prae-cli 0.6.2 → 0.7.1

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./evaluate-CkYySl7T.js";
-import "./views-CAD9738P.js";
-import { t as main } from "./cli-BUgU-LpN.js";
+import "./evaluate-wMPkjcIC.js";
+import "./views-UODslKwu.js";
+import { t as main } from "./cli-mahLCjoD.js";
 import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts

package/lib/{cli-BUgU-LpN.js → cli-mahLCjoD.js}

@@ -1,7 +1,7 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
-import { a as renderPacks, c as renderShell, d as cite, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor, u as FRAMEWORKS } from "./views-CAD9738P.js";
-import { m as seal, t as Ledger } from "./src-Ciggx9ja.js";
-import { existsSync, readFileSync } from "node:fs";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
+import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-UODslKwu.js";
+import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
+import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
@@ -72,9 +72,11 @@ function readCommandMatch(check$1, path, value) {
 	check$1.keys(path, value, [
 		"name",
 		"token",
-		"pipedTo"
+		"anyToken",
+		"pipedTo",
+		"pipeline"
 	]);
-	if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check$1.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check$1.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
 	const out = {};
 	if (value.token !== void 0) {
 		const tokens = check$1.names(`${path}.token`, value.token);
@@ -84,10 +86,18 @@ function readCommandMatch(check$1, path, value) {
 		const names = check$1.names(`${path}.name`, value.name);
 		if (names !== void 0) out.name = names;
 	}
+	if (value.anyToken !== void 0) {
+		const tokens = check$1.names(`${path}.anyToken`, value.anyToken);
+		if (tokens !== void 0) out.anyToken = tokens;
+	}
 	if (value.pipedTo !== void 0) {
 		const pipes = check$1.names(`${path}.pipedTo`, value.pipedTo);
 		if (pipes !== void 0) out.pipedTo = pipes;
 	}
+	if (value.pipeline !== void 0) {
+		const shapes = check$1.names(`${path}.pipeline`, value.pipeline);
+		if (shapes !== void 0) out.pipeline = shapes;
+	}
 	return out;
 }
 function readPathMatch(check$1, path, value) {
@@ -752,7 +762,9 @@ function praeRow(options) {
 	];
 	if (options.ledger !== void 0) lines.push(`        ledger: ${JSON.stringify(options.ledger)}`);
 	if (options.approver !== void 0) lines.push(`        approver: ${JSON.stringify(options.approver)}`);
-	lines.push("        pack: |", indent(options.pack, 10));
+	if (options.mode !== void 0) lines.push(`        mode: ${options.mode}`);
+	if (options.packFile !== void 0) lines.push(`        packFile: ${JSON.stringify(options.packFile)}`);
+	else lines.push("        pack: |", indent(options.pack ?? "", 10));
 	return lines.join("\n");
 }
 /** Compose the write and check it, without touching the file. */
@@ -792,6 +804,60 @@ async function applyWrite(profile, plan, expectedRevision) {
 	return { snapshot: manifest.id };
 }
 
+//#endregion
+//#region src/record-files.ts
+function jsonOrNull(path) {
+	if (!existsSync(path)) return null;
+	try {
+		return JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return null;
+	}
+}
+function readLedger(path) {
+	if (!existsSync(path)) return [];
+	const out = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		if (line.trim() === "") continue;
+		try {
+			out.push(JSON.parse(line));
+		} catch {}
+	}
+	return out;
+}
+/** The defaults the demo writes; a caller with other names overrides them. */
+const DEFAULT_FILES = {
+	ledger: "papaya.jsonl",
+	discovery: "discovery.json",
+	report: "security-report.json",
+	guardians: "guardians.json",
+	pack: "papaya.prae.json",
+	publicKey: "prae-signing.pub.pem",
+	redteam: "../redteam/results"
+};
+function readRecord(dir, files) {
+	return {
+		ledger: readLedger(resolve(dir, files.ledger)),
+		discovery: jsonOrNull(resolve(dir, files.discovery)),
+		report: jsonOrNull(resolve(dir, files.report)),
+		guardians: jsonOrNull(resolve(dir, files.guardians)),
+		pack: jsonOrNull(resolve(dir, files.pack))
+	};
+}
+/** The red-team campaign and its runs, as the runner wrote them; empty when none. */
+function readRedteam(dir, files) {
+	const root = resolve(dir, files.redteam);
+	if (!existsSync(root)) return {
+		campaign: null,
+		runs: []
+	};
+	const runs = readdirSync(root).filter((n) => n.endsWith(".json")).sort().filter((n) => n !== "campaign.json").map((n) => jsonOrNull(resolve(root, n))).filter((r) => r !== null);
+	return {
+		campaign: jsonOrNull(resolve(root, "campaign.json")),
+		runs
+	};
+}
+
 //#endregion
 //#region src/serve.ts
 const TYPES = {
@@ -823,8 +889,233 @@ function safePath(root, urlPath) {
 	if (target !== base && !target.startsWith(base + sep)) return void 0;
 	return target;
 }
-/** Start the reader. Resolves once it is listening. */
-function serveConsole(root, port) {
+/**
+* Verify the ledger the way `prae verify` does — chain, then signatures
+* against the public key beside it. With `tamper`, one row's refusal is
+* changed to an allow in memory first and the altered text is what gets
+* verified: the forged-copy demonstration, without writing a file. With
+* `repair` as well, every hash is recomputed over the altered rows — what
+* an attacker would do to mend the chain — and the signatures, made over the
+* original hashes by a key they do not hold, are what fails. Nothing on disk
+* changes.
+*/
+function verifyRecord(record, tamper, repair = false) {
+	const { dir, files } = record;
+	const path = resolve(dir, files.ledger);
+	if (!existsSync(path)) return {
+		ok: false,
+		entries: 0,
+		problems: [{
+			line: 0,
+			message: "no ledger"
+		}],
+		tampered: null,
+		repaired: false,
+		signatures: null
+	};
+	let text = readFileSync(path, "utf8");
+	let tampered = null;
+	if (tamper !== void 0) {
+		const lines = text.trimEnd().split("\n");
+		const idx = lines.findIndex((line) => {
+			try {
+				return JSON.parse(line).seq === tamper;
+			} catch {
+				return false;
+			}
+		});
+		if (idx >= 0) {
+			const row$1 = JSON.parse(lines[idx]);
+			row$1.verdict = "allow";
+			row$1.reason = "looks fine to me";
+			lines[idx] = JSON.stringify(row$1);
+			if (repair) {
+				let prev = GENESIS;
+				for (let i = 0; i < lines.length; i += 1) {
+					const { seq, prev: _prev, hash: _hash, sig,...rest } = JSON.parse(lines[i]);
+					const entry = chain(rest, seq, prev);
+					lines[i] = JSON.stringify(sig === void 0 ? entry : {
+						...entry,
+						sig
+					});
+					prev = entry.hash;
+				}
+			}
+			text = `${lines.join("\n")}\n`;
+			tampered = tamper;
+		}
+	}
+	const verified = verifyEntries(text);
+	const keyPath = resolve(dir, files.publicKey);
+	let signatures = null;
+	if (existsSync(keyPath)) {
+		const publicKey = readFileSync(keyPath, "utf8");
+		let entries = [];
+		try {
+			entries = readEntries(text);
+		} catch {
+			entries = [];
+		}
+		const signed = entries.filter((e) => e.sig !== void 0);
+		signatures = {
+			checked: signed.length,
+			failed: signed.filter((e) => !verifySignature(e, e.sig, publicKey)).map((e) => e.seq),
+			fingerprint: fingerprint(publicKey)
+		};
+	}
+	return {
+		ok: verified.ok,
+		entries: verified.entries,
+		problems: [...verified.problems],
+		tampered,
+		repaired: tampered !== null && repair,
+		signatures
+	};
+}
+const OWASP = "owasp-llm-top-10-2026";
+/**
+* Evidence toward each control, from the pack and the ledger as they are
+* now — the rows the controls package defines, so the console, the exporter and
+* the old pages cannot disagree about what a profile shows. Framed as
+* evidence, never as compliance: an auditor decides.
+*/
+function complianceOf(record) {
+	const { dir, files } = record;
+	const ledgerPath = resolve(dir, files.ledger);
+	const text = existsSync(ledgerPath) ? readFileSync(ledgerPath, "utf8") : "";
+	let entries = [];
+	try {
+		entries = readEntries(text);
+	} catch {
+		entries = [];
+	}
+	const packPath = resolve(dir, files.pack);
+	let pack;
+	if (existsSync(packPath)) {
+		const parsed = parsePack(readFileSync(packPath, "utf8"));
+		if (parsed.ok) pack = parsed.pack;
+	}
+	const data = {
+		...pack === void 0 ? {} : { pack },
+		entries,
+		verification: verifyEntries(text),
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const owasp = FRAMEWORKS[OWASP]?.controls ?? {};
+	return { controls: CONTROLS.map((control) => {
+		const code = /LLM\d\d/.exec(control.id)?.[0];
+		const named = code === void 0 ? void 0 : owasp[code];
+		return {
+			id: code ?? control.id,
+			...named === void 0 ? {} : { name: named.name },
+			asks: control.asks,
+			framework: named === void 0 ? "obligation" : OWASP,
+			...control.evidence(data)
+		};
+	}) };
+}
+/**
+* The record over HTTP, for the Command Center (apps/console): the same
+* files `prae console` renders, as JSON, plus one event stream that says
+* when the ledger moved. Read-only, from files on disk, nothing computed
+* here — the console derives everything it shows from these bodies.
+*
+* Returns false when the URL is not an API route, so a caller can fall
+* through to static files. Shared with the console's Vite dev server so the
+* two answer identically.
+*/
+function handleApi(req, res, record) {
+	const route = (req.url ?? "").split("?")[0] ?? "";
+	if (!route.startsWith("/api/")) return false;
+	const json = (body, status = 200) => {
+		res.statusCode = status;
+		res.setHeader("content-type", "application/json; charset=utf-8");
+		res.setHeader("cache-control", "no-store");
+		res.end(JSON.stringify(body));
+	};
+	const { dir, files } = record;
+	if (route === "/api/events") {
+		res.writeHead(200, {
+			"content-type": "text/event-stream",
+			"cache-control": "no-store",
+			connection: "keep-alive"
+		});
+		res.write(": connected\n\n");
+		let sent = readRecord(dir, files).ledger.length;
+		const push = () => {
+			const rows = readRecord(dir, files).ledger;
+			if (rows.length < sent) sent = 0;
+			const fresh = rows.slice(sent);
+			sent = rows.length;
+			if (fresh.length > 0) res.write(`data: ${JSON.stringify(fresh)}\n\n`);
+			else res.write(": keepalive\n\n");
+		};
+		const watcher = existsSync(dir) ? watch(dir, { persistent: false }, () => push()) : void 0;
+		const keep = setInterval(push, 2e3);
+		res.on("close", () => {
+			clearInterval(keep);
+			watcher?.close();
+		});
+		return true;
+	}
+	if (route === "/api/verify") {
+		const raw = new URL(req.url ?? "/", "http://localhost").searchParams.get("tamper");
+		const tamper = raw === null ? void 0 : Number(raw);
+		const repair = new URL(req.url ?? "/", "http://localhost").searchParams.get("repair") === "1";
+		json(verifyRecord(record, Number.isInteger(tamper) ? tamper : void 0, repair));
+		return true;
+	}
+	if (route === "/api/compliance") {
+		json(complianceOf(record));
+		return true;
+	}
+	if (route === "/api/redteam") {
+		json(readRedteam(dir, files));
+		return true;
+	}
+	const snapshot = readRecord(dir, files);
+	switch (route) {
+		case "/api/record":
+			json(snapshot);
+			break;
+		case "/api/ledger":
+			json(snapshot.ledger);
+			break;
+		case "/api/discovery":
+			json(snapshot.discovery);
+			break;
+		case "/api/report":
+			json(snapshot.report);
+			break;
+		case "/api/guardians":
+			json(snapshot.guardians);
+			break;
+		case "/api/pack":
+			json(snapshot.pack);
+			break;
+		case "/api/status":
+			json({
+				dir,
+				files: Object.fromEntries(Object.entries(files).map(([name, file]) => {
+					const path = resolve(dir, file);
+					if (!existsSync(path)) return [name, null];
+					const stat$1 = statSync(path);
+					return [name, {
+						size: stat$1.size,
+						mtime: stat$1.mtimeMs
+					}];
+				}))
+			});
+			break;
+		default: json({ error: "not found" }, 404);
+	}
+	return true;
+}
+/**
+* Start the reader. Resolves once it is listening. With a record source,
+* `/api/*` answers from it; without one, only the rendered pages are served.
+*/
+function serveConsole(root, port, record) {
 	const server = createServer((req, res) => {
 		if (req.method !== "GET" && req.method !== "HEAD") {
 			res.statusCode = 405;
@@ -832,6 +1123,7 @@ function serveConsole(root, port) {
 			res.end();
 			return;
 		}
+		if (record !== void 0 && handleApi(req, res, record)) return;
 		const target = safePath(root, req.url ?? "/");
 		if (target === void 0) {
 			res.statusCode = 403;
@@ -852,9 +1144,10 @@ function serveConsole(root, port) {
 	return new Promise((ok, fail$1) => {
 		server.once("error", fail$1);
 		server.listen(port, "127.0.0.1", () => {
+			const address = server.address();
 			ok({
 				server,
-				url: `http://127.0.0.1:${port}/`
+				url: `http://127.0.0.1:${typeof address === "object" && address !== null ? address.port : port}/`
 			});
 		});
 	});
@@ -869,7 +1162,7 @@ const VERDICT_LABEL = {
 	deny: "DENIED",
 	correct: "CORRECTED"
 };
-const USAGE = `prae — operator policy for agent harnesses
+const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
 
   prae check <pack.json>
       Validate a policy pack and summarise what it enforces.
@@ -931,9 +1224,11 @@ const USAGE = `prae — operator policy for agent harnesses
 
   prae init [--pack <file>] [--profile <dir>] [--ledger <file>]
                 (no --pack mounts the built-in baseline of 8 high-risk rules)
-                  [--approver <name>] [--apply]
+                  [--approver <name>] [--link] [--shadow] [--apply]
       Compose the overlay row that mounts PRAE with a pack. Prints the
-      diff; writes only with --apply.
+      diff; writes only with --apply. --link points the profile at the
+      pack file instead of copying it in, so edits hot-reload; --shadow
+      mounts in shadow mode: every verdict sealed, every call let through.
 `;
 function fail(message) {
 	console.error(`prae: ${message}`);
@@ -1015,7 +1310,7 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-Bq0DNPPR.js");
+	const { serveMcp } = await import("./mcp-DDcejhwQ.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
@@ -1073,7 +1368,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint } = await import("./src-C9L6NBvu.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1082,14 +1377,14 @@ async function keygen(dir) {
 	writeFileSync$1(pub, keys.publicKey);
 	console.log(`private     ${priv}  (0600 — this signs; guard it)`);
 	console.log(`public      ${pub}`);
-	console.log(`fingerprint ${fingerprint(keys.publicKey)}`);
+	console.log(`fingerprint ${fingerprint$1(keys.publicKey)}`);
 	console.log("");
 	console.log("Give the PUBLIC key and fingerprint to whoever will verify");
 	console.log("receipts, through a channel they trust. Point the plugin at the");
 	console.log("private key with `signingKey` to sign every row.");
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1106,7 +1401,7 @@ async function receipt(path, seq, keyPath, out) {
 		await writeFile(out, text);
 		console.log(`${out} · seq ${seq} · ${entry.verdict} ${entry.tool} ${entry.subject ?? ""}`);
 	}
-	console.log(`fingerprint ${fingerprint(publicKey)}`);
+	console.log(`fingerprint ${fingerprint$1(publicKey)}`);
 	console.log("The verifier compares that fingerprint against the one they");
 	console.log("pinned — a receipt is only as good as the key they trust.");
 }
@@ -1150,7 +1445,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-04ubUcSb.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-DOaCKD1t.js");
 	const suite = parseSuite(parsed);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
@@ -1190,7 +1485,7 @@ async function verify(path, keyPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (keyPath !== void 0) {
-			const { verifySignature, fingerprint } = await import("./src-C9L6NBvu.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1198,13 +1493,13 @@ async function verify(path, keyPath) {
 			for (const entry of entries) {
 				if (entry.sig === void 0) continue;
 				signed += 1;
-				if (!verifySignature(entry, entry.sig, publicKey)) bad.push(entry.seq);
+				if (!verifySignature$1(entry, entry.sig, publicKey)) bad.push(entry.seq);
 			}
 			if (bad.length > 0) {
-				console.error(`signatures: ${bad.length} of ${signed} FAIL against ${fingerprint(publicKey)} — rows ${bad.join(", ")}`);
+				console.error(`signatures: ${bad.length} of ${signed} FAIL against ${fingerprint$1(publicKey)} — rows ${bad.join(", ")}`);
 				process.exitCode = 1;
 			} else if (signed === 0) console.log("signatures: none present — this ledger is not signed");
-			else console.log(`signatures: ${signed}/${entries.length} rows verify against ${fingerprint(publicKey)}`);
+			else console.log(`signatures: ${signed}/${entries.length} rows verify against ${fingerprint$1(publicKey)}`);
 		}
 		console.log("tamper-evident: a removed, edited, or reordered row breaks this chain.");
 		console.log("It does not prove against a rewrite of the whole file by someone holding this code.");
@@ -1366,7 +1661,7 @@ async function consoleOut(path, argv) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
 			import("./src-CraUX64d.js"),
 			import("./src-CQ0UmFUK.js"),
-			import("./instructions-oGCdVxHM.js")
+			import("./instructions-C104EUaE.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1395,8 +1690,16 @@ async function consoleOut(path, argv) {
 	const portFlag = flag(argv, "serve");
 	const port = portFlag === void 0 ? 4180 : Number(portFlag);
 	if (!Number.isInteger(port) || port < 1 || port > 65535) fail(`--serve takes a port, got \`${portFlag}\``);
-	const { url } = await serveConsole(out, port);
+	const { url } = await serveConsole(out, port, {
+		dir: dirname(resolve(path)),
+		files: {
+			...DEFAULT_FILES,
+			ledger: resolve(path),
+			...packPath === void 0 ? {} : { pack: resolve(packPath) }
+		}
+	});
 	console.log(`\nserving ${out} at ${url}`);
+	console.log(`record at ${url}api/record · events at ${url}api/events`);
 	console.log("loopback only, read-only. ctrl-c to stop.");
 }
 async function init(argv) {
@@ -1413,8 +1716,11 @@ async function init(argv) {
 	const profile = profileDir === void 0 ? defaultProfile() : profileAt(profileDir);
 	const ledger = flag(argv, "ledger");
 	const approver = flag(argv, "approver");
+	const link = argv.includes("--link");
+	const shadow = argv.includes("--shadow");
 	const row$1 = praeRow({
-		pack: source,
+		...link ? { packFile: resolve(packPath) } : { pack: source },
+		...shadow ? { mode: "shadow" } : {},
 		...ledger === void 0 ? {} : { ledger },
 		...approver === void 0 ? {} : { approver }
 	});
@@ -1426,7 +1732,8 @@ async function init(argv) {
 	}
 	console.log(`profile     ${profile.dir}`);
 	console.log(`overlay     ${plan.patchPath}`);
-	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules`);
+	console.log(`pack        ${pack.pack} ${pack.version} · ${pack.rules.length} rules${link ? ` · linked, edits hot-reload (${resolve(packPath)})` : ""}`);
+	if (shadow) console.log("mode        shadow · every verdict sealed, every call proceeds");
 	if (ledger !== void 0) console.log(`ledger      ${ledger}`);
 	if (plan.findings.length > 0) {
 		console.log("");

package/lib/{evaluate-CkYySl7T.js → evaluate-wMPkjcIC.js}

@@ -123,6 +123,22 @@ function matches$1(pattern, value) {
 	if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
 	return value === pattern;
 }
+/**
+* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+* shape of download-and-execute however the two ends are spelled.
+*/
+function globMatches(pattern, value) {
+	const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+}
+/**
+* Every wanted token holds in a segment: a plain pattern must match some
+* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+* force-delete, not a rehearsal of one.
+*/
+function tokensHold(wanted, tokens) {
+	return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+}
 const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
 /**
 * Judge one command line against one matcher. Every present field must hold.
@@ -132,17 +148,24 @@ function commandMatches(match, command) {
 	if (parts.length === 0) return false;
 	const names = list(match.name);
 	const args = list(match.token);
+	const anyArgs = list(match.anyToken);
 	const pipes = list(match.pipedTo);
+	const shapes = list(match.pipeline);
+	const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
 	if (names.length > 0) {
 		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 		if (hit.length === 0) return false;
-		if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-	} else if (args.length > 0) {
-		if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+		if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+	} else if (args.length > 0 || anyArgs.length > 0) {
+		if (!parts.some(argsHold)) return false;
 	}
 	if (pipes.length > 0) {
 		if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
 	}
+	if (shapes.length > 0) {
+		const signature = parts.map((segment) => segment.name).join("|");
+		if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
+	}
 	return true;
 }
 

package/lib/index.d.ts

@@ -32,7 +32,12 @@ declare function defaultProfile(name?: string): Profile;
  * was in force at the time.
  */
 declare function praeRow(options: {
-  readonly pack: string;
+  /** The pack inline, as JSON text. */
+  readonly pack?: string;
+  /** The pack as a file the gate watches (hot reload); wins over `pack`. */
+  readonly packFile?: string;
+  /** `shadow` seals every verdict and lets every call through. */
+  readonly mode?: 'enforce' | 'shadow';
   readonly ledger?: string;
   readonly approver?: string;
 }): string;

package/lib/index.js

@@ -1,6 +1,6 @@
-import "./evaluate-CkYySl7T.js";
-import "./views-CAD9738P.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BUgU-LpN.js";
+import "./evaluate-wMPkjcIC.js";
+import "./views-UODslKwu.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-mahLCjoD.js";
 import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-oGCdVxHM.js → instructions-C104EUaE.js}

@@ -1,4 +1,4 @@
-import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-CAD9738P.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-UODslKwu.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-Bq0DNPPR.js → mcp-DDcejhwQ.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 import { a as scan, n as MAX_SCAN_BYTES } from "./src-Br1tGPtS.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";

package/lib/playground.js

@@ -126,6 +126,22 @@
 		if (pattern.endsWith("*")) return value.startsWith(pattern.slice(0, -1));
 		return value === pattern;
 	}
+	/**
+	* A glob with `*` anywhere, for pipeline signatures: `curl*|*sh` is the
+	* shape of download-and-execute however the two ends are spelled.
+	*/
+	function globMatches(pattern, value) {
+		const source = pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+		return (/* @__PURE__ */ new RegExp(`^${source}$`)).test(value);
+	}
+	/**
+	* Every wanted token holds in a segment: a plain pattern must match some
+	* token, a `!pattern` must match none. `["-rf", "!--dry-run"]` is a real
+	* force-delete, not a rehearsal of one.
+	*/
+	function tokensHold(wanted, tokens) {
+		return wanted.every((pattern) => pattern.startsWith("!") ? !tokens.some((token) => matches$1(pattern.slice(1), token)) : tokens.some((token) => matches$1(pattern, token)));
+	}
 	const list = (v) => v === void 0 ? [] : typeof v === "string" ? [v] : v;
 	/**
 	* Judge one command line against one matcher. Every present field must hold.
@@ -135,17 +151,24 @@
 		if (parts.length === 0) return false;
 		const names = list(match.name);
 		const args = list(match.token);
+		const anyArgs = list(match.anyToken);
 		const pipes = list(match.pipedTo);
+		const shapes = list(match.pipeline);
+		const argsHold = (segment) => tokensHold(args, segment.tokens) && (anyArgs.length === 0 || anyArgs.some((wanted) => segment.tokens.some((token) => matches$1(wanted, token))));
 		if (names.length > 0) {
 			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 			if (hit.length === 0) return false;
-			if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
-		} else if (args.length > 0) {
-			if (!parts.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
+			if ((args.length > 0 || anyArgs.length > 0) && !hit.some(argsHold)) return false;
+		} else if (args.length > 0 || anyArgs.length > 0) {
+			if (!parts.some(argsHold)) return false;
 		}
 		if (pipes.length > 0) {
 			if (!parts.slice(1).some((segment) => pipes.some((pattern) => matches$1(pattern, segment.name)))) return false;
 		}
+		if (shapes.length > 0) {
+			const signature = parts.map((segment) => segment.name).join("|");
+			if (!shapes.some((pattern) => globMatches(pattern, signature))) return false;
+		}
 		return true;
 	}
 
@@ -580,9 +603,11 @@
 		check.keys(path, value, [
 			"name",
 			"token",
-			"pipedTo"
+			"anyToken",
+			"pipedTo",
+			"pipeline"
 		]);
-		if (value.name === void 0 && value.token === void 0 && value.pipedTo === void 0) check.fail(path, "expected `name`, `token` or `pipedTo`; a command matcher with none matches nothing");
+		if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
 		const out = {};
 		if (value.token !== void 0) {
 			const tokens = check.names(`${path}.token`, value.token);
@@ -592,10 +617,18 @@
 			const names = check.names(`${path}.name`, value.name);
 			if (names !== void 0) out.name = names;
 		}
+		if (value.anyToken !== void 0) {
+			const tokens = check.names(`${path}.anyToken`, value.anyToken);
+			if (tokens !== void 0) out.anyToken = tokens;
+		}
 		if (value.pipedTo !== void 0) {
 			const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
 			if (pipes !== void 0) out.pipedTo = pipes;
 		}
+		if (value.pipeline !== void 0) {
+			const shapes = check.names(`${path}.pipeline`, value.pipeline);
+			if (shapes !== void 0) out.pipeline = shapes;
+		}
 		return out;
 	}
 	function readPathMatch(check, path, value) {

package/lib/prae-baseline.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "prae-baseline",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "rules": [
     {
       "id": "BASE-001",
@@ -15,33 +15,65 @@
       "effect": {
         "kind": "deny",
         "because": "piping a download into an interpreter runs code nobody has read"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-002",
       "title": "Recursive force-delete is held",
-      "when": { "command": { "name": ["rm", "shred"], "token": "-rf" } },
+      "when": {
+        "command": {
+          "name": ["rm", "shred"],
+          "anyToken": ["-rf", "-fr", "-Rf", "-fR", "-r", "-R"],
+          "token": ["!--dry-run"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "a recursive force-delete is not reversible and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-003",
       "title": "Privilege escalation is held",
-      "when": { "command": { "name": ["su", "doas", "pkexec"] } },
+      "when": {
+        "command": {
+          "name": ["su", "doas", "pkexec"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "escalating privileges needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-004",
       "title": "Filesystem-wide destruction is refused",
-      "when": { "command": { "name": ["mkfs*", "dd", "diskutil", "fdisk"] } },
+      "when": {
+        "command": {
+          "name": ["mkfs*", "diskutil", "fdisk", "dd"],
+          "token": [
+            "!of=/dev/null",
+            "!of=/dev/zero",
+            "!of=/dev/stdout",
+            "!of=/dev/stderr"
+          ]
+        }
+      },
       "effect": {
         "kind": "deny",
         "because": "block-device and filesystem tools are not granted to agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
@@ -64,24 +96,43 @@
       "effect": {
         "kind": "deny",
         "because": "secrets and credential stores are out of scope for agents"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
       "id": "BASE-006",
       "title": "Writes outside the workspace are held",
-      "when": { "capability": "fs:write", "path": { "outside": ["./**"] } },
+      "when": {
+        "capability": "fs:write",
+        "path": {
+          "outside": ["./**"]
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "writing outside the working tree needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
       "id": "BASE-007",
       "title": "Force-push is held",
-      "when": { "command": { "name": "git", "token": "--force*" } },
+      "when": {
+        "command": {
+          "name": "git",
+          "token": "--force*"
+        }
+      },
       "effect": {
         "kind": "ask",
         "because": "rewriting shared history needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     },
     {
@@ -96,6 +147,9 @@
       "effect": {
         "kind": "ask",
         "because": "publishing is outward-facing and needs a human"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM03"]
       }
     }
   ]

package/lib/{test-run-04ubUcSb.js → test-run-DOaCKD1t.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { t as evaluate } from "./evaluate-wMPkjcIC.js";
 
 //#region src/test-run.ts
 /** The path argument a scenario's call carries, if any. */

package/lib/{views-CAD9738P.js → views-UODslKwu.js}

@@ -67,17 +67,74 @@ function cite(rule) {
 }
 
 //#endregion
-//#region src/console/logo.ts
+//#region ../tokens/src/mark.ts
 /**
-* The mark, inlined.
+* The mark — Guardians — as code.
+*
+* Four corner brackets around a core that none of them touch: the Guardians
+* PRAE assembles around an agent, and the agent, green because what is
+* inside has been verified. The console, the site and the CLI draw it from
+* here, so there is one geometry and no copies to drift. `brand/` holds the
+* same shapes as files, for places that need a file.
 *
-* A P drawn as a door: the product is the moment permission is granted,
-* and the glyph is the gate it comes through. Inlined as a data URI rather
-* than linked because these pages are read offline and mailed around as
-* evidence — a page that fetches an image renders wrong on the machine that
-* matters.
+* Grid 32u. Arms 11u long, 5u thick. Core 8u, centred, 5u clear. Radius 0.
 */
-const LOGO = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAOxAAADsQBlSsOGwAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAABJQSURBVHic7d1frKR1fcfxD+zyR0BQC13FKrKWViANf0ypcRcQxYhpL+oFaUxqk15Ir/ovXtCkvbBNmlTvSNq0tjdIm8bSq9akCbKosGwRagVModDELbSW5Y/CsssuC7tAL54Z5+xwlnPOzHPmNzPf1yt5wjm7uvsFVp/3PM/M90kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgYWxpPQAwsYuSfCbJ7yV5IsnTPf7aH03y5STbkhxO8qMef20AYAO2J7kpyW3pTvhvrDiu6fn3umHs138xyZ1Jbk6yM8mpPf9+wIxtbT0AsKotST6UZEeS65N8LMl5Dec5ezDH9YPvDyW5L8meJPcOjiNtRgMmIQBgPmxJcnm6V9c7knwiybuaTvTWzszxQXA0yfeT7EoXBfeku2oAzCkBAG1sTXJZuhPoziRXJzmn6UTTOSXJhwdHkryW5KGMrhB8M8mP24wGAO2cke5Ef3O6e+mHc/w99mmPzX4PQB/HD5J8JclvJHlfz/MCwFw4K92r+y+mO+EfSf8n1EULgNWC4LZ0b2zc3vP8wBrcAoB+nJ3kqowu6V+V7rI4J7Z9cHxu8P2+dLcLhrcNvpcuFIBNIABgMtvSneSH79K/IsnJTSdafO9JcuPgSJJnkzyQLgZ2JXkwyettRoPlIwBgfc5Pd7Ifvkv/yiQnNZ1o+f10kl8ZHElyMMn9GV0h2J3klTajweITALC67Rmd7K+Pe9Tz4O05/qOHh9NdFRheIdiT5OU2owGwqFZu2Xsym/8GOG8C7P84muS7SW5JdxvhnT3/M4Gl4goAFY1v2bsuyblNJ6IPWzPaRfA76XYRPJ7RFYJvxTMN4CcEABUs2pY9+rElySWD46bBj+3N6HbB3emu9kBJAoBltGxb9ujP8FbPMAiGHz0cRsEjjeaCmRMALIMz0r0rf3hJf2eS05tOxKIY/+jh0+k+XTD8pIGPHrK0BACL6KwkH8nokv7VSU5rOhHL4t05PggOpNtFMLxCcH+6NxvCwhMALAJb9mhl/DHILyX5TjwGmSUgAJhHtuwxr4bPePAYZBaeAGAeDLfsDV/hXxxb9lgM449BPpbk4YyuENyV5Pk2o8FbEwC0YMsey2p8F8HrSR7L6CFH30ryv82mgxUEALOwPaNX99cmeX/bcWBmTs7quwiGVwjuTPLfbUajOgFA32zZg7fmMcjMBQHAtIZLd1Ze0reDHdZvfBfBM0n+LR6DzCYTAGyULXuwubblrR+DfE+SV9uMxjIRAKzlzHQfw7NlD9oYfwzyoSQPxWOQmZIAYNz4lr1rkpzadCJgpTPT/W9zR5KbM/ro4TAGdifZ32w6FoYAwJY9WGwrP3qYeAwy6yQA6nl3uvv2w1f4tuzBcvEYZNZFACw/W/YAj0HmTQTA8lm5Ze+TSS5sOw4wh8Y/emgXQUECYPHZsgdMazwIPAa5AAGwWGzZA2Zhrccg707ySpvR6IsAmG+27AHzYPwxyIfTbSgc3jbwGOQFJADmiy17wCI4I6NdBInHIC8kAdCWLXvAMhh/DPLKXQR7knwzyQ+bTceqBMBs2bIHVHCiXQQegzxHBMDmOi/dCX/4Ct/SHaCqEz0GefhJg0fjo4czJQD6Nb5l78pYugOwGo9BbkwATMeWPYB+nOgxyMMrBA/EY5B7JQA2xpY9gNlY6zHI9yY50ma05SAA1vaBJF9O94a9bW1HAShr/DHIR9LdMrg73WKif023sIh1EgBruyCje1QAzIfT073n6urB98fSPcNgd7rFRLvSLSziBLwjHYBlsDXJVUm+kOSfkvxi23HmnwAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChoa+sBAJbUU0m+muT+JP+R5I0kpyV5b5KfTXJRkp8b/PXCJKe2GZOqBABAv15I8vtJ/j7J0VV+/j+T7Br7sa1JLsibw+CiwY/7/2p65w8VQH/uS3Jjkv/b4H/vWJIfDI47xn7ulCTbMwqClcf74lYuExIAAP14OMkvp7sC0KejSR4fHONOTfIz6QJhe5JLk1wy+PoDEQe8BQEAML0DST6d/k/+a3k1yd7BMe7MdFcJLk/yqSS/muT02Y3GvFOHANP74yT7Wg8x5lCSh5LcmuSz6a4I3JruzYggAACm9GKSv2g9xDo8k+Q3B8dqb06kGAEAMJ1/TvJK6yE24KtJPhdXAsoTAADTuaf1ABP4hyR/3noI2hIAANP5YesBJvSHSX7cegjaEQAA03mu9QATOpjkb1oPQTsCAGA6i3wv/S+z2PMzBQEAUNf/JHms9RC0IQAAaruv9QC0IQAAanu69QC0IQAAanu99QC0IQAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAATGdr6wFgEgIAYDrbWg8wpZNaD0AbAgBgOhe2HmBKP9V6ANoQAADTuaH1AFN6b+sBaEMAAEzn40nObz3EhLYm+WjrIWhDAABM57Qkf9R6iAldE7cAyhIAANP7rSSfaj3EBP6g9QC0IwAApndykr9LcmnrQTbgM0k+2XoI2hEAAP04N8meJJ9uPcg6/EKSW1sPQVsCAKA/5yT5lyS3Z36vBnw8yR1Jzm49CG3ZYAXQvxsHx8NJdid5LMmzSQ4kOTQ4Xkzy0orvN9tFSb6Q5PPx4o8IAIDNdNngWI/9GcXAwYxi4fDg51bGwv4VP3dglf/s4XS3JD6YZEe6e/3XxomfFQQAwHx4x+CAmVCDAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABW1tPQAA9Ojw4Hi59SDzTgAA0NKRJC+kO2Gv9vVa36/8+kdJXp3t+ItLAACwXkfSz4l6+P3+JG/M9O+AnxAAAMurrxP1kSTPJTk62/HZTAIAYD6Mv7qe9ET9QpLnB1/DCQkAgM3zYJLdSf4rybNJDiQ5NDheTPLSiu9hpgQAQL/eSHJ7kj9J8mjjWeCEBABAf/Yn+bUk32g9CKxFAAD047kk1yV5pPUgsB42AQJM77Ukvx4nfxaIAACY3l/FZX8WjAAAmM4rSf609RCwUQIAYDp3JdnXegjYKAEAMJ07Wg8AkxAAANPZ23oAmIQAAJjOs60HgEkIAIDpHGs9AExCAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQIAAAoSAABQkAAAgIIEAAAUJAAAoCABAAAFCQAAKEgAAEBBAgAAChIAAFCQAACAggQAABQkAACgIAEAAAUJAAAoSAAAQEECAAAKEgAAUJAAAICCBAAAFCQAAKAgAQAABQkAAChIAABAQQJgbU8m+VqSp1oPAgB92dp6gAXwRJLPDr4+P8mOJNcn2ZnkkkYzAcBUBMDGPJXkHwdHkrwnXQjsTBcGVyY5qc1oALB+AmA6+3J8EGxLclVGVwmuiNssAMwhAdCvZ5J8fXAkyduT/FJGtwyuSnJKm9EAYEQAbK6DSXYNjiQ5K8lHMrplcHWS09qMBkBlAmC2XsrxQXBGuvcNDG8Z7EjytjajAVCJAGjrcJJ7B8eX0v37uCyjWwY7k7yj2XQALC0BMF+OJfn3wfGlJFuSXJ7RLYNPJHlXs+kAWBoCYL69llEQ3JLuEwUXZ3TL4GNJzms1HACLSwAslteTPDI4/nrwY9szumVwTZIL2owGwCIRAItvb7oYGAaBbYUArEkALB/bCgFYkwBYfrYVAvAmAqCe8W2FZ6cLAtsKAQoRAByIbYUA5QgAxq21rXBnktPbjAZAXwQAa1lrW+HVSc5pNh0AExEAbJRthQBLQAAwrfFthVuSfCijWwbXJTm32XQArEoA0LfXYlshwNwTAMzC+LbC7RndMrh+8D0AMyQAaGHv4Lht8P1wfbFthQAzIgCYB6utL7423ScMrk33PANBwDx6OckrrYeASQgA5tG+JF8bHIlthcyPQ0nuS7Ino4/HHmk6EUxIALAIbCuklYNJ7k/3Z29PkgeSvNp0IuiJAGAR2VbIZnk6yXfTvbLfleTBJK83nQg2iQBgGdhWyKT2ZXSy35Pk0SRvNJ0IZkQAsIxsK+RE9mZ0//4bSZ5oOg00JACowLbCml5L8nhGr/C/neS5lgPBPBEAVLTWtsJrk7y/zWhM4ViShzN6hX9XkuebTgRzTABAx7bCxXM43Zv07k130r873SdGgHUQALC6E20rHF4luDiWE83aS0m+k9Er/N2xhAcmJgBgfca3FW5Lt5BoGAVXJDm5zWhL60C6z90P36F/f5KjTSeCJSIAYDLPJPn64EhsK+zD0+le1Q9f4X8vPpIHm0YAQD9sK9y48c/gP9J2HKhFAMDmsK3wzfZmdLK/O8mTbccBgNnbmuTDSW5Odxthf7rL3ZMe1/Q83w1TznMs3Sv6ryS5MfYsAMCqhkHwu0luT/f59UUKgKPpdujfku6E/86e5wGAErYkuTTJTemC4LnMVwAcSnf//s/S3dJ4W8+/PwAwsD1dENyW7v75LAPgYJI7k3wx3QnfGxoBoJGfT/L5JH+bbg9Bn3ak23nw2+merGjHAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACt/D8OdL0ResTTzQAAAABJRU5ErkJggg==";
+const MARK = {
+	viewBox: "0 0 32 32",
+	brackets: "M2 2H13V7H7V13H2ZM19 2H30V13H25V7H19ZM2 19H7V25H13V30H2ZM25 19H30V30H19V25H25Z",
+	corners: [
+		{
+			d: "M2 2H13V7H7V13H2Z",
+			dx: -14,
+			dy: -14
+		},
+		{
+			d: "M19 2H30V13H25V7H19Z",
+			dx: 14,
+			dy: -14
+		},
+		{
+			d: "M25 19H30V30H19V25H25Z",
+			dx: 14,
+			dy: 14
+		},
+		{
+			d: "M2 19H7V25H13V30H2Z",
+			dx: -14,
+			dy: 14
+		}
+	],
+	core: {
+		x: 12,
+		y: 12,
+		width: 8,
+		height: 8
+	},
+	colour: {
+		graphite: "#0E1114",
+		ink: "#FFFFFF",
+		signal: "#98ED49",
+		signalOnLight: "#0C6800"
+	}
+};
+/** The inner drawing: brackets and, unless absent, the core. */
+function markShapes({ surface = "graphite", core = "verified", mono = false } = {}) {
+	const ink = surface === "graphite" ? MARK.colour.ink : MARK.colour.graphite;
+	const green = surface === "graphite" ? MARK.colour.signal : MARK.colour.signalOnLight;
+	const coreFill = mono || core === "unverified" ? ink : green;
+	const { x, y, width, height } = MARK.core;
+	const rect = core === "absent" ? "" : `<rect class="prae-core" x="${x}" y="${y}" width="${width}" height="${height}" fill="${coreFill}"/>`;
+	return `${MARK.corners.map((c, i) => `<path class="prae-corner" style="--i:${i};--dx:${c.dx};--dy:${c.dy}" d="${c.d}" fill="${ink}"/>`).join("")}${rect}`;
+}
+/** A complete SVG document of the mark. */
+function markSvg(options = {}) {
+	const size = options.size ?? 32;
+	return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${MARK.viewBox}" width="${size}" height="${size}">${markShapes(options)}</svg>`;
+}
+/** The mark as a data URI, for an `<img>` that must not fetch anything. */
+function markDataUri(options = {}) {
+	return `data:image/svg+xml;utf8,${encodeURIComponent(markSvg(options))}`;
+}
 
 //#endregion
 //#region ../tokens/src/palette.ts
@@ -345,6 +402,10 @@ const VERDICT_LABEL = {
 	correct: "CORRECTED"
 };
 
+//#endregion
+//#region src/console/logo.ts
+const LOGO = markDataUri({ size: 26 });
+
 //#endregion
 //#region src/console/shell.ts
 function esc(value) {
@@ -1073,4 +1134,4 @@ ${history}`;
 }
 
 //#endregion
-export { renderPacks as a, renderShell as c, cite as d, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t, FRAMEWORKS as u };
+export { renderPacks as a, renderNav as c, FRAMEWORKS as d, cite as f, renderOverview as i, renderShell as l, renderApprovals as n, CONTROLS as o, renderCompliance as r, esc as s, navFor as t, VERDICT_LABEL as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.6.2",
+  "version": "0.7.1",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,12 +40,12 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
-    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",
+    "@prae/controls": "0.1.0",
     "@prae/tokens": "0.1.0"
   },
   "scripts": {