prae-cli 0.10.1 → 0.10.2

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 //#region src/bin.ts
 const argv = process.argv.slice(2);
-(argv[0] === "hook" && argv[1] === "claude-code" ? import("./hook-DxLgNtc4.js").then(({ runHook }) => runHook(argv.slice(2))) : import("./cli-BlWTUnGJ.js").then(({ main }) => main(argv))).catch((error) => {
+(argv[0] === "hook" && argv[1] === "claude-code" ? import("./hook-C7LGEIs2.js").then(({ runHook }) => runHook(argv.slice(2))) : import("./cli-DYKKNlDI.js").then(({ main }) => main(argv))).catch((error) => {
 	console.error(`prae: ${error instanceof Error ? error.message : error}`);
 	process.exit(1);
 });

package/lib/{cli-C_6dosaw.js → cli-BTVEk0Fh.js}

@@ -1,6 +1,7 @@
 import { c as withinAny, i as evaluate, n as FRAMEWORKS, o as hostOf, r as cite, t as parsePack } from "./src-CZYvvEn5.js";
 import { a as verifyEntries, b as seal, g as GENESIS, h as verifySignature, l as verifyBytes, n as Ledger, r as readEntries, t as verifyGrowing, u as fingerprint, v as chain } from "./src-CuiWC80o.js";
-import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-C7DD-Oif.js";
+import { t as capabilityOf } from "./facts-DkTRO2p0.js";
+import { a as renderPacks, c as renderNav, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-endiZu1Z.js";
 import { createRequire } from "node:module";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, watch, writeFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -2184,7 +2185,7 @@ async function check(path, argv = []) {
 * from the findings, so there is nothing here to be careful about printing.
 */
 async function scanFile(path, packPath, json) {
-	const { scan } = await import("./src-CwBEFhww.js");
+	const { scan } = await import("./src-DIuEg7gi.js");
 	let content;
 	try {
 		content = await readFile(path, "utf8");
@@ -2224,7 +2225,7 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-DdEDvTvR.js");
+	const { serveMcp } = await import("./mcp-C2gadkb2.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
@@ -2256,8 +2257,7 @@ function parseArgs(pairs) {
 }
 async function explain(path, tool, pairs) {
 	const pack = await loadPack(path);
-	const { capabilityForTool } = await import("capmark");
-	const capability = capabilityForTool(tool)?.id;
+	const capability = capabilityOf(tool);
 	const decision = evaluate(pack, {
 		tool,
 		...capability === void 0 ? {} : { capability },
@@ -2393,7 +2393,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-2F4zLEW5.js");
+	const { checkReceipt } = await import("./receipt-check-BtAJqyrX.js");
 	let parsed$1;
 	try {
 		parsed$1 = JSON.parse(await readFile(path, "utf8"));
@@ -2424,7 +2424,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-BGsK-inZ.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-DCprBW44.js");
 	const suite = parseSuite(parsed$1);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
@@ -2434,8 +2434,7 @@ async function test(suitePath, packOverride, asJson) {
 	const chosen = packOverride ?? (suite.suite.pack === void 0 ? void 0 : resolve(dirname(suitePath), suite.suite.pack));
 	if (chosen === void 0) return fail("test needs a pack: set `pack` in the suite or pass --pack");
 	const pack = await loadPack(chosen);
-	const { capabilityForTool } = await import("capmark");
-	const { scan } = await import("./src-CwBEFhww.js");
+	const { scan } = await import("./src-DIuEg7gi.js");
 	const inspect = pack.rules.some((rule) => rule.when.secrets !== void 0) ? (path) => {
 		try {
 			return scan(readFileSync(path, "utf8"));
@@ -2444,7 +2443,7 @@ async function test(suitePath, packOverride, asJson) {
 		}
 	} : void 0;
 	const result = runSuite(pack, suite.suite, {
-		capabilityFor: (tool) => capabilityForTool(tool)?.id,
+		capabilityFor: capabilityOf,
 		...inspect === void 0 ? {} : { inspect }
 	});
 	if (asJson) console.log(JSON.stringify(result, null, 2));
@@ -2464,7 +2463,7 @@ async function verify$1(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
+			const { checkCheckpoint } = await import("./checkpoint-D7d6ZGXR.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
@@ -2549,7 +2548,7 @@ async function report(path, out, packPath) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-XukJfuml.js");
+	const { ingest } = await import("./src-DxJIOaP5.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -2585,7 +2584,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-XukJfuml.js"), import("./src-BoBCmiwj.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-DxJIOaP5.js"), import("./src-DV83J9G2.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -2645,9 +2644,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-XukJfuml.js"),
-			import("./src-BoBCmiwj.js"),
-			import("./instructions-fCJ4j7ce.js")
+			import("./src-DxJIOaP5.js"),
+			import("./src-DV83J9G2.js"),
+			import("./instructions-Bcs2n2O6.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -2811,7 +2810,7 @@ async function chainMatrix(path, argv) {
 	if (!chainOk || sigFailed) process.exitCode = 1;
 }
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-BLOGdWFu.js");
+	const { makeCheckpoint } = await import("./checkpoint-D7d6ZGXR.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -2832,7 +2831,7 @@ async function checkpoint(path, keyPath, out) {
 	}
 }
 async function exportLedger(path, options) {
-	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-BwWyM7hc.js");
+	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DwExfPqP.js");
 	const { createRequire: createRequire$1 } = await import("node:module");
 	const { version } = createRequire$1(import.meta.url)("../package.json");
 	let ledger;
@@ -2963,7 +2962,7 @@ async function main(argv) {
 		}
 		case "init":
 			if (rest[0] === "claude-code") {
-				const { initClaudeCode, stableNode } = await import("./init-BPlBJvA-.js");
+				const { initClaudeCode, stableNode } = await import("./init-DvzCuemh.js");
 				try {
 					return initClaudeCode(rest.slice(1), {
 						cwd: process.cwd(),
@@ -2978,7 +2977,7 @@ async function main(argv) {
 			return init(rest);
 		case "hook": {
 			if (rest[0] !== "claude-code") fail("hook takes claude-code");
-			const { runHook } = await import("./hook-DxLgNtc4.js");
+			const { runHook } = await import("./hook-C7LGEIs2.js");
 			return runHook(rest.slice(1));
 		}
 		case "--help":

package/lib/cli-DYKKNlDI.js

@@ -0,0 +1,7 @@
+import "./src-CZYvvEn5.js";
+import "./src-CuiWC80o.js";
+import { t as main } from "./cli-BTVEk0Fh.js";
+import "./facts-DkTRO2p0.js";
+import "./views-endiZu1Z.js";
+
+export { main };

package/lib/facts-DkTRO2p0.js

@@ -0,0 +1,89 @@
+import { a as PATH_ARGS, s as relativeTo } from "./src-CZYvvEn5.js";
+import { capabilityForTool } from "capmark";
+
+//#region ../dsh/src/facts.ts
+function resolveArgs(args, resolvePath, cwd) {
+	if (resolvePath === void 0 && cwd === void 0) return args;
+	const out = { ...args };
+	for (const key of PATH_ARGS) {
+		const value = out[key];
+		if (typeof value !== "string") continue;
+		let path = value;
+		if (resolvePath !== void 0) try {
+			path = resolvePath(path);
+		} catch {}
+		out[key] = cwd === void 0 ? path : relativeTo(path, cwd);
+	}
+	return out;
+}
+/**
+* Claude Code names its built-in tools in PascalCase (`Read`, `Bash`, …),
+* which capmark's catalogue does not list. Each takes the capability of its
+* lowercase counterpart; without this a Claude Code call carries no
+* capability, and the rules scoped by one (paths, egress, the shell) never
+* see it. An MCP tool, `mcp__<server>__<tool>`, takes its tool's.
+*/
+const CLAUDE_CODE = {
+	Read: "read",
+	Write: "write",
+	Edit: "edit",
+	MultiEdit: "edit",
+	NotebookEdit: "edit",
+	Bash: "bash",
+	PowerShell: "bash",
+	Grep: "grep",
+	Glob: "glob",
+	LS: "glob",
+	WebFetch: "web_fetch",
+	WebSearch: "web_search"
+};
+/**
+* MCP tools whose names capmark's catalogue does not list, from the
+* reference servers an agent most often mounts (modelcontextprotocol
+* `filesystem` and `fetch`) and `prae mcp`'s own. Applied only after an
+* `mcp__<server>__` prefix: without it, a Claude Code session reading
+* `.env` through `mcp__filesystem__read_file` carries no capability, and
+* no `fs:read` rule sees it.
+*/
+const MCP_TOOLS = {
+	read_file: "read",
+	read_text_file: "read",
+	read_media_file: "read",
+	list_directory: "glob",
+	list_dir: "glob",
+	directory_tree: "glob",
+	search_files: "glob",
+	get_file_info: "glob",
+	write_file: "write",
+	edit_file: "edit",
+	create_directory: "write",
+	fetch: "web_fetch"
+};
+function capabilityOf(tool) {
+	const direct = capabilityForTool(tool)?.id;
+	if (direct !== void 0) return direct;
+	const alias = CLAUDE_CODE[tool];
+	if (alias !== void 0) return capabilityForTool(alias)?.id;
+	const mcp = tool.startsWith("mcp__") ? tool.lastIndexOf("__") : -1;
+	if (mcp <= 5) return void 0;
+	const name = tool.slice(mcp + 2);
+	return capabilityOf(MCP_TOOLS[name] ?? name);
+}
+function factsFor(exec, options = {}) {
+	const args = exec.arguments ?? {};
+	const capability = capabilityOf(exec.name);
+	const plugin = options.owners?.get(exec.name);
+	const id = exec.agent?.id;
+	const agent = typeof id === "string" ? id : void 0;
+	return {
+		tool: exec.name,
+		...capability === void 0 ? {} : { capability },
+		...plugin === void 0 ? {} : { plugin },
+		...agent === void 0 ? {} : { agent },
+		args: resolveArgs(args, options.resolvePath, options.cwd),
+		...options.counts === void 0 ? {} : { counts: options.counts }
+	};
+}
+
+//#endregion
+export { factsFor as n, capabilityOf as t };

package/lib/{hook-DxLgNtc4.js → hook-C7LGEIs2.js}

@@ -1,96 +1,11 @@
 import { a as PATH_ARGS, i as evaluate, l as segments, s as relativeTo, t as parsePack } from "./src-CZYvvEn5.js";
 import { n as Ledger } from "./src-CuiWC80o.js";
-import { a as scan, n as MAX_SCAN_BYTES } from "./src-B25SHWcz.js";
+import { n as factsFor, t as capabilityOf } from "./facts-DkTRO2p0.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-9phPLfAL.js";
 import { lstatSync, readFileSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHash } from "node:crypto";
-import { capabilityForTool } from "capmark";
 
-//#region ../dsh/src/facts.ts
-function resolveArgs(args, resolvePath, cwd) {
-	if (resolvePath === void 0 && cwd === void 0) return args;
-	const out = { ...args };
-	for (const key of PATH_ARGS) {
-		const value = out[key];
-		if (typeof value !== "string") continue;
-		let path = value;
-		if (resolvePath !== void 0) try {
-			path = resolvePath(path);
-		} catch {}
-		out[key] = cwd === void 0 ? path : relativeTo(path, cwd);
-	}
-	return out;
-}
-/**
-* Claude Code names its built-in tools in PascalCase (`Read`, `Bash`, …),
-* which capmark's catalogue does not list. Each takes the capability of its
-* lowercase counterpart; without this a Claude Code call carries no
-* capability, and the rules scoped by one (paths, egress, the shell) never
-* see it. An MCP tool, `mcp__<server>__<tool>`, takes its tool's.
-*/
-const CLAUDE_CODE = {
-	Read: "read",
-	Write: "write",
-	Edit: "edit",
-	MultiEdit: "edit",
-	NotebookEdit: "edit",
-	Bash: "bash",
-	PowerShell: "bash",
-	Grep: "grep",
-	Glob: "glob",
-	LS: "glob",
-	WebFetch: "web_fetch",
-	WebSearch: "web_search"
-};
-/**
-* MCP tools whose names capmark's catalogue does not list, from the
-* reference servers an agent most often mounts (modelcontextprotocol
-* `filesystem` and `fetch`) and `prae mcp`'s own. Applied only after an
-* `mcp__<server>__` prefix: without it, a Claude Code session reading
-* `.env` through `mcp__filesystem__read_file` carries no capability, and
-* no `fs:read` rule sees it.
-*/
-const MCP_TOOLS = {
-	read_file: "read",
-	read_text_file: "read",
-	read_media_file: "read",
-	list_directory: "glob",
-	list_dir: "glob",
-	directory_tree: "glob",
-	search_files: "glob",
-	get_file_info: "glob",
-	write_file: "write",
-	edit_file: "edit",
-	create_directory: "write",
-	fetch: "web_fetch"
-};
-function capabilityOf(tool) {
-	const direct = capabilityForTool(tool)?.id;
-	if (direct !== void 0) return direct;
-	const alias = CLAUDE_CODE[tool];
-	if (alias !== void 0) return capabilityForTool(alias)?.id;
-	const mcp = tool.startsWith("mcp__") ? tool.lastIndexOf("__") : -1;
-	if (mcp <= 5) return void 0;
-	const name = tool.slice(mcp + 2);
-	return capabilityOf(MCP_TOOLS[name] ?? name);
-}
-function factsFor(exec, options = {}) {
-	const args = exec.arguments ?? {};
-	const capability = capabilityOf(exec.name);
-	const plugin = options.owners?.get(exec.name);
-	const id = exec.agent?.id;
-	const agent = typeof id === "string" ? id : void 0;
-	return {
-		tool: exec.name,
-		...capability === void 0 ? {} : { capability },
-		...plugin === void 0 ? {} : { plugin },
-		...agent === void 0 ? {} : { agent },
-		args: resolveArgs(args, options.resolvePath, options.cwd),
-		...options.counts === void 0 ? {} : { counts: options.counts }
-	};
-}
-
-//#endregion
 //#region ../dsh/src/judge.ts
 /**
 * Judge one call against a pack, without a harness anywhere near it.

package/lib/index.js

@@ -1,6 +1,7 @@
 import "./src-CZYvvEn5.js";
 import "./src-CuiWC80o.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-C_6dosaw.js";
-import "./views-C7DD-Oif.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BTVEk0Fh.js";
+import "./facts-DkTRO2p0.js";
+import "./views-endiZu1Z.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-fCJ4j7ce.js → instructions-Bcs2n2O6.js}

@@ -1,5 +1,5 @@
 import "./src-CZYvvEn5.js";
-import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-C7DD-Oif.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-endiZu1Z.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-DdEDvTvR.js → mcp-C2gadkb2.js}

@@ -1,5 +1,5 @@
 import { i as evaluate } from "./src-CZYvvEn5.js";
-import { a as scan, n as MAX_SCAN_BYTES } from "./src-B25SHWcz.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-9phPLfAL.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/lib/{src-CwBEFhww.js → src-DIuEg7gi.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-9phPLfAL.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -42,12 +42,12 @@
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
     "@prae/controls": "0.1.0",
-    "@prae/extract": "0.1.0",
+    "@prae/instructions": "0.1.0",
+    "@prae/inspect": "0.1.0",
     "@prae/kernel": "0.1.0",
-    "@prae/ledger": "0.1.0",
     "@prae/tokens": "0.1.0",
-    "@prae/instructions": "0.1.0",
-    "@prae/inspect": "0.1.0"
+    "@prae/extract": "0.1.0",
+    "@prae/ledger": "0.1.0"
   },
   "scripts": {
     "test": "vitest run",

package/lib/cli-BlWTUnGJ.js

@@ -1,6 +0,0 @@
-import "./src-CZYvvEn5.js";
-import "./src-CuiWC80o.js";
-import { t as main } from "./cli-C_6dosaw.js";
-import "./views-C7DD-Oif.js";
-
-export { main };