prae-cli 0.7.1 → 0.9.1

package/lib/ocsf-DhVGbBUw.js

@@ -0,0 +1,211 @@
+import { basename } from "node:path";
+
+//#region src/ocsf.ts
+const OCSF_VERSION = "1.5.0";
+const DETECTION_FINDING = 2004;
+const API_ACTIVITY = 6003;
+/** OCSF `severity_id`. */
+const SEVERITY = {
+	informational: 1,
+	low: 2,
+	medium: 3,
+	high: 4
+};
+/** OCSF `action_id`: what was done about it, in the schema's four words. */
+const ACTION = {
+	allowed: 1,
+	denied: 2,
+	observed: 3
+};
+/** OCSF API Activity `activity_id`. */
+const API_ACTIVITY_OF = {
+	read: 2,
+	list_dir: 2,
+	read_file: 2,
+	web_fetch: 2,
+	write: 3,
+	edit: 3,
+	str_replace_editor: 3
+};
+function isEvent(row) {
+	return row.tool.startsWith("prae:");
+}
+const isUrl = (subject) => /^https?:\/\//.test(subject);
+/** The file or URL the call was aimed at, as an OCSF evidence artifact. */
+function evidences(row) {
+	const subject = row.subject;
+	if (subject === void 0 || subject === "" || isEvent(row)) return [];
+	if (isUrl(subject)) return [{ url: {
+		url_string: subject,
+		hostname: subject.replace(/^https?:\/\//, "").split("/")[0] ?? ""
+	} }];
+	if (row.command !== void 0) return [];
+	return [{ file: {
+		name: basename(subject),
+		path: subject,
+		type_id: 1
+	} }];
+}
+/** The same target, as the resource an API Activity touched. */
+function resources(row) {
+	const subject = row.subject;
+	if (subject === void 0 || subject === "") return [];
+	if (row.command !== void 0) return [{
+		name: row.command.program,
+		type: "program"
+	}];
+	return [{
+		name: subject,
+		type: isUrl(subject) ? "url" : "file"
+	}];
+}
+/** Everything the SIEM has no field for, kept verbatim. The seal lives here. */
+function unmapped(row, disposition) {
+	return {
+		seq: row.seq,
+		disposition,
+		seal: row.hash,
+		prev: row.prev,
+		...row.sig === void 0 ? {} : { sig: row.sig },
+		verdict: row.verdict,
+		...row.rule === void 0 ? {} : { rule: row.rule },
+		...row.capability === void 0 ? {} : { capability: row.capability },
+		...row.phase === void 0 ? {} : { phase: row.phase },
+		...row.shadow === void 0 ? {} : { shadow: row.shadow },
+		...row.subject === void 0 ? {} : { subject: row.subject },
+		...row.command === void 0 ? {} : { command: row.command },
+		...row.secrets === void 0 ? {} : { secrets: row.secrets.map((s) => ({
+			type: s.type,
+			rule: s.rule
+		})) },
+		...row.micros === void 0 ? {} : { micros: row.micros },
+		pack: row.pack,
+		trace: row.trace,
+		evidence: "PRAE ledger row. The seal and signature cover the original row, not this event; verify with `prae verify` or a receipt."
+	};
+}
+function metadata(row, options) {
+	const log = options.ledger === void 0 ? void 0 : basename(options.ledger);
+	return {
+		product: {
+			name: options.product.name,
+			vendor_name: "PRAE",
+			version: options.product.version
+		},
+		version: OCSF_VERSION,
+		profiles: ["security_control"],
+		uid: `${row.session ?? log ?? "ledger"}#${row.seq}`,
+		...row.session === void 0 ? {} : { correlation_uid: row.session },
+		...log === void 0 ? {} : { log_name: log },
+		logged_time: Date.parse(row.at)
+	};
+}
+/** What happened, in one line a SOC analyst reads first. */
+function message(row) {
+	const what = row.command?.program ?? row.subject ?? row.tool;
+	if (isEvent(row)) return `${row.rule ?? row.tool}: ${row.reason ?? what}`;
+	const verb = row.verdict === "deny" ? row.phase === "output" ? "ran; output withheld from the model" : "refused before execution" : row.verdict === "ask" ? "held for approval" : row.rule === void 0 ? "allowed" : "allowed and recorded";
+	const shadow = row.shadow ? " (shadow mode)" : "";
+	const rule = row.rule === void 0 ? "" : ` · ${row.rule}`;
+	return `${row.tool} ${what}: ${verb}${shadow}${rule}`;
+}
+function finding(row, options) {
+	const event = isEvent(row);
+	const severity = event ? SEVERITY.informational : row.verdict === "deny" ? SEVERITY.high : row.verdict === "ask" || row.verdict === "correct" ? SEVERITY.medium : SEVERITY.low;
+	const disposition = event ? "logged" : row.shadow ? "logged" : row.verdict === "deny" ? row.phase === "output" ? "withheld" : "blocked" : row.verdict === "ask" ? "held" : "logged";
+	const action = disposition === "blocked" || disposition === "withheld" ? ACTION.denied : ACTION.observed;
+	const activity = 1;
+	return {
+		class_uid: DETECTION_FINDING,
+		category_uid: 2,
+		activity_id: activity,
+		type_uid: DETECTION_FINDING * 100 + activity,
+		time: Date.parse(row.at),
+		severity_id: severity,
+		status_id: 1,
+		action_id: action,
+		is_alert: !event && row.verdict === "deny" && row.shadow !== true,
+		message: message(row),
+		metadata: metadata(row, options),
+		finding_info: {
+			uid: `${row.session ?? "ledger"}#${row.seq}`,
+			title: event ? `PRAE ${row.rule ?? row.tool}` : `PRAE ${row.verdict}${row.phase === "output" ? " (output)" : ""}${row.rule === void 0 ? "" : ` · ${row.rule}`}`,
+			...row.reason === void 0 ? {} : { desc: row.reason },
+			analytic: {
+				name: row.rule ?? "baseline",
+				type_id: 1,
+				...row.pack === void 0 ? {} : { version: `${row.pack.name} ${row.pack.version}` }
+			},
+			...row.capability === void 0 ? {} : { types: [row.capability] }
+		},
+		evidences: evidences(row),
+		unmapped: unmapped(row, disposition)
+	};
+}
+function apiActivity(row, options) {
+	const activity = API_ACTIVITY_OF[row.tool] ?? 99;
+	return {
+		class_uid: API_ACTIVITY,
+		category_uid: 6,
+		activity_id: activity,
+		type_uid: API_ACTIVITY * 100 + activity,
+		time: Date.parse(row.at),
+		severity_id: SEVERITY.informational,
+		status_id: 1,
+		action_id: ACTION.allowed,
+		message: message(row),
+		metadata: metadata(row, options),
+		actor: {
+			app_name: "dsh",
+			...row.session === void 0 ? {} : { session: { uid: row.session } }
+		},
+		api: {
+			operation: row.tool,
+			request: { uid: `${row.seq}` },
+			response: {
+				code: 0,
+				message: "allowed"
+			}
+		},
+		src_endpoint: { name: "agent harness" },
+		resources: resources(row),
+		unmapped: unmapped(row, "allowed")
+	};
+}
+/** One OCSF event per ledger row, in file order. */
+function toOcsf(rows, options) {
+	return rows.map((row) => isEvent(row) || row.verdict !== "allow" || row.rule !== void 0 ? finding(row, options) : apiActivity(row, options));
+}
+/** Newline-delimited JSON, the form every collector takes. */
+function ndjson(events) {
+	return `${events.map((event) => JSON.stringify(event)).join("\n")}\n`;
+}
+/**
+* Splunk HTTP Event Collector: one request, one JSON object per line, each
+* wrapping the event with its time. Sentinel and Security Lake take the
+* NDJSON file through their own ingestion; only HEC has a wire this simple.
+*/
+async function sendToHec(events, url, token, fetchImpl = fetch) {
+	const endpoint = `${url.replace(/\/$/, "")}/services/collector/event`;
+	const body = events.map((event) => JSON.stringify({
+		time: Number(event.time) / 1e3,
+		sourcetype: "ocsf:prae",
+		event
+	})).join("\n");
+	const response = await fetchImpl(endpoint, {
+		method: "POST",
+		headers: {
+			authorization: `Splunk ${token}`,
+			"content-type": "application/json"
+		},
+		body
+	});
+	return {
+		sent: events.length,
+		status: response.status,
+		body: await response.text()
+	};
+}
+
+//#endregion
+export { OCSF_VERSION, ndjson, sendToHec, toOcsf };

package/lib/playground.js

@@ -491,52 +491,100 @@
 
 //#endregion
 //#region ../kernel/src/frameworks.ts
-	const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-		name: "OWASP Top 10 for LLM Applications — 2026",
-		short: "OWASP LLM 2026",
-		controls: {
-			LLM01: {
-				name: "Prompt Injection",
-				summary: "Instructions in a prompt or in retrieved content alter what the model does."
-			},
-			LLM02: {
-				name: "Sensitive Information Disclosure",
-				summary: "Credentials, personal data or proprietary content reach the model or its output."
-			},
-			LLM03: {
-				name: "Excessive Agency",
-				summary: "The model can take actions, or holds permissions, beyond what its task needs."
-			},
-			LLM04: {
-				name: "Supply Chain",
-				summary: "A compromised model, dataset, plugin or dependency enters the application."
-			},
-			LLM05: {
-				name: "Data and Model Poisoning",
-				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-			},
-			LLM06: {
-				name: "Unbounded Consumption",
-				summary: "The application permits resource use without a limit, exhausting budget or service."
-			},
-			LLM07: {
-				name: "Misinformation",
-				summary: "The model produces false or misleading content that is acted on as if true."
-			},
-			LLM08: {
-				name: "Hidden Context Exposure",
-				summary: "System prompts, hidden instructions or internal context are revealed."
-			},
-			LLM09: {
-				name: "Vector and Embedding Weaknesses",
-				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-			},
-			LLM10: {
-				name: "Improper Output Handling",
-				summary: "Model output is passed to downstream systems without validation."
+	const FRAMEWORKS = {
+		"owasp-llm-top-10-2026": {
+			name: "OWASP Top 10 for LLM Applications — 2026",
+			short: "OWASP LLM 2026",
+			controls: {
+				LLM01: {
+					name: "Prompt Injection",
+					summary: "Instructions in a prompt or in retrieved content alter what the model does."
+				},
+				LLM02: {
+					name: "Sensitive Information Disclosure",
+					summary: "Credentials, personal data or proprietary content reach the model or its output."
+				},
+				LLM03: {
+					name: "Excessive Agency",
+					summary: "The model can take actions, or holds permissions, beyond what its task needs."
+				},
+				LLM04: {
+					name: "Supply Chain",
+					summary: "A compromised model, dataset, plugin or dependency enters the application."
+				},
+				LLM05: {
+					name: "Data and Model Poisoning",
+					summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+				},
+				LLM06: {
+					name: "Unbounded Consumption",
+					summary: "The application permits resource use without a limit, exhausting budget or service."
+				},
+				LLM07: {
+					name: "Misinformation",
+					summary: "The model produces false or misleading content that is acted on as if true."
+				},
+				LLM08: {
+					name: "Hidden Context Exposure",
+					summary: "System prompts, hidden instructions or internal context are revealed."
+				},
+				LLM09: {
+					name: "Vector and Embedding Weaknesses",
+					summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+				},
+				LLM10: {
+					name: "Improper Output Handling",
+					summary: "Model output is passed to downstream systems without validation."
+				}
+			}
+		},
+		"owasp-agentic-top-10-2026": {
+			name: "OWASP Top 10 for Agentic Applications — 2026",
+			short: "OWASP Agentic 2026",
+			controls: {
+				ASI01: {
+					name: "Agent Goal Hijack",
+					summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+				},
+				ASI02: {
+					name: "Tool Misuse and Exploitation",
+					summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+				},
+				ASI03: {
+					name: "Identity and Privilege Abuse",
+					summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+				},
+				ASI04: {
+					name: "Agentic Supply Chain",
+					summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+				},
+				ASI05: {
+					name: "Unexpected Code Execution",
+					summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+				},
+				ASI06: {
+					name: "Memory and Context Poisoning",
+					summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+				},
+				ASI07: {
+					name: "Insecure Inter-Agent Communication",
+					summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+				},
+				ASI08: {
+					name: "Cascading Failures",
+					summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+				},
+				ASI09: {
+					name: "Human-Agent Trust Exploitation",
+					summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+				},
+				ASI10: {
+					name: "Rogue Agents",
+					summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+				}
 			}
 		}
-	} };
+	};
 
 //#endregion
 //#region ../kernel/src/pack.ts

package/lib/prae-baseline.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "prae-baseline",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "rules": [
     {
       "id": "BASE-001",
@@ -17,7 +17,8 @@
         "because": "piping a download into an interpreter runs code nobody has read"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI05", "ASI02"]
       }
     },
     {
@@ -35,7 +36,8 @@
         "because": "a recursive force-delete is not reversible and needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -51,7 +53,8 @@
         "because": "escalating privileges needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -73,7 +76,8 @@
         "because": "block-device and filesystem tools are not granted to agents"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -98,7 +102,8 @@
         "because": "secrets and credential stores are out of scope for agents"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -115,7 +120,8 @@
         "because": "writing outside the working tree needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -132,7 +138,8 @@
         "because": "rewriting shared history needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -149,7 +156,8 @@
         "because": "publishing is outward-facing and needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     }
   ]

package/lib/{receipt-check-DrDE3Wwi.js → receipt-check-CD-W1wXs.js}

@@ -1,4 +1,4 @@
-import { c as verifyReceipt, i as fingerprint } from "./src-Ciggx9ja.js";
+import { d as verifyReceipt, s as fingerprint } from "./src-D7g4lvaY.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */

package/lib/secret-catcher.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "secret-catcher",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "rules": [
     {
       "id": "SEC-001",
@@ -26,7 +26,8 @@
         "because": "the requested file contains a protected credential; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -43,7 +44,8 @@
         "because": "the requested file contains a private key; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -74,7 +76,8 @@
         "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     }
   ]

package/lib/{src-Vnr0fcpK.js → src-CwBEFhww.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-Br1tGPtS.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };