prae-cli 0.1.0

package/lib/cli-DGVWMDT0.js

@@ -0,0 +1,2405 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, extname, join, normalize, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
+import { createServer } from "node:http";
+
+//#region ../kernel/src/path.ts
+/**
+* Path normalization and glob containment, with no filesystem access.
+*
+* The contract, stated here because getting it wrong is how path policies
+* become theatre: **this module compares strings.** It resolves `.` and `..`
+* lexically so that `./src/../../etc/passwd` cannot pose as a workspace path,
+* but it cannot see a symlink. A link inside an allowed directory pointing out
+* of it will pass every check here.
+*
+* That is not a gap to paper over in the matcher — it is a gap the caller
+* closes by resolving before it asks. `dsh-overlay-check` learned this the
+* hard way during the plugin-store gate review: lexical containment accepted a
+* symlink escape cleanly, and the fix was to resolve both the path and its
+* nearest existing ancestor before deciding. Adapters that can touch the
+* filesystem must resolve first and pass the resolved path in.
+*/
+/** Split a path into segments, resolving `.` and `..` lexically. */
+function normalize$1(path) {
+	const absolute = path.startsWith("/");
+	const out = [];
+	let escaped = false;
+	for (const raw of path.split(/[/\\]+/)) {
+		if (raw === "" || raw === ".") continue;
+		if (raw === "..") {
+			if (out.length > 0) out.pop();
+			else escaped = true;
+			continue;
+		}
+		out.push(raw);
+	}
+	return {
+		segments: out,
+		absolute,
+		escaped
+	};
+}
+/** Turn one glob segment into an anchored regular expression. */
+function segmentPattern(segment) {
+	const body = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+	return /* @__PURE__ */ new RegExp(`^${body}$`);
+}
+/**
+* Wildcard segment matching, where `**` spans zero or more segments.
+*
+* Two-pointer with backtracking rather than a recursive walk: the pattern
+* comes from a policy pack and the path from a tool call, and a catastrophic
+* backtrack in the hot path of every call would be a denial of service handed
+* to whoever writes the pack.
+*/
+function matchSegments(path, pattern) {
+	let i = 0;
+	let j = 0;
+	let starPattern = -1;
+	let starPath = 0;
+	while (i < path.length) {
+		const segment = j < pattern.length ? pattern[j] : void 0;
+		const here = path[i];
+		if (segment === "**") {
+			starPattern = j;
+			starPath = i;
+			j += 1;
+			continue;
+		}
+		if (segment !== void 0 && here !== void 0 && segmentPattern(segment).test(here)) {
+			i += 1;
+			j += 1;
+			continue;
+		}
+		if (starPattern >= 0) {
+			starPath += 1;
+			i = starPath;
+			j = starPattern + 1;
+			continue;
+		}
+		return false;
+	}
+	while (j < pattern.length && pattern[j] === "**") j += 1;
+	return j === pattern.length;
+}
+/**
+* Is `path` contained by `glob`?
+*
+* A glob naming a directory contains everything under it: `./src` and
+* `./src/**` both match `src/app/main.ts`. Writing the shorter form is the
+* common intent, and treating it as "this exact directory entry only" is a
+* trap that silently grants the whole subtree past the rule.
+*/
+function within(path, glob) {
+	const target = normalize$1(path);
+	if (target.escaped) return false;
+	const pattern = normalize$1(glob);
+	if (matchSegments(target.segments, pattern.segments)) return true;
+	return matchSegments(target.segments, [...pattern.segments, "**"]);
+}
+/** Is `path` inside any of these globs? */
+function withinAny(path, globs) {
+	return globs.some((glob) => within(path, glob));
+}
+/**
+* The host of a URL, or undefined when it is not a URL we can read.
+*
+* Unparseable input returns undefined, and callers treat that as "no host" —
+* which for a `notIn` rule means the rule matches. Failing toward the rule is
+* the only safe direction: a string we cannot parse is exactly the shape an
+* evasion attempt takes.
+*/
+function hostOf(url) {
+	try {
+		return new URL(url).hostname.toLowerCase();
+	} catch {
+		return;
+	}
+}
+/**
+* Host list membership, where a leading dot means "this domain or below".
+*
+* `example.com` matches only that host. `.example.com` also matches
+* `api.example.com`, and deliberately still matches `example.com` itself —
+* an operator writing the suffix form means the organisation, not a rule that
+* covers every subdomain except the one they first thought of.
+*/
+function hostIn(host, list) {
+	return list.some((entry) => {
+		const want = entry.toLowerCase();
+		if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
+		return host === want;
+	});
+}
+
+//#endregion
+//#region ../kernel/src/rule.ts
+/**
+* Strength ordering, used when several rules match one call.
+*
+* Higher wins. This is the property that makes a pack safe to extend: adding a
+* rule can raise the strength of a decision and never lower it, so an operator
+* appending to a pack can never accidentally widen what an agent may do.
+*/
+const STRENGTH = {
+	warn: 1,
+	correct: 2,
+	ask: 3,
+	deny: 4
+};
+
+//#endregion
+//#region ../kernel/src/evaluate.ts
+function listed(value, want) {
+	if (want === void 0) return true;
+	if (value === void 0) return false;
+	return typeof want === "string" ? value === want : want.includes(value);
+}
+function argMatches(match, args) {
+	const has = Object.hasOwn(args, match.name);
+	if (match.present !== void 0 && match.present !== has) return false;
+	if (!has) return match.above === void 0 && match.below === void 0 && match.equals === void 0 && match.oneOf === void 0;
+	const value = args[match.name];
+	if (match.above !== void 0) {
+		if (typeof value !== "number" || !(value > match.above)) return false;
+	}
+	if (match.below !== void 0) {
+		if (typeof value !== "number" || !(value < match.below)) return false;
+	}
+	if (match.equals !== void 0 && value !== match.equals) return false;
+	if (match.oneOf !== void 0) {
+		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return false;
+		if (!match.oneOf.includes(value)) return false;
+	}
+	return true;
+}
+function matches(when, facts) {
+	if (!listed(facts.tool, when.tool)) return false;
+	if (!listed(facts.capability, when.capability)) return false;
+	if (!listed(facts.plugin, when.plugin)) return false;
+	if (!listed(facts.agent, when.agent)) return false;
+	if (when.path !== void 0) {
+		const raw = facts.args[when.path.arg ?? "path"];
+		if (typeof raw !== "string") return false;
+		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
+		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;
+	}
+	if (when.host !== void 0) {
+		const raw = facts.args[when.host.arg ?? "url"];
+		if (typeof raw !== "string") return false;
+		const host = hostOf(raw);
+		if (host === void 0) return when.host.notIn !== void 0;
+		if (when.host.in !== void 0 && !hostIn(host, when.host.in)) return false;
+		if (when.host.notIn !== void 0 && hostIn(host, when.host.notIn)) return false;
+	}
+	if (when.arg !== void 0) {
+		for (const one of when.arg) if (!argMatches(one, facts.args)) return false;
+	}
+	if (when.count !== void 0) {
+		const key = facts.capability;
+		if (key === void 0) return false;
+		if (!((facts.counts?.[key] ?? 0) > when.count.above)) return false;
+	}
+	return true;
+}
+function step(rule, effect) {
+	return {
+		rule: rule.id,
+		...rule.title === void 0 ? {} : { title: rule.title },
+		effect: effect.kind,
+		because: effect.because
+	};
+}
+/**
+* Decide one call against one pack.
+*
+* Every matching rule lands in the trace; the strongest effect decides. Ties
+* go to the first rule in pack order, so a pack reads top-down the way its
+* author wrote it.
+*
+* `correct` is the effect the rest of this ecosystem does not have. A rival
+* guardrail can allow a call or refuse it; a rule here can also rewrite an
+* argument and let it through, recording what it changed. Refusing is not
+* always the safe option — an agent denied mid-task retries, and the retry is
+* rarely safer than the clamp would have been.
+*/
+function evaluate(pack, facts) {
+	const hits = [];
+	for (const rule of pack.rules) if (matches(rule.when, facts)) hits.push({
+		rule,
+		effect: rule.effect
+	});
+	if (hits.length === 0) return {
+		kind: "allow",
+		trace: [],
+		evaluated: pack.rules.length
+	};
+	hits.sort((a, b) => STRENGTH[b.effect.kind] - STRENGTH[a.effect.kind]);
+	const trace = hits.map((hit) => step(hit.rule, hit.effect));
+	const evaluated = pack.rules.length;
+	const strongest = hits[0];
+	if (strongest === void 0) return {
+		kind: "allow",
+		trace: [],
+		evaluated
+	};
+	const winner = strongest.effect.kind;
+	if (winner === "deny" || winner === "ask") return {
+		kind: winner,
+		rule: strongest.rule.id,
+		reason: strongest.effect.because,
+		trace,
+		evaluated
+	};
+	if (winner === "correct") {
+		const args = { ...facts.args };
+		for (const hit of hits) if (hit.effect.kind === "correct") Object.assign(args, hit.effect.set);
+		return {
+			kind: "correct",
+			rule: strongest.rule.id,
+			reason: strongest.effect.because,
+			args,
+			trace,
+			evaluated
+		};
+	}
+	return {
+		kind: "allow",
+		trace,
+		evaluated
+	};
+}
+
+//#endregion
+//#region ../kernel/src/pack.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var Check = class {
+	errors = [];
+	fail(path, message) {
+		this.errors.push({
+			path,
+			message
+		});
+	}
+	/** Reject any key the shape does not define. */
+	keys(path, value, allowed) {
+		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
+	}
+	text(path, value) {
+		if (typeof value !== "string" || value.trim() === "") {
+			this.fail(path, "expected a non-empty string");
+			return;
+		}
+		return value;
+	}
+	/** A field that accepts one name or a list of them. */
+	names(path, value) {
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const out = [];
+			value.forEach((entry, index) => {
+				const one = this.text(`${path}[${index}]`, entry);
+				if (one !== void 0) out.push(one);
+			});
+			return out;
+		}
+		this.fail(path, "expected a string or an array of strings");
+	}
+	globs(path, value) {
+		if (!Array.isArray(value)) {
+			this.fail(path, "expected an array of path globs");
+			return;
+		}
+		const out = [];
+		value.forEach((entry, index) => {
+			const one = this.text(`${path}[${index}]`, entry);
+			if (one !== void 0) out.push(one);
+		});
+		return out;
+	}
+	number(path, value) {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			this.fail(path, "expected a finite number");
+			return;
+		}
+		return value;
+	}
+};
+function readPathMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"arg",
+		"outside",
+		"inside"
+	]);
+	if (value.outside === void 0 && value.inside === void 0) check$1.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check$1.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.outside !== void 0) {
+		const globs = check$1.globs(`${path}.outside`, value.outside);
+		if (globs !== void 0) out.outside = globs;
+	}
+	if (value.inside !== void 0) {
+		const globs = check$1.globs(`${path}.inside`, value.inside);
+		if (globs !== void 0) out.inside = globs;
+	}
+	return out;
+}
+function readHostMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"arg",
+		"in",
+		"notIn"
+	]);
+	if (value.in === void 0 && value.notIn === void 0) check$1.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check$1.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.in !== void 0) {
+		const list = check$1.globs(`${path}.in`, value.in);
+		if (list !== void 0) out.in = list;
+	}
+	if (value.notIn !== void 0) {
+		const list = check$1.globs(`${path}.notIn`, value.notIn);
+		if (list !== void 0) out.notIn = list;
+	}
+	return out;
+}
+function readArgMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"name",
+		"above",
+		"below",
+		"equals",
+		"oneOf",
+		"present"
+	]);
+	const name = check$1.text(`${path}.name`, value.name);
+	if (name === void 0) return void 0;
+	const out = { name };
+	if (value.above !== void 0) {
+		const n = check$1.number(`${path}.above`, value.above);
+		if (n !== void 0) out.above = n;
+	}
+	if (value.below !== void 0) {
+		const n = check$1.number(`${path}.below`, value.below);
+		if (n !== void 0) out.below = n;
+	}
+	if (value.equals !== void 0) out.equals = value.equals;
+	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check$1.fail(`${path}.oneOf`, "expected an array");
+	else out.oneOf = value.oneOf;
+	if (value.present !== void 0) if (typeof value.present !== "boolean") check$1.fail(`${path}.present`, "expected a boolean");
+	else out.present = value.present;
+	return out;
+}
+function readMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return {};
+	}
+	check$1.keys(path, value, [
+		"tool",
+		"capability",
+		"plugin",
+		"agent",
+		"path",
+		"host",
+		"arg",
+		"count"
+	]);
+	const out = {};
+	for (const key of [
+		"tool",
+		"capability",
+		"plugin",
+		"agent"
+	]) if (value[key] !== void 0) {
+		const names = check$1.names(`${path}.${key}`, value[key]);
+		if (names !== void 0) out[key] = names;
+	}
+	if (value.path !== void 0) {
+		const match = readPathMatch(check$1, `${path}.path`, value.path);
+		if (match !== void 0) out.path = match;
+	}
+	if (value.host !== void 0) {
+		const match = readHostMatch(check$1, `${path}.host`, value.host);
+		if (match !== void 0) out.host = match;
+	}
+	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check$1.fail(`${path}.arg`, "expected an array of argument matchers");
+	else {
+		const list = [];
+		value.arg.forEach((entry, index) => {
+			const one = readArgMatch(check$1, `${path}.arg[${index}]`, entry);
+			if (one !== void 0) list.push(one);
+		});
+		out.arg = list;
+	}
+	if (value.count !== void 0) if (!isObject(value.count)) check$1.fail(`${path}.count`, "expected an object");
+	else {
+		check$1.keys(`${path}.count`, value.count, ["above"]);
+		const above = check$1.number(`${path}.count.above`, value.count.above);
+		if (above !== void 0) out.count = { above };
+	}
+	return out;
+}
+function readEffect(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	const kind = value.kind;
+	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn") {
+		check$1.fail(`${path}.kind`, "expected `deny`, `ask`, `correct`, or `warn`");
+		return;
+	}
+	check$1.keys(path, value, kind === "correct" ? [
+		"kind",
+		"set",
+		"because"
+	] : ["kind", "because"]);
+	const because = check$1.text(`${path}.because`, value.because);
+	if (because === void 0) return void 0;
+	if (kind === "correct") {
+		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
+			check$1.fail(`${path}.set`, "expected a non-empty object of arguments to set");
+			return;
+		}
+		return {
+			kind,
+			set: value.set,
+			because
+		};
+	}
+	return {
+		kind,
+		because
+	};
+}
+function readRule(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"id",
+		"title",
+		"when",
+		"effect"
+	]);
+	const id = check$1.text(`${path}.id`, value.id);
+	const effect = readEffect(check$1, `${path}.effect`, value.effect);
+	if (value.when === void 0) check$1.fail(`${path}.when`, "expected an object");
+	const when = readMatch(check$1, `${path}.when`, value.when ?? {});
+	if (id === void 0 || effect === void 0) return void 0;
+	const rule = {
+		id,
+		when,
+		effect
+	};
+	if (value.title !== void 0) {
+		const title = check$1.text(`${path}.title`, value.title);
+		if (title !== void 0) rule.title = title;
+	}
+	return rule;
+}
+/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
+function parsePack(source) {
+	let raw;
+	try {
+		raw = JSON.parse(source);
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [{
+				path: "",
+				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+			}]
+		};
+	}
+	const check$1 = new Check();
+	if (!isObject(raw)) return {
+		ok: false,
+		errors: [{
+			path: "",
+			message: "expected an object"
+		}]
+	};
+	check$1.keys("", raw, [
+		"prae",
+		"pack",
+		"version",
+		"baseline",
+		"rules"
+	]);
+	if (raw.prae !== "0.1") check$1.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
+	const name = check$1.text(".pack", raw.pack);
+	const version = check$1.text(".version", raw.version);
+	let baseline;
+	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check$1.fail(".baseline", "expected an object");
+	else {
+		check$1.keys(".baseline", raw.baseline, ["capabilities"]);
+		const caps = check$1.globs(".baseline.capabilities", raw.baseline.capabilities);
+		if (caps !== void 0) baseline = { capabilities: caps };
+	}
+	const rules = [];
+	if (!Array.isArray(raw.rules)) check$1.fail(".rules", "expected an array");
+	else {
+		const seen = /* @__PURE__ */ new Set();
+		raw.rules.forEach((entry, index) => {
+			const rule = readRule(check$1, `rules[${index}]`, entry);
+			if (rule === void 0) return;
+			if (seen.has(rule.id)) {
+				check$1.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
+				return;
+			}
+			seen.add(rule.id);
+			rules.push(rule);
+		});
+	}
+	if (check$1.errors.length > 0) return {
+		ok: false,
+		errors: check$1.errors
+	};
+	if (name === void 0 || version === void 0) return {
+		ok: false,
+		errors: check$1.errors
+	};
+	return {
+		ok: true,
+		pack: {
+			prae: "0.1",
+			pack: name,
+			version,
+			...baseline === void 0 ? {} : { baseline },
+			rules
+		}
+	};
+}
+
+//#endregion
+//#region ../ledger/src/entry.ts
+/** The hash a chain starts from. */
+const GENESIS = "0".repeat(64);
+/**
+* Deterministic serialization: object keys sorted at every depth.
+*
+* A hash over `JSON.stringify(entry)` would depend on key insertion order,
+* which means a re-serialized entry could hash differently while saying
+* exactly the same thing — and a verifier that reports tampering on a
+* faithful copy trains its operators to ignore it.
+*/
+function canonical(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+}
+/** Hash one entry's content together with its position and predecessor. */
+function hashEntry(record, seq, prev) {
+	return createHash("sha256").update(canonical({
+		...record,
+		seq,
+		prev
+	})).digest("hex");
+}
+/** Chain a record onto a predecessor. */
+function chain(record, seq, prev) {
+	return {
+		...record,
+		seq,
+		prev,
+		hash: hashEntry(record, seq, prev)
+	};
+}
+/** The short form an auditor quotes from a screenshot. */
+function seal(entry) {
+	return `${entry.hash.slice(0, 4)}…${entry.hash.slice(-4)}`;
+}
+
+//#endregion
+//#region ../ledger/src/ledger.ts
+/**
+* Read a ledger held as text.
+*
+* Split out from the class because a ledger is not always a file being
+* appended to: a build step renders one it imported, and a reader pastes one
+* in. Those callers need the same parsing and the same verification the CLI
+* runs, and a second implementation of either is how two answers to "does this
+* chain hold" come to exist.
+*/
+function readEntries(text) {
+	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+}
+/** Re-derive every hash and confirm each entry names its predecessor. */
+function verifyEntries(text) {
+	const problems = [];
+	let expectedPrev = GENESIS;
+	let expectedSeq = 0;
+	let count = 0;
+	const lines = text.split("\n").filter((line) => line.trim() !== "");
+	for (const [index, line] of lines.entries()) {
+		const at = index + 1;
+		count += 1;
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			problems.push({
+				line: at,
+				message: "not valid JSON"
+			});
+			return {
+				ok: false,
+				entries: count,
+				problems
+			};
+		}
+		if (entry.seq !== expectedSeq) problems.push({
+			line: at,
+			message: `expected seq ${expectedSeq}, found ${entry.seq}`
+		});
+		if (entry.prev !== expectedPrev) problems.push({
+			line: at,
+			message: "does not name the previous entry; a row was removed or reordered"
+		});
+		const { seq, prev, hash,...record } = entry;
+		if (hashEntry(record, seq, prev) !== hash) problems.push({
+			line: at,
+			message: "contents do not match the sealed hash"
+		});
+		expectedPrev = entry.hash;
+		expectedSeq = entry.seq + 1;
+	}
+	return {
+		ok: problems.length === 0,
+		entries: count,
+		problems
+	};
+}
+var Ledger = class Ledger {
+	path;
+	seq;
+	last;
+	constructor(path, seq, last) {
+		this.path = path;
+		this.seq = seq;
+		this.last = last;
+	}
+	/**
+	* Open a ledger, reading the tail to continue an existing chain.
+	*
+	* A corrupt or truncated final line is a hard error rather than something to
+	* skip past: appending onto a chain whose end we could not read would bury
+	* the damage under valid-looking entries.
+	*/
+	static open(path) {
+		mkdirSync(dirname(path), { recursive: true });
+		let text = "";
+		try {
+			text = readFileSync(path, "utf8");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+			writeFileSync(path, "", { flag: "wx" });
+			return new Ledger(path, 0, GENESIS);
+		}
+		const tail = text.split("\n").filter((line) => line.trim() !== "").at(-1);
+		if (tail === void 0) return new Ledger(path, 0, GENESIS);
+		let entry;
+		try {
+			entry = JSON.parse(tail);
+		} catch {
+			throw new Error(`prae ledger: last line of ${path} is not readable; refusing to append onto a chain that cannot be continued`);
+		}
+		return new Ledger(path, entry.seq + 1, entry.hash);
+	}
+	/** Append one decision and return the entry as written. */
+	append(record) {
+		const entry = chain(record, this.seq, this.last);
+		appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
+		this.seq += 1;
+		this.last = entry.hash;
+		return entry;
+	}
+	/** Every entry, in order. */
+	read() {
+		return readEntries(readFileSync(this.path, "utf8"));
+	}
+	/**
+	* Re-derive every hash and confirm each entry names its predecessor.
+	*
+	* Catches a deleted row, an edited field, and a reordering. Does not catch a
+	* wholesale rewrite of the file by someone holding the same code — see the
+	* note in `entry.ts`.
+	*/
+	verify() {
+		return verifyEntries(readFileSync(this.path, "utf8"));
+	}
+};
+
+//#endregion
+//#region src/console/logo.ts
+/**
+* The mark, inlined.
+*
+* A P drawn as a door: the product is the moment permission is granted,
+* and the glyph is the gate it comes through. Inlined as a data URI rather
+* than linked because these pages are read offline and mailed around as
+* evidence — a page that fetches an image renders wrong on the machine that
+* matters.
+*/
+const LOGO = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAABJQSURBVHic7d1frKR1fcfxD+zyR0BQC13FKrKWViANf0ypcRcQxYhpL+oFaUxqk15Ir/ovXtCkvbBNmlTvSNq0tjdIm8bSq9akCbKosGwRagVModDELbSW5Y/CsssuC7tAL54Z5+xwlnPOzHPmNzPf1yt5wjm7uvsFVp/3PM/M90kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgYWxpPQAwsYuSfCbJ7yV5IsnTPf7aH03y5STbkhxO8qMef20AYAO2J7kpyW3pTvhvrDiu6fn3umHs138xyZ1Jbk6yM8mpPf9+wIxtbT0AsKotST6UZEeS65N8LMl5Dec5ezDH9YPvDyW5L8meJPcOjiNtRgMmIQBgPmxJcnm6V9c7knwiybuaTvTWzszxQXA0yfeT7EoXBfeku2oAzCkBAG1sTXJZuhPoziRXJzmn6UTTOSXJhwdHkryW5KGMrhB8M8mP24wGAO2cke5Ef3O6e+mHc/w99mmPzX4PQB/HD5J8JclvJHlfz/MCwFw4K92r+y+mO+EfSf8n1EULgNWC4LZ0b2zc3vP8wBrcAoB+nJ3kqowu6V+V7rI4J7Z9cHxu8P2+dLcLhrcNvpcuFIBNIABgMtvSneSH79K/IsnJTSdafO9JcuPgSJJnkzyQLgZ2JXkwyettRoPlIwBgfc5Pd7Ifvkv/yiQnNZ1o+f10kl8ZHElyMMn9GV0h2J3klTajweITALC67Rmd7K+Pe9Tz4O05/qOHh9NdFRheIdiT5OU2owGwqFZu2Xsym/8GOG8C7P84muS7SW5JdxvhnT3/M4Gl4goAFY1v2bsuyblNJ6IPWzPaRfA76XYRPJ7RFYJvxTMN4CcEABUs2pY9+rElySWD46bBj+3N6HbB3emu9kBJAoBltGxb9ujP8FbPMAiGHz0cRsEjjeaCmRMALIMz0r0rf3hJf2eS05tOxKIY/+jh0+k+XTD8pIGPHrK0BACL6KwkH8nokv7VSU5rOhHL4t05PggOpNtFMLxCcH+6NxvCwhMALAJb9mhl/DHILyX5TjwGmSUgAJhHtuwxr4bPePAYZBaeAGAeDLfsDV/hXxxb9lgM449BPpbk4YyuENyV5Pk2o8FbEwC0YMsey2p8F8HrSR7L6CFH30ryv82mgxUEALOwPaNX99cmeX/bcWBmTs7quwiGVwjuTPLfbUajOgFA32zZg7fmMcjMBQHAtIZLd1Ze0reDHdZvfBfBM0n+LR6DzCYTAGyULXuwubblrR+DfE+SV9uMxjIRAKzlzHQfw7NlD9oYfwzyoSQPxWOQmZIAYNz4lr1rkpzadCJgpTPT/W9zR5KbM/ro4TAGdifZ32w6FoYAwJY9WGwrP3qYeAwy6yQA6nl3uvv2w1f4tuzBcvEYZNZFACw/W/YAj0HmTQTA8lm5Ze+TSS5sOw4wh8Y/emgXQUECYPHZsgdMazwIPAa5AAGwWGzZA2Zhrccg707ySpvR6IsAmG+27AHzYPwxyIfTbSgc3jbwGOQFJADmiy17wCI4I6NdBInHIC8kAdCWLXvAMhh/DPLKXQR7knwzyQ+bTceqBMBs2bIHVHCiXQQegzxHBMDmOi/dCX/4Ct/SHaCqEz0GefhJg0fjo4czJQD6Nb5l78pYugOwGo9BbkwATMeWPYB+nOgxyMMrBA/EY5B7JQA2xpY9gNlY6zHI9yY50ma05SAA1vaBJF9O94a9bW1HAShr/DHIR9LdMrg73WKif023sIh1EgBruyCje1QAzIfT073n6urB98fSPcNgd7rFRLvSLSziBLwjHYBlsDXJVUm+kOSfkvxi23HmnwAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChoa+sBAJbUU0m+muT+JP+R5I0kpyV5b5KfTXJRkp8b/PXCJKe2GZOqBABAv15I8vtJ/j7J0VV+/j+T7Br7sa1JLsibw+CiwY/7/2p65w8VQH/uS3Jjkv/b4H/vWJIfDI47xn7ulCTbMwqClcf74lYuExIAAP14OMkvp7sC0KejSR4fHONOTfIz6QJhe5JLk1wy+PoDEQe8BQEAML0DST6d/k/+a3k1yd7BMe7MdFcJLk/yqSS/muT02Y3GvFOHANP74yT7Wg8x5lCSh5LcmuSz6a4I3JruzYggAACm9GKSv2g9xDo8k+Q3B8dqb06kGAEAMJ1/TvJK6yE24KtJPhdXAsoTAADTuaf1ABP4hyR/3noI2hIAANP5YesBJvSHSX7cegjaEQAA03mu9QATOpjkb1oPQTsCAGA6i3wv/S+z2PMzBQEAUNf/JHms9RC0IQAAaruv9QC0IQAAanu69QC0IQAAanu99QC0IQAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAATGdr6wFgEgIAYDrbWg8wpZNaD0AbAgBgOhe2HmBKP9V6ANoQAADTuaH1AFN6b+sBaEMAAEzn40nObz3EhLYm+WjrIWhDAABM57Qkf9R6iAldE7cAyhIAANP7rSSfaj3EBP6g9QC0IwAApndykr9LcmnrQTbgM0k+2XoI2hEAAP04N8meJJ9uPcg6/EKSW1sPQVsCAKA/5yT5lyS3Z36vBnw8yR1Jzm49CG3ZYAXQvxsHx8NJdid5LMmzSQ4kOTQ4Xkzy0orvN9tFSb6Q5PPx4o8IAIDNdNngWI/9GcXAwYxi4fDg51bGwv4VP3dglf/s4XS3JD6YZEe6e/3XxomfFQQAwHx4x+CAmVCDAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABW1tPQAA9Ojw4Hi59SDzTgAA0NKRJC+kO2Gv9vVa36/8+kdJXp3t+ItLAACwXkfSz4l6+P3+JG/M9O+AnxAAAMurrxP1kSTPJTk62/HZTAIAYD6Mv7qe9ET9QpLnB1/DCQkAgM3zYJLdSf4rybNJDiQ5NDheTPLSiu9hpgQAQL/eSHJ7kj9J8mjjWeCEBABAf/Yn+bUk32g9CKxFAAD047kk1yV5pPUgsB42AQJM77Ukvx4nfxaIAACY3l/FZX8WjAAAmM4rSf609RCwUQIAYDp3JdnXegjYKAEAMJ07Wg8AkxAAANPZ23oAmIQAAJjOs60HgEkIAIDpHGs9AExCAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQJgbU8m+VqSp1oPAgB92dp6gAXwRJLPDr4+P8mOJNcn2ZnkkkYzAcBUBMDGPJXkHwdHkrwnXQjsTBcGVyY5qc1oALB+AmA6+3J8EGxLclVGVwmuiNssAMwhAdCvZ5J8fXAkyduT/FJGtwyuSnJKm9EAYEQAbK6DSXYNjiQ5K8lHMrplcHWS09qMBkBlAmC2XsrxQXBGuvcNDG8Z7EjytjajAVCJAGjrcJJ7B8eX0v37uCyjWwY7k7yj2XQALC0BMF+OJfn3wfGlJFuSXJ7RLYNPJHlXs+kAWBoCYL69llEQ3JLuEwUXZ3TL4GNJzms1HACLSwAslteTPDI4/nrwY9szumVwTZIL2owGwCIRAItvb7oYGAaBbYUArEkALB/bCgFYkwBYfrYVAvAmAqCe8W2FZ6cLAtsKAQoRAByIbYUA5QgAxq21rXBnktPbjAZAXwQAa1lrW+HVSc5pNh0AExEAbJRthQBLQAAwrfFthVuSfCijWwbXJTm32XQArEoA0LfXYlshwNwTAMzC+LbC7RndMrh+8D0AMyQAaGHv4Lht8P1wfbFthQAzIgCYB6utL7423ScMrk33PANBwDx6OckrrYeASQgA5tG+JF8bHIlthcyPQ0nuS7Ino4/HHmk6EUxIALAIbCuklYNJ7k/3Z29PkgeSvNp0IuiJAGAR2VbIZnk6yXfTvbLfleTBJK83nQg2iQBgGdhWyKT2ZXSy35Pk0SRvNJ0IZkQAsIxsK+RE9mZ0//4bSZ5oOg00JACowLbCml5L8nhGr/C/neS5lgPBPBEAVLTWtsJrk7y/zWhM4ViShzN6hX9XkuebTgRzTABAx7bCxXM43Zv07k130r873SdGgHUQALC6E20rHF4luDiWE83aS0m+k9Er/N2xhAcmJgBgfca3FW5Lt5BoGAVXJDm5zWhL60C6z90P36F/f5KjTSeCJSIAYDLPJPn64EhsK+zD0+le1Q9f4X8vPpIHm0YAQD9sK9y48c/gP9J2HKhFAMDmsK3wzfZmdLK/O8mTbccBgNnbmuTDSW5Odxthf7rL3ZMe1/Q83w1TznMs3Sv6ryS5MfYsAMCqhkHwu0luT/f59UUKgKPpdujfku6E/86e5wGAErYkuTTJTemC4LnMVwAcSnf//s/S3dJ4W8+/PwAwsD1dENyW7v75LAPgYJI7k3wx3QnfGxoBoJGfT/L5JH+bbg9Bn3ak23nw2+merGjHAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACt/D8OdL0ResTTzQAAAABJRU5ErkJggg==";
+
+//#endregion
+//#region ../tokens/src/palette.ts
+/**
+* The two grounds, as declaration blocks.
+*
+* The console renders twice from one design: `prae console --out` inlines its
+* stylesheet into standalone documents, and the web app links a real one. Both
+* need these values, so they are defined here once and the test in this
+* package asserts the stylesheet agrees — the same guard the rest of the
+* tokens already have, for the same reason.
+*
+* Names are unprefixed because these are consumed as a surface's own palette
+* rather than alongside another product's. `tokens.css` carries the prefixed
+* `--prae-*` set for anyone embedding PRAE inside their own page.
+*/
+/** §06 — Surface B, the ledger, on paper. Printable and high-contrast. */
+const PAPER = `  --signal: oklch(0.45 0.16 140);
+  --signal-bright: oklch(0.5 0.16 140);
+  --signal-edge: oklch(0.5 0.13 140);
+  --signal-text: oklch(0.42 0.14 140);
+  --signal-on: oklch(0.985 0.003 100);
+  --hold: oklch(0.55 0.15 55);
+  --veto: oklch(0.52 0.19 25);
+  --veto-text: oklch(0.5 0.19 25);
+  --veto-edge: oklch(0.62 0.17 25);
+
+  --ground: oklch(0.975 0.003 100);
+  --raised: oklch(0.99 0.002 100);
+  --sunk: oklch(0.955 0.004 100);
+  --active: oklch(0.955 0.006 130);
+  --line: oklch(0.88 0.004 100);
+  --line-soft: oklch(0.92 0.004 100);
+  --line-faint: oklch(0.93 0.004 100);
+  --line-card: oklch(0.86 0.005 100);
+  --line-strong: oklch(0.8 0.006 100);
+  --edge: oklch(0.32 0.01 255);
+  --ink: oklch(0.22 0.01 255);
+  --ink-row: oklch(0.24 0.01 255);
+  --secondary: oklch(0.4 0.01 255);
+  --muted: oklch(0.5 0.01 255);
+  --muted-soft: oklch(0.55 0.01 255);
+  --dim: oklch(0.45 0.01 255);
+  --seal: oklch(0.6 0.01 255);
+
+  --mark: none;`;
+/** §02 — the graphite ramp and the neon signal it is drawn for. */
+const FENCE = `  --signal: oklch(0.86 0.21 133);
+  --signal-bright: oklch(0.95 0.15 133);
+  --signal-edge: oklch(0.4 0.06 133);
+  --signal-text: oklch(0.86 0.21 133);
+  --signal-on: oklch(0.155 0.008 255);
+  --hold: oklch(0.83 0.16 78);
+  --veto: oklch(0.66 0.2 25);
+  --veto-text: oklch(0.75 0.16 25);
+  --veto-edge: oklch(0.45 0.12 25);
+
+  --ground: oklch(0.155 0.008 255);
+  --raised: oklch(0.185 0.009 255);
+  --sunk: oklch(0.135 0.008 255);
+  --active: oklch(0.215 0.022 133);
+  --line: oklch(0.28 0.01 255);
+  --line-soft: oklch(0.26 0.01 255);
+  --line-faint: oklch(0.235 0.01 255);
+  --line-card: oklch(0.3 0.01 255);
+  --line-strong: oklch(0.32 0.01 255);
+  --edge: oklch(0.72 0.01 255);
+  --ink: oklch(0.96 0.004 255);
+  --ink-row: oklch(0.9 0.006 255);
+  --secondary: oklch(0.72 0.01 255);
+  --muted: oklch(0.6 0.012 255);
+  /* Lands where paper's does, at AA on its own ground: 0.55 measures 4.03
+     against graphite, and this token labels pending and absent states that
+     still have to be read. */
+  --muted-soft: oklch(0.575 0.012 255);
+  --dim: oklch(0.62 0.012 255);
+  --seal: oklch(0.58 0.012 255);
+
+  /* The mark is a solid black glyph, so it disappears on the graphite ground.
+     Inverting it yields the white it would have been drawn as. */
+  --mark: invert(1);`;
+
+//#endregion
+//#region ../tokens/src/views.ts
+/**
+* The console's view styles, as one definition.
+*
+* Header, stat band, ledger grid, rule and mapping tables, the awaiting-human
+* panel, and the limits block — everything that makes a PRAE view look like a
+* PRAE view rather than a generic table.
+*
+* Both renderers need these. `prae console --out` inlines them into standalone
+* documents; the web app injects them into a global style tag. Exported as a
+* string rather than a stylesheet so there is exactly one copy: a `.css` file
+* plus a mirrored constant would be two, and two copies of a stylesheet drift
+* the same way two copies of a palette do.
+*
+* What is *not* here is layout — the rail, the scroll containment, the routing.
+* The app has a persistent frame and the exporter produces separate documents,
+* and that is the one thing the two are genuinely allowed to disagree about.
+*/
+const VIEWS_CSS = `/* ── header ───────────────────────────────────────────────────────────── */
+.head {
+  display: flex; align-items: flex-end; justify-content: space-between;
+  gap: 24px; padding: 26px 30px 22px; border-bottom: 1px solid var(--line);
+}
+.head h1 { font-size: 30px; font-weight: 700; letter-spacing: -0.03em; margin: 0; }
+.head .meta {
+  font-family: var(--proof); font-size: 11.5px; color: var(--muted); margin-top: 6px;
+}
+.actions { display: flex; align-items: center; gap: 10px; }
+.chain {
+  display: flex; align-items: center; gap: 8px; padding: 7px 12px;
+  border: 1px solid var(--signal-edge); border-radius: 999px;
+  font-family: var(--proof); font-size: 10.5px; letter-spacing: 0.12em;
+  color: var(--signal-text); white-space: nowrap;
+}
+.chain i { width: 6px; height: 6px; background: var(--signal-bright); border-radius: 999px; }
+.chain.broken { border-color: var(--veto-edge); color: var(--veto-text); }
+.chain.broken i { background: var(--veto); }
+.btn {
+  padding: 9px 16px; border: 1px solid var(--line-strong); font-size: 13.5px;
+  border-radius: 2px; background: none; color: inherit; font-family: inherit;
+  white-space: nowrap;
+}
+
+/* ── stat band ────────────────────────────────────────────────────────── */
+.stats { display: grid; grid-template-columns: repeat(4, 1fr); border-bottom: 1px solid var(--line); }
+.stat { padding: 20px 24px; border-right: 1px solid var(--line-soft); }
+.stat:first-child { padding-left: 30px; }
+.stat:last-child { border-right: none; }
+.stat .v {
+  font-size: 28px; font-weight: 700; letter-spacing: -0.03em;
+  font-variant-numeric: tabular-nums;
+}
+.stat .v.veto { color: var(--veto); }
+.stat .v.hold { color: var(--hold); }
+.stat .k {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.14em;
+  color: var(--muted); margin-top: 4px;
+}
+
+/* ── ledger table ─────────────────────────────────────────────────────── */
+.grid {
+  display: grid;
+  grid-template-columns: 96px 1fr 150px 130px 104px 120px;
+  gap: 16px;
+}
+.thead {
+  padding: 12px 30px; font-family: var(--proof); font-size: 10px;
+  letter-spacing: 0.14em; color: var(--muted); border-bottom: 1px solid var(--line);
+}
+.row {
+  padding: 14px 30px; font-family: var(--proof); font-size: 12px;
+  border-bottom: 1px solid var(--line-faint); align-items: center;
+}
+.row .seq { color: var(--muted-soft); font-variant-numeric: tabular-nums; }
+.row .call { color: var(--ink-row); overflow-wrap: anywhere; }
+.row .actor, .row .clause { color: var(--dim); }
+.row .seal { color: var(--seal); }
+.row .verdict { letter-spacing: 0.1em; }
+.v-allow { color: var(--signal-text); }
+.v-deny { color: var(--veto-text); }
+.v-ask { color: var(--hold); }
+.v-correct { color: var(--muted); }
+.empty { padding: 30px; font-family: var(--proof); font-size: 12px; color: var(--muted); }
+
+/* ── awaiting-human panel ─────────────────────────────────────────────── */
+.await { padding: 26px 30px 30px; background: var(--sunk); border-top: 1px solid var(--line); }
+.await .k {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
+  color: var(--muted); margin-bottom: 16px;
+}
+.card {
+  display: flex; gap: 24px; align-items: flex-start; background: var(--raised);
+  border: 1px solid var(--line-card); padding: 22px 24px;
+}
+.card h2 { font-size: 20px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 8px; }
+.card .detail { font-family: var(--proof); font-size: 12px; color: var(--muted); line-height: 1.8; }
+.decide { display: flex; flex-direction: column; gap: 8px; width: 200px; flex: none; }
+.approve {
+  padding: 11px 18px; background: var(--signal); color: var(--signal-on);
+  font-weight: 600; font-size: 13.5px; text-align: center; border-radius: 2px;
+  border: none; font-family: inherit;
+}
+.deny {
+  padding: 11px 18px; border: 1px solid var(--veto-edge); color: var(--veto-text);
+  font-weight: 600; font-size: 13.5px; text-align: center; border-radius: 2px;
+  background: none; font-family: inherit;
+}
+/*
+ * A control that cannot act must not look like one that can. These render so
+ * the reader knows where the decision lives, and read as inert so they never
+ * reach for it — the harness settles approvals, and a button that looks live
+ * here would be an invitation to a second audit trail.
+ *
+ * The fill is dropped rather than faded. Fading a filled button works against
+ * paper and fails against graphite, where a dimmed green block still reads as
+ * a live primary action; an outline reads the same on either ground.
+ */
+.approve[disabled], .deny[disabled] {
+  background: none; border: 1px solid var(--line-strong);
+  color: var(--muted-soft); font-weight: 500; cursor: not-allowed;
+}
+.recorded {
+  font-family: var(--proof); font-size: 10px; color: var(--muted-soft);
+  text-align: center; letter-spacing: 0.08em;
+}
+
+/* ── limits ───────────────────────────────────────────────────────────── */
+.limits { padding: 22px 30px 28px; border-top: 1px solid var(--line); }
+.limits .k {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
+  color: var(--muted); margin-bottom: 10px;
+}
+.limits ul { margin: 0; padding-left: 18px; font-size: 13px; line-height: 1.7; color: var(--secondary); }
+.limits code { font-family: var(--proof); font-size: 12px; }
+
+/* ── rule / mapping tables, shared by the packs and compliance views ──── */
+.rules { display: grid; grid-template-columns: 110px 1fr 96px; gap: 16px; }
+.map { display: grid; grid-template-columns: 210px 1fr 96px; gap: 16px; }
+.sect { padding: 22px 30px 8px; }
+.sect h2 {
+  font-size: 20px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 4px;
+}
+.sect p {
+  margin: 0 0 4px; font-size: 14px; line-height: 1.6; color: var(--secondary);
+  max-width: 76ch;
+}
+.caps { display: flex; flex-wrap: wrap; gap: 6px; padding: 4px 30px 22px; }
+.cap {
+  font-family: var(--proof); font-size: 12px; padding: 6px 10px;
+  border: 1px solid var(--signal-edge); color: var(--signal-text);
+  border-radius: 2px;
+}
+.cap.off {
+  border-color: var(--line-strong); color: var(--muted-soft);
+  text-decoration: line-through;
+}
+.effect { letter-spacing: 0.1em; font-size: 11px; }
+.e-deny { color: var(--veto-text); }
+.e-ask { color: var(--hold); }
+.e-warn { color: var(--muted); }
+.e-correct { color: var(--signal-text); }
+.covered { color: var(--signal-text); }
+.partial { color: var(--hold); }
+.absent { color: var(--muted-soft); }
+
+button { cursor: pointer; }
+a:focus-visible, button:focus-visible { outline: 2px solid var(--signal); outline-offset: 2px; }
+`;
+
+//#endregion
+//#region ../tokens/src/index.ts
+/** The Google Fonts stylesheet both surfaces link. */
+const FONT_HREF = "https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap";
+/**
+* Verdict chip labels. Uppercase, mono, and never rendered without a clause
+* reference within 8px — §04 is explicit that a chip alone is not allowed.
+*/
+const VERDICT_LABEL$1 = {
+	allow: "ALLOWED",
+	ask: "HELD",
+	deny: "DENIED",
+	correct: "CORRECTED"
+};
+
+//#endregion
+//#region src/console/shell.ts
+function esc(value) {
+	return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+/** The stylesheet both console views share. Tokens first, then the surface. */
+/** The stylesheet both console views share. Tokens first, then the surface. */
+const SHEET = `
+:root {
+${PAPER}
+  --claim: 'Space Grotesk', ui-sans-serif, system-ui, sans-serif;
+  --proof: 'IBM Plex Mono', ui-monospace, 'SF Mono', Menlo, monospace;
+  --ease: cubic-bezier(0.2, 0, 0, 1);
+  --surface-motion: 180ms;
+}
+
+/* An explicit choice, remembered. */
+:root[data-theme='dark'] {
+${FENCE}
+}
+
+/* No choice made: follow the machine, unless the reader has said light. */
+@media (prefers-color-scheme: dark) {
+  :root:not([data-theme='light']) {
+${FENCE}
+  }
+}
+
+/*
+ * The ground moves at the surface budget, and only while it is moving.
+ *
+ * Arming this permanently would put a 180ms fade on every hover and every
+ * verdict that renders, so the class goes on for one toggle and comes off.
+ * §01's 0ms rule is about a decision animating in; nothing is deciding here,
+ * the page is repainting, and a verdict that snapped while the page behind it
+ * faded would read as a glitch.
+ */
+html.theming, html.theming * {
+  transition:
+    background-color var(--surface-motion) var(--ease),
+    border-color var(--surface-motion) var(--ease),
+    color var(--surface-motion) var(--ease),
+    fill var(--surface-motion) var(--ease) !important;
+}
+
+* { box-sizing: border-box; }
+
+/*
+ * An application, not a document: the shell fills the viewport and only the
+ * content column scrolls, so the rail and the header stay where a reader left
+ * them. Print undoes all of it further down — the same page still has to
+ * flatten into evidence.
+ */
+html, body { height: 100%; }
+body {
+  margin: 0;
+  background: var(--ground);
+  color: var(--ink);
+  font-family: var(--claim);
+  -webkit-font-smoothing: antialiased;
+  overflow: hidden;
+}
+
+.wrap { height: 100%; }
+.scroll { height: 100%; }
+
+.console {
+  background: var(--ground);
+  display: grid;
+  grid-template-columns: 232px 1fr;
+  height: 100%;
+  min-height: 0;
+}
+
+/* The one column that moves. */
+.console > main {
+  overflow-y: auto;
+  overflow-x: auto;
+  min-height: 0;
+  scroll-behavior: smooth;
+}
+
+/* ── rail ─────────────────────────────────────────────────────────────── */
+.rail {
+  border-right: 1px solid var(--line); padding: 22px 0;
+  overflow-y: auto; min-height: 0;
+  display: flex; flex-direction: column;
+}
+.rail .compliance { margin-top: auto; }
+
+/*
+ * Two positions, named, rather than a switch with a state you have to infer.
+ * Hidden until the head script has run: without scripting it would be a
+ * control that does nothing.
+ */
+.ground { display: none; margin: auto 20px 14px; }
+html.js .ground { display: grid; grid-template-columns: 1fr 1fr; }
+html.js .rail .compliance { margin-top: 0; }
+.ground button {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.14em;
+  padding: 6px 0; background: none; color: var(--muted);
+  border: 1px solid var(--line); border-radius: 0;
+  transition: color 120ms var(--ease), border-color 120ms var(--ease);
+}
+.ground button:first-child { border-radius: 2px 0 0 2px; border-right: none; }
+.ground button:last-child { border-radius: 0 2px 2px 0; }
+.ground button:hover { color: var(--secondary); }
+:root:not([data-theme='dark']) .ground [data-ground='paper'],
+:root[data-theme='dark'] .ground [data-ground='fence'] {
+  color: var(--ink); border-color: var(--line-strong); background: var(--active);
+}
+.brand { display: flex; align-items: center; gap: 10px; padding: 0 20px 22px; }
+/* The canvas sizes the mark at 26px; the glyph is square and needs no frame. */
+.mark { width: 26px; height: 26px; display: block; filter: var(--mark); }
+.brand b {
+  font-weight: 700; font-size: 16px; letter-spacing: 0.04em;
+}
+.eyebrow {
+  font-family: var(--proof); font-size: 10px; letter-spacing: 0.16em;
+  color: var(--muted-soft); padding: 0 20px 10px;
+}
+.nav { display: grid; }
+.nav a, .nav span {
+  padding: 10px 20px; font-size: 14.5px; color: var(--secondary);
+  text-decoration: none; display: flex; justify-content: space-between;
+  align-items: center;
+}
+.nav a { transition: background var(--t-state, 120ms) var(--ease, cubic-bezier(.2,0,0,1)),
+                     color var(--t-state, 120ms) var(--ease, cubic-bezier(.2,0,0,1)); }
+.nav a:hover { background: var(--sunk); }
+
+/*
+ * The surface transition, spent where the language says to spend it. Verdicts
+ * are deliberately excluded: a decision appears, it never animates in.
+ */
+main > * { animation: surface 180ms cubic-bezier(0.2, 0, 0, 1) both; }
+@keyframes surface {
+  from { opacity: 0; transform: translateY(4px); }
+  to { opacity: 1; transform: none; }
+}
+main.leaving { opacity: 0; transition: opacity 120ms cubic-bezier(0.2, 0, 0, 1); }
+@media (prefers-reduced-motion: reduce) {
+  main > *, main.leaving { animation: none; transition: none; }
+  .console > main { scroll-behavior: auto; }
+  :root { --surface-motion: 0ms; }
+}
+.nav .pending { color: var(--muted-soft); }
+.nav .badge.soon {
+  font-size: 9px; letter-spacing: 0.14em; color: var(--muted-soft);
+  border: 1px solid var(--line); border-radius: 999px; padding: 1px 6px;
+}
+.nav a.on {
+  font-weight: 600; color: var(--ink);
+  border-left: 2px solid var(--signal-bright);
+  background: var(--active); margin-left: -1px;
+}
+.nav .badge { font-family: var(--proof); font-size: 11px; color: var(--hold); }
+.compliance {
+  margin: 22px 20px 0; padding-top: 18px; border-top: 1px solid var(--line-soft);
+  font-family: var(--proof); font-size: 10.5px; line-height: 1.9; color: var(--muted);
+}
+
+${VIEWS_CSS}
+
+/* Print is a first-class state, not an afterthought. */
+@media print {
+  @page { margin: 12mm; }
+  /* Evidence prints on paper. The fence has no printed form. */
+  :root, :root[data-theme='dark'] {
+${PAPER}
+  }
+  html.theming, html.theming * { transition: none !important; }
+  html, body { height: auto; overflow: visible; }
+  body { padding: 0; background: #fff; }
+  .wrap, .scroll { height: auto; }
+  .console > main { overflow: visible; height: auto; }
+  main > * { animation: none; }
+  .console {
+    border: none; grid-template-columns: 1fr; min-width: 0;
+    height: auto; display: block;
+  }
+  .rail, .actions, .decide, .ground { display: none; }
+  .thead { display: grid; }
+  thead { display: table-header-group; }
+  .row { break-inside: avoid; }
+  /* A chip is colour; a printed page may not be. Keep the word. */
+  .chain { border-color: currentColor !important; }
+  .stats { break-inside: avoid; }
+}
+`;
+/**
+* Resolve the ground before the first paint.
+*
+* This runs in `<head>`, synchronously, on purpose: read the choice after the
+* body has painted and the reader watches the page flash the wrong palette on
+* every navigation. It also marks the document as scripted, which is what
+* reveals the toggle — a control that cannot work should not be offered.
+*/
+const GROUND_SCRIPT = `
+(() => {
+  const root = document.documentElement;
+  root.classList.add('js');
+  let choice = null;
+  try { choice = localStorage.getItem('prae-ground'); } catch (e) {}
+  if (choice !== 'dark' && choice !== 'light') {
+    choice = matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
+  root.dataset.theme = choice;
+})();
+`;
+/**
+* Client-side navigation, as progressive enhancement.
+*
+* Every view is still a complete document that opens, prints and mails on its
+* own — that requirement has not moved. This only intercepts a click when the
+* page is being served, swaps the main column, and leaves the rail alone, so
+* the frame stays put and the surface transition the language budgets actually
+* has somewhere to happen. With scripting off, the links are ordinary links.
+*/
+const NAV_SCRIPT = `
+(() => {
+  const main = () => document.querySelector('main');
+  const rail = () => document.querySelector('.rail');
+  if (!main() || !window.fetch) return;
+
+  const swap = async (href, push) => {
+    const target = main();
+    target.classList.add('leaving');
+    try {
+      const res = await fetch(href, { headers: { accept: 'text/html' } });
+      if (!res.ok) throw new Error(String(res.status));
+      const doc = new DOMParser().parseFromString(await res.text(), 'text/html');
+      const next = doc.querySelector('main');
+      const nextRail = doc.querySelector('.rail');
+      if (!next) throw new Error('no main');
+
+      // Collect the view's scripts BEFORE moving it: replaceWith detaches the
+      // element from the parsed document, so querying that document afterwards
+      // finds nothing and the view arrives inert. A parser-created script never
+      // executes on insertion either, which is why each is re-created below.
+      const scripts = [...next.querySelectorAll('script')].map((s) => s.textContent);
+      for (const s of next.querySelectorAll('script')) s.remove();
+
+      target.replaceWith(next);
+      // Only the rail's active marker changes; the element itself stays, so
+      // nothing in it flickers or loses scroll position.
+      if (nextRail) rail().innerHTML = nextRail.innerHTML;
+      if (doc.title) document.title = doc.title;
+      if (push) history.pushState({}, '', href);
+      next.scrollTop = 0;
+      wire();
+      for (const code of scripts) {
+        const el = document.createElement('script');
+        el.textContent = code;
+        document.body.appendChild(el);
+      }
+    } catch {
+      // A failed swap falls back to a real navigation rather than stranding
+      // the reader on a half-updated page.
+      location.href = href;
+    }
+  };
+
+  const wire = () => {
+    for (const a of document.querySelectorAll('.nav a[href$=".html"]')) {
+      a.addEventListener('click', (e) => {
+        if (e.metaKey || e.ctrlKey || e.shiftKey || e.button !== 0) return;
+        e.preventDefault();
+        swap(a.getAttribute('href'), true);
+      });
+    }
+  };
+
+  // Delegated, because a client-side swap replaces the rail's markup and a
+  // handler bound to the old buttons would go with it.
+  let settle;
+  document.addEventListener('click', (e) => {
+    const button = e.target.closest('[data-ground]');
+    if (!button) return;
+    const next = button.dataset.ground === 'fence' ? 'dark' : 'light';
+    const root = document.documentElement;
+    if (root.dataset.theme === next) return;
+
+    // Arm the transition, let the current palette paint once, then move. Doing
+    // both in one frame gives the browser no 'from' state and it jumps.
+    root.classList.add('theming');
+    void root.offsetHeight;
+    root.dataset.theme = next;
+    try { localStorage.setItem('prae-ground', next); } catch (err) {}
+    clearTimeout(settle);
+    settle = setTimeout(() => root.classList.remove('theming'), 240);
+  });
+
+  addEventListener('popstate', () => swap(location.pathname, false));
+  wire();
+})();
+`;
+/** Wrap a view in the console shell: rail, then the view's own header and body. */
+function renderShell(page) {
+	return `<!doctype html>
+<html lang="en" data-prae="ledger"><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(page.title)}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="${FONT_HREF}" rel="stylesheet">
+<script>${GROUND_SCRIPT}<\/script>
+<style>${SHEET}</style>
+</head><body>
+<div class="wrap"><div class="scroll">
+<div class="console">
+  <nav class="rail">
+    <div class="brand"><img class="mark" src="${LOGO}" alt=""><b>PRAE</b></div>
+    <div class="eyebrow">CONTROL PLANE</div>
+    ${page.nav}
+    <div class="ground" role="group" aria-label="Ground">
+      <button type="button" data-ground="paper">PAPER</button>
+      <button type="button" data-ground="fence">FENCE</button>
+    </div>
+    <div class="compliance">EU AI ACT art. 12<br>NIST AI 600-1<br>SOC 2 CC7.2</div>
+  </nav>
+  <main>
+${page.head}
+${page.body}
+  </main>
+</div>
+</div></div>
+<script>${NAV_SCRIPT}<\/script>
+</body></html>
+`;
+}
+function renderNav(items, active) {
+	return `<div class="nav">\n${items.map((item) => {
+		const classes = [item.label === active ? "on" : "", item.pending === true ? "pending" : ""].filter(Boolean).join(" ");
+		const attr = classes === "" ? "" : ` class="${classes}"`;
+		const badge = item.pending === true ? "<span class=\"badge soon\">SOON</span>" : item.badge === void 0 || item.badge === 0 ? "" : `<span class="badge">${item.badge}</span>`;
+		const href = item.pending === true ? "" : ` href="${esc(item.href ?? "#")}"`;
+		const tag = item.pending === true ? "span" : "a";
+		return `    <${tag}${href}${attr}>${esc(item.label)}${badge}</${tag}>`;
+	}).join("\n")}\n    </div>`;
+}
+
+//#endregion
+//#region ../controls/src/index.ts
+/**
+* What each control asks for, and what this profile actually produces.
+*
+* Framed as evidence toward a control, never as compliance with it. Nothing
+* here certifies anything: an auditor decides whether the evidence satisfies
+* the obligation, and a tool that told them the answer would be selling the
+* one thing it cannot supply.
+*/
+const CONTROLS = [
+	{
+		id: "EU AI Act art. 12",
+		asks: "Automatic recording of events over the lifetime of the system, to a degree that enables tracing.",
+		evidence: (data) => ({
+			state: data.entries.length > 0 ? "covered" : "partial",
+			note: data.entries.length > 0 ? `${data.entries.length} decisions recorded, each with the clause that produced it and a hash linking it to the one before.` : "Recording is configured but nothing has been logged yet."
+		})
+	},
+	{
+		id: "NIST AI 600-1 · GV-1.2",
+		asks: "Characteristics of trustworthy AI are integrated into organisational policies.",
+		evidence: (data) => ({
+			state: data.pack === void 0 ? "absent" : "covered",
+			note: data.pack === void 0 ? "No pack supplied to this view." : `${data.pack.rules.length} rules are declared as data and applied to every tool call, rather than living in a runbook.`
+		})
+	},
+	{
+		id: "NIST AI 600-1 · MS-2.6",
+		asks: "AI system is evaluated regularly for safety risks, with results documented.",
+		evidence: () => ({
+			state: "partial",
+			note: "Decisions are documented per call. Periodic evaluation of the policy itself is an operator process this tool does not perform."
+		})
+	},
+	{
+		id: "SOC 2 · CC7.2",
+		asks: "The entity monitors system components for anomalies indicative of malicious acts.",
+		evidence: (data) => ({
+			state: data.entries.some((e) => e.verdict === "deny") ? "covered" : "partial",
+			note: `Refusals and held calls are recorded with their clause. ${data.entries.some((e) => e.verdict === "deny") ? "This record contains refusals." : "This record contains none yet, so the monitoring is unproven in practice."}`
+		})
+	},
+	{
+		id: "SOC 2 · CC6.1",
+		asks: "Logical access to protected information assets is restricted to authorised users.",
+		evidence: () => ({
+			state: "partial",
+			note: "Capabilities are restricted per agent. Authorisation of the human is not: approvals record what was decided, never who decided it."
+		})
+	}
+];
+
+//#endregion
+//#region src/console/views.ts
+/** One rail for every view, so the shape of the product stays consistent. */
+function navFor(data) {
+	return [
+		{
+			label: "Overview",
+			href: "overview.html"
+		},
+		{
+			label: "Policy packs",
+			href: "packs.html"
+		},
+		{
+			label: "Playground",
+			href: "playground.html"
+		},
+		{
+			label: "Approvals",
+			href: "approvals.html",
+			badge: data.entries.filter((e) => e.verdict === "ask").length
+		},
+		{
+			label: "Audit ledger",
+			href: "ledger.html"
+		},
+		{
+			label: "Fleet",
+			pending: true
+		},
+		{
+			label: "Compliance map",
+			href: "compliance.html"
+		}
+	];
+}
+function chainPill(ok) {
+	return `<div class="chain${ok ? "" : " broken"}"><i></i>${ok ? "CHAIN INTACT" : "CHAIN BROKEN"}</div>`;
+}
+function header(title, meta, ok) {
+	return `    <header class="head">
+      <div><h1>${esc(title)}</h1><div class="meta">${esc(meta)}</div></div>
+      <div class="actions">${chainPill(ok)}
+        <button type="button" class="btn" onclick="window.print()">Export evidence</button>
+      </div>
+    </header>`;
+}
+function renderOverview(data) {
+	const counts = {};
+	for (const entry of data.entries) counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
+	const held = counts.ask ?? 0;
+	const pack = data.pack;
+	const enforcing = pack?.rules.some((r) => r.effect.kind === "deny") ?? false;
+	const body = `${`    <section class="stats">
+      <div class="stat"><div class="v">${data.entries.length}</div><div class="k">DECISIONS</div></div>
+      <div class="stat"><div class="v veto">${counts.deny ?? 0}</div><div class="k">VETOED</div></div>
+      <div class="stat"><div class="v hold">${held}</div><div class="k">AWAITING HUMAN</div></div>
+      <div class="stat"><div class="v">${pack === void 0 ? "—" : esc(pack.rules.length)}</div><div class="k">RULES IN FORCE</div></div>
+    </section>`}
+    <section class="sect">
+      <h2>Posture</h2>
+      <p>${pack === void 0 ? "No pack was supplied to this view, so nothing here describes a policy in force." : enforcing ? `<strong>${esc(pack.pack)} ${esc(pack.version)}</strong> is enforcing: some calls are refused outright.` : `<strong>${esc(pack.pack)} ${esc(pack.version)}</strong> is observing: it records what an enforcing pack would refuse, and denies nothing.`}</p>
+      <p>${data.verification.ok ? "The decision chain verifies: no row has been removed, edited, or reordered since it was written." : "The decision chain does <strong>not</strong> verify. This record is not continuous, and the Audit ledger names where it breaks."}</p>
+    </section>
+    <section class="sect" style="padding-bottom:26px">
+      <h2>What is not covered</h2>
+      <p>This gate decides tool calls. It does not sandbox plugin code — a
+      plugin's <code>apply()</code> runs with full privileges before any tool
+      call exists — and it does not secure the harness itself. Approvals record
+      what was decided, never who decided it.</p>
+    </section>`;
+	return renderShell({
+		title: `Overview — ${pack?.pack ?? "PRAE"}`,
+		nav: renderNav(navFor(data), "Overview"),
+		head: header("Overview", `${data.entries.length} decisions · ${pack === void 0 ? "no pack" : `${pack.pack} ${pack.version}`}`, data.verification.ok),
+		body
+	});
+}
+function matcherOf(rule) {
+	const when = rule.when;
+	const parts = [];
+	const list = (v) => v === void 0 ? void 0 : Array.isArray(v) ? v.join(", ") : String(v);
+	const cap = list(when.capability);
+	if (cap !== void 0) parts.push(`capability ${cap}`);
+	const tool = list(when.tool);
+	if (tool !== void 0) parts.push(`tool ${tool}`);
+	const plugin = list(when.plugin);
+	if (plugin !== void 0) parts.push(`plugin ${plugin}`);
+	if (when.path?.outside !== void 0) parts.push(`path outside ${when.path.outside.join(", ")}`);
+	if (when.path?.inside !== void 0) parts.push(`path inside ${when.path.inside.join(", ")}`);
+	if (when.host?.notIn !== void 0) parts.push(`host not in ${when.host.notIn.join(", ")}`);
+	if (when.host?.in !== void 0) parts.push(`host in ${when.host.in.join(", ")}`);
+	if (when.count !== void 0) parts.push(`more than ${when.count.above}`);
+	for (const arg of when.arg ?? []) {
+		const bits = [
+			arg.above === void 0 ? "" : `above ${arg.above}`,
+			arg.below === void 0 ? "" : `below ${arg.below}`,
+			arg.equals === void 0 ? "" : `= ${String(arg.equals)}`
+		].filter(Boolean);
+		parts.push(`${arg.name} ${bits.join(" ")}`.trim());
+	}
+	return parts.length === 0 ? "every call" : parts.join(" · ");
+}
+function renderPacks(data) {
+	const pack = data.pack;
+	if (pack === void 0) return renderShell({
+		title: "Policy packs",
+		nav: renderNav(navFor(data), "Policy packs"),
+		head: header("Policy packs", "no pack supplied", data.verification.ok),
+		body: "    <div class=\"empty\">Pass --pack to render the policy in force.</div>"
+	});
+	const baseline = pack.baseline?.capabilities;
+	const caps = baseline === void 0 ? `<p style="padding:0 30px 22px;font-size:14px;color:var(--secondary);max-width:76ch">This pack sets no capability ceiling. It governs through its rules alone, and withholds nothing an author declares.</p>` : `<div class="caps">${baseline.map((c) => `<span class="cap">${esc(c)}</span>`).join("")}</div>`;
+	const rows = pack.rules.map((rule) => `      <div class="grid rules row">
+        <div class="seq">${esc(rule.id)}</div>
+        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span></div>
+        <div class="effect e-${esc(rule.effect.kind)}">${esc(rule.effect.kind.toUpperCase())}</div>
+      </div>`).join("\n");
+	const body = `    <section class="sect">
+      <h2>${esc(pack.pack)} <span style="font-family:var(--proof);font-size:14px;color:var(--muted)">${esc(pack.version)}</span></h2>
+      <p>The operator baseline is intersected with whatever a plugin's own
+      manifest declares, and the operator can only ever narrow. A pack cannot
+      grant a capability an author never asked for.</p>
+    </section>
+    ${caps}
+    <div class="grid rules thead">
+      <div>CLAUSE</div><div>RULE</div><div>EFFECT</div>
+    </div>
+${rows}
+    <section class="sect" style="padding-bottom:26px">
+      <h2>Ordering</h2>
+      <p>When several rules match one call the strongest effect wins —
+      deny over ask over correct over warn — and every match stays in the
+      trace. That is what makes a pack safe to extend: appending a rule can
+      raise a decision's strength and never lower it.</p>
+    </section>`;
+	return renderShell({
+		title: `Policy packs — ${pack.pack}`,
+		nav: renderNav(navFor(data), "Policy packs"),
+		head: header("Policy packs", `${pack.pack} ${pack.version} · ${pack.rules.length} rules`, data.verification.ok),
+		body
+	});
+}
+function renderCompliance(data) {
+	const body = `    <section class="sect">
+      <h2>Evidence, not compliance</h2>
+      <p>Each row states what a control asks for and what this profile actually
+      produces. Nothing here certifies anything — whether the evidence satisfies
+      the obligation is an auditor's judgement, and a tool that answered it for
+      them would be selling the one thing it cannot supply.</p>
+    </section>
+    <div class="grid map thead">
+      <div>CONTROL</div><div>ASKS FOR · WHAT THIS PROFILE PRODUCES</div><div>STATE</div>
+    </div>
+${CONTROLS.map((control) => {
+		const found = control.evidence(data);
+		const label = found.state === "covered" ? "EVIDENCE" : found.state === "partial" ? "PARTIAL" : "NONE";
+		return `      <div class="grid map row">
+        <div class="call">${esc(control.id)}</div>
+        <div class="actor">${esc(control.asks)}<br><span style="color:var(--ink-row)">${esc(found.note)}</span></div>
+        <div class="effect ${esc(found.state)}">${label}</div>
+      </div>`;
+	}).join("\n")}
+    <section class="sect" style="padding-bottom:26px">
+      <h2>The gap that recurs</h2>
+      <p>Three of these rows stop at <em>partial</em> for the same reason: the
+      harness records what was decided and never who decided it. Attributable
+      approval needs an identity anchor outside this machine, which is a
+      control-plane concern this build does not claim.</p>
+    </section>`;
+	return renderShell({
+		title: "Compliance map",
+		nav: renderNav(navFor(data), "Compliance map"),
+		head: header("Compliance map", `${CONTROLS.length} controls · evidence from this profile`, data.verification.ok),
+		body
+	});
+}
+/**
+* Every call the policy held, and what became of it.
+*
+* This is a queue you read, not one you act on. The gate returns `ask` into the
+* harness's own approval seam and the harness settles it there; a second set of
+* buttons here would mean two places to approve from and two audit trails to
+* reconcile. So the view shows what is waiting and what was decided, and says
+* plainly where the decision happens.
+*/
+function renderApprovals(data) {
+	const held = data.entries.filter((e) => e.verdict === "ask");
+	const settled = data.entries.filter((e) => e.rule === "approval");
+	const now = Date.parse(data.generatedAt);
+	const waited = (iso) => {
+		const s = Math.max(0, Math.round((now - Date.parse(iso)) / 1e3));
+		if (!Number.isFinite(s)) return "";
+		const h = Math.floor(s / 3600);
+		const m = Math.floor(s % 3600 / 60);
+		return h > 0 ? `${h}h ${m}m` : `${m}m`;
+	};
+	const queue = held.length === 0 ? "    <div class=\"empty\">Nothing is waiting on a human.</div>" : held.map((e) => `    <section class="await" style="border-top:none">
+      <div class="card">
+        <div style="flex:1">
+          <h2>${esc(e.tool)}${e.subject === void 0 ? "" : ` on ${esc(e.subject)}`}</h2>
+          <div class="detail">
+            ${esc(e.rule ?? "held")} · ${esc(e.session ?? "local session")} · waiting ${esc(waited(e.at))}<br>
+            ${esc(e.reason ?? "")}
+          </div>
+        </div>
+        <div class="decide">
+          <button type="button" class="approve" disabled title="The harness settles approvals; a second prompt would mean two audit trails">Approve</button>
+          <button type="button" class="deny" disabled title="The harness settles approvals; a second prompt would mean two audit trails">Deny</button>
+          <div class="recorded">SETTLED IN THE HARNESS</div>
+        </div>
+      </div>
+    </section>`).join("\n");
+	const history = settled.length === 0 ? "" : `    <div class="grid map thead">
+      <div>WHEN</div><div>CALL · WHY</div><div>OUTCOME</div>
+    </div>
+${settled.map((e) => `      <div class="grid map row">
+        <div class="seq">${esc(e.at.replace("T", " ").replace(/\.\d+Z$/, "Z"))}</div>
+        <div class="call">${esc(e.tool)}${e.subject === void 0 ? "" : ` ${esc(e.subject)}`}<br><span style="color:var(--muted)">${esc(e.reason ?? "")}${e.actor === void 0 ? "" : ` · ${esc(e.actor)}`}</span></div>
+        <div class="effect ${e.verdict === "allow" ? "covered" : "absent"}">${e.verdict === "allow" ? "APPROVED" : "REFUSED"}</div>
+      </div>`).join("\n")}`;
+	const body = `    <section class="stats">
+      <div class="stat"><div class="v hold">${held.length}</div><div class="k">AWAITING HUMAN</div></div>
+      <div class="stat"><div class="v">${settled.length}</div><div class="k">SETTLED</div></div>
+      <div class="stat"><div class="v">${settled.filter((e) => e.actor !== void 0).length}</div><div class="k">WITH AN ACTOR</div></div>
+      <div class="stat"><div class="v">${data.entries.length}</div><div class="k">DECISIONS</div></div>
+    </section>
+    <section class="sect">
+      <h2>Waiting</h2>
+      <p>A held call is one a clause would not decide alone. The harness owns
+      the prompt and settles it; this is the queue, not a second place to
+      approve from.</p>
+    </section>
+${queue}
+    <section class="sect">
+      <h2>Settled</h2>
+      <p>Where an entry names an actor, that name is asserted by configuration.
+      The harness records what was decided and never who decided it, so an
+      attributable approval needs an identity anchor this build does not have.</p>
+    </section>
+${history}`;
+	return renderShell({
+		title: "Approvals",
+		nav: renderNav(navFor(data), "Approvals"),
+		head: header("Approvals", `${held.length} waiting · ${settled.length} settled`, data.verification.ok),
+		body
+	});
+}
+
+//#endregion
+//#region src/console/ledger.ts
+function ago(iso, now) {
+	const seconds = Math.max(0, Math.round((now - Date.parse(iso)) / 1e3));
+	if (Number.isNaN(seconds)) return "";
+	const h = Math.floor(seconds / 3600);
+	const m = Math.floor(seconds % 3600 / 60);
+	const s = seconds % 60;
+	return `${String(h).padStart(2, "0")}:${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
+}
+function row(entry) {
+	const call = entry.subject === void 0 ? entry.tool : `${entry.tool} ${entry.subject}`;
+	const actor = entry.actor ?? entry.agent ?? "—";
+	return `      <div class="grid row">
+        <div class="seq">${entry.seq}</div>
+        <div class="call">${esc(call)}</div>
+        <div class="actor">${esc(actor)}</div>
+        <div class="clause">${esc(entry.rule ?? "—")}</div>
+        <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}</div>
+        <div class="seal">${esc(seal(entry))}</div>
+      </div>`;
+}
+function renderLedgerView(entries, verification, options) {
+	const counts = {};
+	const packs = /* @__PURE__ */ new Set();
+	const sessions = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		counts[entry.verdict] = (counts[entry.verdict] ?? 0) + 1;
+		packs.add(`${entry.pack.name} ${entry.pack.version}`);
+		if (entry.session !== void 0) sessions.add(entry.session);
+	}
+	const held = entries.filter((e) => e.verdict === "ask");
+	const pack = [...packs][0] ?? "—";
+	const now = Date.parse(options.generatedAt);
+	const chainOk = verification.ok;
+	const head = `    <header class="head">
+      <div>
+        <h1>Audit ledger</h1>
+        <div class="meta">${esc([
+		`${sessions.size || 1} session${sessions.size === 1 ? "" : "s"}`,
+		`${entries.length.toLocaleString("en-US")} decisions`,
+		options.retention === void 0 ? "retention local" : `retention ${options.retention}`
+	].join(" · "))}</div>
+      </div>
+      <div class="actions">
+        <div class="chain${chainOk ? "" : " broken"}"><i></i>${chainOk ? "CHAIN INTACT" : "CHAIN BROKEN"}</div>
+        <button type="button" class="btn" onclick="window.print()">Export evidence</button>
+      </div>
+    </header>`;
+	const stats = `    <section class="stats">
+      <div class="stat"><div class="v">${entries.length.toLocaleString("en-US")}</div><div class="k">DECISIONS</div></div>
+      <div class="stat"><div class="v veto">${counts.deny ?? 0}</div><div class="k">VETOED</div></div>
+      <div class="stat"><div class="v hold">${held.length}</div><div class="k">AWAITING HUMAN</div></div>
+      <div class="stat"><div class="v">${esc(pack.split(" ")[1] ?? "—")}</div><div class="k">PACK · ${esc(pack.split(" ")[0] ?? "")}</div></div>
+    </section>`;
+	const table = `    <div class="grid thead">
+      <div>SEQ</div><div>CALL</div><div>ACTOR</div><div>CLAUSE</div><div>VERDICT</div><div>SEAL</div>
+    </div>
+${entries.length === 0 ? "    <div class=\"empty\">No decisions recorded yet.</div>" : [...entries].reverse().map(row).join("\n")}`;
+	const first = held.at(-1);
+	const awaiting = first === void 0 ? "" : `    <section class="await">
+      <div class="k">AWAITING HUMAN · 1 OF ${held.length}</div>
+      <div class="card">
+        <div style="flex:1">
+          <h2>${esc(first.tool)}${first.subject === void 0 ? "" : ` on ${esc(first.subject)}`}</h2>
+          <div class="detail">
+            ${esc(first.rule ?? "held")} · ${esc(first.session ?? "local session")} · requested ${esc(ago(first.at, now))} ago<br>
+            ${esc(first.reason ?? "")}
+          </div>
+        </div>
+        <div class="decide">
+          <button type="button" class="approve" disabled title="Approvals are settled in the harness, not here">Approve</button>
+          <button type="button" class="deny" disabled title="Approvals are settled in the harness, not here">Deny</button>
+          <div class="recorded">SETTLED IN THE HARNESS</div>
+        </div>
+      </div>
+    </section>`;
+	const limits = `    <section class="limits">
+      <div class="k">WHAT THIS RECORD DOES NOT PROVE</div>
+      <ul>
+        <li>Tamper-<em>evident</em>, not tamper-proof: a removed, edited or reordered row breaks the chain, but anyone able to rewrite the whole file with this code can recompute every hash.</li>
+        <li>Where a row names an actor, that name is asserted by configuration — the harness records what was decided, never who decided it.</li>
+        <li><code>run_code</code> cannot be masked, and path rules compare normalized strings without resolving symlinks.</li>
+      </ul>
+    </section>`;
+	const problems = chainOk ? "" : `    <section class="limits" style="border-top:1px solid var(--veto-edge)">
+      <div class="k" style="color:var(--veto-text)">CHAIN BROKEN — THIS RECORD IS NOT CONTINUOUS</div>
+      <ul>${verification.problems.map((p) => `<li>line ${p.line}: ${esc(p.message)}</li>`).join("")}</ul>
+    </section>`;
+	return renderShell({
+		title: `Audit ledger — ${pack}`,
+		nav: renderNav(navFor({
+			entries,
+			verification,
+			generatedAt: options.generatedAt,
+			...options.pack === void 0 ? {} : { pack: options.pack }
+		}), "Audit ledger"),
+		head,
+		body: `${stats}\n${problems}${table}\n${awaiting}\n${limits}`
+	});
+}
+
+//#endregion
+//#region src/console/playground.ts
+/**
+* Load the browser bundle from this package's own `lib`.
+*
+* Read at render time rather than imported, because it is a built artifact of a
+* different target — the Node half cannot execute it, it only ships it.
+*/
+function bundle() {
+	const here = import.meta.dirname;
+	for (const candidate of [
+		join(here, "playground.js"),
+		join(here, "..", "playground.js"),
+		join(here, "..", "..", "lib", "playground.js")
+	]) try {
+		return readFileSync(candidate, "utf8");
+	} catch {}
+	throw new Error("prae: playground bundle not found; run `pnpm build` before rendering the console");
+}
+const PRESETS = [
+	{
+		label: "write outside the workspace",
+		tool: "write",
+		capability: "fs:write",
+		args: "path=/etc/hosts"
+	},
+	{
+		label: "write inside it",
+		tool: "write",
+		capability: "fs:write",
+		args: "path=./src/server/auth.ts"
+	},
+	{
+		label: "read a secret",
+		tool: "read",
+		capability: "fs:read",
+		args: "path=./.env"
+	},
+	{
+		label: "fetch an unlisted host",
+		tool: "web_fetch",
+		capability: "net:fetch",
+		args: "url=https://pastebin.example.net/raw/xK9"
+	},
+	{
+		label: "traverse out with ..",
+		tool: "write",
+		capability: "fs:write",
+		args: "path=./src/../../etc/passwd"
+	},
+	{
+		label: "exceed the network budget",
+		tool: "web_fetch",
+		capability: "net:fetch",
+		args: "url=https://build.acme.internal/x",
+		counts: "25"
+	}
+];
+const STYLE = `
+.pg { display: grid; grid-template-columns: 1fr 1fr; gap: 1px; background: var(--line); }
+.pg > div { background: var(--ground); padding: 22px 30px 26px; }
+.pg h2 {
+  font-size: 20px; font-weight: 600; letter-spacing: -0.02em; margin: 0 0 4px;
+}
+.pg .hint {
+  font-size: 13px; color: var(--secondary); margin: 0 0 14px; max-width: 60ch;
+  line-height: 1.6;
+}
+.pg label {
+  display: block; font-family: var(--proof); font-size: 10px;
+  letter-spacing: 0.14em; color: var(--muted); margin: 14px 0 6px;
+}
+.pg textarea, .pg input {
+  width: 100%; font-family: var(--proof); font-size: 12px; line-height: 1.7;
+  color: var(--ink); background: var(--raised);
+  border: 1px solid var(--line-strong); border-radius: 2px; padding: 10px 12px;
+}
+.pg textarea { resize: vertical; }
+#pack { min-height: 300px; }
+#args { min-height: 74px; }
+.pg .two { display: grid; grid-template-columns: 1fr 120px; gap: 12px; }
+.tries { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 12px; }
+.tries button {
+  font-family: var(--proof); font-size: 11px; padding: 6px 10px;
+  border: 1px solid var(--line-strong); background: none; color: var(--secondary);
+  border-radius: 2px;
+}
+.tries button:hover { border-color: var(--signal-edge); color: var(--signal-text); }
+
+#verdict {
+  display: flex; flex-direction: column; gap: 6px;
+  padding: 20px 0 18px; border-bottom: 1px solid var(--line);
+}
+#verdict .big {
+  font-size: 34px; font-weight: 700; letter-spacing: -0.03em; line-height: 1;
+}
+#verdict .clause { font-family: var(--proof); font-size: 12px; color: var(--muted); }
+.step {
+  display: grid; grid-template-columns: 86px 96px 1fr; gap: 12px;
+  padding: 10px 0; border-bottom: 1px solid var(--line-faint);
+  font-family: var(--proof); font-size: 12px; align-items: baseline;
+}
+.step .id { color: var(--dim); }
+.step .why { color: var(--ink-row); }
+.none {
+  font-family: var(--proof); font-size: 11px; color: var(--muted); padding-top: 12px;
+}
+#errors { padding-top: 16px; }
+#errors ul { margin: 6px 0 0; padding-left: 18px; font-size: 12px; line-height: 1.7; }
+#errors code { font-family: var(--proof); }
+
+@media print { .pg { grid-template-columns: 1fr; } .tries { display: none; } }
+`;
+function renderPlayground(data, packSource) {
+	const tries = PRESETS.map((p) => {
+		return `<button type="button" data-try='${esc(JSON.stringify({
+			tool: p.tool,
+			capability: p.capability,
+			args: p.args,
+			counts: p.counts ?? ""
+		}))}'>${esc(p.label)}</button>`;
+	}).join("");
+	const body = `<style>${STYLE}</style>
+    <div class="pg">
+      <div>
+        <h2>The pack</h2>
+        <p class="hint">Edit it. Unknown fields are errors here exactly as they
+        are at load time, so a typo fails in front of you rather than loading
+        clean and enforcing nothing.</p>
+        <label for="pack">POLICY PACK · JSON</label>
+        <textarea id="pack" spellcheck="false">${esc(packSource)}</textarea>
+      </div>
+      <div>
+        <h2>A call</h2>
+        <p class="hint">This runs the same evaluator the gate calls on every
+        tool call in a live profile — not a model of it.</p>
+
+        <div class="two">
+          <div>
+            <label for="tool">TOOL</label>
+            <input id="tool" value="write" spellcheck="false">
+          </div>
+          <div>
+            <label for="counts">PRIOR CALLS</label>
+            <input id="counts" value="" placeholder="0" spellcheck="false">
+          </div>
+        </div>
+
+        <label for="capability">CAPABILITY</label>
+        <input id="capability" value="fs:write" spellcheck="false">
+
+        <label for="args">ARGUMENTS · KEY=VALUE PER LINE</label>
+        <textarea id="args" spellcheck="false">path=/etc/hosts</textarea>
+
+        <div class="tries">${tries}</div>
+
+        <div id="verdict"></div>
+        <div id="trace"></div>
+        <div id="errors" hidden></div>
+      </div>
+    </div>
+<script>${bundle()}<\/script>`;
+	return renderShell({
+		title: "Playground",
+		nav: renderNav(navFor(data), "Playground"),
+		head: `    <header class="head">
+      <div><h1>Playground</h1><div class="meta">the real kernel, in the page · nothing is executed</div></div>
+      <div class="actions"><button type="button" class="btn" onclick="window.print()">Export evidence</button></div>
+    </header>`,
+		body
+	});
+}
+
+//#endregion
+//#region src/profile.ts
+/**
+* Our own region of the overlay.
+*
+* A managed block is replaced wholesale on every write, so sharing one with
+* another writer would mean whichever ran second deleted the other's rows.
+* Blueprint manages the same file; naming the owner keeps both usable on one
+* profile, and tells a reader who to go back to.
+*/
+const OWNER = {
+	name: "prae",
+	wrote: "Written by `prae init`. Edit the pack and re-run, or delete the block"
+};
+/** Where dsh keeps its home, honouring the same env var the CLI does. */
+function dshHome() {
+	return process.env.DSH_HOME ?? join(homedir(), ".dsh");
+}
+function profileAt(dir) {
+	return {
+		dir,
+		patchPath: join(dir, "cordis.patch.yml")
+	};
+}
+/** The default profile, unless a caller names one. */
+function defaultProfile(name = "web") {
+	return profileAt(join(dshHome(), "profiles", name));
+}
+/**
+* The overlay row that mounts PRAE with a policy.
+*
+* The pack is embedded rather than referenced by path. A row pointing at a
+* file that later moves or changes is a policy nobody can reconstruct from the
+* profile alone, and the whole point of this plugin is being able to say what
+* was in force at the time.
+*/
+function praeRow(options) {
+	const indent = (text, spaces) => text.split("\n").map((line) => line.trim() === "" ? "" : " ".repeat(spaces) + line).join("\n");
+	const lines = [
+		"# Holds every tool call on this profile to the pack below.",
+		"- insert:",
+		"    - id: prae",
+		"      name: dsh-prae",
+		"      config:",
+		"        strict: true"
+	];
+	if (options.ledger !== void 0) lines.push(`        ledger: ${JSON.stringify(options.ledger)}`);
+	if (options.approver !== void 0) lines.push(`        approver: ${JSON.stringify(options.approver)}`);
+	lines.push("        pack: |", indent(options.pack, 10));
+	return lines.join("\n");
+}
+/** Compose the write and check it, without touching the file. */
+async function planWrite(profile, row$1) {
+	const before = await readFile(profile.patchPath, "utf8");
+	const after = composePatchFile(before, row$1, OWNER);
+	const findings = await preflightOps(profile.dir, [{ insert: [{
+		id: "prae",
+		name: "dsh-prae"
+	}] }]);
+	const blocking = findings.some((finding) => finding.level === "blocking");
+	return {
+		patchPath: profile.patchPath,
+		before,
+		after,
+		revision: revisionOf(before),
+		findings,
+		blocking
+	};
+}
+/**
+* Apply a plan, snapshotting first.
+*
+* `expectedRevision` is a precondition rather than a formality: between
+* previewing and applying, the user may have edited the file, and writing over
+* an edit they made after reviewing our diff would hand them a profile nobody
+* chose.
+*/
+async function applyWrite(profile, plan, expectedRevision) {
+	if (revisionOf(await readFile(profile.patchPath, "utf8")) !== expectedRevision) throw new Error("the overlay changed since it was previewed; re-run to see the current diff");
+	if (plan.blocking) throw new Error("refusing to write: a blocking finding means this row would stop the profile from booting");
+	const manifest = await takeSnapshot({
+		dir: join(profile.dir, ".prae", "snapshots"),
+		root: profile.dir
+	}, "prae-init", [profile.patchPath]);
+	await writeFile(profile.patchPath, plan.after, "utf8");
+	return { snapshot: manifest.id };
+}
+
+//#endregion
+//#region src/serve.ts
+const TYPES = {
+	".html": "text/html; charset=utf-8",
+	".css": "text/css; charset=utf-8",
+	".js": "text/javascript; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".png": "image/png",
+	".svg": "image/svg+xml"
+};
+/**
+* Resolve a URL path inside the root, or return undefined.
+*
+* Decoded first, then normalized, then checked against the resolved root with a
+* separator — `..` and encoded traversal both have to fail, and a sibling
+* directory whose name merely starts with the root's must not pass as inside it.
+*/
+function safePath(root, urlPath) {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(urlPath.split("?")[0] ?? "/");
+	} catch {
+		return;
+	}
+	if (decoded.includes("\0")) return void 0;
+	if (normalize(decoded).split(/[/\\]/).includes("..")) return void 0;
+	const base = resolve(root);
+	const target = resolve(join(base, decoded === "/" ? "overview.html" : decoded));
+	if (target !== base && !target.startsWith(base + sep)) return void 0;
+	return target;
+}
+/** Start the reader. Resolves once it is listening. */
+function serveConsole(root, port) {
+	const server = createServer((req, res) => {
+		if (req.method !== "GET" && req.method !== "HEAD") {
+			res.statusCode = 405;
+			res.setHeader("allow", "GET, HEAD");
+			res.end();
+			return;
+		}
+		const target = safePath(root, req.url ?? "/");
+		if (target === void 0) {
+			res.statusCode = 403;
+			res.end();
+			return;
+		}
+		readFile(target).then((body) => {
+			res.statusCode = 200;
+			res.setHeader("content-type", TYPES[extname(target)] ?? "application/octet-stream");
+			res.setHeader("cache-control", "no-store");
+			res.end(req.method === "HEAD" ? void 0 : body);
+		}, () => {
+			res.statusCode = 404;
+			res.setHeader("content-type", "text/plain; charset=utf-8");
+			res.end("not found\n");
+		});
+	});
+	return new Promise((ok, fail$1) => {
+		server.once("error", fail$1);
+		server.listen(port, "127.0.0.1", () => {
+			ok({
+				server,
+				url: `http://127.0.0.1:${port}/`
+			});
+		});
+	});
+}
+
+//#endregion
+//#region src/cli.ts
+/** Verdict labels, uppercase and fixed-width so a terminal column lines up. */
+const VERDICT_LABEL = {
+	allow: "ALLOWED",
+	ask: "HELD",
+	deny: "DENIED",
+	correct: "CORRECTED"
+};
+const USAGE = `prae — operator policy for agent harnesses
+
+  prae check <pack.json>
+      Validate a policy pack and summarise what it enforces.
+
+  prae explain <pack.json> <tool> [key=value ...]
+      Judge one call against the pack and print the trace. Nothing is executed.
+
+  prae verify <ledger.jsonl>
+      Re-derive every hash in a decision log and report any break.
+
+  prae report <ledger.jsonl> [--out <file.html>]
+      Render the decision record as a printable evidence report.
+
+  prae console <ledger.jsonl> --out <dir> [--pack <file>] [--serve [port]]
+      Write the control plane: overview, policy packs, playground, ledger,
+      compliance map. The playground needs --pack.
+
+  prae init [--pack <file>] [--profile <dir>] [--ledger <file>]
+                  [--approver <name>] [--apply]
+      Compose the overlay row that mounts PRAE with a pack. Prints the
+      diff; writes only with --apply.
+`;
+function fail(message) {
+	console.error(`prae: ${message}`);
+	process.exit(1);
+}
+async function loadPack(path) {
+	let source;
+	try {
+		source = await readFile(path, "utf8");
+	} catch {
+		return fail(`cannot read ${path}`);
+	}
+	const result = parsePack(source);
+	if (!result.ok) {
+		console.error(`prae: ${path} is not a valid pack`);
+		for (const error of result.errors) console.error(`  ${error.path || "<root>"}: ${error.message}`);
+		process.exit(1);
+	}
+	return result.pack;
+}
+async function check(path) {
+	const pack = await loadPack(path);
+	console.log(`${pack.pack} ${pack.version} — valid`);
+	const baseline = pack.baseline?.capabilities;
+	console.log(baseline === void 0 ? "\nbaseline    (none — this pack governs through rules alone, and\n             withholds no capability an author declares)" : `\nbaseline    ${baseline.join(", ")}`);
+	console.log(`\nrules       ${pack.rules.length}`);
+	for (const rule of pack.rules) {
+		const label = rule.title ?? rule.effect.because;
+		console.log(`  ${rule.id.padEnd(10)} ${rule.effect.kind.toUpperCase().padEnd(8)} ${label}`);
+	}
+}
+/** `key=value` pairs, with numbers and booleans read as themselves. */
+function parseArgs(pairs) {
+	const args = {};
+	for (const pair of pairs) {
+		const at = pair.indexOf("=");
+		if (at === -1) fail(`expected key=value, got \`${pair}\``);
+		const key = pair.slice(0, at);
+		const raw = pair.slice(at + 1);
+		if (raw === "true") args[key] = true;
+		else if (raw === "false") args[key] = false;
+		else if (raw !== "" && !Number.isNaN(Number(raw))) args[key] = Number(raw);
+		else args[key] = raw;
+	}
+	return args;
+}
+async function explain(path, tool, pairs) {
+	const pack = await loadPack(path);
+	const { capabilityForTool } = await import("capmark");
+	const capability = capabilityForTool(tool)?.id;
+	const decision = evaluate(pack, {
+		tool,
+		...capability === void 0 ? {} : { capability },
+		args: parseArgs(pairs)
+	});
+	const label = VERDICT_LABEL[decision.kind];
+	console.log(`${label}  ${tool}${capability ? `  (${capability})` : ""}`);
+	if (decision.reason !== void 0) console.log(`        ${decision.rule} · ${decision.reason}`);
+	if (decision.trace.length === 0) console.log("\n        no rule matched this call");
+	else {
+		console.log("");
+		for (const step$1 of decision.trace) console.log(`        ${step$1.rule.padEnd(10)} ${step$1.effect.padEnd(8)} ${step$1.because}`);
+	}
+	console.log(`\n${pack.pack} ${pack.version} · ${decision.evaluated} rules considered`);
+	if (capability === void 0) console.log(`\nnote: no capability claims \`${tool}\`, so capability rules did not apply`);
+}
+async function verify(path) {
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const result = ledger.verify();
+	if (result.ok) {
+		const last = ledger.read().at(-1);
+		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
+		console.log("tamper-evident: a removed, edited, or reordered row breaks this chain.");
+		console.log("It does not prove against a rewrite of the whole file by someone holding this code.");
+		return;
+	}
+	console.error(`${result.entries} entries · CHAIN BROKEN`);
+	for (const problem of result.problems) console.error(`  line ${problem.line}: ${problem.message}`);
+	process.exit(1);
+}
+function flag(argv, name) {
+	const at = argv.indexOf(`--${name}`);
+	if (at === -1) return void 0;
+	const value = argv[at + 1];
+	if (value === void 0 || value.startsWith("--")) fail(`--${name} needs a value`);
+	return value;
+}
+/**
+* Render the decision record as a report.
+*
+* The chain is verified before rendering rather than after, so a broken chain
+* is stated at the top of the document instead of being something the reader
+* has to go and check separately. A report that looks authoritative while
+* quietly sitting on a broken chain is worse than no report.
+*/
+async function report(path, out) {
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const entries = ledger.read();
+	const verification = ledger.verify();
+	const html = renderLedgerView(entries, verification, {
+		ledgerPath: path,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	if (out === void 0) {
+		process.stdout.write(html);
+		return;
+	}
+	await writeFile(out, html, "utf8");
+	console.log(`${out} · ${entries.length} decisions · chain ${verification.ok ? "intact" : "BROKEN"}`);
+	if (!verification.ok) process.exitCode = 1;
+}
+/**
+* Write the whole control plane as linked files.
+*
+* Static output rather than a server: the views are a read of local evidence,
+* and a governance tool that opens a port to show you its own audit trail has
+* added an attack surface to solve a rendering problem.
+*/
+async function consoleOut(path, argv) {
+	const out = flag(argv, "out");
+	if (out === void 0) fail("console needs --out <dir>");
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const packPath = flag(argv, "pack");
+	const packSource = packPath === void 0 ? void 0 : await readFile(packPath, "utf8");
+	const data = {
+		entries: ledger.read(),
+		verification: ledger.verify(),
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		...packPath === void 0 ? {} : { pack: await loadPack(packPath) }
+	};
+	await mkdir(out, { recursive: true });
+	const pages = [
+		["overview.html", renderOverview(data)],
+		["packs.html", renderPacks(data)],
+		["ledger.html", renderLedgerView(data.entries, data.verification, {
+			ledgerPath: path,
+			generatedAt: data.generatedAt,
+			...data.pack === void 0 ? {} : { pack: data.pack }
+		})],
+		["approvals.html", renderApprovals(data)],
+		["compliance.html", renderCompliance(data)],
+		...packSource === void 0 ? [] : [["playground.html", renderPlayground(data, packSource)]]
+	];
+	for (const [name, html] of pages) await writeFile(join(out, name), html, "utf8");
+	console.log(`${out} · ${pages.length} views · ${data.entries.length} decisions · chain ${data.verification.ok ? "intact" : "BROKEN"}`);
+	if (!data.verification.ok) process.exitCode = 1;
+	if (!argv.includes("--serve")) {
+		console.log(`open ${join(out, "overview.html")}`);
+		return;
+	}
+	const portFlag = flag(argv, "serve");
+	const port = portFlag === void 0 ? 4180 : Number(portFlag);
+	if (!Number.isInteger(port) || port < 1 || port > 65535) fail(`--serve takes a port, got \`${portFlag}\``);
+	const { url } = await serveConsole(out, port);
+	console.log(`\nserving ${out} at ${url}`);
+	console.log("loopback only, read-only. ctrl-c to stop.");
+}
+async function init(argv) {
+	const packPath = flag(argv, "pack");
+	if (packPath === void 0) fail("init needs --pack <file>");
+	const pack = await loadPack(packPath);
+	const source = await readFile(packPath, "utf8");
+	const profileDir = flag(argv, "profile");
+	const profile = profileDir === void 0 ? defaultProfile() : profileAt(profileDir);
+	const ledger = flag(argv, "ledger");
+	const approver = flag(argv, "approver");
+	const row$1 = praeRow({
+		pack: source,
+		...ledger === void 0 ? {} : { ledger },
+		...approver === void 0 ? {} : { approver }
+	});
+	let plan;
+	try {
+		plan = await planWrite(profile, row$1);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	console.log(`profile     ${profile.dir}`);
+	console.log(`overlay     ${plan.patchPath}`);
+	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules`);
+	if (ledger !== void 0) console.log(`ledger      ${ledger}`);
+	if (plan.findings.length > 0) {
+		console.log("");
+		for (const finding of plan.findings) console.log(`${finding.level === "blocking" ? "BLOCKING" : "warning "}    ${finding.text}`);
+	}
+	if (plan.blocking) {
+		console.error("\nNot writing. A row naming a package the profile cannot resolve stops it");
+		console.error("from booting entirely — install dsh-prae into the profile first.");
+		process.exit(1);
+	}
+	if (!argv.includes("--apply")) {
+		console.log("\n--- overlay after this change ---");
+		console.log(plan.after);
+		console.log("--- end ---");
+		console.log("\nNothing was written. Re-run with --apply to write it.");
+		return;
+	}
+	try {
+		const { snapshot } = await applyWrite(profile, plan, plan.revision);
+		console.log(`\nwritten · snapshot ${snapshot}`);
+		console.log("Restart the harness for the row to take effect.");
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+}
+async function main(argv) {
+	const [command, ...rest] = argv;
+	switch (command) {
+		case "check": {
+			const path = rest[0];
+			if (path === void 0) fail("check needs a pack file");
+			return check(path);
+		}
+		case "explain": {
+			const [path, tool, ...pairs] = rest;
+			if (path === void 0 || tool === void 0) fail("explain needs a pack file and a tool name");
+			return explain(path, tool, pairs);
+		}
+		case "verify": {
+			const path = rest[0];
+			if (path === void 0) fail("verify needs a ledger file");
+			return verify(path);
+		}
+		case "report": {
+			const path = rest[0];
+			if (path === void 0) fail("report needs a ledger file");
+			return report(path, flag(rest, "out"));
+		}
+		case "console": {
+			const path = rest[0];
+			if (path === void 0) fail("console needs a ledger file");
+			return consoleOut(path, rest);
+		}
+		case "init": return init(rest);
+		case "--help":
+		case "-h":
+		case void 0:
+			console.log(USAGE);
+			return;
+		default: fail(`unknown command \`${command}\`\n\n${USAGE}`);
+	}
+}
+
+//#endregion
+export { planWrite as a, dshHome as i, applyWrite as n, praeRow as o, defaultProfile as r, profileAt as s, main as t };