prae-cli 0.3.0 → 0.5.0

package/lib/{cli-DZ0FPdSr.js → cli-ZfwhJKRw.js}

@@ -1,5 +1,6 @@
-import { p as seal, t as Ledger } from "./src-DGWTvmRZ.js";
-import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-CLLfJPWB.js";
+import { t as evaluate } from "./evaluate-BilZez15.js";
+import { m as seal, t as Ledger } from "./src-CXU0_W1P.js";
+import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
 import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { extname, join, normalize, resolve, sep } from "node:path";
@@ -7,419 +8,6 @@ import { homedir } from "node:os";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
 
-//#region ../kernel/src/command.ts
-/** Wrappers whose first operand is the program actually being run. */
-const WRAPPERS = new Set([
-	"sudo",
-	"command",
-	"env",
-	"nohup",
-	"time",
-	"xargs"
-]);
-/** Wrapper options that consume the next token, so it is not the program. */
-const OPTION_WITH_VALUE = new Set([
-	"-u",
-	"-g",
-	"-p",
-	"-h",
-	"-C",
-	"-r",
-	"-t",
-	"-U",
-	"-I",
-	"-n",
-	"-P",
-	"-L",
-	"-s"
-]);
-const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
-/**
-* Split a line into pipeline segments of words, one scan, quote-aware.
-*
-* Splitting on `|` before parsing quotes is the classic mistake — it turns
-* `echo "a | b"` into two segments — so quoting and separators are read
-* together.
-*/
-function scan(command) {
-	const parts = [];
-	let tokens = [];
-	let current = "";
-	let quote;
-	const endToken = () => {
-		if (current !== "") tokens.push(current);
-		current = "";
-	};
-	const endSegment = () => {
-		endToken();
-		if (tokens.length > 0) parts.push(tokens);
-		tokens = [];
-	};
-	for (let at = 0; at < command.length; at += 1) {
-		const ch = command[at];
-		if (quote !== void 0) {
-			if (ch === quote) quote = void 0;
-			else current += ch;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			continue;
-		}
-		if (ch === ";") {
-			endSegment();
-			continue;
-		}
-		if (ch === "|" || ch === "&") {
-			endSegment();
-			if (command[at + 1] === ch) at += 1;
-			continue;
-		}
-		if (/\s/.test(ch)) {
-			endToken();
-			continue;
-		}
-		current += ch;
-	}
-	endSegment();
-	return parts;
-}
-/** Decompose a command line into pipeline segments. */
-function segments(command) {
-	const found = [];
-	for (const tokens of scan(command)) {
-		let at = 0;
-		while (at < tokens.length) {
-			const token = tokens[at];
-			if (ASSIGNMENT.test(token)) {
-				at += 1;
-				continue;
-			}
-			if (WRAPPERS.has(token)) {
-				at += 1;
-				while (at < tokens.length) {
-					const option = tokens[at];
-					if (!option.startsWith("-")) break;
-					at += OPTION_WITH_VALUE.has(option) ? 2 : 1;
-				}
-				continue;
-			}
-			break;
-		}
-		const name = tokens[at];
-		if (name === void 0) continue;
-		found.push({
-			name: (name.split("/").pop() ?? name).toLowerCase(),
-			tokens: tokens.slice(at + 1)
-		});
-	}
-	return found;
-}
-/** `git*` matches `git`, `github`; bare strings match exactly. */
-function matches$1(pattern, value) {
-	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
-	return value === pattern;
-}
-const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
-/**
-* Judge one command line against one matcher. Every present field must hold.
-*/
-function commandMatches(match, command) {
-	const parts = segments(command);
-	if (parts.length === 0) return false;
-	const names = list(match.name);
-	const args = list(match.token);
-	const pipes = list(match.pipedTo);
-	if (names.length > 0) {
-		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name)));
-		if (hit.length === 0) return false;
-		if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	} else if (args.length > 0) {
-		if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	}
-	if (pipes.length > 0) {
-		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
-	}
-	return true;
-}
-
-//#endregion
-//#region ../kernel/src/path.ts
-/**
-* Path normalization and glob containment, with no filesystem access.
-*
-* The contract, stated here because getting it wrong is how path policies
-* become theatre: **this module compares strings.** It resolves `.` and `..`
-* lexically so that `./src/../../etc/passwd` cannot pose as a workspace path,
-* but it cannot see a symlink. A link inside an allowed directory pointing out
-* of it will pass every check here.
-*
-* That is not a gap to paper over in the matcher — it is a gap the caller
-* closes by resolving before it asks. `dsh-overlay-check` learned this the
-* hard way during the plugin-store gate review: lexical containment accepted a
-* symlink escape cleanly, and the fix was to resolve both the path and its
-* nearest existing ancestor before deciding. Adapters that can touch the
-* filesystem must resolve first and pass the resolved path in.
-*/
-/** Split a path into segments, resolving `.` and `..` lexically. */
-function normalize$1(path) {
-	const absolute = path.startsWith("/");
-	const out = [];
-	let escaped = false;
-	for (const raw of path.split(/[/\\]+/)) {
-		if (raw === "" || raw === ".") continue;
-		if (raw === "..") {
-			if (out.length > 0) out.pop();
-			else escaped = true;
-			continue;
-		}
-		out.push(raw);
-	}
-	return {
-		segments: out,
-		absolute,
-		escaped
-	};
-}
-/** Turn one glob segment into an anchored regular expression. */
-function segmentPattern(segment) {
-	const body = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-	return /* @__PURE__ */ new RegExp(`^${body}$`);
-}
-/**
-* Wildcard segment matching, where `**` spans zero or more segments.
-*
-* Two-pointer with backtracking rather than a recursive walk: the pattern
-* comes from a policy pack and the path from a tool call, and a catastrophic
-* backtrack in the hot path of every call would be a denial of service handed
-* to whoever writes the pack.
-*/
-function matchSegments(path, pattern) {
-	let i = 0;
-	let j = 0;
-	let starPattern = -1;
-	let starPath = 0;
-	while (i < path.length) {
-		const segment = j < pattern.length ? pattern[j] : void 0;
-		const here = path[i];
-		if (segment === "**") {
-			starPattern = j;
-			starPath = i;
-			j += 1;
-			continue;
-		}
-		if (segment !== void 0 && here !== void 0 && segmentPattern(segment).test(here)) {
-			i += 1;
-			j += 1;
-			continue;
-		}
-		if (starPattern >= 0) {
-			starPath += 1;
-			i = starPath;
-			j = starPattern + 1;
-			continue;
-		}
-		return false;
-	}
-	while (j < pattern.length && pattern[j] === "**") j += 1;
-	return j === pattern.length;
-}
-/**
-* Is `path` contained by `glob`?
-*
-* A glob naming a directory contains everything under it: `./src` and
-* `./src/**` both match `src/app/main.ts`. Writing the shorter form is the
-* common intent, and treating it as "this exact directory entry only" is a
-* trap that silently grants the whole subtree past the rule.
-*/
-function within(path, glob) {
-	const target = normalize$1(path);
-	if (target.escaped) return false;
-	const trimmed = glob.trim();
-	if (!(trimmed === "**" || trimmed.startsWith("**/")) && target.absolute !== trimmed.startsWith("/")) return false;
-	const pattern = normalize$1(glob);
-	if (matchSegments(target.segments, pattern.segments)) return true;
-	return matchSegments(target.segments, [...pattern.segments, "**"]);
-}
-/** Is `path` inside any of these globs? */
-function withinAny(path, globs) {
-	return globs.some((glob) => within(path, glob));
-}
-/**
-* The host of a URL, or undefined when it is not a URL we can read.
-*
-* Unparseable input returns undefined, and callers treat that as "no host" —
-* which for a `notIn` rule means the rule matches. Failing toward the rule is
-* the only safe direction: a string we cannot parse is exactly the shape an
-* evasion attempt takes.
-*/
-function hostOf(url) {
-	try {
-		return new URL(url).hostname.toLowerCase();
-	} catch {
-		return;
-	}
-}
-/**
-* Host list membership, where a leading dot means "this domain or below".
-*
-* `example.com` matches only that host. `.example.com` also matches
-* `api.example.com`, and deliberately still matches `example.com` itself —
-* an operator writing the suffix form means the organisation, not a rule that
-* covers every subdomain except the one they first thought of.
-*/
-function hostIn(host, list$1) {
-	return list$1.some((entry) => {
-		const want = entry.toLowerCase();
-		if (want.startsWith(".")) return host === want.slice(1) || host.endsWith(want);
-		return host === want;
-	});
-}
-
-//#endregion
-//#region ../kernel/src/rule.ts
-/**
-* Strength ordering, used when several rules match one call.
-*
-* Higher wins. This is the property that makes a pack safe to extend: adding a
-* rule can raise the strength of a decision and never lower it, so an operator
-* appending to a pack can never accidentally widen what an agent may do.
-*/
-const STRENGTH = {
-	warn: 1,
-	correct: 2,
-	ask: 3,
-	deny: 4
-};
-
-//#endregion
-//#region ../kernel/src/evaluate.ts
-function listed(value, want) {
-	if (want === void 0) return true;
-	if (value === void 0) return false;
-	return typeof want === "string" ? value === want : want.includes(value);
-}
-function argMatches(match, args) {
-	const has = Object.hasOwn(args, match.name);
-	if (match.present !== void 0 && match.present !== has) return false;
-	if (!has) return match.above === void 0 && match.below === void 0 && match.equals === void 0 && match.oneOf === void 0;
-	const value = args[match.name];
-	if (match.above !== void 0) {
-		if (typeof value !== "number" || !(value > match.above)) return false;
-	}
-	if (match.below !== void 0) {
-		if (typeof value !== "number" || !(value < match.below)) return false;
-	}
-	if (match.equals !== void 0 && value !== match.equals) return false;
-	if (match.oneOf !== void 0) {
-		if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") return false;
-		if (!match.oneOf.includes(value)) return false;
-	}
-	return true;
-}
-function matches(when, facts) {
-	if (!listed(facts.tool, when.tool)) return false;
-	if (!listed(facts.capability, when.capability)) return false;
-	if (!listed(facts.plugin, when.plugin)) return false;
-	if (!listed(facts.agent, when.agent)) return false;
-	if (when.command !== void 0) {
-		const raw = facts.args.command ?? facts.args.cmd ?? facts.args.script;
-		if (typeof raw !== "string") return false;
-		if (!commandMatches(when.command, raw)) return false;
-	}
-	if (when.path !== void 0) {
-		const raw = facts.args[when.path.arg ?? "path"];
-		if (typeof raw !== "string") return false;
-		if (when.path.inside !== void 0 && !withinAny(raw, when.path.inside)) return false;
-		if (when.path.outside !== void 0 && withinAny(raw, when.path.outside)) return false;
-	}
-	if (when.host !== void 0) {
-		const raw = facts.args[when.host.arg ?? "url"];
-		if (typeof raw !== "string") return false;
-		const host = hostOf(raw);
-		if (host === void 0) return when.host.notIn !== void 0;
-		if (when.host.in !== void 0 && !hostIn(host, when.host.in)) return false;
-		if (when.host.notIn !== void 0 && hostIn(host, when.host.notIn)) return false;
-	}
-	if (when.arg !== void 0) {
-		for (const one of when.arg) if (!argMatches(one, facts.args)) return false;
-	}
-	if (when.count !== void 0) {
-		const key = facts.capability;
-		if (key === void 0) return false;
-		if (!((facts.counts?.[key] ?? 0) > when.count.above)) return false;
-	}
-	return true;
-}
-function step(rule, effect) {
-	return {
-		rule: rule.id,
-		...rule.title === void 0 ? {} : { title: rule.title },
-		effect: effect.kind,
-		because: effect.because
-	};
-}
-/**
-* Decide one call against one pack.
-*
-* Every matching rule lands in the trace; the strongest effect decides. Ties
-* go to the first rule in pack order, so a pack reads top-down the way its
-* author wrote it.
-*
-* `correct` is the effect the rest of this ecosystem does not have. A rival
-* guardrail can allow a call or refuse it; a rule here can also rewrite an
-* argument and let it through, recording what it changed. Refusing is not
-* always the safe option — an agent denied mid-task retries, and the retry is
-* rarely safer than the clamp would have been.
-*/
-function evaluate(pack, facts) {
-	const hits = [];
-	for (const rule of pack.rules) if (matches(rule.when, facts)) hits.push({
-		rule,
-		effect: rule.effect
-	});
-	if (hits.length === 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated: pack.rules.length
-	};
-	hits.sort((a, b) => STRENGTH[b.effect.kind] - STRENGTH[a.effect.kind]);
-	const trace = hits.map((hit) => step(hit.rule, hit.effect));
-	const evaluated = pack.rules.length;
-	const strongest = hits[0];
-	if (strongest === void 0) return {
-		kind: "allow",
-		trace: [],
-		evaluated
-	};
-	const winner = strongest.effect.kind;
-	if (winner === "deny" || winner === "ask") return {
-		kind: winner,
-		rule: strongest.rule.id,
-		reason: strongest.effect.because,
-		trace,
-		evaluated
-	};
-	if (winner === "correct") {
-		const args = { ...facts.args };
-		for (const hit of hits) if (hit.effect.kind === "correct") Object.assign(args, hit.effect.set);
-		return {
-			kind: "correct",
-			rule: strongest.rule.id,
-			reason: strongest.effect.because,
-			args,
-			trace,
-			evaluated
-		};
-	}
-	return {
-		kind: "allow",
-		trace,
-		evaluated
-	};
-}
-
-//#endregion
 //#region ../kernel/src/pack.ts
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -545,12 +133,12 @@ function readHostMatch(check$1, path, value) {
 		if (arg !== void 0) out.arg = arg;
 	}
 	if (value.in !== void 0) {
-		const list$1 = check$1.globs(`${path}.in`, value.in);
-		if (list$1 !== void 0) out.in = list$1;
+		const list = check$1.globs(`${path}.in`, value.in);
+		if (list !== void 0) out.in = list;
 	}
 	if (value.notIn !== void 0) {
-		const list$1 = check$1.globs(`${path}.notIn`, value.notIn);
-		if (list$1 !== void 0) out.notIn = list$1;
+		const list = check$1.globs(`${path}.notIn`, value.notIn);
+		if (list !== void 0) out.notIn = list;
 	}
 	return out;
 }
@@ -585,6 +173,33 @@ function readArgMatch(check$1, path, value) {
 	else out.present = value.present;
 	return out;
 }
+function readSecretsMatch(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object");
+		return;
+	}
+	check$1.keys(path, value, [
+		"types",
+		"minConfidence",
+		"atLeast"
+	]);
+	const out = {};
+	if (value.types !== void 0) {
+		const types = check$1.globs(`${path}.types`, value.types);
+		if (types !== void 0) out.types = types;
+	}
+	if (value.minConfidence !== void 0) {
+		const n = check$1.number(`${path}.minConfidence`, value.minConfidence);
+		if (n !== void 0) if (n < 0 || n > 1) check$1.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
+		else out.minConfidence = n;
+	}
+	if (value.atLeast !== void 0) {
+		const n = check$1.number(`${path}.atLeast`, value.atLeast);
+		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check$1.fail(`${path}.atLeast`, "expected an integer of at least 1");
+		else out.atLeast = n;
+	}
+	return out;
+}
 function readMatch(check$1, path, value) {
 	if (!isObject(value)) {
 		check$1.fail(path, "expected an object");
@@ -599,7 +214,8 @@ function readMatch(check$1, path, value) {
 		"path",
 		"host",
 		"arg",
-		"count"
+		"count",
+		"secrets"
 	]);
 	const out = {};
 	for (const key of [
@@ -625,12 +241,12 @@ function readMatch(check$1, path, value) {
 	}
 	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check$1.fail(`${path}.arg`, "expected an array of argument matchers");
 	else {
-		const list$1 = [];
+		const list = [];
 		value.arg.forEach((entry, index) => {
 			const one = readArgMatch(check$1, `${path}.arg[${index}]`, entry);
-			if (one !== void 0) list$1.push(one);
+			if (one !== void 0) list.push(one);
 		});
-		out.arg = list$1;
+		out.arg = list;
 	}
 	if (value.count !== void 0) if (!isObject(value.count)) check$1.fail(`${path}.count`, "expected an object");
 	else {
@@ -638,6 +254,10 @@ function readMatch(check$1, path, value) {
 		const above = check$1.number(`${path}.count.above`, value.count.above);
 		if (above !== void 0) out.count = { above };
 	}
+	if (value.secrets !== void 0) {
+		const match = readSecretsMatch(check$1, `${path}.secrets`, value.secrets);
+		if (match !== void 0) out.secrets = match;
+	}
 	return out;
 }
 function readEffect(check$1, path, value) {
@@ -1222,6 +842,17 @@ const USAGE = `prae — operator policy for agent harnesses
   prae explain <pack.json> <tool> [key=value ...]
       Judge one call against the pack and print the trace. Nothing is executed.
 
+  prae scan <file> [--pack <pack.json>] [--json]
+      Inspect a file for credentials the way the gate would before a read.
+      Findings name the type and the line, never the secret. With --pack,
+      also print the verdict the pack would reach.
+
+  prae mcp --root <dir> [--pack <pack.json>] [--ledger <file>]
+      Serve gated filesystem access over MCP stdio. Any MCP-capable agent or
+      IDE mounts this as its file tool; every read is inspected before its
+      contents are returned, and every decision lands in the ledger.
+      (no --pack mounts the bundled secret-catcher pack)
+
   prae verify <ledger.jsonl> [--key <public.pem>]
       Re-derive every hash in a decision log and report any break. With
       --key, also verify each row's signature against that pinned key.
@@ -1233,6 +864,10 @@ const USAGE = `prae — operator policy for agent harnesses
   prae receipt <ledger.jsonl> <seq> --key <private.pem> [--out <file>]
       Export one decision as a self-contained signed receipt.
 
+  prae verify-receipt <receipt.json>
+      Check one receipt with nothing but the file: recompute its hash, verify
+      its signature, and print the key fingerprint to compare against your own.
+
   prae report <ledger.jsonl> [--out <file.html>]
       Render the decision record as a printable evidence report.
 
@@ -1286,6 +921,70 @@ async function check(path) {
 		console.log(`  ${rule.id.padEnd(10)} ${rule.effect.kind.toUpperCase().padEnd(8)} ${label}`);
 	}
 }
+/**
+* `prae scan`: the gate's pre-read inspection, runnable by hand.
+*
+* This is the command a pilot runs first — point it at a file that holds a
+* credential and watch the gate see it without repeating it. Output carries
+* type, rule, line and confidence; the matched text is structurally absent
+* from the findings, so there is nothing here to be careful about printing.
+*/
+async function scanFile(path, packPath, json) {
+	const { scan } = await import("./src-Vnr0fcpK.js");
+	let content;
+	try {
+		content = await readFile(path, "utf8");
+	} catch {
+		return fail(`cannot read ${path}`);
+	}
+	const findings = scan(content);
+	if (json) console.log(JSON.stringify({
+		file: path,
+		findings
+	}, null, 2));
+	else if (findings.length === 0) console.log(`${path} — no credentials detected`);
+	else {
+		console.log(`${path} — ${findings.length} finding(s)\n`);
+		for (const f of findings) {
+			const score = `${Math.round(f.confidence * 100)}%`;
+			console.log(`  line ${String(f.line).padEnd(5)} ${f.type.padEnd(18)} ${f.rule.padEnd(22)} ${score}`);
+		}
+	}
+	if (packPath !== void 0) {
+		const pack = await loadPack(packPath);
+		const decision = evaluate(pack, {
+			tool: "read",
+			capability: "fs:read",
+			args: { path },
+			secrets: findings
+		});
+		const label = VERDICT_LABEL[decision.kind];
+		console.log(`\n${pack.pack} ${pack.version} would say: ${label}${decision.rule === void 0 ? "" : ` (${decision.rule})`}`);
+	}
+}
+/**
+* `prae mcp`: mount the gate as a filesystem MCP server on stdio.
+*
+* With no --pack, the bundled secret-catcher mounts — same day-zero logic as
+* `init`'s baseline: a gate whose whole point is content inspection should
+* not come up inspecting nothing.
+*/
+async function mcp(root, packPath, ledgerPath) {
+	const { serveMcp } = await import("./mcp-BH5I4Eyu.js");
+	const { resolve: resolve$1 } = await import("node:path");
+	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
+	const chosen = packPath ?? bundled;
+	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
+	const pack = await loadPack(chosen);
+	const { Ledger: Ledger$1 } = await import("./src-Kubj3MTX.js");
+	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
+	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
+	await serveMcp({
+		pack,
+		root: resolve$1(root),
+		...ledger === void 0 ? {} : { ledger }
+	});
+}
 /** `key=value` pairs, with numbers and booleans read as themselves. */
 function parseArgs(pairs) {
 	const args = {};
@@ -1316,7 +1015,7 @@ async function explain(path, tool, pairs) {
 	if (decision.trace.length === 0) console.log("\n        no rule matched this call");
 	else {
 		console.log("");
-		for (const step$1 of decision.trace) console.log(`        ${step$1.rule.padEnd(10)} ${step$1.effect.padEnd(8)} ${step$1.because}`);
+		for (const step of decision.trace) console.log(`        ${step.rule.padEnd(10)} ${step.effect.padEnd(8)} ${step.because}`);
 	}
 	console.log(`\n${pack.pack} ${pack.version} · ${decision.evaluated} rules considered`);
 	if (capability === void 0) console.log(`\nnote: no capability claims \`${tool}\`, so capability rules did not apply`);
@@ -1329,7 +1028,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint } = await import("./src-Cinsv7Wq.js");
+	const { generateKeypair, fingerprint } = await import("./src-Kubj3MTX.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1345,7 +1044,7 @@ async function keygen(dir) {
 	console.log("private key with `signingKey` to sign every row.");
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-Cinsv7Wq.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-Kubj3MTX.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1366,6 +1065,27 @@ async function receipt(path, seq, keyPath, out) {
 	console.log("The verifier compares that fingerprint against the one they");
 	console.log("pinned — a receipt is only as good as the key they trust.");
 }
+/**
+* `prae verify-receipt`: check a single self-contained receipt.
+*
+* The counterparty's command. It needs nothing but the receipt file — no
+* ledger, no PRAE account, no trust in the machine that issued it. The verdict
+* and its wording live in `receipt-check.ts` as a pure function; this reads the
+* file and sets the exit code, so scripts can branch on it.
+*/
+async function verifyReceiptCmd(path) {
+	const { checkReceipt } = await import("./receipt-check-Dql0uqxw.js");
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(path, "utf8"));
+	} catch {
+		return fail(`cannot read a receipt from ${path}`);
+	}
+	const result = checkReceipt(parsed);
+	for (const line of result.lines) if (result.ok) console.log(line);
+	else console.error(line);
+	if (!result.ok) process.exit(1);
+}
 async function verify(path, keyPath) {
 	let ledger;
 	try {
@@ -1379,7 +1099,7 @@ async function verify(path, keyPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (keyPath !== void 0) {
-			const { verifySignature, fingerprint } = await import("./src-Cinsv7Wq.js");
+			const { verifySignature, fingerprint } = await import("./src-Kubj3MTX.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1455,7 +1175,7 @@ async function report(path, out) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-2pGbYeGU.js");
+	const { ingest } = await import("./src-C4fnUm9V.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -1491,7 +1211,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-2pGbYeGU.js"), import("./src-CuHszf3f.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-C4fnUm9V.js"), import("./src-BfYsUDW9.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -1551,9 +1271,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-2pGbYeGU.js"),
-			import("./src-CuHszf3f.js"),
-			import("./instructions-C6jwClPO.js")
+			import("./src-C4fnUm9V.js"),
+			import("./src-BfYsUDW9.js"),
+			import("./instructions-D4VOn2lk.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1652,6 +1372,16 @@ async function main(argv) {
 			if (path === void 0 || tool === void 0) fail("explain needs a pack file and a tool name");
 			return explain(path, tool, pairs);
 		}
+		case "scan": {
+			const path = rest[0];
+			if (path === void 0) fail("scan needs a file");
+			return scanFile(path, flag(rest, "pack"), rest.includes("--json"));
+		}
+		case "mcp": {
+			const root = flag(rest, "root");
+			if (root === void 0) fail("mcp needs --root <dir>; serving without a boundary is not a gate");
+			return mcp(root, flag(rest, "pack"), flag(rest, "ledger"));
+		}
 		case "keygen": return keygen(flag(rest, "out") ?? ".");
 		case "receipt": {
 			const [path, seq] = rest;
@@ -1664,6 +1394,11 @@ async function main(argv) {
 			if (path === void 0) fail("verify needs a ledger file");
 			return verify(path, flag(rest, "key"));
 		}
+		case "verify-receipt": {
+			const path = rest[0];
+			if (path === void 0) fail("verify-receipt needs a receipt file");
+			return verifyReceiptCmd(path);
+		}
 		case "report": {
 			const path = rest[0];
 			if (path === void 0) fail("report needs a ledger file");