glirastes 0.3.2 → 0.5.0

package/dist/cjs/contracts/tool-policy.js

@@ -0,0 +1,500 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolPolicyFileSchema = exports.CONTROL_REF = exports.TOOL_POLICY_RULES_VERSION = exports.ToolPolicyPinSchema = exports.ToolPolicyEntrySchema = exports.ToolOverrideDeltaSchema = void 0;
+exports.riskTier = riskTier;
+exports.confirmationFloor = confirmationFloor;
+exports.confirmationRelaxationOutcome = confirmationRelaxationOutcome;
+exports.platformMayRelaxConfirmation = platformMayRelaxConfirmation;
+exports.mostRestrictiveRiskClass = mostRestrictiveRiskClass;
+exports.intersectAllowedRoles = intersectAllowedRoles;
+exports.declaredEffectRiskClass = declaredEffectRiskClass;
+exports.deriveToolPolicyDefaults = deriveToolPolicyDefaults;
+exports.parseToolPolicyFile = parseToolPolicyFile;
+exports.resolveToolPolicy = resolveToolPolicy;
+const zod_1 = require("zod");
+const index_js_1 = require("../diagnostics/index.js");
+const content_boundary_js_1 = require("./content-boundary.js");
+const tool_exclude_pattern_js_1 = require("./tool-exclude-pattern.js");
+const tool_policy_entry_js_1 = require("./tool-policy-entry.js");
+var tool_policy_entry_js_2 = require("./tool-policy-entry.js");
+Object.defineProperty(exports, "ToolOverrideDeltaSchema", { enumerable: true, get: function () { return tool_policy_entry_js_2.ToolOverrideDeltaSchema; } });
+Object.defineProperty(exports, "ToolPolicyEntrySchema", { enumerable: true, get: function () { return tool_policy_entry_js_2.ToolPolicyEntrySchema; } });
+Object.defineProperty(exports, "ToolPolicyPinSchema", { enumerable: true, get: function () { return tool_policy_entry_js_2.ToolPolicyPinSchema; } });
+/**
+ * Version of the default table and the policy bounds below. The golden
+ * vectors in `__vectors__/tool-policy.v1.json` pin it; the Platform port
+ * must produce byte-identical results for the same version.
+ */
+exports.TOOL_POLICY_RULES_VERSION = 1;
+const RISK_TIERS = {
+    'safe-read': 0,
+    'read-sensitive': 1,
+    write: 2,
+    delete: 3,
+    financial: 3,
+    external: 3,
+    // An unassessed risk class is treated like the highest tier.
+    unknown: 3,
+};
+/**
+ * A value outside the enum (untyped input, an `as` cast) is unassessed. Own
+ * keys only: a prototype key such as 'constructor' must not read as a tier.
+ */
+function knownRiskClass(riskClass) {
+    return Object.hasOwn(RISK_TIERS, riskClass) ? riskClass : 'unknown';
+}
+/** Fails closed: an out-of-enum class is tier 3, like `unknown`. */
+function riskTier(riskClass) {
+    return RISK_TIERS[knownRiskClass(riskClass)];
+}
+/**
+ * The runtime confirmation floor: tier 3 always asks before it runs,
+ * whatever any policy layer says.
+ */
+function confirmationFloor(riskClass, requiresApproval) {
+    return requiresApproval || riskTier(riskClass) >= 3;
+}
+/**
+ * The one relaxation rule (spec 4.5, D16), shared by `resolveToolPolicy` and
+ * the runtime overlay: whether a `requiresApproval: false` entry with this pin
+ * takes effect at the effective risk class. A pin for another tool id (an
+ * earlier incarnation) lapses. Tier 0-1 relaxes freely. From tier 2 on the
+ * entry needs a reviewed pin at a tier-2 class the effective class does not
+ * exceed, so the relaxation lapses as soon as the risk rises. Tier 3 never
+ * relaxes, pinned or not.
+ */
+function confirmationRelaxationOutcome(toolId, pin, riskClass) {
+    if (pin && pin.toolId !== toolId)
+        return 'pin-for-other-tool';
+    const tier = riskTier(riskClass);
+    if (tier <= 1)
+        return 'applies';
+    if (!pin) {
+        return tier >= 3
+            ? 'tier-3-always-requires-approval'
+            : 'relaxation-requires-reviewed-pin';
+    }
+    const pinnedTier = riskTier(pin.atRiskClass);
+    if (pinnedTier >= 3)
+        return 'tier-3-always-requires-approval';
+    if (tier > pinnedTier)
+        return 'override-lapsed-risk-raised';
+    return 'applies';
+}
+/**
+ * D16 local lock: may a signed Platform decision switch off this tool's
+ * confirmation at all? Only a confirmation the local code report attributes
+ * to the code default, on a tool of tier 0-2. Whatever tool-policy.json
+ * decided (an explicit `requiresApproval: true`, or a risk raise that brings
+ * confirmation) and an origin the report does not name are local locks the
+ * Platform never relaxes; tier 3 always confirms.
+ */
+function platformMayRelaxConfirmation(riskClass, requiresApprovalOrigin) {
+    return requiresApprovalOrigin === 'code-default' && riskTier(riskClass) <= 2;
+}
+/**
+ * Raise-only combination. A candidate replaces the current class only from a
+ * strictly higher tier; a same-tier relabel or a lower class never applies.
+ * An out-of-enum candidate raises as `unknown`, so none enters the result.
+ */
+function mostRestrictiveRiskClass(current, candidate) {
+    if (candidate === undefined)
+        return current;
+    return riskTier(candidate) > riskTier(current)
+        ? knownRiskClass(candidate)
+        : current;
+}
+function intersectAllowedRoles(current, restriction) {
+    const left = normalizedRoles(current);
+    const right = normalizedRoles(restriction ?? []);
+    if (left.length === 0)
+        return { roles: right, disjoint: false };
+    if (right.length === 0)
+        return { roles: left, disjoint: false };
+    const roles = left.filter((role) => right.includes(role));
+    return { roles, disjoint: roles.length === 0 };
+}
+function normalizedRoles(roles) {
+    return [...new Set(roles)].sort();
+}
+const METHOD_DEFAULTS = new Map([
+    ['GET', { operationGroup: 'read', riskClass: 'safe-read', requiresApproval: false }],
+    ['HEAD', { operationGroup: 'read', riskClass: 'safe-read', requiresApproval: false }],
+    ['POST', { operationGroup: 'create', riskClass: 'write', requiresApproval: true }],
+    ['PUT', { operationGroup: 'update', riskClass: 'write', requiresApproval: true }],
+    ['PATCH', { operationGroup: 'update', riskClass: 'write', requiresApproval: true }],
+    ['DELETE', { operationGroup: 'delete', riskClass: 'delete', requiresApproval: true }],
+]);
+const UNKNOWN_METHOD_DEFAULTS = {
+    operationGroup: 'update',
+    riskClass: 'write',
+    requiresApproval: true,
+};
+const UI_DEFAULTS = {
+    operationGroup: 'ui',
+    riskClass: 'safe-read',
+    requiresApproval: false,
+};
+const DESTRUCTIVE_WORDS = new Set([
+    'delete',
+    'remove',
+    'destroy',
+    'purge',
+    'erase',
+    'wipe',
+    'permanent',
+    'revoke',
+]);
+/** Multi-word tokens; `hard-delete` is already covered by `delete`. */
+const DESTRUCTIVE_WORD_PAIRS = [
+    ['empty', 'trash'],
+];
+const DECLARED_EFFECT_RISK = {
+    read: 'safe-read',
+    write: 'write',
+    destructive: 'delete',
+    external: 'external',
+    financial: 'financial',
+};
+/**
+ * The risk class a declared effect stands for. `deriveToolPolicyDefaults`
+ * raises to it, and anything that checks an effect against the code's class
+ * (the agent resolution gate) must read it here, never from a copy.
+ */
+function declaredEffectRiskClass(effect) {
+    return DECLARED_EFFECT_RISK[effect];
+}
+function segmentWords(segment) {
+    return segment
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((word) => word.length > 0);
+}
+/** Whole-word match per path or definitionId segment (camelCase aware). */
+function hasDestructiveToken(...sources) {
+    for (const source of sources) {
+        for (const segment of (source ?? '').split(/[/.]/)) {
+            const words = segmentWords(segment);
+            if (words.some((word) => DESTRUCTIVE_WORDS.has(word)))
+                return true;
+            for (let index = 0; index + 1 < words.length; index += 1) {
+                if (DESTRUCTIVE_WORD_PAIRS.some(([first, second]) => words[index] === first && words[index + 1] === second)) {
+                    return true;
+                }
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Raise-only step on the assessed class set. It delegates to
+ * `mostRestrictiveRiskClass` so the raise rule lives in one place; both inputs
+ * are assessed, so the result is always one of them and never `unknown`.
+ */
+function raiseAssessed(current, candidate) {
+    return mostRestrictiveRiskClass(current, candidate) === candidate
+        ? candidate
+        : current;
+}
+/**
+ * Deterministic stage-1 defaults (spec 4.5). Escalations only ever raise;
+ * `unknown` is never produced. Roles are not part of the defaults: the
+ * endpoint's own authorization applies.
+ */
+function deriveToolPolicyDefaults(input) {
+    const isUi = input.executionKind === 'ui';
+    const method = input.method?.toUpperCase();
+    const base = isUi
+        ? UI_DEFAULTS
+        : METHOD_DEFAULTS.get(method ?? '') ?? UNKNOWN_METHOD_DEFAULTS;
+    let operationGroup = base.operationGroup;
+    let riskClass = base.riskClass;
+    const readOnlyMethod = !isUi && (method === 'GET' || method === 'HEAD');
+    const tokensApply = isUi
+        ? input.evidence?.uiMutation === true
+        : !readOnlyMethod;
+    if (tokensApply && hasDestructiveToken(input.path, input.definitionId)) {
+        riskClass = raiseAssessed(riskClass, 'delete');
+        if (!isUi)
+            operationGroup = 'delete';
+    }
+    if (input.declaredEffect !== undefined) {
+        riskClass = raiseAssessed(riskClass, DECLARED_EFFECT_RISK[input.declaredEffect]);
+        if (input.declaredEffect === 'destructive' && !isUi) {
+            operationGroup = 'delete';
+        }
+    }
+    if (input.evidence?.externalCall) {
+        riskClass = raiseAssessed(riskClass, 'external');
+    }
+    if (isUi && input.evidence?.uiMutation) {
+        riskClass = raiseAssessed(riskClass, 'write');
+    }
+    return {
+        operationGroup,
+        riskClass,
+        requiresApproval: base.requiresApproval || riskTier(riskClass) >= 2,
+        rulesVersion: exports.TOOL_POLICY_RULES_VERSION,
+    };
+}
+const boundedText = (max) => zod_1.z.string().trim().min(1).max(max);
+const stableKey = zod_1.z.string().min(1).max(512);
+/** `src/components/ui-size-provider.tsx#setSize`: the file that declares a control and its setter. */
+exports.CONTROL_REF = /^[^#\s]+#[A-Za-z_$][\w$]*$/;
+/**
+ * `.glirastes/tool-policy.json`. Written by the developer or the CLI only,
+ * never by an agent; `tools refresh` never rewrites it.
+ */
+exports.ToolPolicyFileSchema = zod_1.z.object({
+    schemaVersion: zod_1.z.literal(1),
+    tools: zod_1.z.record(stableKey, tool_policy_entry_js_1.ToolPolicyEntrySchema).default({}),
+    exclude: zod_1.z.array(zod_1.z.object({
+        // A pattern outside the grammar would exclude nothing, so it is rejected instead.
+        match: boundedText(2_048).refine((match) => (0, tool_exclude_pattern_js_1.parseExcludePattern)(match) !== undefined, {
+            message: 'Expected "[METHOD|*] /path" with * or ** as whole segments',
+        }),
+        reason: boundedText(500),
+    }).strict()).max(500).default([]),
+    acceptedRisk: zod_1.z.record(stableKey, zod_1.z.object({
+        riskClass: tool_policy_entry_js_1.ToolRiskClassSchema,
+        toolId: zod_1.z.uuid(),
+    }).strict()).default({}),
+    /** UI controls (`<file>#<setter>`) the developer keeps out of the chat; refresh stops proposing a client action for them. */
+    excludeControls: zod_1.z.array(zod_1.z.object({
+        control: zod_1.z.string().max(1_024).regex(exports.CONTROL_REF, 'Expected "<app file>#<setter>", e.g. "src/theme.tsx#setTheme"'),
+        reason: boundedText(500),
+    }).strict()).max(500).optional(),
+}).strict().superRefine((file, context) => {
+    // Values only: stable keys such as "POST /api/auth/token" are not content.
+    const sensitivePath = (0, content_boundary_js_1.findSensitiveStringPath)(file);
+    if (sensitivePath) {
+        context.addIssue({
+            code: 'custom',
+            message: 'Tool policy contains secret-like content',
+            path: sensitivePath,
+        });
+    }
+});
+function parseToolPolicyFile(value) {
+    const parsed = exports.ToolPolicyFileSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    // The issue path names the field; the offending value is never echoed.
+    const identifier = parsed.error.issues[0]?.path.map(String).join('.') ?? '';
+    throw new index_js_1.FoundationDiagnosticError({
+        code: 'E-POLICY-001',
+        operation: 'tools.policy',
+        message: 'The tool policy file is invalid.',
+        remediation: 'repair-tool-policy-file',
+        path: '.glirastes/tool-policy.json',
+        ...(identifier ? { identifier } : {}),
+    });
+}
+/**
+ * Pure policy resolution shared with the Platform port via golden vectors.
+ * Code defaults are the base; local and Platform entries restrict, except a
+ * reviewed, pinned relaxation of confirmation up to tier 2. Across all layers
+ * the most restrictive protection value wins.
+ */
+function resolveToolPolicy(input) {
+    const warnings = [];
+    const errors = [];
+    const { layers, invalidOrigin } = collectPolicyLayers(input, warnings, errors);
+    const risk = resolveRiskClass(input, layers, warnings);
+    const roles = resolveAllowedRoles(layers);
+    const enabled = resolveEnabled(input.codeEnabled, layers, roles.disjointOrigin, invalidOrigin);
+    const approval = resolveApproval(input, layers, risk, warnings, errors);
+    const description = resolveDescription(layers);
+    return {
+        effective: {
+            enabled: enabled.value,
+            requiresApproval: approval.value,
+            riskClass: risk.value,
+            allowedRoles: roles.value,
+            ...(description.value === undefined
+                ? {}
+                : { description: description.value }),
+            origin: {
+                enabled: enabled.origin,
+                requiresApproval: approval.origin,
+                riskClass: risk.origin,
+                allowedRoles: roles.origin,
+                description: description.origin,
+            },
+        },
+        warnings,
+        errors,
+    };
+}
+function collectPolicyLayers(input, warnings, errors) {
+    const layers = [];
+    let invalidOrigin;
+    const candidates = [
+        { name: 'local', origin: 'local-policy', entry: input.local },
+        { name: 'platform', origin: 'platform', entry: input.platform },
+    ];
+    for (const candidate of candidates) {
+        if (candidate.entry === undefined)
+            continue;
+        const parsed = tool_policy_entry_js_1.ToolPolicyEntrySchema.safeParse(candidate.entry);
+        if (!parsed.success) {
+            const path = parsed.error.issues[0]?.path.map(String).join('.') ?? '';
+            errors.push({
+                code: 'E-POLICY-001',
+                field: path ? `${candidate.name}.${path}` : candidate.name,
+                reason: 'invalid-entry',
+            });
+            // A layer we cannot read must not silently drop its restrictions.
+            invalidOrigin ??= candidate.origin;
+            continue;
+        }
+        const layer = {
+            name: candidate.name,
+            origin: candidate.origin,
+            entry: parsed.data,
+        };
+        // A pin from an earlier incarnation: relaxations lapse, hardenings stay.
+        if (layer.entry.pin && layer.entry.pin.toolId !== input.toolId) {
+            warnings.push({
+                code: 'policy-entry-orphaned',
+                field: `${layer.name}.pin.toolId`,
+            });
+        }
+        layers.push(layer);
+    }
+    return { layers, ...(invalidOrigin ? { invalidOrigin } : {}) };
+}
+function resolveRiskClass(input, layers, warnings) {
+    let value = input.defaults.riskClass;
+    let origin = 'code-default';
+    for (const layer of layers) {
+        const raised = mostRestrictiveRiskClass(value, layer.entry.riskClass);
+        if (raised !== value) {
+            value = raised;
+            origin = layer.origin;
+        }
+    }
+    // Ratchet: a code-caused decrease is held until `tools policy accept`.
+    // `acceptedRisk.riskClass` is matched against the layered `value` (defaults
+    // plus local/Platform raises), not the class the code alone derives, so the
+    // warning names `value` as the class accept must record.
+    const previous = input.previousEffectiveRiskClass;
+    if (previous !== undefined && riskTier(previous) > riskTier(value)) {
+        const acceptedRisk = input.acceptedRisk;
+        const accepted = acceptedRisk !== undefined
+            && acceptedRisk.toolId === input.toolId
+            && acceptedRisk.riskClass === value;
+        if (!accepted) {
+            warnings.push({
+                code: 'risk-lower-available',
+                field: 'riskClass',
+                riskClass: value,
+            });
+            // An out-of-enum previous class is held as tier-3 `unknown`.
+            return { value: knownRiskClass(previous), origin: 'code-default' };
+        }
+    }
+    return { value, origin };
+}
+function sameRoles(left, right) {
+    return left.length === right.length
+        && left.every((role, index) => role === right[index]);
+}
+function resolveAllowedRoles(layers) {
+    let value = [];
+    let origin = 'code-default';
+    for (const layer of layers) {
+        const restriction = layer.entry.allowedRoles;
+        if (!restriction || restriction.length === 0)
+            continue;
+        const next = intersectAllowedRoles(value, restriction);
+        if (next.disjoint) {
+            // [] would read as "everyone"; a disjoint restriction means nobody.
+            return { value: [], origin: layer.origin, disjointOrigin: layer.origin };
+        }
+        if (!sameRoles(next.roles, value)) {
+            value = next.roles;
+            origin = layer.origin;
+        }
+    }
+    return { value, origin };
+}
+function resolveEnabled(codeEnabled, layers, disjointOrigin, invalidOrigin) {
+    if (!codeEnabled)
+        return { value: false, origin: 'code-default' };
+    if (invalidOrigin)
+        return { value: false, origin: invalidOrigin };
+    const disabledBy = layers.find((layer) => layer.entry.enabled === false);
+    if (disabledBy)
+        return { value: false, origin: disabledBy.origin };
+    if (disjointOrigin)
+        return { value: false, origin: disjointOrigin };
+    return { value: true, origin: 'code-default' };
+}
+function resolveApproval(input, layers, risk, warnings, errors) {
+    const tier = riskTier(risk.value);
+    const raisedIntoConfirmation = tier >= 2
+        && tier > riskTier(input.defaults.riskClass);
+    const baseline = input.defaults.requiresApproval || raisedIntoConfirmation;
+    const baselineOrigin = !input.defaults.requiresApproval && raisedIntoConfirmation
+        ? risk.origin
+        : 'code-default';
+    let hardenedBy;
+    let relaxedBy;
+    for (const layer of layers) {
+        if (layer.entry.requiresApproval === true) {
+            hardenedBy ??= layer;
+        }
+        else if (layer.entry.requiresApproval === false
+            && relaxationAllowed(input.toolId, layer, risk.value, warnings, errors)) {
+            relaxedBy = layer;
+        }
+    }
+    let result;
+    if (hardenedBy) {
+        result = {
+            value: true,
+            origin: baseline && !relaxedBy ? baselineOrigin : hardenedBy.origin,
+        };
+    }
+    else if (relaxedBy) {
+        result = { value: false, origin: relaxedBy.origin };
+    }
+    else {
+        result = { value: baseline, origin: baselineOrigin };
+    }
+    // Tier 3 always confirms, whatever any layer says.
+    return !result.value && tier >= 3
+        ? { value: true, origin: 'code-default' }
+        : result;
+}
+function relaxationAllowed(toolId, layer, riskClass, warnings, errors) {
+    const field = `${layer.name}.requiresApproval`;
+    const outcome = confirmationRelaxationOutcome(toolId, layer.entry.pin, riskClass);
+    switch (outcome) {
+        case 'applies':
+            return true;
+        case 'pin-for-other-tool':
+            // Reported once as `policy-entry-orphaned` by collectPolicyLayers.
+            return false;
+        case 'override-lapsed-risk-raised':
+            warnings.push({ code: 'override-lapsed-risk-raised', field });
+            return false;
+        default:
+            errors.push({ code: 'E-POLICY-002', field, reason: outcome });
+            return false;
+    }
+}
+function resolveDescription(layers) {
+    let result = {
+        value: undefined,
+        origin: 'code-default',
+    };
+    for (const layer of layers) {
+        if (layer.entry.description !== undefined) {
+            result = { value: layer.entry.description, origin: layer.origin };
+        }
+    }
+    return result;
+}

package/dist/cjs/contracts/url.d.ts

@@ -0,0 +1,2 @@
+/** `url` without trailing slashes, in linear time (a `/\/+$/` replace is quadratic on hostile input). */
+export declare function trimTrailingSlashes(url: string): string;

package/dist/cjs/contracts/url.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trimTrailingSlashes = trimTrailingSlashes;
+/** `url` without trailing slashes, in linear time (a `/\/+$/` replace is quadratic on hostile input). */
+function trimTrailingSlashes(url) {
+    let end = url.length;
+    while (end > 0 && url.charCodeAt(end - 1) === 47)
+        end -= 1;
+    return end === url.length ? url : url.slice(0, end);
+}

package/dist/cjs/diagnostics/foundation-diagnostic.d.ts

@@ -0,0 +1,34 @@
+export type FoundationDiagnosticCode = `E-SETUP-${string}` | `E-INVENTORY-${string}` | `E-SEMANTICS-${string}` | `E-BINDING-${string}` | `E-SIGNATURE-${string}` | `E-SCOPE-${string}` | `E-SYNC-${string}` | `E-CONNECT-${string}` | `E-POLICY-${string}` | `E-TOOLS-${string}`;
+export interface FoundationDiagnosticJson {
+    schemaVersion: 1;
+    code: FoundationDiagnosticCode;
+    operation: string;
+    message: string;
+    remediation: string;
+    path?: string;
+    identifier?: string;
+}
+export interface FoundationDiagnosticInput {
+    code: FoundationDiagnosticCode;
+    operation: string;
+    message: string;
+    remediation: string;
+    path?: string;
+    identifier?: string;
+}
+/**
+ * A bounded operator diagnostic. It deliberately carries no arbitrary
+ * metadata or cause so JSON output cannot accidentally cross the local
+ * content and secret boundary.
+ */
+export declare class FoundationDiagnosticError extends Error {
+    readonly code: FoundationDiagnosticCode;
+    readonly operation: string;
+    readonly remediation: string;
+    readonly path?: string;
+    readonly identifier?: string;
+    constructor(input: FoundationDiagnosticInput);
+    toJSON(): FoundationDiagnosticJson;
+}
+export declare function isFoundationDiagnosticError(value: unknown): value is FoundationDiagnosticError;
+export declare function foundationDiagnosticJson(error: unknown, operation?: string): FoundationDiagnosticJson;

package/dist/cjs/diagnostics/foundation-diagnostic.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FoundationDiagnosticError = void 0;
+exports.isFoundationDiagnosticError = isFoundationDiagnosticError;
+exports.foundationDiagnosticJson = foundationDiagnosticJson;
+/**
+ * A bounded operator diagnostic. It deliberately carries no arbitrary
+ * metadata or cause so JSON output cannot accidentally cross the local
+ * content and secret boundary.
+ */
+class FoundationDiagnosticError extends Error {
+    code;
+    operation;
+    remediation;
+    path;
+    identifier;
+    constructor(input) {
+        super(input.message);
+        this.name = 'FoundationDiagnosticError';
+        this.code = input.code;
+        this.operation = input.operation;
+        this.remediation = input.remediation;
+        this.path = input.path;
+        this.identifier = input.identifier;
+    }
+    toJSON() {
+        return {
+            schemaVersion: 1,
+            code: this.code,
+            operation: this.operation,
+            message: this.message,
+            remediation: this.remediation,
+            ...(this.path ? { path: this.path } : {}),
+            ...(this.identifier ? { identifier: this.identifier } : {}),
+        };
+    }
+}
+exports.FoundationDiagnosticError = FoundationDiagnosticError;
+function isFoundationDiagnosticError(value) {
+    return value instanceof FoundationDiagnosticError;
+}
+function foundationDiagnosticJson(error, operation = 'unknown') {
+    if (isFoundationDiagnosticError(error))
+        return error.toJSON();
+    return {
+        schemaVersion: 1,
+        code: 'E-SETUP-999',
+        operation,
+        message: 'Glirastes command failed.',
+        remediation: 'inspect-local-diagnostics',
+    };
+}

package/dist/cjs/diagnostics/index.d.ts

@@ -0,0 +1,2 @@
+export { FoundationDiagnosticError, foundationDiagnosticJson, isFoundationDiagnosticError, } from './foundation-diagnostic.js';
+export type { FoundationDiagnosticCode, FoundationDiagnosticInput, FoundationDiagnosticJson, } from './foundation-diagnostic.js';

package/dist/cjs/diagnostics/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFoundationDiagnosticError = exports.foundationDiagnosticJson = exports.FoundationDiagnosticError = void 0;
+var foundation_diagnostic_js_1 = require("./foundation-diagnostic.js");
+Object.defineProperty(exports, "FoundationDiagnosticError", { enumerable: true, get: function () { return foundation_diagnostic_js_1.FoundationDiagnosticError; } });
+Object.defineProperty(exports, "foundationDiagnosticJson", { enumerable: true, get: function () { return foundation_diagnostic_js_1.foundationDiagnosticJson; } });
+Object.defineProperty(exports, "isFoundationDiagnosticError", { enumerable: true, get: function () { return foundation_diagnostic_js_1.isFoundationDiagnosticError; } });