prae-cli 0.7.1 → 0.9.1

package/lib/{views-UODslKwu.js → views-CIg2ZNG0.js}

@@ -1,50 +1,98 @@
 //#region ../kernel/src/frameworks.ts
-const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-	name: "OWASP Top 10 for LLM Applications — 2026",
-	short: "OWASP LLM 2026",
-	controls: {
-		LLM01: {
-			name: "Prompt Injection",
-			summary: "Instructions in a prompt or in retrieved content alter what the model does."
-		},
-		LLM02: {
-			name: "Sensitive Information Disclosure",
-			summary: "Credentials, personal data or proprietary content reach the model or its output."
-		},
-		LLM03: {
-			name: "Excessive Agency",
-			summary: "The model can take actions, or holds permissions, beyond what its task needs."
-		},
-		LLM04: {
-			name: "Supply Chain",
-			summary: "A compromised model, dataset, plugin or dependency enters the application."
-		},
-		LLM05: {
-			name: "Data and Model Poisoning",
-			summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-		},
-		LLM06: {
-			name: "Unbounded Consumption",
-			summary: "The application permits resource use without a limit, exhausting budget or service."
-		},
-		LLM07: {
-			name: "Misinformation",
-			summary: "The model produces false or misleading content that is acted on as if true."
-		},
-		LLM08: {
-			name: "Hidden Context Exposure",
-			summary: "System prompts, hidden instructions or internal context are revealed."
-		},
-		LLM09: {
-			name: "Vector and Embedding Weaknesses",
-			summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-		},
-		LLM10: {
-			name: "Improper Output Handling",
-			summary: "Model output is passed to downstream systems without validation."
+const FRAMEWORKS = {
+	"owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	},
+	"owasp-agentic-top-10-2026": {
+		name: "OWASP Top 10 for Agentic Applications — 2026",
+		short: "OWASP Agentic 2026",
+		controls: {
+			ASI01: {
+				name: "Agent Goal Hijack",
+				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+			},
+			ASI02: {
+				name: "Tool Misuse and Exploitation",
+				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+			},
+			ASI03: {
+				name: "Identity and Privilege Abuse",
+				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+			},
+			ASI04: {
+				name: "Agentic Supply Chain",
+				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+			},
+			ASI05: {
+				name: "Unexpected Code Execution",
+				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+			},
+			ASI06: {
+				name: "Memory and Context Poisoning",
+				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+			},
+			ASI07: {
+				name: "Insecure Inter-Agent Communication",
+				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+			},
+			ASI08: {
+				name: "Cascading Failures",
+				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+			},
+			ASI09: {
+				name: "Human-Agent Trust Exploitation",
+				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+			},
+			ASI10: {
+				name: "Rogue Agents",
+				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+			}
 		}
 	}
-} };
+};
 /**
 * Every framework control a rule cites, resolved to names.
 *
@@ -802,6 +850,7 @@ const OBLIGATIONS = [
 	}
 ];
 const OWASP = "owasp-llm-top-10-2026";
+const AGENTIC = "owasp-agentic-top-10-2026";
 /** Rules in the pack that cite one control of one framework. */
 function citing(pack, framework, control) {
 	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
@@ -819,32 +868,91 @@ const NOT_THIS_BOUNDARY = {
 	LLM07: "Whether an answer is true is not a property of a tool call.",
 	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
 	LLM09: "Retrieval stores are upstream of the call the gate judges.",
-	LLM10: "What downstream code does with model output is that code's boundary, not this one's."
+	LLM10: "What downstream code does with model output is that code's boundary, not this one's.",
+	ASI04: "Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.",
+	ASI06: "Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.",
+	ASI07: "A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.",
+	ASI09: "Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion."
+};
+/**
+* A risk this gate answers by *not* answering it: nothing here detects an
+* injected instruction or a hijacked goal, and saying otherwise would be the
+* claim a red team disproves first. What the gate does is bound what the
+* subverted agent can execute — the cited controls of another risk doing
+* their job. Said in those words, every time.
+*/
+const BOUNDED_BY = {
+	LLM01: {
+		framework: OWASP,
+		control: "LLM03"
+	},
+	ASI01: {
+		framework: AGENTIC,
+		control: "ASI02"
+	}
+};
+function bounded(data, risk, by) {
+	const bounding = citing(data.pack, by.framework, by.control);
+	const what = risk === "ASI01" ? "a hijacked goal" : "injected instructions";
+	const who = risk === "ASI01" ? "a hijacked agent" : "an injected instruction";
+	return {
+		state: "partial",
+		note: bounding.length === 0 ? `Not mitigated: this gate does not detect ${what}, and no ${by.control} control in this pack bounds what ${who} can execute.` : `Not mitigated: this gate does not detect ${what}. Bounded: ${bounding.length} ${by.control} control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what ${who} can execute.`
+	};
+}
+/**
+* Risks whose evidence is in the record rather than in a citing rule.
+*
+* ASI06: a poisoned context cannot be prevented here, but every change to what
+* the agent was told is sealed, so it is evidenced. ASI10: a drifting agent's
+* actions are judged like any other's; what the record shows is whether the
+* gate refused any of them.
+*/
+const FROM_THE_RECORD = {
+	ASI06: (data) => {
+		const seals = data.entries.filter((e) => e.rule === "PRAE-ASM" || e.rule === "PRAE-CTX");
+		return seals.length === 0 ? void 0 : {
+			state: "partial",
+			note: `Evidenced, not prevented: ${seals.length} seal${seals.length === 1 ? "" : "s"} of what the agent was told (PRAE-ASM / PRAE-CTX) in this record; a poisoned context changes the hash and is answerable afterwards.`
+		};
+	},
+	ASI10: (data) => {
+		const refused = data.entries.filter((e) => e.verdict === "deny").length;
+		const armed = [
+			"ASI02",
+			"ASI03",
+			"ASI08"
+		].flatMap((c) => citing(data.pack, AGENTIC, c));
+		if (armed.length === 0) return void 0;
+		return {
+			state: refused > 0 ? "covered" : "partial",
+			note: refused > 0 ? `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call, and ${refused} refusal${refused === 1 ? "" : "s"} in this record show them holding.` : `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call; none has refused one in this record yet. Detecting drift itself is derived from the record, not a rule.`
+		};
+	}
 };
-function owaspRow(control) {
-	const framework = FRAMEWORKS[OWASP];
+function frameworkRow(frameworkId, control) {
+	const framework = FRAMEWORKS[frameworkId];
 	const risk = framework?.controls[control];
 	const name = risk?.name ?? control;
 	return {
-		id: `${framework?.short ?? OWASP} · ${control}`,
+		id: `${framework?.short ?? frameworkId} · ${control}`,
 		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
 		evidence: (data) => {
 			if (data.pack === void 0) return {
 				state: "absent",
 				note: "No pack supplied to this view."
 			};
-			if (control === "LLM01") {
-				const bounding = citing(data.pack, OWASP, "LLM03");
+			const by = BOUNDED_BY[control];
+			if (by !== void 0) return bounded(data, control, by);
+			const rules = citing(data.pack, frameworkId, control);
+			if (rules.length === 0) {
+				const derived = FROM_THE_RECORD[control]?.(data);
+				if (derived !== void 0) return derived;
 				return {
-					state: "partial",
-					note: bounding.length === 0 ? "Not mitigated: this gate does not detect injected instructions, and no LLM03 control in this pack bounds what one can execute." : `Not mitigated: this gate does not detect injected instructions. Bounded: ${bounding.length} LLM03 control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what an injected instruction can execute.`
+					state: "absent",
+					note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
 				};
 			}
-			const rules = citing(data.pack, OWASP, control);
-			if (rules.length === 0) return {
-				state: "absent",
-				note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
-			};
 			const ids = new Set(rules.map((rule) => rule.id));
 			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
 			const listed = rules.map((rule) => rule.id).join(", ");
@@ -858,14 +966,170 @@ function owaspRow(control) {
 		}
 	};
 }
-const OWASP_ROWS = Object.keys(FRAMEWORKS[OWASP]?.controls ?? {}).map(owaspRow);
+const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ?? {}).map((control) => frameworkRow(frameworkId, control));
+const ISO_42001 = {
+	id: "iso-iec-42001-2023",
+	name: "ISO/IEC 42001:2023 — AI management system, Annex A"
+};
+const ISO_27001 = {
+	id: "iso-iec-27001-2022",
+	name: "ISO/IEC 27001:2022 — Annex A"
+};
+const isEvent = (e) => e.tool.startsWith("prae:") || e.tool === "system-prompt";
+const decisionsOf = (data) => data.entries.filter((e) => !isEvent(e));
+/** Rules in the pack whose `when` names a capability matching `test`. */
+function rulesOn(pack, test) {
+	return (pack?.rules ?? []).filter((rule) => {
+		const cap = rule.when.capability;
+		return (cap === void 0 ? [] : typeof cap === "string" ? [cap] : cap).some(test);
+	});
+}
+/** The record itself: recorded, chained, and how much of it is signed. */
+function recorded(data) {
+	const n = data.entries.length;
+	if (n === 0) return {
+		state: "partial",
+		note: "Recording is configured but nothing has been logged yet."
+	};
+	const signed = data.entries.filter((e) => e.sig !== void 0).length;
+	if (!data.verification.ok) return {
+		state: "partial",
+		note: `${n} rows recorded, but the chain does not verify: the log is present and its integrity is not.`
+	};
+	return {
+		state: "covered",
+		note: `${n} rows recorded, each hash-linked to the one before, chain intact${signed > 0 ? `, ${signed} of ${n} signed` : ", unsigned"} — an edited, removed or reordered row breaks it.`
+	};
+}
+/** Refusals and holds, recorded with their clause. */
+function monitored(data) {
+	const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
+	const held = decisionsOf(data).filter((e) => e.verdict === "ask").length;
+	return refused + held > 0 ? {
+		state: "covered",
+		note: `Every call is judged as it happens; this record holds ${refused} refusal${refused === 1 ? "" : "s"} and ${held} hold${held === 1 ? "" : "s"} for a human, each with the clause that produced it.`
+	} : {
+		state: "partial",
+		note: "Every call is judged as it happens, but this record contains no refusal or hold yet, so the monitoring is unproven in practice."
+	};
+}
+const ISO_CONTROLS = [
+	{
+		id: "ISO/IEC 42001 · A.2.2",
+		name: "AI policy",
+		standard: ISO_42001,
+		asks: "The organisation has a documented policy for developing or using AI systems.",
+		evidence: (data) => data.pack === void 0 ? {
+			state: "absent",
+			note: "No pack supplied to this view."
+		} : {
+			state: "partial",
+			note: `The executable part of an AI policy: ${data.pack.rules.length} rules declared as data and applied to every tool call. The policy document and its approval are the organisation's.`
+		}
+	},
+	{
+		id: "ISO/IEC 42001 · A.6.2.6",
+		name: "AI system operation and monitoring",
+		standard: ISO_42001,
+		asks: "The AI system is monitored while it operates, and what is found is acted on.",
+		evidence: monitored
+	},
+	{
+		id: "ISO/IEC 42001 · A.6.2.8",
+		name: "Recording of event logs",
+		standard: ISO_42001,
+		asks: "Event logs are kept while the AI system is in use.",
+		evidence: recorded
+	},
+	{
+		id: "ISO/IEC 42001 · A.9.4",
+		name: "Intended use of the AI system",
+		standard: ISO_42001,
+		asks: "The AI system is used only for its intended uses.",
+		evidence: (data) => {
+			if (data.pack === void 0) return {
+				state: "absent",
+				note: "No pack supplied to this view."
+			};
+			const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
+			return refused > 0 ? {
+				state: "covered",
+				note: `Intended use is enforced as scope: ${refused} action${refused === 1 ? "" : "s"} outside it refused before execution in this record.`
+			} : {
+				state: "partial",
+				note: "Intended use is enforced as scope by the pack; nothing outside it has been attempted in this record yet."
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.3",
+		name: "Information access restriction",
+		standard: ISO_27001,
+		asks: "Access to information is restricted according to the access-control policy.",
+		evidence: (data) => {
+			const rules = rulesOn(data.pack, (c) => c.startsWith("fs:"));
+			if (rules.length === 0) return {
+				state: "absent",
+				note: "No rule in this pack restricts file access."
+			};
+			const refused = decisionsOf(data).filter((e) => e.verdict === "deny" && e.capability?.startsWith("fs:")).length;
+			return refused > 0 ? {
+				state: "covered",
+				note: `${rules.length} file-access rules restrict what the agent may read and write; ${refused} access${refused === 1 ? "" : "es"} refused in this record. Restriction is per agent, not per human.`
+			} : {
+				state: "partial",
+				note: `${rules.length} file-access rules restrict what the agent may read and write; none has refused an access in this record yet.`
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.12",
+		name: "Data leakage prevention",
+		standard: ISO_27001,
+		asks: "Leakage of sensitive information is prevented where it is processed or sent.",
+		evidence: (data) => {
+			const rules = [...rulesOn(data.pack, (c) => c === "net:fetch"), ...(data.pack?.rules ?? []).filter((r) => r.when.secrets !== void 0)];
+			if (rules.length === 0) return {
+				state: "absent",
+				note: "No rule in this pack governs egress or credentials."
+			};
+			const stopped = decisionsOf(data).filter((e) => e.verdict === "deny" && (e.capability === "net:fetch" || e.secrets !== void 0 || e.phase === "output")).length;
+			return stopped > 0 ? {
+				state: "covered",
+				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules; ${stopped} send${stopped === 1 ? "" : "s"} or credential read${stopped === 1 ? "" : "s"} stopped in this record before the data left.`
+			} : {
+				state: "partial",
+				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules in force; none has stopped anything in this record yet.`
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.15",
+		name: "Logging",
+		standard: ISO_27001,
+		asks: "Activities, exceptions and other relevant events are logged, and the logs are protected.",
+		evidence: recorded
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.16",
+		name: "Monitoring activities",
+		standard: ISO_27001,
+		asks: "Systems are monitored for anomalous behaviour, and potential incidents are evaluated.",
+		evidence: monitored
+	}
+];
 /**
-* The obligations first, then the OWASP risks. Two kinds of row in one table
-* on purpose: an auditor reads down one list and finds the audit obligations
-* the ledger evidences and the application risks the pack's rules address,
-* each stated in its framework's own words.
+* The obligations first, then the risks framework by framework. Two kinds of
+* row in one table on purpose: an auditor reads down one list and finds the
+* audit obligations the ledger evidences and the application risks the pack's
+* rules address, each stated in its framework's own words.
 */
-const CONTROLS = [...OBLIGATIONS, ...OWASP_ROWS];
+const CONTROLS = [
+	...OBLIGATIONS,
+	...rowsOf(OWASP),
+	...rowsOf(AGENTIC),
+	...ISO_CONTROLS
+];
 
 //#endregion
 //#region src/console/views.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.7.1",
+  "version": "0.9.1",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,12 +40,12 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
+    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",
-    "@prae/controls": "0.1.0",
     "@prae/tokens": "0.1.0"
   },
   "scripts": {

package/lib/src-C9L6NBvu.js

@@ -1,3 +0,0 @@
-import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
-
-export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifyReceipt, verifySignature };