prae-cli 0.8.0 → 0.9.1

package/lib/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import "./evaluate-wMPkjcIC.js";
-import "./views-CCwVXpo2.js";
-import { t as main } from "./cli-UAE968If.js";
-import "./src-Ciggx9ja.js";
+import "./views-CIg2ZNG0.js";
+import { t as main } from "./cli-7yLG89gV.js";
+import "./src-D7g4lvaY.js";
 
 //#region src/bin.ts
 main(process.argv.slice(2)).catch((error) => {

package/lib/{checkpoint-DiznOVpS.js → checkpoint-BWSuhZ5h.js}

@@ -1,4 +1,4 @@
-import { d as canonical, i as fingerprint } from "./src-Ciggx9ja.js";
+import { m as canonical, s as fingerprint } from "./src-D7g4lvaY.js";
 import { createPrivateKey, createPublicKey, sign, verify } from "node:crypto";
 
 //#region src/checkpoint.ts

package/lib/{cli-UAE968If.js → cli-7yLG89gV.js}

@@ -1,6 +1,6 @@
 import { t as evaluate } from "./evaluate-wMPkjcIC.js";
-import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CCwVXpo2.js";
-import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
+import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CIg2ZNG0.js";
+import { _ as seal, f as verifySignature, h as chain, n as readEntries, p as GENESIS, r as verifyEntries, s as fingerprint, t as Ledger } from "./src-D7g4lvaY.js";
 import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, extname, join, normalize, resolve, sep } from "node:path";
@@ -1004,12 +1004,14 @@ function complianceOf(record) {
 		const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
 		const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
 		const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
+		const standard = control.standard;
+		const name = named?.name ?? control.name;
 		return {
-			id: code ?? control.id,
-			...named === void 0 ? {} : { name: named.name },
+			id: code ?? (standard === void 0 ? control.id : control.id.split(" · ")[1] ?? control.id),
+			...name === void 0 ? {} : { name },
 			asks: control.asks,
-			framework: found === void 0 ? "obligation" : found[0],
-			...found === void 0 ? {} : { frameworkName: found[1].name },
+			framework: found?.[0] ?? standard?.id ?? "obligation",
+			...found === void 0 ? standard === void 0 ? {} : { frameworkName: standard.name } : { frameworkName: found[1].name },
 			...control.evidence(data)
 		};
 	}) };
@@ -1209,6 +1211,20 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       Generate an Ed25519 keypair for signing ledger rows. Prints the
       fingerprint a counterparty pins.
 
+  prae keygen --role operator|policy|ledger [--out <dir>]
+      A keypair whose private half is sealed under a passphrase (asked for
+      without echo, or PRAE_KEY_PASSPHRASE). The operator key signs answers
+      to held calls; the policy key signs packs. Pin the public half in the
+      gate (operator.publicKey / policyKey); the agent can read the sealed
+      file and still cannot sign. The ledger key is for the signer that
+      holds it on the harness's behalf (signerFd): prae-signing.*.
+
+  prae sign-pack <pack.json> --key <policy.key.sealed.pem>
+      Sign a pack's exact bytes with the sealed policy key (passphrase asked
+      without echo, or PRAE_KEY_PASSPHRASE), writing <pack.json>.sig. A gate
+      with policyKey pinned governs only by a signed pack whose version
+      rises; raise the version before signing.
+
   prae receipt <ledger.jsonl> <seq> --key <private.pem> [--out <file>]
       Export one decision as a self-contained signed receipt.
 
@@ -1330,7 +1346,7 @@ async function mcp(root, packPath, ledgerPath) {
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1 } = await import("./src-d82lSKVQ.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1382,7 +1398,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+	const { generateKeypair, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1397,8 +1413,73 @@ async function keygen(dir) {
 	console.log("receipts, through a channel they trust. Point the plugin at the");
 	console.log("private key with `signingKey` to sign every row.");
 }
+/**
+* A sealed keypair for a human authority (PRA-106/107): written as
+* `<role>.pub.pem` and `<role>.key.sealed.pem`. The passphrase is never an
+* argument — arguments land in process listings and shell history.
+*/
+async function keygenSealed(role, dir) {
+	if (role !== "operator" && role !== "policy" && role !== "ledger") fail("--role is operator, policy or ledger");
+	const stem = role === "ledger" ? "prae-signing" : role;
+	const { sealedKeypair, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
+	const keys = sealedKeypair(process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: "));
+	const pub = join(dir, `${stem}.pub.pem`);
+	const sealed = join(dir, `${stem}.key.sealed.pem`);
+	writeFileSync$1(sealed, keys.sealedPrivateKey, { mode: 384 });
+	writeFileSync$1(pub, keys.publicKey);
+	console.log(`sealed      ${sealed}  (useless without the passphrase)`);
+	console.log(`public      ${pub}`);
+	console.log(`fingerprint ${fingerprint$1(keys.publicKey)}`);
+}
+/** A detached signature over a pack's bytes (PRA-107). */
+async function signPack(packPath, keyPath) {
+	const { signBytes, unsealPrivateKey, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
+	const { createPublicKey } = await import("node:crypto");
+	const bytes = readFileSync(packPath);
+	const parsed = parsePack(bytes.toString("utf8"));
+	if (!parsed.ok) fail(`${packPath} does not parse; nothing signed`);
+	const passphrase = process.env.PRAE_KEY_PASSPHRASE ?? await askHidden("passphrase: ");
+	let key;
+	try {
+		key = unsealPrivateKey(readFileSync(keyPath, "utf8"), passphrase);
+	} catch {
+		fail("wrong passphrase, or not a sealed key");
+	}
+	await writeFile(`${packPath}.sig`, `${signBytes(bytes, key)}\n`);
+	const pub = createPublicKey(key).export({
+		type: "spki",
+		format: "pem"
+	});
+	console.log(`signed      ${packPath}.sig  (${parsed.pack.pack} ${parsed.pack.version})`);
+	console.log(`policy key  ${fingerprint$1(pub.toString())}`);
+}
+/** Read a line from the terminal without echoing it. */
+function askHidden(prompt) {
+	const input = process.stdin;
+	if (!input.isTTY) fail("no terminal to ask on: set PRAE_KEY_PASSPHRASE");
+	process.stdout.write(prompt);
+	input.setRawMode(true);
+	input.resume();
+	input.setEncoding("utf8");
+	return new Promise((done) => {
+		let typed = "";
+		const onData = (ch) => {
+			if (ch === "\r" || ch === "\n") {
+				input.setRawMode(false);
+				input.pause();
+				input.off("data", onData);
+				process.stdout.write("\n");
+				done(typed);
+			} else if (ch === "") process.exit(130);
+			else if (ch === "") typed = typed.slice(0, -1);
+			else typed += ch;
+		};
+		input.on("data", onData);
+	});
+}
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1428,7 +1509,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-s3Aryyz-.js");
+	const { checkReceipt } = await import("./receipt-check-CD-W1wXs.js");
 	let parsed;
 	try {
 		parsed = JSON.parse(await readFile(path, "utf8"));
@@ -1499,14 +1580,14 @@ async function verify(path, keyPath, checkpointPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (checkpointPath !== void 0) {
-			const { checkCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+			const { checkCheckpoint } = await import("./checkpoint-BWSuhZ5h.js");
 			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
 			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
 			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
 			if (!verdict.ok) process.exitCode = 1;
 		}
 		if (keyPath !== void 0) {
-			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
+			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-d82lSKVQ.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1682,7 +1763,7 @@ async function consoleOut(path, argv) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
 			import("./src-d4c_n6wd.js"),
 			import("./src-CBGZVvt7.js"),
-			import("./instructions-DulxSqFd.js")
+			import("./instructions-Bg5puOen.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1781,7 +1862,7 @@ async function init(argv) {
 	}
 }
 async function checkpoint(path, keyPath, out) {
-	const { makeCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+	const { makeCheckpoint } = await import("./checkpoint-BWSuhZ5h.js");
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1857,7 +1938,17 @@ async function main(argv) {
 			if (root === void 0) fail("mcp needs --root <dir>; serving without a boundary is not a gate");
 			return mcp(root, flag(rest, "pack"), flag(rest, "ledger"));
 		}
-		case "keygen": return keygen(flag(rest, "out") ?? ".");
+		case "keygen": {
+			const role = flag(rest, "role");
+			if (role !== void 0) return keygenSealed(role, flag(rest, "out") ?? ".");
+			return keygen(flag(rest, "out") ?? ".");
+		}
+		case "sign-pack": {
+			const [path] = rest;
+			const key = flag(rest, "key");
+			if (path === void 0 || key === void 0) fail("sign-pack needs <pack.json> --key <policy.key.sealed.pem>");
+			return signPack(path, key);
+		}
 		case "receipt": {
 			const [path, seq] = rest;
 			const key = flag(rest, "key");

package/lib/index.js

@@ -1,6 +1,6 @@
 import "./evaluate-wMPkjcIC.js";
-import "./views-CCwVXpo2.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-UAE968If.js";
-import "./src-Ciggx9ja.js";
+import "./views-CIg2ZNG0.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-7yLG89gV.js";
+import "./src-D7g4lvaY.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-DulxSqFd.js → instructions-Bg5puOen.js}

@@ -1,4 +1,4 @@
-import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-CCwVXpo2.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-CIg2ZNG0.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{receipt-check-s3Aryyz-.js → receipt-check-CD-W1wXs.js}

@@ -1,4 +1,4 @@
-import { c as verifyReceipt, i as fingerprint } from "./src-Ciggx9ja.js";
+import { d as verifyReceipt, s as fingerprint } from "./src-D7g4lvaY.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */

package/lib/src-D7g4lvaY.js

@@ -0,0 +1,392 @@
+import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, scryptSync, sign, verify } from "node:crypto";
+
+//#region ../ledger/src/entry.ts
+/** The hash a chain starts from. */
+const GENESIS = "0".repeat(64);
+/**
+* Deterministic serialization: object keys sorted at every depth.
+*
+* A hash over `JSON.stringify(entry)` would depend on key insertion order,
+* which means a re-serialized entry could hash differently while saying
+* exactly the same thing — and a verifier that reports tampering on a
+* faithful copy trains its operators to ignore it.
+*/
+function canonical(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+}
+/** Hash one entry's content together with its position and predecessor. */
+function hashEntry(record, seq, prev) {
+	return createHash("sha256").update(canonical({
+		...record,
+		seq,
+		prev
+	})).digest("hex");
+}
+/** Chain a record onto a predecessor. */
+function chain(record, seq, prev) {
+	return {
+		...record,
+		seq,
+		prev,
+		hash: hashEntry(record, seq, prev)
+	};
+}
+/** The short form an auditor quotes from a screenshot. */
+function seal(entry) {
+	return `${entry.hash.slice(0, 4)}…${entry.hash.slice(-4)}`;
+}
+
+//#endregion
+//#region ../ledger/src/receipt.ts
+function generateKeypair() {
+	const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+	return {
+		publicKey: publicKey.export({
+			type: "spki",
+			format: "pem"
+		}).toString(),
+		privateKey: privateKey.export({
+			type: "pkcs8",
+			format: "pem"
+		}).toString()
+	};
+}
+/** Sign a row's seal. The seal already covers the whole canonical record. */
+function signEntry(entry, privateKeyPem) {
+	const key = createPrivateKey(privateKeyPem);
+	return sign(null, Buffer.from(entry.hash, "hex"), key).toString("base64");
+}
+function verifySignature(entry, signature, publicKeyPem) {
+	try {
+		const key = createPublicKey(publicKeyPem);
+		return verify(null, Buffer.from(entry.hash, "hex"), key, Buffer.from(signature, "base64"));
+	} catch {
+		return false;
+	}
+}
+function makeReceipt(entry, privateKeyPem, publicKeyPem) {
+	return {
+		receipt: "prae/1",
+		entry,
+		signature: signEntry(entry, privateKeyPem),
+		publicKey: publicKeyPem
+	};
+}
+/** Verify a receipt from nothing but the receipt. */
+function verifyReceipt(receipt) {
+	if (receipt.receipt !== "prae/1") return {
+		ok: false,
+		reason: `unknown receipt format ${String(receipt.receipt)}`
+	};
+	const { seq, prev, hash, sig,...record } = receipt.entry;
+	if (hashEntry(record, seq, prev) !== hash) return {
+		ok: false,
+		reason: "entry contents do not match their seal; the row was altered"
+	};
+	if (!verifySignature(receipt.entry, receipt.signature, receipt.publicKey)) return {
+		ok: false,
+		reason: "signature does not verify; not sealed by this key"
+	};
+	return { ok: true };
+}
+/**
+* A short identifier for a public key, for pinning by eye.
+*
+* A counterparty checks a receipt against a key they already trust; comparing
+* the whole PEM by hand invites skimming, and eight grouped hex bytes do not.
+*/
+function fingerprint(publicKeyPem) {
+	const der = createPublicKey(publicKeyPem).export({
+		type: "spki",
+		format: "der"
+	});
+	return createHash("sha256").update(der).digest("hex").slice(0, 16).replace(/(.{4})/g, "$1 ").trim();
+}
+
+//#endregion
+//#region ../ledger/src/authority.ts
+const priv = (k) => typeof k === "string" ? createPrivateKey(k) : k;
+/** How long a signed answer is good for, by default. */
+const ANSWER_TTL_MS = 5 * 6e4;
+/** A detached signature over exact bytes (a policy pack's file). */
+function signBytes(bytes, privateKey) {
+	return sign(null, Buffer.from(bytes), priv(privateKey)).toString("base64");
+}
+/**
+* How a private key is sealed at rest: scrypt (N = 2^17, r = 8, p = 1) over
+* the passphrase, AES-256-GCM over the key. The sealed file can sit where an
+* agent can read it; each guess at the passphrase costs ~128 MiB and a
+* noticeable fraction of a second, so a strong passphrase holds against an
+* offline attack. (PKCS#8 as Node writes it uses PBKDF2 at 2,048 rounds —
+* too cheap for a file the agent can copy.)
+*/
+const SCRYPT = {
+	N: 2 ** 17,
+	r: 8,
+	p: 1,
+	maxmem: 512 * 1024 * 1024
+};
+const MIN_PASSPHRASE = 12;
+const SEALED = "PRAE SEALED KEY";
+function sealPrivateKey(key, passphrase) {
+	if (passphrase.length < MIN_PASSPHRASE) throw new Error(`passphrase: ${MIN_PASSPHRASE} characters or more`);
+	const salt = randomBytes(16);
+	const iv = randomBytes(12);
+	const cipher = createCipheriv("aes-256-gcm", scryptSync(passphrase, salt, 32, SCRYPT), iv);
+	const der = key.export({
+		type: "pkcs8",
+		format: "der"
+	});
+	const data = Buffer.concat([cipher.update(der), cipher.final()]);
+	return `-----BEGIN ${SEALED}-----\n${(Buffer.from(JSON.stringify({
+		v: 1,
+		kdf: "scrypt",
+		N: SCRYPT.N,
+		r: SCRYPT.r,
+		p: SCRYPT.p,
+		salt: salt.toString("base64"),
+		iv: iv.toString("base64"),
+		tag: cipher.getAuthTag().toString("base64"),
+		data: data.toString("base64")
+	})).toString("base64").match(/.{1,64}/g) ?? []).join("\n")}\n-----END ${SEALED}-----\n`;
+}
+/** A keypair whose private half is sealed under a passphrase. */
+function sealedKeypair(passphrase) {
+	const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+	return {
+		publicKey: publicKey.export({
+			type: "spki",
+			format: "pem"
+		}).toString(),
+		sealedPrivateKey: sealPrivateKey(privateKey, passphrase)
+	};
+}
+/** Unseal into memory. Throws on a wrong passphrase or a tampered file. */
+function unsealPrivateKey(sealed, passphrase) {
+	const match = sealed.match(/* @__PURE__ */ new RegExp(`-----BEGIN ${SEALED}-----([\\s\\S]+?)-----END ${SEALED}-----`));
+	if (match === null) throw new Error("not a PRAE sealed key (an older format?): make a new one with prae keygen --role");
+	const box = JSON.parse(Buffer.from((match[1] ?? "").replace(/\s/g, ""), "base64").toString("utf8"));
+	if (box.v !== 1 || box.kdf !== "scrypt") throw new Error("unknown sealing");
+	const decipher = createDecipheriv("aes-256-gcm", scryptSync(passphrase, Buffer.from(String(box.salt), "base64"), 32, {
+		N: Number(box.N),
+		r: Number(box.r),
+		p: Number(box.p),
+		maxmem: SCRYPT.maxmem
+	}), Buffer.from(String(box.iv), "base64"));
+	decipher.setAuthTag(Buffer.from(String(box.tag), "base64"));
+	return createPrivateKey({
+		key: Buffer.concat([decipher.update(Buffer.from(String(box.data), "base64")), decipher.final()]),
+		format: "der",
+		type: "pkcs8"
+	});
+}
+
+//#endregion
+//#region ../ledger/src/ledger.ts
+/**
+* Read a ledger held as text.
+*
+* Split out from the class because a ledger is not always a file being
+* appended to: a build step renders one it imported, and a reader pastes one
+* in. Those callers need the same parsing and the same verification the CLI
+* runs, and a second implementation of either is how two answers to "does this
+* chain hold" come to exist.
+*/
+function readEntries(text) {
+	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+}
+/** Re-derive every hash and confirm each entry names its predecessor. */
+function verifyEntries(text) {
+	const problems = [];
+	let expectedPrev = GENESIS;
+	let expectedSeq = 0;
+	let count = 0;
+	const lines = text.split("\n").filter((line) => line.trim() !== "");
+	for (const [index, line] of lines.entries()) {
+		const at = index + 1;
+		count += 1;
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			problems.push({
+				line: at,
+				message: "not valid JSON"
+			});
+			return {
+				ok: false,
+				entries: count,
+				problems
+			};
+		}
+		if (entry.seq !== expectedSeq) problems.push({
+			line: at,
+			message: `expected seq ${expectedSeq}, found ${entry.seq}`
+		});
+		if (entry.prev !== expectedPrev) problems.push({
+			line: at,
+			message: "does not name the previous entry; a row was removed or reordered"
+		});
+		const { seq, prev, hash, sig: _sig,...record } = entry;
+		if (hashEntry(record, seq, prev) !== hash) problems.push({
+			line: at,
+			message: "contents do not match the sealed hash"
+		});
+		expectedPrev = entry.hash;
+		expectedSeq = entry.seq + 1;
+	}
+	return {
+		ok: problems.length === 0,
+		entries: count,
+		problems
+	};
+}
+/** The last complete line of a file, reading only its end when it can. */
+function lastLine(path) {
+	const fd = openSync(path, "r");
+	try {
+		const size = fstatSync(fd).size;
+		for (let span = 64 * 1024;; span *= 4) {
+			const start = Math.max(0, size - span);
+			const buffer = Buffer.alloc(size - start);
+			readSync(fd, buffer, 0, buffer.length, start);
+			const lines = buffer.toString("utf8").split("\n").filter((line) => line.trim() !== "");
+			if (start === 0 || lines.length > 1) return lines.at(-1);
+		}
+	} finally {
+		closeSync(fd);
+	}
+}
+/** Where the chain ends now: the next seq and the hash to continue from. */
+function tailOf(path) {
+	let tail;
+	try {
+		tail = lastLine(path);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		return {
+			seq: 0,
+			last: GENESIS
+		};
+	}
+	if (tail === void 0) return {
+		seq: 0,
+		last: GENESIS
+	};
+	let entry;
+	try {
+		entry = JSON.parse(tail);
+	} catch {
+		throw new Error(`prae ledger: last line of ${path} is not readable; refusing to append onto a chain that cannot be continued`);
+	}
+	return {
+		seq: entry.seq + 1,
+		last: entry.hash
+	};
+}
+const SLEEP = new Int32Array(new SharedArrayBuffer(4));
+/** A lock older than this was left by a writer that died holding it. */
+const STALE_LOCK_MS = 1e4;
+/** Run `fn` holding an exclusive lock file; synchronous, like the append. */
+function withLock(lock, fn) {
+	const deadline = Date.now() + 3e4;
+	for (;;) {
+		let fd;
+		try {
+			fd = openSync(lock, "wx");
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			try {
+				if (Date.now() - statSync(lock).mtimeMs > STALE_LOCK_MS) {
+					unlinkSync(lock);
+					continue;
+				}
+			} catch {}
+			if (Date.now() > deadline) throw new Error(`prae ledger: ${lock} has been held for 30 s; refusing to append without it`);
+			Atomics.wait(SLEEP, 0, 0, 2);
+			continue;
+		}
+		try {
+			return fn();
+		} finally {
+			closeSync(fd);
+			try {
+				unlinkSync(lock);
+			} catch {}
+		}
+	}
+}
+var Ledger = class Ledger {
+	path;
+	constructor(path) {
+		this.path = path;
+	}
+	/**
+	* Open a ledger, reading the tail to continue an existing chain.
+	*
+	* A corrupt or truncated final line is a hard error rather than something to
+	* skip past: appending onto a chain whose end we could not read would bury
+	* the damage under valid-looking entries.
+	*/
+	/** Sign every appended row with this Ed25519 private key (PEM). */
+	signWith;
+	/** Or through a signing boundary that holds the key (PRA-108). */
+	signer;
+	static open(path, options = {}) {
+		const ledger = Ledger.openUnsigned(path);
+		ledger.signWith = options.signWith;
+		ledger.signer = options.signer;
+		return ledger;
+	}
+	static openUnsigned(path) {
+		mkdirSync(dirname(path), { recursive: true });
+		try {
+			writeFileSync(path, "", { flag: "wx" });
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+		}
+		tailOf(path);
+		return new Ledger(path);
+	}
+	/** Append one decision and return the entry as written. */
+	append(record) {
+		return withLock(`${this.path}.lock`, () => {
+			const { seq, last } = tailOf(this.path);
+			const sealed = chain(record, seq, last);
+			const entry = this.signer !== void 0 ? {
+				...sealed,
+				sig: this.signer(sealed)
+			} : this.signWith === void 0 ? sealed : {
+				...sealed,
+				sig: signEntry(sealed, this.signWith)
+			};
+			appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
+			return entry;
+		});
+	}
+	/** Every entry, in order. */
+	read() {
+		return readEntries(readFileSync(this.path, "utf8"));
+	}
+	/**
+	* Re-derive every hash and confirm each entry names its predecessor.
+	*
+	* Catches a deleted row, an edited field, and a reordering. Does not catch a
+	* wholesale rewrite of the file by someone holding the same code — see the
+	* note in `entry.ts`.
+	*/
+	verify() {
+		return verifyEntries(readFileSync(this.path, "utf8"));
+	}
+};
+
+//#endregion
+//#region ../ledger/src/signer.ts
+const nap = new Int32Array(new SharedArrayBuffer(4));
+
+//#endregion
+export { seal as _, signBytes as a, generateKeypair as c, verifyReceipt as d, verifySignature as f, hashEntry as g, chain as h, sealedKeypair as i, makeReceipt as l, canonical as m, readEntries as n, unsealPrivateKey as o, GENESIS as p, verifyEntries as r, fingerprint as s, Ledger as t, signEntry as u };

package/lib/src-d82lSKVQ.js

@@ -0,0 +1,3 @@
+import { _ as seal, a as signBytes, c as generateKeypair, d as verifyReceipt, f as verifySignature, g as hashEntry, h as chain, i as sealedKeypair, l as makeReceipt, m as canonical, n as readEntries, o as unsealPrivateKey, p as GENESIS, r as verifyEntries, s as fingerprint, t as Ledger, u as signEntry } from "./src-D7g4lvaY.js";
+
+export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, sealedKeypair, signBytes, signEntry, unsealPrivateKey, verifyEntries, verifyReceipt, verifySignature };

package/lib/{views-CCwVXpo2.js → views-CIg2ZNG0.js}

@@ -967,6 +967,157 @@ function frameworkRow(frameworkId, control) {
 	};
 }
 const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ?? {}).map((control) => frameworkRow(frameworkId, control));
+const ISO_42001 = {
+	id: "iso-iec-42001-2023",
+	name: "ISO/IEC 42001:2023 — AI management system, Annex A"
+};
+const ISO_27001 = {
+	id: "iso-iec-27001-2022",
+	name: "ISO/IEC 27001:2022 — Annex A"
+};
+const isEvent = (e) => e.tool.startsWith("prae:") || e.tool === "system-prompt";
+const decisionsOf = (data) => data.entries.filter((e) => !isEvent(e));
+/** Rules in the pack whose `when` names a capability matching `test`. */
+function rulesOn(pack, test) {
+	return (pack?.rules ?? []).filter((rule) => {
+		const cap = rule.when.capability;
+		return (cap === void 0 ? [] : typeof cap === "string" ? [cap] : cap).some(test);
+	});
+}
+/** The record itself: recorded, chained, and how much of it is signed. */
+function recorded(data) {
+	const n = data.entries.length;
+	if (n === 0) return {
+		state: "partial",
+		note: "Recording is configured but nothing has been logged yet."
+	};
+	const signed = data.entries.filter((e) => e.sig !== void 0).length;
+	if (!data.verification.ok) return {
+		state: "partial",
+		note: `${n} rows recorded, but the chain does not verify: the log is present and its integrity is not.`
+	};
+	return {
+		state: "covered",
+		note: `${n} rows recorded, each hash-linked to the one before, chain intact${signed > 0 ? `, ${signed} of ${n} signed` : ", unsigned"} — an edited, removed or reordered row breaks it.`
+	};
+}
+/** Refusals and holds, recorded with their clause. */
+function monitored(data) {
+	const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
+	const held = decisionsOf(data).filter((e) => e.verdict === "ask").length;
+	return refused + held > 0 ? {
+		state: "covered",
+		note: `Every call is judged as it happens; this record holds ${refused} refusal${refused === 1 ? "" : "s"} and ${held} hold${held === 1 ? "" : "s"} for a human, each with the clause that produced it.`
+	} : {
+		state: "partial",
+		note: "Every call is judged as it happens, but this record contains no refusal or hold yet, so the monitoring is unproven in practice."
+	};
+}
+const ISO_CONTROLS = [
+	{
+		id: "ISO/IEC 42001 · A.2.2",
+		name: "AI policy",
+		standard: ISO_42001,
+		asks: "The organisation has a documented policy for developing or using AI systems.",
+		evidence: (data) => data.pack === void 0 ? {
+			state: "absent",
+			note: "No pack supplied to this view."
+		} : {
+			state: "partial",
+			note: `The executable part of an AI policy: ${data.pack.rules.length} rules declared as data and applied to every tool call. The policy document and its approval are the organisation's.`
+		}
+	},
+	{
+		id: "ISO/IEC 42001 · A.6.2.6",
+		name: "AI system operation and monitoring",
+		standard: ISO_42001,
+		asks: "The AI system is monitored while it operates, and what is found is acted on.",
+		evidence: monitored
+	},
+	{
+		id: "ISO/IEC 42001 · A.6.2.8",
+		name: "Recording of event logs",
+		standard: ISO_42001,
+		asks: "Event logs are kept while the AI system is in use.",
+		evidence: recorded
+	},
+	{
+		id: "ISO/IEC 42001 · A.9.4",
+		name: "Intended use of the AI system",
+		standard: ISO_42001,
+		asks: "The AI system is used only for its intended uses.",
+		evidence: (data) => {
+			if (data.pack === void 0) return {
+				state: "absent",
+				note: "No pack supplied to this view."
+			};
+			const refused = decisionsOf(data).filter((e) => e.verdict === "deny").length;
+			return refused > 0 ? {
+				state: "covered",
+				note: `Intended use is enforced as scope: ${refused} action${refused === 1 ? "" : "s"} outside it refused before execution in this record.`
+			} : {
+				state: "partial",
+				note: "Intended use is enforced as scope by the pack; nothing outside it has been attempted in this record yet."
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.3",
+		name: "Information access restriction",
+		standard: ISO_27001,
+		asks: "Access to information is restricted according to the access-control policy.",
+		evidence: (data) => {
+			const rules = rulesOn(data.pack, (c) => c.startsWith("fs:"));
+			if (rules.length === 0) return {
+				state: "absent",
+				note: "No rule in this pack restricts file access."
+			};
+			const refused = decisionsOf(data).filter((e) => e.verdict === "deny" && e.capability?.startsWith("fs:")).length;
+			return refused > 0 ? {
+				state: "covered",
+				note: `${rules.length} file-access rules restrict what the agent may read and write; ${refused} access${refused === 1 ? "" : "es"} refused in this record. Restriction is per agent, not per human.`
+			} : {
+				state: "partial",
+				note: `${rules.length} file-access rules restrict what the agent may read and write; none has refused an access in this record yet.`
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.12",
+		name: "Data leakage prevention",
+		standard: ISO_27001,
+		asks: "Leakage of sensitive information is prevented where it is processed or sent.",
+		evidence: (data) => {
+			const rules = [...rulesOn(data.pack, (c) => c === "net:fetch"), ...(data.pack?.rules ?? []).filter((r) => r.when.secrets !== void 0)];
+			if (rules.length === 0) return {
+				state: "absent",
+				note: "No rule in this pack governs egress or credentials."
+			};
+			const stopped = decisionsOf(data).filter((e) => e.verdict === "deny" && (e.capability === "net:fetch" || e.secrets !== void 0 || e.phase === "output")).length;
+			return stopped > 0 ? {
+				state: "covered",
+				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules; ${stopped} send${stopped === 1 ? "" : "s"} or credential read${stopped === 1 ? "" : "s"} stopped in this record before the data left.`
+			} : {
+				state: "partial",
+				note: `${new Set(rules.map((r) => r.id)).size} egress and credential rules in force; none has stopped anything in this record yet.`
+			};
+		}
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.15",
+		name: "Logging",
+		standard: ISO_27001,
+		asks: "Activities, exceptions and other relevant events are logged, and the logs are protected.",
+		evidence: recorded
+	},
+	{
+		id: "ISO/IEC 27001 · A.8.16",
+		name: "Monitoring activities",
+		standard: ISO_27001,
+		asks: "Systems are monitored for anomalous behaviour, and potential incidents are evaluated.",
+		evidence: monitored
+	}
+];
 /**
 * The obligations first, then the risks framework by framework. Two kinds of
 * row in one table on purpose: an auditor reads down one list and finds the
@@ -976,7 +1127,8 @@ const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ??
 const CONTROLS = [
 	...OBLIGATIONS,
 	...rowsOf(OWASP),
-	...rowsOf(AGENTIC)
+	...rowsOf(AGENTIC),
+	...ISO_CONTROLS
 ];
 
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -40,9 +40,9 @@
     "tsdown": "^0.15.6",
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
+    "@prae/controls": "0.1.0",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
-    "@prae/controls": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",

package/lib/src-C9L6NBvu.js

@@ -1,3 +0,0 @@
-import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
-
-export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifyReceipt, verifySignature };

package/lib/src-Ciggx9ja.js

@@ -1,242 +0,0 @@
-import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
-
-//#region ../ledger/src/entry.ts
-/** The hash a chain starts from. */
-const GENESIS = "0".repeat(64);
-/**
-* Deterministic serialization: object keys sorted at every depth.
-*
-* A hash over `JSON.stringify(entry)` would depend on key insertion order,
-* which means a re-serialized entry could hash differently while saying
-* exactly the same thing — and a verifier that reports tampering on a
-* faithful copy trains its operators to ignore it.
-*/
-function canonical(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value);
-	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-}
-/** Hash one entry's content together with its position and predecessor. */
-function hashEntry(record, seq, prev) {
-	return createHash("sha256").update(canonical({
-		...record,
-		seq,
-		prev
-	})).digest("hex");
-}
-/** Chain a record onto a predecessor. */
-function chain(record, seq, prev) {
-	return {
-		...record,
-		seq,
-		prev,
-		hash: hashEntry(record, seq, prev)
-	};
-}
-/** The short form an auditor quotes from a screenshot. */
-function seal(entry) {
-	return `${entry.hash.slice(0, 4)}…${entry.hash.slice(-4)}`;
-}
-
-//#endregion
-//#region ../ledger/src/receipt.ts
-function generateKeypair() {
-	const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-	return {
-		publicKey: publicKey.export({
-			type: "spki",
-			format: "pem"
-		}).toString(),
-		privateKey: privateKey.export({
-			type: "pkcs8",
-			format: "pem"
-		}).toString()
-	};
-}
-/** Sign a row's seal. The seal already covers the whole canonical record. */
-function signEntry(entry, privateKeyPem) {
-	const key = createPrivateKey(privateKeyPem);
-	return sign(null, Buffer.from(entry.hash, "hex"), key).toString("base64");
-}
-function verifySignature(entry, signature, publicKeyPem) {
-	try {
-		const key = createPublicKey(publicKeyPem);
-		return verify(null, Buffer.from(entry.hash, "hex"), key, Buffer.from(signature, "base64"));
-	} catch {
-		return false;
-	}
-}
-function makeReceipt(entry, privateKeyPem, publicKeyPem) {
-	return {
-		receipt: "prae/1",
-		entry,
-		signature: signEntry(entry, privateKeyPem),
-		publicKey: publicKeyPem
-	};
-}
-/** Verify a receipt from nothing but the receipt. */
-function verifyReceipt(receipt) {
-	if (receipt.receipt !== "prae/1") return {
-		ok: false,
-		reason: `unknown receipt format ${String(receipt.receipt)}`
-	};
-	const { seq, prev, hash, sig,...record } = receipt.entry;
-	if (hashEntry(record, seq, prev) !== hash) return {
-		ok: false,
-		reason: "entry contents do not match their seal; the row was altered"
-	};
-	if (!verifySignature(receipt.entry, receipt.signature, receipt.publicKey)) return {
-		ok: false,
-		reason: "signature does not verify; not sealed by this key"
-	};
-	return { ok: true };
-}
-/**
-* A short identifier for a public key, for pinning by eye.
-*
-* A counterparty checks a receipt against a key they already trust; comparing
-* the whole PEM by hand invites skimming, and eight grouped hex bytes do not.
-*/
-function fingerprint(publicKeyPem) {
-	const der = createPublicKey(publicKeyPem).export({
-		type: "spki",
-		format: "der"
-	});
-	return createHash("sha256").update(der).digest("hex").slice(0, 16).replace(/(.{4})/g, "$1 ").trim();
-}
-
-//#endregion
-//#region ../ledger/src/ledger.ts
-/**
-* Read a ledger held as text.
-*
-* Split out from the class because a ledger is not always a file being
-* appended to: a build step renders one it imported, and a reader pastes one
-* in. Those callers need the same parsing and the same verification the CLI
-* runs, and a second implementation of either is how two answers to "does this
-* chain hold" come to exist.
-*/
-function readEntries(text) {
-	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
-}
-/** Re-derive every hash and confirm each entry names its predecessor. */
-function verifyEntries(text) {
-	const problems = [];
-	let expectedPrev = GENESIS;
-	let expectedSeq = 0;
-	let count = 0;
-	const lines = text.split("\n").filter((line) => line.trim() !== "");
-	for (const [index, line] of lines.entries()) {
-		const at = index + 1;
-		count += 1;
-		let entry;
-		try {
-			entry = JSON.parse(line);
-		} catch {
-			problems.push({
-				line: at,
-				message: "not valid JSON"
-			});
-			return {
-				ok: false,
-				entries: count,
-				problems
-			};
-		}
-		if (entry.seq !== expectedSeq) problems.push({
-			line: at,
-			message: `expected seq ${expectedSeq}, found ${entry.seq}`
-		});
-		if (entry.prev !== expectedPrev) problems.push({
-			line: at,
-			message: "does not name the previous entry; a row was removed or reordered"
-		});
-		const { seq, prev, hash, sig: _sig,...record } = entry;
-		if (hashEntry(record, seq, prev) !== hash) problems.push({
-			line: at,
-			message: "contents do not match the sealed hash"
-		});
-		expectedPrev = entry.hash;
-		expectedSeq = entry.seq + 1;
-	}
-	return {
-		ok: problems.length === 0,
-		entries: count,
-		problems
-	};
-}
-var Ledger = class Ledger {
-	path;
-	seq;
-	last;
-	constructor(path, seq, last) {
-		this.path = path;
-		this.seq = seq;
-		this.last = last;
-	}
-	/**
-	* Open a ledger, reading the tail to continue an existing chain.
-	*
-	* A corrupt or truncated final line is a hard error rather than something to
-	* skip past: appending onto a chain whose end we could not read would bury
-	* the damage under valid-looking entries.
-	*/
-	/** Sign every appended row with this Ed25519 private key (PEM). */
-	signWith;
-	static open(path, options = {}) {
-		const ledger = Ledger.openUnsigned(path);
-		ledger.signWith = options.signWith;
-		return ledger;
-	}
-	static openUnsigned(path) {
-		mkdirSync(dirname(path), { recursive: true });
-		let text = "";
-		try {
-			text = readFileSync(path, "utf8");
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-			writeFileSync(path, "", { flag: "wx" });
-			return new Ledger(path, 0, GENESIS);
-		}
-		const tail = text.split("\n").filter((line) => line.trim() !== "").at(-1);
-		if (tail === void 0) return new Ledger(path, 0, GENESIS);
-		let entry;
-		try {
-			entry = JSON.parse(tail);
-		} catch {
-			throw new Error(`prae ledger: last line of ${path} is not readable; refusing to append onto a chain that cannot be continued`);
-		}
-		return new Ledger(path, entry.seq + 1, entry.hash);
-	}
-	/** Append one decision and return the entry as written. */
-	append(record) {
-		const sealed = chain(record, this.seq, this.last);
-		const entry = this.signWith === void 0 ? sealed : {
-			...sealed,
-			sig: signEntry(sealed, this.signWith)
-		};
-		appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
-		this.seq += 1;
-		this.last = entry.hash;
-		return entry;
-	}
-	/** Every entry, in order. */
-	read() {
-		return readEntries(readFileSync(this.path, "utf8"));
-	}
-	/**
-	* Re-derive every hash and confirm each entry names its predecessor.
-	*
-	* Catches a deleted row, an edited field, and a reordering. Does not catch a
-	* wholesale rewrite of the file by someone holding the same code — see the
-	* note in `entry.ts`.
-	*/
-	verify() {
-		return verifyEntries(readFileSync(this.path, "utf8"));
-	}
-};
-
-//#endregion
-export { generateKeypair as a, verifyReceipt as c, canonical as d, chain as f, fingerprint as i, verifySignature as l, seal as m, readEntries as n, makeReceipt as o, hashEntry as p, verifyEntries as r, signEntry as s, Ledger as t, GENESIS as u };