prae-cli 0.10.0 → 0.10.1

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 //#region src/bin.ts
 const argv = process.argv.slice(2);
-(argv[0] === "hook" && argv[1] === "claude-code" ? import("./hook-Gll2spTP.js").then(({ runHook }) => runHook(argv.slice(2))) : import("./cli-BcAJlB9B.js").then(({ main }) => main(argv))).catch((error) => {
+(argv[0] === "hook" && argv[1] === "claude-code" ? import("./hook-DxLgNtc4.js").then(({ runHook }) => runHook(argv.slice(2))) : import("./cli-BlWTUnGJ.js").then(({ main }) => main(argv))).catch((error) => {
 	console.error(`prae: ${error instanceof Error ? error.message : error}`);
 	process.exit(1);
 });

package/lib/{checkpoint-BqJ8xwky.js → checkpoint-BLOGdWFu.js}

@@ -1,4 +1,4 @@
-import { _ as canonical, u as fingerprint } from "./src-Cy-Acrgj.js";
+import { _ as canonical, u as fingerprint } from "./src-CuiWC80o.js";
 import { createPrivateKey, createPublicKey, sign, verify } from "node:crypto";
 
 //#region src/checkpoint.ts

package/lib/cli-BlWTUnGJ.js

@@ -0,0 +1,6 @@
+import "./src-CZYvvEn5.js";
+import "./src-CuiWC80o.js";
+import { t as main } from "./cli-C_6dosaw.js";
+import "./views-C7DD-Oif.js";
+
+export { main };

package/lib/{cli-DPldZ2ND.js → cli-C_6dosaw.js}

@@ -1,8 +1,6 @@
-import { a as withinAny, r as hostOf, t as evaluate } from "./evaluate-DhoGQw0Z.js";
-import { n as cite, t as FRAMEWORKS } from "./frameworks-BgZHGKiH.js";
-import { t as parsePack } from "./pack-h5n43S0F.js";
-import { a as verifyEntries, b as seal, g as GENESIS, h as verifySignature, l as verifyBytes, n as Ledger, r as readEntries, t as verifyGrowing, u as fingerprint, v as chain } from "./src-Cy-Acrgj.js";
-import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CUcixte0.js";
+import { c as withinAny, i as evaluate, n as FRAMEWORKS, o as hostOf, r as cite, t as parsePack } from "./src-CZYvvEn5.js";
+import { a as verifyEntries, b as seal, g as GENESIS, h as verifySignature, l as verifyBytes, n as Ledger, r as readEntries, t as verifyGrowing, u as fingerprint, v as chain } from "./src-CuiWC80o.js";
+import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-C7DD-Oif.js";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -866,6 +864,327 @@ function readRedteam(dir, files) {
 	};
 }
 
+//#endregion
+//#region ../controls/src/inspect.ts
+/**
+* How a rule is evaluated, one label per matcher field it uses. Every one
+* of them runs in the PRAE kernel's deterministic matcher; these are the
+* only engines the rule model has. There is no semantic model and no
+* syntax tree behind any rule: `command` is a lexical decomposition.
+*/
+const ENGINES = {
+	tool: "Tool / capability match",
+	capability: "Tool / capability match",
+	plugin: "Tool / capability match",
+	agent: "Agent match",
+	path: "Path glob match",
+	host: "Host list match",
+	arg: "Argument value match",
+	count: "Session call count",
+	command: "Command decomposition (lexical)",
+	secrets: "Content inspection (regex + entropy)"
+};
+function enginesOf(rule) {
+	const keys = Object.keys(rule.when);
+	if (keys.length === 0) return ["Every call (no matcher)"];
+	return [...new Set(keys.map((k) => ENGINES[k] ?? `Unknown matcher: ${k}`))];
+}
+const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
+const quoted = (v) => v.map((x) => `\`${String(x)}\``).join(", ");
+/** The plain-language reading, or undefined when it cannot be given reliably. */
+function logicOf(rule) {
+	const w = rule.when;
+	if (Object.keys(w).some((k) => ENGINES[k] === void 0)) return void 0;
+	const subjects = [];
+	if (w.capability !== void 0) subjects.push(`calls with capability ${quoted(list(w.capability))}`);
+	if (w.tool !== void 0) subjects.push(`calls to ${quoted(list(w.tool))}`);
+	if (w.plugin !== void 0) subjects.push(`tools registered by ${quoted(list(w.plugin))}`);
+	const evaluates = subjects.length === 0 ? "Every tool call" : `${subjects.join(" that are also ")}`.replace(/^./, (c$1) => c$1.toUpperCase());
+	const targets = [];
+	if (w.path !== void 0) targets.push(w.path.arg === void 0 ? "the path argument (the first conventional one present)" : `the path in argument \`${w.path.arg}\``);
+	if (w.host !== void 0) targets.push(w.host.arg === void 0 ? "the URL argument's host" : `the host of argument \`${w.host.arg}\``);
+	if (w.command !== void 0) targets.push("the shell command line, read lexically");
+	if (w.arg !== void 0) targets.push(`argument${w.arg.length === 1 ? "" : "s"} ${quoted(w.arg.map((a) => a.name))}`);
+	if (w.count !== void 0) targets.push("this session's count of calls with the same capability");
+	if (w.secrets !== void 0) targets.push("findings the content inspection attached to the call");
+	if (w.agent !== void 0) targets.push("the agent making the call");
+	const target = targets.length === 0 ? "The call as a whole" : targets.join("; ");
+	const condition = [];
+	if (w.agent !== void 0) condition.push(`the agent is ${quoted(list(w.agent))}`);
+	if (w.path?.inside !== void 0) condition.push(`the path is under ${quoted(w.path.inside)}`);
+	if (w.path?.outside !== void 0) condition.push(`the path is outside all of ${quoted(w.path.outside)}`);
+	if (w.host?.in !== void 0) condition.push(`the host is one of ${quoted(w.host.in)}`);
+	if (w.host?.notIn !== void 0) condition.push(`the host is not one of ${quoted(w.host.notIn)}`);
+	for (const a of w.arg ?? []) {
+		if (a.present !== void 0) condition.push(`\`${a.name}\` is ${a.present ? "present" : "absent"}`);
+		if (a.above !== void 0) condition.push(`\`${a.name}\` is above ${a.above}`);
+		if (a.below !== void 0) condition.push(`\`${a.name}\` is below ${a.below}`);
+		if (a.equals !== void 0) condition.push(`\`${a.name}\` equals \`${String(a.equals)}\``);
+		if (a.oneOf !== void 0) condition.push(`\`${a.name}\` is one of ${quoted(a.oneOf)}`);
+	}
+	if (w.count !== void 0) condition.push(`more than ${w.count.above} such calls have already run in this session`);
+	if (w.secrets !== void 0) {
+		const n = w.secrets.atLeast ?? 1;
+		condition.push(`${n === 1 ? "a finding" : `at least ${n} findings`}${w.secrets.types === void 0 ? "" : ` of type ${quoted(w.secrets.types)}`}${w.secrets.minConfidence === void 0 ? "" : ` with confidence ≥ ${w.secrets.minConfidence}`}`);
+	}
+	const c = w.command;
+	if (c !== void 0) {
+		if (c.name !== void 0) condition.push(`the program (or a wrapper it runs through) is ${quoted(list(c.name))}`);
+		const must = list(c.token).filter((t) => !t.startsWith("!"));
+		const never = list(c.token).filter((t) => t.startsWith("!")).map((t) => t.slice(1));
+		if (must.length > 0) condition.push(`it carries all of ${quoted(must)}`);
+		if (never.length > 0) condition.push(`it carries none of ${quoted(never)}`);
+		if (c.anyToken !== void 0) condition.push(`it carries any of ${quoted(list(c.anyToken))}`);
+		if (c.pipedTo !== void 0) condition.push(`it pipes into ${quoted(list(c.pipedTo))}`);
+		if (c.pipeline !== void 0) condition.push(`its pipeline has the shape ${quoted(list(c.pipeline))}`);
+	}
+	if (condition.length === 0) condition.push("always: no further condition");
+	const e = rule.effect;
+	return {
+		evaluates,
+		target,
+		condition,
+		action: e.kind === "deny" ? "Refuses the call before it runs." : e.kind === "ask" ? "Holds the call until a person allows or refuses it." : e.kind === "warn" ? "Lets the call run and records a warning." : e.kind === "allow" ? "Allows the call and names this rule in the evidence; an allow never overrides another rule's refusal." : `Rewrites ${quoted(Object.keys(e.set))} before the call runs.`
+	};
+}
+const isEvent = (e) => e.tool.startsWith("prae:") || e.tool === "system-prompt";
+/**
+* Per pack name, every row in which a gate showed it in force — its
+* activation or reload row, or a decision attributed to it — and its
+* removal rows, in ledger order.
+*/
+function packActivity(entries) {
+	const out = /* @__PURE__ */ new Map();
+	const add = (name, seen) => {
+		const list$1 = out.get(name);
+		if (list$1 === void 0) out.set(name, [seen]);
+		else list$1.push(seen);
+	};
+	for (const e of entries) if (e.tool === "prae:pack") {
+		if (e.rule === "pack.activated" || e.rule === "pack.reloaded") add(e.pack.name, {
+			row: e,
+			kind: "in-force"
+		});
+		else if (e.rule === "pack.removed") add(e.pack.name, {
+			row: e,
+			kind: "removed"
+		});
+	} else if (!isEvent(e) && e.pack !== void 0) add(e.pack.name, {
+		row: e,
+		kind: "in-force"
+	});
+	return out;
+}
+/** Whether a gate confirmed this exact definition of a pack in force. */
+function activityOf(pack, activity, failed) {
+	if (failed !== void 0) return {
+		state: "failed",
+		note: `A gate refused this definition: ${failed.why}`,
+		seq: failed.seq,
+		at: failed.at,
+		sessions: []
+	};
+	const rows = activity.get(pack.name) ?? [];
+	const same = (r) => r.pack.version === pack.version && (pack.sha256 === void 0 || r.pack.sha256 === void 0 || r.pack.sha256 === pack.sha256);
+	const last = rows.at(-1);
+	if (last?.kind === "removed") return {
+		state: "inactive",
+		note: `A gate sealed this pack removed (row #${last.row.seq}); its rules no longer apply there.`,
+		seq: last.row.seq,
+		at: last.row.at,
+		sessions: []
+	};
+	const confirming = rows.filter((s) => s.kind === "in-force" && same(s.row));
+	const newest = confirming.at(-1);
+	if (newest !== void 0) return {
+		state: "active",
+		note: `A gate showed ${pack.name} ${pack.version} in force at row #${newest.row.seq}. That is the last confirmation; PRAE has no heartbeat that says a gate is running now.`,
+		seq: newest.row.seq,
+		at: newest.row.at,
+		sessions: [...new Set(confirming.flatMap((s) => s.row.session === void 0 ? [] : [s.row.session]))]
+	};
+	const other = rows.at(-1);
+	return {
+		state: "unconfirmed",
+		note: other !== void 0 ? `Verification required: the gate last showed ${pack.name} ${other.row.pack.version} in force (row #${other.row.seq}); this configured definition has not been confirmed by any gate.` : "Verification required: configured, but no gate has sealed this pack in force in this record yet.",
+		sessions: []
+	};
+}
+/**
+* The rows that can be evidence: every row except the console's own
+* deployment rows. Placing a pack is an operation, not something the agent
+* did or a gate decided, so it never counts toward a control — not as a
+* recorded event, and never as a refusal.
+*/
+function evidenceRows(entries) {
+	return entries.filter((e) => e.tool !== "prae:deploy");
+}
+/** How long a written pack waits for a gate before it needs verification. */
+const CONFIRM_WINDOW_MS = 2e4;
+/**
+* Each deployment's lifecycle, read from the ledger alone: the console's
+* `deploy.requested` row, then what a gate sealed after it. ACTIVE only on
+* a gate's activation or reload row carrying the deployed file's exact
+* sha256; FAILED on the console's own failure row or a gate refusing the
+* file; INACTIVE when a gate later sealed it removed. With no gate row,
+* APPLYING for a short window and then VERIFICATION_REQUIRED — the file is
+* configured, and nothing has shown it enforced.
+*/
+function deploymentsOf(entries, now = Date.now()) {
+	const out = [];
+	const requests = entries.filter((e) => e.tool === "prae:deploy" && e.deploy?.action === "requested");
+	for (const r of requests) {
+		const d = r.deploy;
+		if (d === void 0 || r.pack.sha256 === void 0) continue;
+		const sha = r.pack.sha256;
+		const after = entries.filter((e) => e.seq > r.seq);
+		const base = {
+			operation: d.operation,
+			pack: r.pack.name,
+			version: r.pack.version,
+			sha256: sha,
+			file: d.file,
+			target: d.target,
+			environment: d.environment,
+			rules: d.rules,
+			controls: d.controls,
+			...d.operator === void 0 ? {} : { operator: d.operator },
+			requestedAt: r.at,
+			seq: r.seq
+		};
+		const failedRow = after.find((e) => e.tool === "prae:deploy" && e.deploy?.action === "failed" && e.deploy.operation === d.operation);
+		if (failedRow !== void 0) {
+			out.push({
+				...base,
+				state: "FAILED",
+				failure: "operation",
+				note: `Not deployed: ${failedRow.deploy?.error ?? "the operation failed"}. Nothing was placed where a gate reads, so coverage is unchanged.`,
+				runtime: {
+					seq: failedRow.seq,
+					at: failedRow.at
+				},
+				sessions: []
+			});
+			continue;
+		}
+		const confirms = after.filter((e) => e.tool === "prae:pack" && (e.rule === "pack.activated" || e.rule === "pack.reloaded") && e.pack.sha256 === sha);
+		const refused = after.find((e) => e.tool === "prae:pack" && e.rule === "pack.rejected" && e.subject === d.file);
+		const removed = after.find((e) => e.tool === "prae:pack" && e.rule === "pack.removed" && e.pack.sha256 === sha);
+		const sessions = [...new Set(confirms.flatMap((e) => e.session === void 0 ? [] : [e.session]))];
+		const at = (e) => ({
+			seq: e.seq,
+			at: e.at,
+			...e.session === void 0 ? {} : { session: e.session }
+		});
+		if (refused !== void 0) {
+			out.push({
+				...base,
+				state: "FAILED",
+				failure: "runtime",
+				note: `A gate refused the pack (row #${refused.seq}): ${(refused.reason ?? "").replace(/^pack rejected, not loaded: /, "")}. The gate kept the policy it had; this pack does not count toward coverage.`,
+				runtime: at(refused),
+				sessions
+			});
+			continue;
+		}
+		if (removed !== void 0) {
+			out.push({
+				...base,
+				state: "INACTIVE",
+				note: `A gate sealed the pack removed (row #${removed.seq}); its rules no longer apply there.`,
+				runtime: at(removed),
+				sessions
+			});
+			continue;
+		}
+		const first = confirms[0];
+		if (first !== void 0) {
+			out.push({
+				...base,
+				state: "ACTIVE",
+				note: `A gate sealed this exact pack (sha256 ${sha.slice(0, 12)}) in force at row #${first.seq}${sessions.length > 0 ? ` · ${sessions.length} session${sessions.length === 1 ? "" : "s"}` : ""}.`,
+				runtime: at(first),
+				sessions
+			});
+			continue;
+		}
+		const waiting = now - Date.parse(r.at) < CONFIRM_WINDOW_MS;
+		out.push({
+			...base,
+			state: waiting ? "APPLYING" : "VERIFICATION_REQUIRED",
+			note: waiting ? "Written to the workspace pack directory; waiting for a gate to seal it in force." : "Written and configured, but no gate has sealed it in force: no gate watching this workspace is running. A gate mounted with this workspace confirms it when it starts.",
+			sessions
+		});
+	}
+	return out;
+}
+function describeRule(rule) {
+	const logic = logicOf(rule);
+	return {
+		id: rule.id,
+		...rule.title === void 0 ? {} : { title: rule.title },
+		...rule.description === void 0 ? {} : { description: rule.description },
+		effect: rule.effect.kind,
+		because: rule.effect.because,
+		engines: enginesOf(rule),
+		...logic === void 0 ? {} : { logic },
+		definition: JSON.stringify({
+			when: rule.when,
+			effect: rule.effect
+		}, null, 2),
+		cites: Object.entries(rule.frameworks ?? {}).flatMap(([f, cs]) => cs.map((c) => `${f}:${c}`))
+	};
+}
+function ruleViews(pack, origins, entries, admitted, environment, failedPacks = /* @__PURE__ */ new Map()) {
+	const activity = packActivity(entries);
+	const byRule = /* @__PURE__ */ new Map();
+	for (const e of admitted) {
+		if (e.rule === void 0 || isEvent(e)) continue;
+		const rows = byRule.get(e.rule);
+		if (rows === void 0) byRule.set(e.rule, [e]);
+		else rows.push(e);
+	}
+	const out = {};
+	for (const rule of pack?.rules ?? []) {
+		const ref = origins.get(rule.id) ?? {
+			name: pack?.pack ?? "unknown",
+			version: pack?.version ?? ""
+		};
+		const rows = byRule.get(rule.id) ?? [];
+		const last = rows.at(-1);
+		out[rule.id] = {
+			...describeRule(rule),
+			pack: ref,
+			scope: {
+				agents: rule.when.agent === void 0 ? "all" : list(rule.when.agent),
+				environment
+			},
+			active: activityOf(ref, activity, ref.sha256 === void 0 ? void 0 : failedPacks.get(ref.sha256)),
+			evidence: {
+				count: rows.length,
+				...last === void 0 ? {} : { last: {
+					seq: last.seq,
+					at: last.at
+				} }
+			}
+		};
+	}
+	return out;
+}
+/**
+* Deployed packs a gate refused, by sha256 — the latest deployment of each
+* definition decides — kept out of coverage: the gate does not enforce them.
+*/
+function refusedDeployments(deployments) {
+	const latest = /* @__PURE__ */ new Map();
+	for (const d of deployments) latest.set(d.sha256, d);
+	return new Map([...latest.values()].filter((d) => d.failure === "runtime").map((d) => [d.sha256, {
+		seq: d.runtime?.seq ?? d.seq,
+		at: d.runtime?.at ?? d.requestedAt,
+		why: d.note
+	}]));
+}
+
 //#endregion
 //#region ../controls/src/scope.ts
 const ROW_LIMIT = 50;
@@ -943,10 +1262,11 @@ function catalogOf(file) {
 			};
 			frameworks.set(framework.id, f);
 		}
+		const name = control.name ?? FRAMEWORKS[framework.id]?.controls[id]?.name;
 		f.controls.push({
 			key,
 			id,
-			...control.name === void 0 ? {} : { name: control.name },
+			...name === void 0 ? {} : { name },
 			asks: control.asks
 		});
 	};
@@ -1040,6 +1360,11 @@ function inPeriod(at, period, now) {
 	if (period.kind === "days") return t >= now - period.days * 864e5;
 	return t >= Date.parse(period.from) && t < Date.parse(period.to) + 864e5;
 }
+/** The rows a scope admits: its agents, its sessions, its period. */
+function admit(entries, scope, agent, now = Date.now()) {
+	const agentOf$1 = (e) => e.agent ?? agent;
+	return entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+}
 /**
 * Assess the scoped controls against the record. The rows are narrowed to
 * the scope's agents, sessions and period before any control reads them;
@@ -1049,7 +1374,7 @@ function inPeriod(at, period, now) {
 function assess(data, scope, catalog, options) {
 	const now = options.now ?? Date.now();
 	const agentOf$1 = (e) => e.agent ?? options.agent;
-	const admitted = data.entries.filter((e) => (scope.agents === "all" || scope.agents.includes(agentOf$1(e))) && (scope.sessions === "all" || e.session !== void 0 && scope.sessions.includes(e.session)) && inPeriod(e.at, scope.period, now));
+	const admitted = admit(data.entries, scope, options.agent, now);
 	const scoped = {
 		...data,
 		entries: admitted
@@ -1196,17 +1521,39 @@ function agentOf(dir) {
 	} catch {}
 	return "this agent";
 }
-function assessCompliance(record, data) {
+/** What a record's compliance is assessed against: its catalog and scope. */
+function complianceContext(record) {
 	const { catalog, catalogError } = catalogFor(record.dir);
 	return {
-		...assess(data, scopeFor(record.dir, catalog), catalog, {
+		catalog,
+		...catalogError === void 0 ? {} : { catalogError },
+		scope: scopeFor(record.dir, catalog),
+		options: {
 			agent: agentOf(record.dir),
 			environment: basename(resolve(record.dir))
-		}),
+		}
+	};
+}
+function assessCompliance(record, data) {
+	const { catalog, catalogError, scope, options } = complianceContext(record);
+	return {
+		...assess(data, scope, catalog, options),
 		saved: existsSync(resolve(record.dir, SCOPE_FILE)),
 		...catalogError === void 0 ? {} : { catalogError }
 	};
 }
+/**
+* The Rule Inspector's rules (PRA-195): every rule in force, with where it
+* came from, how it is evaluated, whether a gate confirmed its pack in
+* force, and its sealed decisions within the scope. Read-only.
+*/
+function inspectorOf(record, data, scope, origins, deployments, refused) {
+	const agent = agentOf(record.dir);
+	return {
+		rules: ruleViews(data.pack, origins, data.entries, admit(data.entries, scope, agent), basename(resolve(record.dir)), refused),
+		deployments
+	};
+}
 
 //#endregion
 //#region src/serve.ts
@@ -1395,15 +1742,30 @@ function complianceOf(record) {
 		problems: grown.problems
 	};
 	const { set } = packSetOf(record);
-	const pack = set.packs.length > 0 ? set.effective : void 0;
+	const deployments = deploymentsOf(entries);
+	const refused = refusedDeployments(deployments);
+	const kept = set.packs.filter((p) => !refused.has(p.sha256));
+	const pack = kept.length === 0 ? void 0 : kept.length === set.packs.length ? set.effective : {
+		...set.effective,
+		rules: kept.flatMap((p) => p.pack.rules)
+	};
 	const data = {
 		...pack === void 0 ? {} : { pack },
-		entries,
+		entries: evidenceRows(entries),
 		verification,
 		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
+	const assessment = assessCompliance(record, data);
+	const origins = new Map(set.packs.flatMap((p) => p.pack.rules.map((r) => [r.id, {
+		name: p.pack.pack,
+		version: p.pack.version,
+		sha256: p.sha256,
+		origin: p.origin,
+		file: p.file.split("/").at(-1) ?? p.file
+	}])));
 	return {
-		assessment: assessCompliance(record, data),
+		assessment,
+		inspector: inspectorOf(record, data, assessment.scope, origins, deployments, refused),
 		controls: CONTROLS.map((control) => {
 			const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
 			const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
@@ -1822,7 +2184,7 @@ async function check(path, argv = []) {
 * from the findings, so there is nothing here to be careful about printing.
 */
 async function scanFile(path, packPath, json) {
-	const { scan } = await import("./src-DMoYsdfo.js");
+	const { scan } = await import("./src-CwBEFhww.js");
 	let content;
 	try {
 		content = await readFile(path, "utf8");
@@ -1862,13 +2224,13 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-D521EoP6.js");
+	const { serveMcp } = await import("./mcp-DdEDvTvR.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-wG36kT6K.js");
+	const { Ledger: Ledger$1 } = await import("./src-2iJy5MZc.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1920,7 +2282,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1943,7 +2305,7 @@ async function keygen(dir) {
 async function keygenSealed(role, dir) {
 	if (role !== "operator" && role !== "policy" && role !== "ledger") fail("--role is operator, policy or ledger");
 	const stem = role === "ledger" ? "prae-signing" : role;
-	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = sealedKeypair(process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: "));
 	const pub = join(dir, `${stem}.pub.pem`);
@@ -1956,7 +2318,7 @@ async function keygenSealed(role, dir) {
 }
 /** A detached signature over a pack's bytes (PRA-107). */
 async function signPack(packPath, keyPath) {
-	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const bytes = readFileSync(packPath);
 	const parsed$1 = parsePack(bytes.toString("utf8"));
@@ -2001,7 +2363,7 @@ function askHidden(prompt) {
 	});
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey: createPublicKey$1 } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -2031,7 +2393,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-CUuEjGHL.js");
+	const { checkReceipt } = await import("./receipt-check-2F4zLEW5.js");
 	let parsed$1;
 	try {
 		parsed$1 = JSON.parse(await readFile(path, "utf8"));
@@ -2062,7 +2424,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-C8dHjIE2.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-BGsK-inZ.js");
 	const suite = parseSuite(parsed$1);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
@@ -2073,7 +2435,7 @@ async function test(suitePath, packOverride, asJson) {
 	if (chosen === void 0) return fail("test needs a pack: set `pack` in the suite or pass --pack");
 	const pack = await loadPack(chosen);
 	const { capabilityForTool } = await import("capmark");
-	const { scan } = await import("./src-DMoYsdfo.js");
+	const { scan } = await import("./src-CwBEFhww.js");
 	const inspect = pack.rules.some((rule) => rule.when.secrets !== void 0) ? (path) => {
 		try {
 			return scan(readFileSync(path, "utf8"));
@@ -2102,14 +2464,14 @@ async function verify$1(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-BqJ8xwky.js");
+			const { checkCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
 			if (!verdict.ok) process.exitCode = 1;
 		}
 		if (keyPath !== void 0) {
-			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-wG36kT6K.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-2iJy5MZc.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -2187,7 +2549,7 @@ async function report(path, out, packPath) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-CDYyZyeU.js");
+	const { ingest } = await import("./src-XukJfuml.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -2223,7 +2585,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-CDYyZyeU.js"), import("./src-BlmsTGdY.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-XukJfuml.js"), import("./src-BoBCmiwj.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -2283,9 +2645,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-CDYyZyeU.js"),
-			import("./src-BlmsTGdY.js"),
-			import("./instructions-DihPiiC2.js")
+			import("./src-XukJfuml.js"),
+			import("./src-BoBCmiwj.js"),
+			import("./instructions-fCJ4j7ce.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -2333,11 +2695,11 @@ function bundledBaseline() {
 async function init(argv) {
 	const packPath = flag(argv, "pack") ?? bundledBaseline();
 	if (packPath === void 0) fail("init needs --pack <file>; no bundled baseline found");
+	const pack = await loadPack(packPath);
 	if (flag(argv, "pack") === void 0) {
-		console.log("No --pack given; mounting the built-in baseline (8 rules).");
+		console.log(`No --pack given; mounting the built-in baseline (${pack.rules.length} rules).`);
 		console.log(`See it with: prae check ${packPath}\n`);
 	}
-	const pack = await loadPack(packPath);
 	const source = await readFile(packPath, "utf8");
 	const link = argv.includes("--link");
 	const builtin = link ? { packFile: resolve(packPath) } : { pack: source };
@@ -2418,7 +2780,7 @@ async function chainMatrix(path, argv) {
 	const catalogue = guardiansPath === void 0 ? [] : JSON.parse(readFileSync(guardiansPath, "utf8")).guardians;
 	const guardianOf = (rule) => rule === void 0 ? void 0 : catalogue.find((g) => g.rules.includes(rule) || (g.armed ?? []).includes(rule))?.name;
 	const keyPath = flag(argv, "key");
-	const { verifySignature: verifySignature$1 } = await import("./src-wG36kT6K.js");
+	const { verifySignature: verifySignature$1 } = await import("./src-2iJy5MZc.js");
 	const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 	const matrix = integrityMatrix(entries, pack, guardianOf).map((m) => {
 		const entry = entries.find((e) => e.seq === m.seq);
@@ -2449,7 +2811,7 @@ async function chainMatrix(path, argv) {
 	if (!chainOk || sigFailed) process.exitCode = 1;
 }
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-BqJ8xwky.js");
+	const { makeCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -2470,7 +2832,7 @@ async function checkpoint(path, keyPath, out) {
 	}
 }
 async function exportLedger(path, options) {
-	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DF9cMiQJ.js");
+	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-BwWyM7hc.js");
 	const { createRequire: createRequire$1 } = await import("node:module");
 	const { version } = createRequire$1(import.meta.url)("../package.json");
 	let ledger;
@@ -2601,7 +2963,7 @@ async function main(argv) {
 		}
 		case "init":
 			if (rest[0] === "claude-code") {
-				const { initClaudeCode, stableNode } = await import("./init-DRd-IRR6.js");
+				const { initClaudeCode, stableNode } = await import("./init-BPlBJvA-.js");
 				try {
 					return initClaudeCode(rest.slice(1), {
 						cwd: process.cwd(),
@@ -2616,7 +2978,7 @@ async function main(argv) {
 			return init(rest);
 		case "hook": {
 			if (rest[0] !== "claude-code") fail("hook takes claude-code");
-			const { runHook } = await import("./hook-Gll2spTP.js");
+			const { runHook } = await import("./hook-DxLgNtc4.js");
 			return runHook(rest.slice(1));
 		}
 		case "--help":