prae-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Praesidium contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,101 @@
+# prae-cli
+
+Command line for [`dsh-prae`](https://www.npmjs.com/package/dsh-prae):
+validate an operator policy pack, ask it why a call would be refused, verify a
+decision log, and provision a governed profile.
+
+```bash
+npx prae explain ./acme-baseline.prae.json write path=/etc/hosts
+```
+
+```
+DENIED  write  (fs:write)
+        PRAE-001 · writes outside ./src, ./tests, and ./docs are not granted in this pack
+
+        PRAE-001   deny     writes outside ./src, ./tests, and ./docs are not granted in this pack
+
+acme-baseline 1.0.0 · 6 rules considered
+```
+
+## Commands
+
+### `prae check <pack.json>`
+
+Validate a pack and summarise what it enforces. Unknown fields are errors, so a
+mistyped matcher fails here rather than loading clean and enforcing nothing.
+
+### `prae explain <pack.json> <tool> [key=value ...]`
+
+Judge one call and print the trace. Nothing is executed and no harness is
+involved — "why was this denied" is the first question anyone asks of a policy
+engine, and answering it should not require running an agent.
+
+It also says when no capability claims the named tool, so a reader cannot infer
+coverage that is not there.
+
+### `prae verify <ledger.jsonl>`
+
+Re-derive every hash in a decision log and report any break. Prints the limit
+next to the result rather than in a footnote: a removed, edited, or reordered
+row breaks the chain; a rewrite of the whole file by someone holding this code
+does not.
+
+### `prae console <ledger.jsonl> --out <dir> [--pack <file>]`
+
+Write the control plane as linked pages: Overview, Policy packs, Playground,
+Audit ledger, Compliance map. The Playground is written only when `--pack` is
+given, since an empty one teaches nothing.
+
+The Playground inlines the **real kernel** and runs it in the page, so a rule
+that denies there denies in a live profile. A playground running an
+approximation would be worse than none — it would teach a policy language that
+does not exist, and the difference would surface at the worst moment.
+
+Static files rather than a server. The views are a read of local evidence, and
+a governance tool that opens a port to show you its own audit trail has added
+an attack surface to solve a rendering problem.
+
+The Fleet view the rail names is shown dim and marked `SOON`. It needs a
+control plane that does not exist yet, and a working-looking Fleet page over
+one machine would be a lie told in the most expensive place to tell one.
+
+The Compliance map states what each control asks for against what the profile
+actually produces — evidence toward a control, never compliance with it.
+Whether that evidence satisfies the obligation is an auditor's judgement.
+
+### `prae init [options]`
+
+Compose the overlay row that mounts the plugin with a pack.
+
+| Flag | Meaning |
+| --- | --- |
+| `--pack <file>` | The policy pack to embed. Required. |
+| `--profile <dir>` | Profile directory. Defaults to `$DSH_HOME/profiles/web`. |
+| `--ledger <file>` | Where decisions are appended. |
+| `--approver <name>` | Account this profile runs as, recorded against approvals. |
+| `--apply` | Actually write. Without it, the composed overlay is printed and nothing changes. |
+
+**It defaults to not writing**, because the file it edits decides whether the
+harness boots at all. A row naming a package the profile cannot resolve is not a
+disabled feature — Cordis fails module resolution during boot, the harness does
+not start, and every tool you would debug it with is gone. So `init` refuses
+outright when `dsh-prae` is not installed in the profile, snapshots the
+file before writing, and checks the overlay has not changed since you reviewed
+the diff.
+
+None of that safety is reimplemented here: it comes from
+[`dsh-overlay-check`](https://www.npmjs.com/package/dsh-overlay-check), which was
+hardened against a real gate review — including a symlink escape that lexical
+containment let through.
+
+The pack is embedded in the row rather than referenced by path. A row pointing
+at a file that later moves is a policy nobody can reconstruct from the profile
+alone, and reconstructing what was in force is the entire point.
+
+## Status
+
+Pre-release. Do not pin a production system to it.
+
+## Licence
+
+MIT.

package/lib/bin.d.ts

@@ -0,0 +1 @@
+export { };

package/lib/bin.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { t as main } from "./cli-DGVWMDT0.js";
+
+//#region src/bin.ts
+main(process.argv.slice(2)).catch((error) => {
+	console.error(`prae: ${error instanceof Error ? error.message : error}`);
+	process.exit(1);
+});
+
+//#endregion
+export {  };