** Canonical instruction file not found */
+  INSTRUCTIONS_CANONICAL_NOT_FOUND: "INSTRUCTIONS_CANONICAL_NOT_FOUND",
+  /** Target file already exists (without --force) */
+  INSTRUCTIONS_TARGET_EXISTS: "INSTRUCTIONS_TARGET_EXISTS",
+  /** Invalid projection target specified */
+  INSTRUCTIONS_INVALID_TARGET: "INSTRUCTIONS_INVALID_TARGET",
+  /** Instruction projections out of sync */
+  INSTRUCTIONS_OUT_OF_SYNC: "INSTRUCTIONS_OUT_OF_SYNC"
+};
+var GIT_ERROR_CODES = {
+  /** Not in a git repository */
+  GIT_NOT_REPO: "GIT_NOT_REPO",
+  /** Git command failed */
+  GIT_COMMAND_FAILED: "GIT_COMMAND_FAILED",
+  /** Git branch not found */
+  GIT_BRANCH_NOT_FOUND: "GIT_BRANCH_NOT_FOUND"
+};
+var LEXSONA_ERROR_CODES = {
+  /** Rule not found by ID */
+  LEXSONA_RULE_NOT_FOUND: "LEXSONA_RULE_NOT_FOUND",
+  /** Correction could not be recorded */
+  LEXSONA_CORRECTION_FAILED: "LEXSONA_CORRECTION_FAILED",
+  /** Persona not found */
+  LEXSONA_PERSONA_NOT_FOUND: "LEXSONA_PERSONA_NOT_FOUND"
+};
+var VALIDATION_ERROR_CODES = {
+  /** Required field is missing */
+  VALIDATION_REQUIRED_FIELD: "VALIDATION_REQUIRED_FIELD",
+  /** Field has invalid type */
+  VALIDATION_INVALID_TYPE: "VALIDATION_INVALID_TYPE",
+  /** Field value is out of range */
+  VALIDATION_OUT_OF_RANGE: "VALIDATION_OUT_OF_RANGE",
+  /** Module ID format is invalid */
+  VALIDATION_INVALID_MODULE_ID: "VALIDATION_INVALID_MODULE_ID"
+};
+var WORKSPACE_AUTHORITY_ERROR_CODES = {
+  /** No trusted local binding matched the invocation. */
+  WORKSPACE_UNBOUND: "LEX_WORKSPACE_UNBOUND",
+  /** Repository declaration, provider, path, or registry evidence disagreed. */
+  REPOSITORY_BINDING_MISMATCH: "LEX_REPOSITORY_BINDING_MISMATCH",
+  /** The requested workspace selector was not authorized for the principal. */
+  WORKSPACE_SELECTOR_UNAUTHORIZED: "LEX_WORKSPACE_SELECTOR_UNAUTHORIZED",
+  /** More than one binding matched without deterministic disambiguation. */
+  WORKSPACE_BINDING_AMBIGUOUS: "LEX_WORKSPACE_BINDING_AMBIGUOUS",
+  /** Cached canonical authority expired before it could be reverified. */
+  AUTHORITY_CACHE_EXPIRED: "LEX_AUTHORITY_CACHE_EXPIRED",
+  /** Canonical authority revoked the previously verified grant. */
+  AUTHORITY_GRANT_REVOKED: "LEX_AUTHORITY_GRANT_REVOKED"
+};
+var LEX_ERROR_CODES = {
+  ...CONFIG_ERROR_CODES,
+  ...POLICY_ERROR_CODES,
+  ...STORE_ERROR_CODES,
+  ...PROMPT_ERROR_CODES,
+  ...SCHEMA_ERROR_CODES,
+  ...INSTRUCTIONS_ERROR_CODES,
+  ...GIT_ERROR_CODES,
+  ...LEXSONA_ERROR_CODES,
+  ...VALIDATION_ERROR_CODES,
+  ...WORKSPACE_AUTHORITY_ERROR_CODES
+};
+
+// node_modules/@smartergpt/lex/dist/shared/errors/compact-error.js
+var import_zod2 = require("zod");
+var CompactErrorEnvelopeSchema = import_zod2.z.object({
+  err: import_zod2.z.object({
+    code: import_zod2.z.string(),
+    msg: import_zod2.z.string(),
+    retry: import_zod2.z.boolean(),
+    hintId: import_zod2.z.string().optional()
+  })
+});
+
+// src/errors/adapters.ts
+function gateFailedError(ctx) {
+  const nextActions = [];
+  if (ctx.artifactPath) {
+    nextActions.push(`Check gate output in ${ctx.artifactPath}`);
+  }
+  switch (ctx.gate) {
+    case "lint":
+      nextActions.push("Run 'npm run lint' locally to reproduce");
+      nextActions.push("Fix lint errors and push again");
+      break;
+    case "typecheck":
+      nextActions.push("Run 'npm run typecheck' locally to reproduce");
+      nextActions.push("Fix TypeScript errors and push again");
+      break;
+    case "test":
+      nextActions.push("Run 'npm test' locally to reproduce");
+      nextActions.push("Check for flaky tests or missing test fixtures");
+      break;
+    default:
+      nextActions.push(`Run the '${ctx.gate}' gate locally to reproduce`);
+  }
+  if (nextActions.length === 0) {
+    nextActions.push("Review the gate failure output for details");
+  }
+  return createAXError(
+    ErrorCodes.GATE_FAILED,
+    `Gate '${ctx.gate}'${ctx.item ? ` failed for ${ctx.item}` : " failed"}`,
+    nextActions,
+    {
+      ...ctx,
+      // Default gates to reversible since they don't mutate state
+      reversibility: ctx.reversibility ?? "reversible"
+    }
+  );
+}
+function mergeConflictError(ctx) {
+  const nextActions = ["Resolve conflicts manually in the affected files"];
+  if (ctx.targetBranch) {
+    nextActions.push(`Rebase ${ctx.item || "the PR"} on ${ctx.targetBranch}`);
+  } else {
+    nextActions.push("Rebase on the latest target branch");
+  }
+  if (ctx.files && ctx.files.length > 0) {
+    nextActions.push(`Affected files: ${ctx.files.join(", ")}`);
+  }
+  return createAXError(
+    ErrorCodes.MERGE_CONFLICT,
+    `Merge conflict${ctx.item ? ` for ${ctx.item}` : ""}`,
+    nextActions,
+    {
+      ...ctx,
+      // Merges are reversible via git reset or merge --abort
+      reversibility: ctx.reversibility ?? "reversible",
+      rollbackPath: ctx.rollbackPath ?? "git merge --abort or git reset --hard HEAD~1"
+    }
+  );
+}
+function cycleDetectedError(ctx) {
+  return createAXError(
+    ErrorCodes.PLAN_CYCLE_DETECTED,
+    `Dependency cycle detected: ${ctx.cycle.join(" \u2192 ")}`,
+    [
+      "Review the dependency declarations in the affected PRs",
+      "Remove or restructure dependencies to break the cycle",
+      `Cycle path: ${ctx.cycle.join(" \u2192 ")}`
+    ],
+    { ...ctx }
+  );
+}
+function unknownDependencyError(ctx) {
+  const nextActions = [
+    `Check that '${ctx.dependency}' is included in the plan`,
+    `Verify the dependency reference in '${ctx.item}'`
+  ];
+  if (ctx.availableItems && ctx.availableItems.length > 0) {
+    nextActions.push(`Available items: ${ctx.availableItems.join(", ")}`);
+  }
+  return createAXError(
+    ErrorCodes.UNKNOWN_DEPENDENCY,
+    `Item '${ctx.item}' depends on unknown item '${ctx.dependency}'`,
+    nextActions,
+    { ...ctx }
+  );
+}
+function githubApiError(ctx) {
+  const nextActions = [];
+  if (ctx.status === 401 || ctx.status === 403) {
+    return createAXError(
+      ErrorCodes.GITHUB_AUTH_ERROR,
+      ctx.message || "GitHub authentication failed",
+      [
+        "Check that GITHUB_TOKEN is set and valid",
+        "Verify the token has required permissions",
+        "Try: gh auth status"
+      ],
+      { ...ctx }
+    );
+  }
+  if (ctx.status === 429 || ctx.retryAfter) {
+    const waitTime = ctx.retryAfter ? `${ctx.retryAfter} seconds` : "a few minutes";
+    return createAXError(
+      ErrorCodes.GITHUB_RATE_LIMIT,
+      "GitHub API rate limit exceeded",
+      [
+        `Wait ${waitTime} before retrying`,
+        "Consider using a GitHub App token for higher limits",
+        "Reduce API call frequency"
+      ],
+      { ...ctx }
+    );
+  }
+  nextActions.push("Check the GitHub API status page");
+  if (ctx.endpoint) {
+    nextActions.push(`Failed endpoint: ${ctx.endpoint}`);
+  }
+  nextActions.push("Retry the operation after a brief wait");
+  return createAXError(
+    ErrorCodes.GITHUB_API_ERROR,
+    ctx.message || "GitHub API request failed",
+    nextActions,
+    { ...ctx }
+  );
+}
+function gitOperationError(ctx) {
+  return createAXError(
+    ErrorCodes.GIT_OPERATION_FAILED,
+    ctx.message || `Git ${ctx.operation} failed`,
+    [
+      "Check git status for uncommitted changes",
+      "Ensure you're on the correct branch",
+      ctx.command ? `Command that failed: ${ctx.command}` : "Review git output for details"
+    ],
+    { ...ctx }
+  );
+}
+function planValidationError(ctx) {
+  const nextActions = ["Review the plan file for schema violations"];
+  const errorCount = ctx.errorCount ?? ctx.errors.length;
+  if (ctx.planPath) {
+    nextActions.push(`Plan file: ${ctx.planPath}`);
+  }
+  if (ctx.errors.length > 0) {
+    nextActions.push(`Errors: ${ctx.errors.join("; ")}`);
+  }
+  if (ctx.errorsTruncated) {
+    nextActions.push(
+      `Only the first ${ctx.errors.length} of ${errorCount} validation errors are included`
+    );
+  }
+  return createAXError(
+    ErrorCodes.PLAN_VALIDATION_FAILED,
+    `Plan validation failed with ${errorCount} error(s)`,
+    nextActions,
+    { ...ctx, errorCount, errorsTruncated: ctx.errorsTruncated ?? false }
+  );
+}
+function toAXError(error, code = ErrorCodes.INTERNAL_ERROR, nextActions) {
+  return createAXError(
+    code,
+    error.message,
+    nextActions || ["Review the error details and retry", "Check logs for more context"],
+    {
+      originalError: error.name,
+      stack: error.stack?.split("\n").slice(0, 3)
+    }
+  );
+}
+function mcpToolError(code, message, ctx, nextActions) {
+  const actions = nextActions || [];
+  if (actions.length === 0) {
+    switch (ctx.tool) {
+      case "plan.create":
+        actions.push("Check if configuration files exist in the profile directory");
+        actions.push("Run 'local.init' to create missing configuration");
+        break;
+      case "gates.run":
+        actions.push("Ensure plan.json exists - run 'plan.create' first");
+        actions.push("Check gate commands are valid and available");
+        break;
+      case "merge.apply":
+        actions.push("Set ALLOW_MUTATIONS=true to enable merge operations");
+        actions.push("Use dryRun=true to preview without mutations");
+        break;
+      case "discover":
+        actions.push("Check GITHUB_TOKEN is set and valid");
+        actions.push("Provide owner and repo parameters explicitly");
+        break;
+      case "status":
+        actions.push("Ensure plan.json exists");
+        actions.push("Run 'plan.create' to generate a plan");
+        break;
+      case "merge-order":
+        actions.push("Ensure plan.json exists and is valid");
+        actions.push("Check for dependency cycles in the plan");
+        break;
+      default:
+        actions.push("Review the error details and retry");
+        actions.push("Check MCP server logs for more context");
+    }
+  }
+  return createAXError(code, message, actions, {
+    tool: ctx.tool,
+    operation: ctx.operation,
+    ...ctx.details
+  });
+}
+function planNotFoundError(planFile) {
+  return createAXError(
+    ErrorCodes.PLAN_NOT_FOUND,
+    planFile ? `Plan file not found: ${planFile}` : "No plan found. Run plan.create first.",
+    [
+      "Run 'plan.create' to generate a plan",
+      planFile ? `Check if ${planFile} exists and is accessible` : "Ensure plan.json exists in the profile runner directory"
+    ],
+    { planFile }
+  );
+}
+function profileNotFoundError(profileDir) {
+  return createAXError(
+    ErrorCodes.PROFILE_NOT_FOUND,
+    profileDir ? `Profile directory not found: ${profileDir}` : "No profile directory found",
+    [
+      "Run 'local.init' to create a local profile",
+      "Set LEX_PR_PROFILE_DIR environment variable",
+      "Ensure .smartergpt/ or .smartergpt.local/ exists"
+    ],
+    { profileDir }
+  );
+}
+function configInvalidError(message, details) {
+  return createAXError(
+    ErrorCodes.CONFIG_INVALID,
+    message,
+    [
+      "Check configuration file syntax",
+      "Ensure all required fields are present",
+      "Validate against the schema with 'lex-pr schema validate'"
+    ],
+    details
+  );
+}
+function writeProtectionError(message, operation) {
+  return createAXError(
+    ErrorCodes.WRITE_PROTECTION_ERROR,
+    message,
+    [
+      "Use a local overlay profile (.smartergpt.local/) for write operations",
+      "Set role to 'local' or 'ci' in manifest.yaml",
+      "Run 'local.init' to create a writable profile"
+    ],
+    { operation }
+  );
+}
+function runNotFoundError(ctx) {
+  return createAXError(
+    ErrorCodes.RUN_NOT_FOUND,
+    `Run not found: ${ctx.runId}`,
+    [
+      "List available runs with: lex-pr runs list",
+      "Check .lexrunner/runs/ directory for artifacts"
+    ],
+    { runId: ctx.runId }
+  );
+}
+function throwAXError(axError) {
+  throw new AXErrorException(axError.code, axError.message, axError.nextActions, axError.context);
+}
+function weaveLockConflictError(ctx) {
+  const nextActions = [];
+  const lockFilePath = ctx.lockFile || "weave-lock.json";
+  if (ctx.lockFile) {
+    nextActions.push(`Remove stale lock with: rm ${ctx.lockFile}`);
+  } else {
+    nextActions.push("Remove stale lock file: rm weave-lock.json");
+  }
+  nextActions.push("Wait for other weave operation to complete");
+  nextActions.push("Verify no concurrent weave processes are running");
+  return createAXError(
+    ErrorCodes.WEAVE_LOCK_CONFLICT,
+    ctx.originalError || "Lock file conflict detected",
+    nextActions,
+    {
+      ...ctx,
+      reversibility: ctx.reversibility ?? "reversible",
+      rollbackPath: ctx.rollbackPath ?? `rm ${lockFilePath}`
+    }
+  );
+}
+function weaveStateInvalidError(ctx) {
+  const nextActions = [
+    `Check current weave state: '${ctx.currentState}'`,
+    "Review available transitions for current state"
+  ];
+  if (ctx.availableEvents && ctx.availableEvents.length > 0) {
+    nextActions.push(`Valid events for current state: ${ctx.availableEvents.join(", ")}`);
+  }
+  nextActions.push("Use 'reset' event to return to idle state if stuck");
+  return createAXError(
+    ErrorCodes.WEAVE_STATE_INVALID,
+    `Invalid transition: cannot apply event '${ctx.event}' in state '${ctx.currentState}'`,
+    nextActions,
+    {
+      ...ctx,
+      reversibility: ctx.reversibility ?? "reversible",
+      rollbackPath: ctx.rollbackPath ?? "Apply 'reset' event to return to idle state"
+    }
+  );
+}
+function weavePreflightFailedError(ctx) {
+  const nextActions = [`Verify branch '${ctx.itemBranch}' exists locally or on remote`];
+  if (ctx.targetBranch) {
+    nextActions.push(`Verify target branch '${ctx.targetBranch}' exists`);
+  }
+  nextActions.push("Run 'git fetch' to update remote references");
+  nextActions.push("Check git repository status with 'git status'");
+  return createAXError(
+    ErrorCodes.WEAVE_PREFLIGHT_FAILED,
+    `Failed to simulate merge for ${ctx.itemBranch}${ctx.originalError ? `: ${ctx.originalError}` : ""}`,
+    nextActions,
+    {
+      ...ctx,
+      // Preflight doesn't change state, so always reversible
+      reversibility: ctx.reversibility ?? "reversible"
+    }
+  );
+}
+function securityAuthFailedError(message, ctx) {
+  return createAXError(
+    ErrorCodes.SECURITY_AUTH_FAILED,
+    message,
+    [
+      "Check that GITHUB_TOKEN is set and valid",
+      "Verify the token has required permissions",
+      "Try: gh auth status"
+    ],
+    { ...ctx }
+  );
+}
+function securityUnauthorizedError(message, ctx) {
+  const nextActions = [];
+  if (ctx?.permission) {
+    nextActions.push(`Request '${ctx.permission}' permission from an administrator`);
+  }
+  if (ctx?.roles && ctx.roles.length > 0) {
+    nextActions.push(`Current roles: ${ctx.roles.join(", ")}`);
+  }
+  if (ctx?.level !== void 0 && ctx?.maxLevel !== void 0) {
+    nextActions.push(`Maximum allowed level: ${ctx.maxLevel}`);
+  }
+  if (nextActions.length === 0) {
+    nextActions.push("Contact an administrator to request access");
+  }
+  nextActions.push("Review role definitions in authorization policy");
+  return createAXError(ErrorCodes.SECURITY_UNAUTHORIZED, message, nextActions, { ...ctx });
+}
+function securityCommandBlockedError(message, ctx) {
+  const nextActions = [];
+  switch (ctx.reason) {
+    case "not_whitelisted":
+      nextActions.push("Add command to .smartergpt/allowed-commands.json if legitimate");
+      nextActions.push("Verify the command is safe and necessary");
+      break;
+    case "dangerous_args":
+      nextActions.push("Remove dangerous arguments from the command");
+      nextActions.push("Review allowed-commands.json deny_args list");
+      break;
+    case "shell_operators":
+      nextActions.push("Shell operators (|, >, <, &&, ||) are not allowed");
+      nextActions.push("Split the command into separate operations");
+      break;
+    case "too_long":
+      nextActions.push("Shorten the command to meet the length limit");
+      nextActions.push("Consider using configuration files for long arguments");
+      break;
+    case "hallucination_threshold":
+      nextActions.push(`Hallucination threshold (${ctx.threshold}) reached`);
+      nextActions.push("Human review required before resuming");
+      nextActions.push("Resume with: lex-pr resume --plan plan.json");
+      break;
+  }
+  return createAXError(ErrorCodes.SECURITY_COMMAND_BLOCKED, message, nextActions, { ...ctx });
+}
+function securityComplianceViolationError(message, ctx) {
+  return createAXError(
+    ErrorCodes.SECURITY_COMPLIANCE_VIOLATION,
+    message,
+    [
+      "Review the compliance requirement documentation",
+      "Ensure signing key is configured if required",
+      "Contact security team for guidance"
+    ],
+    { ...ctx }
+  );
+}
+function securitySecretDetectedError(message, ctx) {
+  return createAXError(
+    ErrorCodes.SECURITY_SECRET_DETECTED,
+    message,
+    [
+      "Remove or rotate the exposed secret immediately",
+      "Use environment variables or a secrets manager instead",
+      "Never commit secrets to source control"
+    ],
+    { ...ctx }
+  );
+}
+function securitySecretNotFoundError(message, ctx) {
+  const nextActions = [];
+  if (ctx?.secretId) {
+    nextActions.push(`Set the '${ctx.secretId}' secret in your environment or secrets manager`);
+  }
+  nextActions.push("Check that required environment variables are configured");
+  nextActions.push("Verify your secrets manager connection if using one");
+  nextActions.push("Review the secrets configuration documentation");
+  return createAXError(ErrorCodes.SECURITY_SECRET_NOT_FOUND, message, nextActions, { ...ctx });
+}
+function securitySarifParseError(message, ctx) {
+  return createAXError(
+    ErrorCodes.SECURITY_SARIF_PARSE_ERROR,
+    message,
+    [
+      "Verify the SARIF file is valid JSON",
+      "Ensure the file follows SARIF 2.1.0 specification",
+      "Check scanner configuration for correct output format"
+    ],
+    { ...ctx }
+  );
+}
+function securityScanFailedError(message, ctx) {
+  const nextActions = [];
+  if (ctx?.scanner === "npm-audit") {
+    nextActions.push("Run 'npm audit' locally to reproduce");
+    nextActions.push("Check if package-lock.json is up to date");
+  } else {
+    nextActions.push("Verify the scanner is installed and configured correctly");
+  }
+  if (ctx?.directory) {
+    nextActions.push(`Check that directory exists: ${ctx.directory}`);
+  }
+  nextActions.push("Review scanner logs for more details");
+  return createAXError(ErrorCodes.SECURITY_SCAN_FAILED, message, nextActions, { ...ctx });
+}
+function toolBudgetExceededError(message, ctx) {
+  const nextActions = [];
+  switch (ctx.violation) {
+    case "tool_denied":
+      nextActions.push(`Tool '${ctx.tool}' is explicitly denied in the executor's tool budget`);
+      nextActions.push("Review the executor manifest's toolBudget.denied list");
+      if (ctx.denied && ctx.denied.length > 0) {
+        nextActions.push(`Denied tools: ${ctx.denied.join(", ")}`);
+      }
+      break;
+    case "tool_not_allowed":
+      nextActions.push(`Tool '${ctx.tool}' is not in the executor's allowed tool list`);
+      nextActions.push("Add the tool to toolBudget.allowed in the executor manifest");
+      if (ctx.allowed && ctx.allowed.length > 0) {
+        nextActions.push(`Allowed tools: ${ctx.allowed.join(", ")}`);
+      }
+      break;
+    case "max_calls_exceeded":
+      nextActions.push(`Maximum tool calls limit (${ctx.limit}) has been reached`);
+      nextActions.push(`Current calls: ${ctx.current}`);
+      nextActions.push("Increase toolBudget.limits.maxToolCalls in the executor manifest");
+      break;
+    case "max_tokens_exceeded":
+      nextActions.push(`Maximum token output limit (${ctx.limit}) would be exceeded`);
+      nextActions.push(`Current tokens: ${ctx.current}`);
+      nextActions.push("Increase toolBudget.limits.maxTokensOut in the executor manifest");
+      break;
+  }
+  return createAXError(ErrorCodes.TOOL_BUDGET_EXCEEDED, message, nextActions, { ...ctx });
+}
+
+// src/errors/index.ts
+var ErrorCodes = {
+  // ─────────────────────────────────────────────────────────────────────────
+  // Gate-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** A gate failed during execution (lint, test, build, etc.) */
+  GATE_FAILED: "GATE_FAILED",
+  /** Requested gate was not found in plan */
+  GATE_NOT_FOUND: "GATE_NOT_FOUND",
+  /** Gate execution timed out */
+  GATE_TIMEOUT: "GATE_TIMEOUT",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Merge-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Git merge conflict detected */
+  MERGE_CONFLICT: "MERGE_CONFLICT",
+  /** Merge is blocked by policy or dependencies */
+  MERGE_BLOCKED: "MERGE_BLOCKED",
+  /** Cycle detected in merge dependency graph */
+  MERGE_CYCLE_DETECTED: "MERGE_CYCLE_DETECTED",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Plan-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Plan failed schema validation */
+  PLAN_VALIDATION_FAILED: "PLAN_VALIDATION_FAILED",
+  /** Plan file not found */
+  PLAN_NOT_FOUND: "PLAN_NOT_FOUND",
+  /** Explicit plan reference is empty, overlong, or otherwise invalid */
+  PLAN_REFERENCE_INVALID: "PLAN_REFERENCE_INVALID",
+  /** Plan reference exists but cannot be read as a bounded regular file */
+  PLAN_UNREADABLE: "PLAN_UNREADABLE",
+  /** Plan exceeds the bounded integration artifact limits */
+  PLAN_ARTIFACT_LIMIT_EXCEEDED: "PLAN_ARTIFACT_LIMIT_EXCEEDED",
+  /** Cycle detected in plan item dependencies */
+  PLAN_CYCLE_DETECTED: "PLAN_CYCLE_DETECTED",
+  /** Referenced dependency not found in plan */
+  UNKNOWN_DEPENDENCY: "UNKNOWN_DEPENDENCY",
+  // ─────────────────────────────────────────────────────────────────────────
+  // GitHub-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** GitHub API request failed */
+  GITHUB_API_ERROR: "GITHUB_API_ERROR",
+  /** GitHub API rate limit exceeded */
+  GITHUB_RATE_LIMIT: "GITHUB_RATE_LIMIT",
+  /** GitHub authentication failed (invalid/expired token) */
+  GITHUB_AUTH_ERROR: "GITHUB_AUTH_ERROR",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Git-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Git operation (checkout, merge, etc.) failed */
+  GIT_OPERATION_FAILED: "GIT_OPERATION_FAILED",
+  /** Git conflict during operation */
+  GIT_CONFLICT: "GIT_CONFLICT",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Weave-related errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Lock file conflict detected (stale or in use) */
+  WEAVE_LOCK_CONFLICT: "WEAVE_LOCK_CONFLICT",
+  /** Invalid state transition in weave state machine */
+  WEAVE_STATE_INVALID: "WEAVE_STATE_INVALID",
+  /** Preflight merge simulation failed */
+  WEAVE_PREFLIGHT_FAILED: "WEAVE_PREFLIGHT_FAILED",
+  /** Merge conflict during weave operation */
+  WEAVE_MERGE_CONFLICT: "WEAVE_MERGE_CONFLICT",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Configuration errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Configuration file is invalid */
+  CONFIG_INVALID: "CONFIG_INVALID",
+  /** Profile directory not found */
+  PROFILE_NOT_FOUND: "PROFILE_NOT_FOUND",
+  /** Write operation blocked by profile protection */
+  WRITE_PROTECTION_ERROR: "WRITE_PROTECTION_ERROR",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Run lifecycle errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Run not found by runId */
+  RUN_NOT_FOUND: "RUN_NOT_FOUND",
+  /** Run is already complete and cannot be modified */
+  RUN_ALREADY_COMPLETE: "RUN_ALREADY_COMPLETE",
+  /** Run state is invalid for the requested operation */
+  RUN_STATE_INVALID: "RUN_STATE_INVALID",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Resource errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Budget limit exceeded */
+  BUDGET_EXCEEDED: "BUDGET_EXCEEDED",
+  /** Tool budget limit exceeded */
+  TOOL_BUDGET_EXCEEDED: "TOOL_BUDGET_EXCEEDED",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Security errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Operation violated security policy */
+  SECURITY_POLICY_VIOLATION: "SECURITY_POLICY_VIOLATION",
+  /** Command failed security validation */
+  COMMAND_VALIDATION_FAILED: "COMMAND_VALIDATION_FAILED",
+  /** Authentication failed */
+  SECURITY_AUTH_FAILED: "SECURITY_AUTH_FAILED",
+  /** User is not authorized for operation */
+  SECURITY_UNAUTHORIZED: "SECURITY_UNAUTHORIZED",
+  /** Command is blocked by security policy */
+  SECURITY_COMMAND_BLOCKED: "SECURITY_COMMAND_BLOCKED",
+  /** Operation violates compliance requirements */
+  SECURITY_COMPLIANCE_VIOLATION: "SECURITY_COMPLIANCE_VIOLATION",
+  /** Secret was detected in content */
+  SECURITY_SECRET_DETECTED: "SECURITY_SECRET_DETECTED",
+  /** Required secret not found */
+  SECURITY_SECRET_NOT_FOUND: "SECURITY_SECRET_NOT_FOUND",
+  /** SARIF parsing failed */
+  SECURITY_SARIF_PARSE_ERROR: "SECURITY_SARIF_PARSE_ERROR",
+  /** Security scan failed */
+  SECURITY_SCAN_FAILED: "SECURITY_SCAN_FAILED",
+  // ─────────────────────────────────────────────────────────────────────────
+  // Generic errors
+  // ─────────────────────────────────────────────────────────────────────────
+  /** Internal error - unexpected condition */
+  INTERNAL_ERROR: "INTERNAL_ERROR",
+  /** Invalid input parameters */
+  INVALID_INPUT: "INVALID_INPUT"
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AXErrorException,
+  AXErrorSchema,
+  ErrorCodes,
+  configInvalidError,
+  createAXError,
+  cycleDetectedError,
+  gateFailedError,
+  gitOperationError,
+  githubApiError,
+  isAXError,
+  isAXErrorException,
+  mcpToolError,
+  mergeConflictError,
+  planNotFoundError,
+  planValidationError,
+  profileNotFoundError,
+  runNotFoundError,
+  securityAuthFailedError,
+  securityCommandBlockedError,
+  securityComplianceViolationError,
+  securitySarifParseError,
+  securityScanFailedError,
+  securitySecretDetectedError,
+  securitySecretNotFoundError,
+  securityUnauthorizedError,
+  throwAXError,
+  toAXError,
+  toolBudgetExceededError,
+  unknownDependencyError,
+  weaveLockConflictError,
+  weavePreflightFailedError,
+  weaveStateInvalidError,
+  wrapAsAXError,
+  writeProtectionError
+});